Appearance
8.1 — The Cellular System: From Your Phone to the Tower and Back
You press call. Within about two seconds the other phone rings, anywhere in the world. This chapter follows the whole path, and then explains what each generation of the network actually changed.
1. The cellular idea
Before cells, mobile radio used one powerful transmitter covering a whole city. The entire city shared one set of channels, so a system with 12 channels supported 12 simultaneous calls. In 1976, New York's mobile telephone service had 12 channels for 545 subscribers and a waiting list of 3,700.
The cellular concept, worked out at Bell Labs in 1947 and made practical in the 1970s: use many low-power transmitters, each covering a small area, and reuse the same frequencies in cells far enough apart.
From Chapter 7.4, with a reuse factor N:
D=R\sqrt{3N}
And the capacity consequence is everything. Halve the cell radius and you fit four times as many cells into the same area, so capacity quadruples using exactly the same spectrum.
Every generation of mobile network has got most of its capacity from this, not from better modulation. A modern urban network has cells a few hundred metres across, and inside buildings, cells the size of a room.
Cells are drawn as hexagons because a hexagon is the closest regular shape to a circle that tiles the plane without gaps. Real cells are ragged blobs shaped by terrain, buildings and antenna patterns, and the hexagon is a planning idealisation.
2. The network's two halves
Every mobile network divides into the radio part and the core part, and the division has survived every generation.
The radio access network:
- The base station — antennas, radios, and the baseband processing. Called a BTS in 2G, NodeB in 3G, eNodeB in 4G, gNodeB in 5G. The names change; the job does not.
- A base station controller in older generations, managing several base stations and handling handover between them. 4G removed it, distributing its functions into the base stations themselves, which cut latency substantially.
The core network:
- Subscriber database — who you are, what you have paid for, where you currently are. Called the HLR in 2G/3G and the HSS in 4G.
- Mobility management — tracking which area each phone is in, and authenticating it.
- The gateway to the outside world — to the public telephone network for voice, and to the internet for data.
The separation matters because it is why your phone works abroad. Your home network holds your subscription; the visited network provides the radio and asks your home network whether to serve you. Roaming is a database query.
3. What happens when you switch on
Step 1 — cell search. The phone scans the frequency bands it supports, looking for synchronisation signals. Base stations broadcast a known pattern continuously; the phone correlates against it (Chapter 4.3) and the correlation peak gives both the cell's identity and the exact timing.
Step 2 — synchronisation. From the peak the phone learns the frame timing and corrects its own oscillator's frequency error, which matters enormously for OFDM (Chapter 7.4).
Step 3 — system information. The cell broadcasts its identity, the operator it belongs to, which frequencies it uses, and the parameters for getting access. The phone reads this before transmitting anything, because until it does, it does not know what power to use or when it is allowed to speak.
Step 4 — random access. The phone picks a random preamble from a set and transmits it in a designated window. Random, because several phones may try at once and the randomness lets the base station tell them apart — the same collision logic as Chapter 7.4's ALOHA.
Step 5 — timing advance. The base station measures how late the preamble arrived and tells the phone to transmit that much earlier in future. This is essential, because in a TDMA or OFDM system every phone's transmission must arrive at the base station aligned to the same frame boundary.
t_{advance}=\frac{2d}{c}
Worked example. A phone 10 km from the tower:
t=\frac{2\times10{,}000}{3\times10^8}=66.7\ \mu\text{s}
And this sets the maximum cell radius. GSM's timing advance field allows up to 233 µs, giving a maximum range of 35 km. A cell cannot be larger than the timing advance mechanism permits, which is why coastal and desert cells hit a hard limit no amount of power overcomes. GSM later added an "extended range" mode using two timeslots per call to double it.
Step 6 — authentication. The SIM card holds a secret key that never leaves it. The network sends a random challenge; the SIM computes a response using the key; the network checks it against the same computation done by the home subscriber database.
The key is never transmitted. This is a challenge-response protocol, and Volume I, Chapter 8.4.7 develops the general form. The same computation also derives the session encryption key, so authentication and key agreement happen together.
Step 7 — bearer establishment. The core network sets up a data path and assigns an IP address. The phone is now attached.
4. Making a call
The signalling path. The phone sends a setup request; the core looks up the called number, finds which network it belongs to, and routes the request. If the called party is mobile, their home network is asked where they currently are, and the request is forwarded there. The called phone is paged across the whole tracking area — the network knows roughly where it is, not exactly.
Then the called phone rings, and when answered, a media path is established.
Voice encoding. The audio is compressed by a vocoder:
| Codec | Rate | Generation |
|---|---|---|
| GSM full rate | 13 kbit/s | 2G |
| AMR | 4.75–12.2 kbit/s | 2G/3G, adaptive |
| AMR-WB | 6.6–23.85 kbit/s | HD voice |
| EVS | 5.9–128 kbit/s | 4G/5G |
AMR is adaptive: when radio conditions are poor, it drops to a lower rate so that more of the transmission budget can go to error correction. The call gets quieter and rougher rather than dropping, which is a deliberate design choice.
AMR-WB doubles the audio bandwidth to 50 Hz–7 kHz from the traditional 300 Hz–3.4 kHz, which is what "HD voice" means. The audible difference is mostly in the consonants — the difference between "s" and "f" lives above 4 kHz and is simply absent from a narrowband call, which is why people spell things out on the phone.
How voice actually travels in 4G and 5G: as IP packets, using VoLTE. There is no circuit-switched path at all. Voice is a data application with a guaranteed quality-of-service class, which is why 4G-only networks needed VoLTE before they could carry calls at all.
5. Handover
Moving between cells while connected, and it is the hardest part of a mobile network.
The phone continuously measures neighbouring cells and reports the results. When a neighbour is consistently better by a margin, the network commands a handover.
Hard handover — break the old connection, then make the new one. A gap of tens of milliseconds. Used in GSM and LTE, and it works because the gap is short enough to be inaudible.
Soft handover — connect to both cells simultaneously and combine the signals. Only possible in CDMA, where both cells share the same frequency (Chapter 7.4). Gives better quality at cell edges and costs capacity, since two cells are serving one phone.
The hysteresis that prevents chaos. If handover triggered the instant a neighbour became stronger, a phone at a cell boundary would bounce back and forth continuously — the ping-pong effect, which costs signalling load and drops calls.
So the trigger requires the neighbour to be better by a margin, for a sustained period:
RSRP_{neighbour} \gt RSRP_{serving}+\text{hysteresis}, \quad\text{for}\quad t \gt \text{time-to-trigger}
Typical values: 3 dB of hysteresis and 320 ms of time-to-trigger. This is exactly the Schmitt trigger of Chapter 2.5, applied to a completely different domain for the identical reason.
Tuning those two parameters is a real operational job. Too much hysteresis and calls drop because the phone holds on to a dying cell; too little and the network drowns in handover signalling. On a high-speed rail line, the settings must be different again.
6. The generations, and what each actually changed
1G (1980s) — analog. FM voice, FDMA, no encryption, no data. Anyone with a scanner could listen to any call, and cloning a phone's identity was trivial. Systems: AMPS in North America, TACS in the UK, NMT in Scandinavia.
2G (1991) — digital. GSM used TDMA with eight timeslots per 200 kHz carrier, and added encryption and the SIM card. The SIM was the genuine innovation: it separated the subscription from the handset, so you could change phone without changing number. GSM became the first genuinely global standard, and text messaging — added almost as an afterthought using spare capacity in the signalling channel — became a cultural phenomenon nobody predicted.
Data arrived as GPRS (up to 114 kbit/s) and EDGE (up to 384 kbit/s), by allocating multiple timeslots and, in EDGE's case, upgrading the modulation from GMSK to 8-PSK.
3G (2001) — CDMA and real data. UMTS used wideband CDMA in 5 MHz channels. The design goal was data, and the early reality was disappointing — 384 kbit/s in practice. HSPA and HSPA+ later reached 42 Mbit/s by adding higher-order modulation, MIMO and faster scheduling.
3G's other change was architectural: packet-switched data became a first-class citizen rather than an add-on.
4G / LTE (2009) — OFDM and all-IP. OFDMA downlink, SC-FDMA uplink (Chapter 7.4's peak-to-average argument), MIMO from the start, and no circuit-switched domain at all. Everything is IP.
Peak rates of 150 Mbit/s to 1 Gbit/s with carrier aggregation, and — often more important in practice — latency dropped from around 150 ms in 3G to 30 to 50 ms. That latency change is what made mobile web browsing feel responsive, and it came mostly from removing the base station controller from the path.
5G (2019) — three different things at once. This is the generation whose marketing most obscured its engineering, so it is worth separating.
Enhanced mobile broadband. More bandwidth, more antennas. Two frequency ranges with completely different characteristics:
- Sub-6 GHz — up to 100 MHz channels, similar propagation to 4G, moderate speed improvements. This is what almost all 5G actually is.
- Millimetre wave, 24 to 47 GHz — up to 400 MHz channels and multi-gigabit rates, but the range is a few hundred metres and it does not pass through walls or foliage, or even through a hand. Deployed only in dense hotspots.
Ultra-reliable low latency. Air-interface latency around 1 ms, using shorter transmission intervals and pre-allocated resources. The target applications are industrial control and vehicle communication, and the promise is meaningful only if the whole path is short — the radio can offer 1 ms while the server is 40 ms away.
Massive machine-type communication. Millions of low-power devices per square kilometre, each sending a few bytes a day. Different requirements entirely — battery life measured in years, not throughput.
Massive MIMO is 5G's most substantial technical change: 64 or 128 antenna elements at the base station, forming narrow beams aimed at individual users. This is Chapter 7.6's phased array, doing spatial multiplexing — several users served on the same frequency at the same time, separated only by direction. It multiplies cell capacity several-fold, and it is where most of 5G's real-world gain comes from.
7. What a base station actually contains
The antennas. Typically three sectors of 120°, each with several antennas for MIMO and for different bands. A modern panel contains a dozen or more separate arrays behind one radome.
Remote radio units mounted at the antenna, doing the amplification and the conversion to and from digital. Putting them at the top of the mast eliminates the feeder loss that Chapter 7.1's Friis analysis showed is so expensive — a decision that improves uplink sensitivity by several decibels.
The baseband unit at the base of the mast, doing the OFDM processing, coding, scheduling and protocol handling. Connected to the radio units by optical fibre carrying digitised samples.
Backhaul to the core network — fibre where available, microwave link where not.
Power: 1 to 10 kW for a macro site, with battery backup for a few hours and often a generator.
Synchronisation. GPS timing, to a few hundred nanoseconds. Required absolutely for TDD systems (Chapter 7.4), because a base station transmitting while its neighbour receives, on the same frequency, would deafen it. This makes GPS a critical dependency of the mobile network, which is a genuine and increasingly discussed vulnerability.
8. Why coverage is where it is
Frequency decides everything about a cell's shape.
| Band | Propagation | Typical use |
|---|---|---|
| 700–900 MHz | penetrates buildings well, long range | rural coverage, indoor |
| 1800–2100 MHz | moderate | urban capacity |
| 2.6 / 3.5 GHz | poor penetration, short range | dense urban capacity |
| 26 GHz+ | line of sight only | hotspots |
Low frequencies for coverage, high frequencies for capacity. A 700 MHz cell might cover 10 km of countryside; a 3.5 GHz cell covers a few hundred metres of city centre and carries far more traffic.
This is why rural coverage improved when the analog television bands were released. The 700 and 800 MHz spectrum freed by the digital television switchover was auctioned specifically for mobile coverage obligations, and it works because those frequencies travel.
The uplink is usually the limit, not the downlink. A base station transmits perhaps 40 W from a 17 dBi antenna; a phone transmits 0.2 W from a 0 dBi antenna held against a head. The asymmetry is around 30 dB, so the cell's edge is defined by how far the phone can be heard, not by how far the tower can be heard.
Which explains a familiar experience: full signal bars and a call that will not connect. The bars show downlink strength, which is strong; the uplink is what has failed.
Chapter 8.2 covers the other radio system in your pocket, which does something that sounds impossible — telling you where you are, from satellites that do not know you exist and never receive anything from you.
Every formula above, built from scratch
None of the results in this chapter are worth memorising, because each one can be rebuilt in under a minute from something simpler. What follows is that rebuilding, one result at a time, so the formula and the reason for it sit on the same page as the explanation that needed them.
Cellular
D=R\sqrt{3N} \qquad\text{(frequency reuse distance)}
Capacity in an area is proportional to the number of cells, so halving the cell radius quadruples capacity using the same spectrum. This is where nearly all cellular capacity growth has come from.
\text{co-channel interference ratio}=\frac{(D/R)^n}{6}=\frac{(3N)^{n/2}}{6}
for path loss exponent n and six first-tier interferers.
Timing advance:
t_{TA}=\frac{2d}{c}
Maximum cell radius is set by the timing advance field's range. GSM allows 233 µs, giving
d_{max}=\frac{233\times10^{-6}\times3\times10^8}{2}=35\ \text{km}
Handover trigger:
RSRP_{neighbour}\gt RSRP_{serving}+\text{hysteresis, sustained for } t\gt\text{time-to-trigger}
Typical: 3 dB and 320 ms. This is a Schmitt trigger (Chapter 2.5) applied to radio measurements, for the same reason — to stop chattering at the boundary.
Uplink-downlink asymmetry:
\Delta = (P_{BS}+G_{BS}) - (P_{UE}+G_{UE}) \approx 30\ \text{dB}
which is why the cell edge is defined by the uplink, and why full signal bars can accompany a failed call.
Voice coding rates: GSM full rate 13 kbit/s, AMR 4.75–12.2, AMR-WB 6.6–23.85, EVS 5.9–128.
What the next chapter fixes
A cellular network knows where you are because your phone talks to it. Chapter 8.2 covers the system that works the other way round — receive-only, silent, and accurate to a few metres — which turns out to need the relativity corrections of Volume IV Chapter 6.9 to work at all.