System and method for disabling a cellular phone

[0002] This application claims the benefit of U.S. Provisional Application No. 60/107,491, filed Nov. 6 , 1998.

[0003] 1. Field of the Invention

[0004] This invention relates generally to the field of mobile and wireless communication systems. More particularly, the invention relates to an improved system and method for disabling a wireless device over cellular control channels.

[0005] 2. Description of the Related Art

[0006] A typical cellular network is illustrated in FIG. 1. Some of the primary components include a group of mobile switching centers 110, 115 (hereinafter “MSCs”); a series of base stations 140-142 and 150-151; and one or more a mobile units 130. Each mobile unit 130 includes an RF module (not shown) for transmitting and receiving cellular signals. The MSCs 110, 115 communicate across an interface 150 to one or more additional networks 120 (e.g., the public switched telephone network).

[0007] The mobile station 130 contains a radio frequency (“RF”) module (not shown) which allows the mobile station 130 to tune to a particular frequency as designated by the cellular network. The “cell” site is defined by the area (e.g., line 170 in FIG. 1) surrounding each individual base station 140. In operation, each base station 140-142; 150-151 acts as an interface between the MSCs 110, 115 and the mobile stations 130; transmitting and receiving control and voice signals to and from each, respectively.

[0008] The MSCs 110, 115 perform the primary control functions for the cellular network, routing calls between the base stations 140-142; 150-151 and other networks 120 and performing a variety of call management operations (e.g., performing testing and diagnostics; monitoring network traffic . . . etc). Two databases are maintained at the MSCs 110, 115 for tracking cellular subscribers: the home location register (hereinafter “HLR”) and the visitor location register (hereinafter “VLR ”).

[0009] Every cellular customer belongs to one HLR, which is associated with a particular network provider. Information relating to the customer's account (e.g., subscribed services, account payments) is stored in the HLR along with customer tracking information which identifies the customer's location within the overall cellular network (i.e., either within or outside of the subscribed cellular provider's network).

[0010] The VLR keeps track of customers who are operating outside of their cellular provider's network. For example, if MSC 110 and MSC 115 were operated by different service providers and mobile station 130 moved outside of a MSC 110's range (where he was a subscribed) and into MSC 115's range, then MSC 115 would open a VLR entry for the mobile station 130 and would notify MSC 110 (which would then update the HLR for the mobile station 130).

[0011] The communication interface between a mobile station 130 and a base station 140 can be broken down into two pairs of channels as illustrated in FIG. 2: a pair of voice channels and a pair of control channels. The two voice channels, the reverse voice channel (RVC”) 210 and the forward voice channel (“FVC”) 220 carry digital or analog voice signals to and from the mobile station, respectively. The two control channels, the reverse control channel (“RECC”) 230 and the forward control channel (“FOCC”) 240 carry control signals (e.g., the number to dial, the paging signal indicating an incoming call . . . etc) to and from the mobile station 130, respectively. When the voice channels are not in operation, the mobile station 130 must continually monitor it's designated control channels for event triggers.

[0012] Each cellular service provider broadcasts a unique System Identification Number (hereinafter “SID”) on its FOCC within the cellular provider's allocated frequency range. Accordingly, a properly equipped cellular telephone can determine which service company is providing service on a given channel by identifying the SID. Usually the SID contains three digits.

[0013] At least two identification numbers may be associated with each mobile cellular device: an electronic serial number (“ESN”) and a mobile identification number (“MIN”). The ESN is a 32-bit binary number which is set up by the manufacturer at the time of production. It is comprised of a manufacturer code and a serial number. The ESN is typically burned into memory (e.g., ROM) so that circuitry providing the number is secure.

[0014] The MIN is a 34-bit number that is derived from 10-digit telephone number of the mobile station. The MIN is comprised of MIN1, 24-bits which correspond to is the station's 7-digit directory number, and MIN2, 10 bits that correspond to the station's 3-digit area code.

[0015] The assignee of the present application has developed proprietary, two-way, wireless data communications technologies in which data packets known as Remote Access Application Messages (“RAAM”™) or Control Channel Application Data (“CCAD”™) are transmitted over cellular control channels to and from cellular RF modules. See, e.g., U.S. Pat. No. 5,845,203 which is assigned to the assignee of the present application. These data packets enable a variety of new applications beyond traditional cellular voice communications, including monitoring and control of remote devices. These new systems operate completely within, and are transparent to, current established cellular networks, without usurping or compromising the voice-based infrastructure and revenue generation.

[0016] Occasionally, a mobile device employing elements of the foregoing technology must be disabled for one reason or another. Under certain conditions, the cellular device should be completely disabled such that it needs to be taken back to the factory before it will function properly again (e.g., car theft applications). In other instances, however, it would be more useful to temporarily disable the device such that it may be enabled locally and/or remotely (or otherwise disabled in a less-severe manner).

[0017] Accordingly, what is needed is a system and method for disabling a cellular device using different disabling techniques. What is also needed is a system and method for disabling a cellular device in which the manner in which the device is disabled is based on the application for which the device is employed and/or the underlying facts associated with the act of disabling (e.g., why the device was disabled).

[0018] A method is described for disabling a cellular control module comprising: disabling the cellular control module responsive to either a temporary disable command or a factory disable command received over a cellular control channel; and enabling the cellular control module responsive to an enable command received over the cellular control channel if the cellular control module was disabled by a temporary disable command but not if the cellular control module was disabled by a factory disable command.

[0019] Also described is a cellular control module for receiving commands over a cellular control channel comprising: temporary disable logic which disables the cellular control module responsive to a temporary disable command received over the cellular control channel; factory disable logic which disables the cellular control module responsive to a factory disable command received over the cellular control channel; and enable logic which enables the cellular control module responsive to an enable command received over the cellular control channel if the cellular control module was disabled by the temporary disable logic but not if the cellular control module was disabled by the factory disable logic.

[0020] A better understanding of the present invention can be obtained from the following detailed description in conjunction with the following drawings, in which:

[0021] FIG. 1 illustrates a typical cellular network.

[0022] FIG. 2 illustrates the breakdown of voice channels and control channels on a cellular network.

[0023] FIG. 3 illustrates a cellular module implemented in various embodiments of the invention.

[0024] FIG. 4 illustrates a correlation between a mobile identification numbers and actions/controls enacted by a cellular module in embodiments of the invention.

[0025] FIG. 5 illustrates action values and corresponding actions implemented in one embodiment of the invention.

[0026] FIG. 6 illustrates control values and corresponding controls implemented in one embodiment of the invention.

[0027] FIGS. 7 and 8 illustrate command and data functions implemented in one embodiment of the invention.

[0028] FIG. 9 illustrates action values and corresponding actions implemented in one embodiment of the invention.

[0029] In the following description, for the purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the present invention. It will be apparent, however, to one skilled in the art that the present invention may be practiced without some of these specific details. In other instances, well-known structures and devices are shown in block diagram form to avoid obscuring the underlying principles of the present invention.

[0030] Embodiments of the present invention include various steps, which will be described below. The steps may be embodied in machine-executable instructions. The instructions can be used to cause a general-purpose or special-purpose processor to perform certain steps. Alternatively, these steps may be performed by specific hardware components that contain hardwired logic for is performing the steps, or by any combination of programmed computer components and custom hardware components.

[0031] Elements of the present invention may also be provided as a machine-readable medium for storing the machine-executable instructions. The machine-readable medium may include, but is not limited to, floppy diskettes, optical disks, CD-ROMs, and magneto-optical disks, ROMs, RAMs, EPROMs, EEPROMs, magnet or optical cards, propagation media or other type of media/machine-readable medium suitable for storing electronic instructions. For example, the present invention may be downloaded as a computer program which may be transferred from a remote computer (e.g., a server) to a requesting computer (e.g., a client) by way of data signals embodied in a carrier wave or other propagation medium via a communication link (e.g., a modem or network connection).

[0032] An exemplary RF module 300 used to implement elements of the system and method is illustrated in FIG. 3. The RF module 300 includes a cellular transceiver unit 320 for transmitting and receiving packetized data over cellular control channels. Also illustrated is a processor 310 which may be a Digital Signal Processor (“DSP”), a general purpose processor or a μcontroller. The processor 310 controls the RF module 300 and executes cellular processing instructions/logic. A memory section 330 stores one or more RF module programs and parameters, and may also be used to buffer incoming/outgoing data.

[0033] Other elements of the illustrated embodiment of the RF module 300 include a serial connection for transmitting/receiving data/instructions from external devices; power connections; I/O connections; and additional status pins (e.g., service available flags, multiple channel flags, analog signal strength flags, etc).

[0034] The RF module 300 in one embodiment transmits and receives short RAAM data packets on control channels in cellular networks using standard (e.g., TIA/EIA-553 and IS-41) signaling mechanisms. The module 300 interfaces with various types of cellular devices (e.g., via its serial data interface) and enables a variety of new applications beyond traditional cellular voice communications. Data packets sent by remote devices in this manner may be transmitted to an HLR over the Signaling System Number 7 (hereinafter “SS7”) cellular network for

[0035] The RF Module is embedded in devices that generate data that may be processed by an HLR and/or transmitted wirelessly to other sites. Some exemplary applications include (among others) security systems, utility meters, vending machines and Global Positioning System (“GPS”) units.

[0036] In short, for data uplink, the Module:

[0037] accepts data packets from external devices on a data interface

[0038] accepts and counts inputs on general purpose input pins (if available)

[0039] encodes the data into a proprietary packet format

[0040] transmits the encoded packets using cellular Reverse Control Channels (ROCC).

[0041] For data downlink, the Module:

[0042] responds to event triggers (e.g., cellular pages) on Forward Control Channels (“FOCC”)

[0043] sends data output through the Data Interface to control external devices

[0044] outputs analog voltages or digital values on output pins (if available)

[0045] To support EIA-553 call processing operation for transmission termination, the Module 300 must listen (and respond) to Forward Voice Channel (“FVC”) and Reverse Voice Channel (“RVC”). Accordingly, the cellular RF section of the Module must have the capability to tune to and receive/transmit on voice channel frequencies.

[0046] One embodiment of the invention implements IS-91 authentication protocols. Although IS-91 is not technically required, cellular carriers may eventually require these devices to follow the same authentication protocols as other cellular devices that are used for voice service.

[0047] The data encoding into packets is accomplished by the processor 310 on the Module 300 since it has all the pieces required to generate the packets (e.g., MIN, Serial Number, etc). External host controllers may be configured to transmit to the Modules 300 a predetermined minimum or maximum amount of data (e.g., 16 digits) to be encoded and transmitted in a packet. In one particular embodiment, a minimum of 16 digits must be transmitted. If the external controller does not provide 15 digits of data plus a reach-back character (‘*’) (described in detail below), the Module must not transmit and must report an error to the external host controller.

[0048] The Dialed Digits field of one embodiment of the data packet begins with a single “*” digit. This is a remote feature access digit, and the cellular switch thus treats this message as a remote feature access request by a roamer cellular device. Per the requirements of the EIA-553 and IS-41 B standards, the switch routes the call data (in standard IS-41 format) out to the IS-41 network, using SS7 protocols, for verification of features by an HLR. Based on translation table assignments, the network address DPC (Destination Point Code) attached to the data packet causes the IS-41 message to be received at an HLR, a centrally located data processing center that processes the packets. The data contained within the dialed digits field of the packets may then be extracted and executed upon according to the application requirements. For example, the data thus acquired can be transmitted to a local computer system operated by an application service provider.

[0049] If not provided by the host controller attached to the RF Module 300, the Module 300 in one embodiment must add the ‘*’ Remote Feature Access Control reach-back character to the data before transmission. If the first digit of the data provided to the Module on the Data Interface is not a ‘*’ the digit may either be changed to a ‘*’ or it may be added in front of the provided data (at the discretion of the Module manufacturer). Alternatively, the Module can report an error on the Data Interface if the leading ‘*’ is not present.

[0050] Regardless of the specific implementation selected in support of this requirement, this embodiment of the RF Module must always ensure that a leading ‘*’ is included for any packets that are actually transmitted over the air using the primary MIN of the device.

[0051] The Module 300 may also be capable of using the full 31 data digits (32 transmitted digits) possible with extended RECC (also known as “extended dialing”) when this feature is available at a given MSC. Since a minimum of 16 digits (including the ‘*’) must be transmitted, if additional digits are provided in the transmit command, the Module 300 will transmit all the provided digits.

[0052] However, if more digits are to be sent than the allowed packet size in a given market, the Module may choose to partition the data and transmit in multiple packets. This is not a critical requirement, since it may be very difficult for the Module to determine the digit capacity of the local cellular carrier. Nevertheless, on-board RAM storage for up to 32 digits per data transmission (preferably 64 digits) should be provided.

[0053] In one embodiment, all data packet transmissions are right justified in the 15-digit data field (16 digits when including the leading ‘*’). In addition, when the Module is directly providing the data transmission, for example for reporting the counter value in response to a cellular page, all data must be right justified in the data field. When the Module transmits in this mode, leading ‘0’ digits are inserted in the unused data fields if the data length needed is smaller than the full capacity of the data field.

[0054] The broadcast power of the Module should meet broadcast power standards for the cellular telephone industry for Class 1 mobile cellular units: 3 W. Devices transmitting at other power levels (Class 3 at 0.6 W, for example) may also be desirable if the cost trade-off is favorable.

[0055] The Module can operate with or without an external host controller. As described above, a host controller is connected to the serial port Data Interface, and the Module is then under the command of the host (although certain operations described below can still be automatically enabled and triggered by received cellular pages). If an external host controller is not used, many of the commands described below are not applicable since these commands are normally sent using the serial port connection. When there is no external host controller, the Module is still capable of transmitting data when triggered by a cellular page.

[0056] One embodiment of the Module 300 must accept various commands on the serial port Data Interface, if available, and provide responses to the received commands. For example, sequences are provided to:

[0057] initialize the RF Module (“cold boot”)

[0058] reset the radio section of the RF Module (“warm boot”)

[0059] reset the radio section of the RF Module (“warm boot”) without clearing the data buffer memory

[0060] run self-tests and report status

[0061] report the last command as valid

[0062] report the last command as invalid

[0063] report the last command as unknown or unsupported

[0064] report the status of the RF Module

[0065] select A or B side frequencies (store in non-volatile memory)

[0066] select Home SID Only operation (store in non-volatile memory)

[0067] select Normal SID operation (store in non-volatile memory)

[0068] select a specific control channel for data transmissions (store in non-volatile memory)

[0069] report error conditions

[0070] clear error conditions

[0071] accept and buffer data (volatile memory) for later transmission (upon being “polled” with a cellular page for example)

[0072] transmit and retain buffered packet in memory (ideally non-volatile)

[0073] accept, buffer, transmit packet, and retain in buffer, in one command

[0074] clear transmit buffer

[0075] signal if packet transmission is complete

[0076] signal if packet transmission failed

[0077] set MIN and two bytes representing “Action” and “Control” bytes (in a table in non-volatile memory—up to 10 MIN with 2 bytes per MIN)

[0078] set ESN (in non-volatile memory—factory set only)

[0079] set Home SID (in non-volatile memory)

[0080] report stored MIN (up to 10 MIN numbers) and Action/Control bytes

[0081] the Data Interface

[0082] report stored ESN on the Data Interface

[0083] report stored Home SID on the Data Interface

[0084] report when the received SID changes (i.e., is different from stored SID)

[0085] signal if cellular service is available/unavailable

[0086] signal when the RF Module is “polled” (a MIN is dialed), including which MIN and Action/Control bytes

[0087] transmit the content of an internal 32 bit counter (transmitted data include state of input and output pins since the data capacity is available)

[0088] report the content of the internal 32 bit counter on the Data Interface

[0089] set content of internal 32 bit counter to a specified value

[0090] clear the contents of internal 32 bit counter

[0091] report state of input and output pins on the Data Interface (Mandatory if pins are available)

[0092] provide output on pins under command of the Data Interface (Mandatory if pins are available)

[0093] reset output on pins under command of the Data Interface (Mandatory if pins are available)

[0094] accept counts on a dedicated counter pin and update an internal 32 bit counter

[0095] In one embodiment, all commands are acknowledged, whether from the RF Module 300 to the external host controller or from the external host controller to the RF Module 300. If the RF Module 300 does not receive an acknowledgment from the external host for any given response, it may repeat the transmission (e.g., for a total of three attempts) before giving up on getting an acknowledgement. The Module 300 may continue to attempt to send data to the external host controller even when acknowledgements are not received.

[0096] When the RF Module 300 is operating without an external host controller, some of the above commands will not be applicable—particularly those relating to communications on the Data Interface. Additional capabilities are provided for this mode—although these are not unique and may also be available when an external host controller is used. Thus, depending on the particular embodiment, the RF Module should be able to:

[0097] autonomously transmit information when pin changes state Operating without an external host controller requires the ability to

[0098] respond to events triggered by “polling” on the FOCC, i.e., when a cellular page is received. Thus, when triggered over the air, the RF Module should be able to:

[0099] transmit the content of the internal 32 bit counter

[0100] clear the contents of intern al 32 bit counter

[0101] transmit state of digital input and output pins

[0102] provide “high” output on digital output pins

[0103] provide “low” output on digital output pins

[0104] reset the radio section (“warm boot”)

[0105] initialize the RF Module (“cold boot”)

[0106] select A or B side (store in non-volatile memory)

[0107] It is important to note that the event taken upon receipt of a cellular page may be pre-selected by the values stored in the Action and Control bytes associated with a given MIN. This is described in more detail later.

[0108] If the MIN matching the transmission requirement is a global MIN (i.e., one that applies to all devices), and is set for automatic reporting, all the values (counter, state of pins, etc.) are buffered at the time of the receipt of the cellular page into the transmission buffer. Subsequently, after the automatic delay for transmission, the packet is sent from that buffer, even though it may occur many minutes after the receipt of the cellular page.

[0109] Power Up Default Value. Upon power-up, the RF Module of one embodiment is assigned the following data in its transmit buffer:

[0110] where:

[0111] ‘*’ Remote Feature Access Control “Reach-Back”Character.

[0112] A0-A9 Primary MIN of the RF Module. Immediately after power-up, when the Module receives a transmission request, or the external host controller sends it an initial transmission request without specifying the data, the above default stored in the transmit buffer will be transmitted. Subsequent transmissions may override this default initial value.

[0113] RF Module Generated Data Format. This section describes the format to be used for data initiated by the RF Module (see also FMTP Data Protocol below). Whenever the radio is sent a cellular page to report the counter value and state of the I/O pins over the air, or when an autonomous transmission is sent on a state change on an input pin, this format is used for data transmission:

[0114] where:

[0115] * Remote Feature Access Control “Reach-Back”Character. This is always a ‘*’ character.

[0116] U Unused digit position—must be encoded as a digit ‘9’.

[0117] RE Reason for response. Selected from:

[0118] C0-C9 Internal counter value, always right justified in the ten-digit field with leading ‘0’ digits as needed.

[0119] OP State of output pins (up to three pins A, B and C, if available)

[0120] IP State of input pins (up to three pins: A, B and C, if available)

[0121] CP State of counter pin. ‘0’=Low, ‘1’=High.

[0122] The logic state of the input and output pins is coded as follows in the appropriate digit field (OP or IP):

[0123] If the Module has fewer than three input (or output) pins, then certain digit values are not applicable. For example, if there are only 2 input pins on the Module 300, digit values ‘4’ through ‘7’ are not possible for the IP data digit field. If the Module 300 has more than three pins, the manufacturer may modify this format to report more or less pins.

[0124] Audit Response Format. This section details the transmission for the response to an Audit Request (see also FMTP Data Protocol below). The data is formatted to provide a detectable response, but does not contain any Module 300 status information:

[0125] where:

[0126] * Remote Feature Access Control “Reach-Back”Character. This is always a ‘*’ character.

[0127] U Unused digit position—must be encoded as a digit ‘9’.

[0128] RE Reason for response. Selected from:

[0129] Y Specifies that this is an Audit response transmission—must be encode as a digit ‘2’.

[0130] S1-S2 Slot number that matched the MIN. The value ‘00’states that the data in the MIN fields of this response is the primary MIN of the device. Otherwise ‘01’ through ‘10’represent the matched MIN slots (or FMTP page value).

[0131] N1-N3 Used with O1-O3 and X1-X4, this represents the NPA of the MIN of the page that matched the MIN slot or FMTP address or the primary MIN of the device (see values for S1 and S2).

[0132] O1-O3 See above.

[0133] X1-X4 See above.

[0134] Parameter Response Format. This section details the transmission for the response to a Parameter Response Request (see also FMTP Data Protocol below):

[0135] where:

[0136] * Remote Feature Access Control “Reach-Back” Character. This is always a ‘*’ character.

[0137] U Unused digit position—must be encoded as a digit ‘9’.

[0138] RE Reason for response. Selected from:

[0139] Y Specifies that this is a Parameter response transmission—must be encoded as a digit ‘3’.

[0140] R1-R2 Reserved. May be encoded as digit ‘0’.

[0141] T1-T2 Technology type. Selected from the following list (digit combinations not shown are reserved):

[0142] M Miscellaneous settings. When set, the bits of the digit transmitted are interpreted as follows (combinations are allowed):

[0143] S Carrier Serving System mode setting in the Module.

[0144] The digit specified is selected from the following table:

[0145] I Input port configuration status. When set, the bits of the digit transmitted are interpreted as follows (combinations are allowed):

[0146] E Radio enabled status. When set, the bits of the digit transmitted are interpreted as follows (combinations are allowed):

[0147] V1-V4 Radio firmware revision. The radio manufacturer may interpret this in a variety of ways. The recommendation is for a major and minor number with an implied decimal as V1V2.V3V4 (i.e., transmitted digits 0123 represents revision 1.23 of the Module).

[0148] Binary Byte Stuffed Format. The specific command format for each instruction, the acknowledgment sequence, and the data for each command should be as per the following frame structure:

[0149] where:

[0150] SOF Start Of Frame, hex value 0x2 (STX).

[0151] byte count One byte value representing the total number of bytes in the packet, not including the SOF byte.

[0152] command One byte representing the command or data type being transmitted.

[0153] data1-dataN Arguments/data for the command, if required. checksum One byte checksum—the two's complement of the lower 8 bits of the sum of the binary values of all bytes in the packet, not including the SOF and the checksum byte itself.

[0154] Byte stuffing may be implemented to reduce the probability of errors in frame synchronization for each packet. A DLE byte, 0×10, will be inserted prior to every STX (0×2) and DLE (0×10) bytes in the data bytes; however, the leading STX byte, indicating start of frame, may not be byte stuffed in this manner. All stuffed DLE bytes are counted as valid bytes for determining the byte count and the pseudo “AT” Command Format.

[0155] An alternative to the above binary byte stuffed format is to use a pseudo-AT command set. In this format, the RF Module accepts ASCII commands and data, using a command set similar to typical modem AT command sets. The instruction to the RF Module begins with the letters “AT”, followed by character fields that determine the command, followed by the parameters required by the instruction, followed by a carriage-return character. The commands and responses are ASCII characters. Methods for data validation (using checksums, etc.) must still be incorporated to ensure that correct data has been received, and responded to, by the RF Module.

[0156] The RF Module 300 in on embodiment has multiple MIN capability. The Module 300 is used with FOCC event triggering to transmit data, and up to ten MIN numbers (for ten events) may be stored in a table in memory (e.g., non-volatile memory). Each MIN in the table will have an associated Action byte and an associated Control byte. This association is by the slot number, or position, within the table. The Action byte is an unsigned 8-bit value that allows the radio to perform pre-programmed actions based on that value; some of these are predefined and others are for use of the Application Service Provider (i.e., the organization) using the RF Module. The Control byte is an unsigned 8-bit value whose individual bit positions are used to determine the conditions under which the Action byte applies.

[0157] FIG. 4 illustrates MIN numbers, the Action bytes, and Control bytes. Corresponding slots in the tables are always used together to determine the action taken. In other words, Act1 will only apply if MIN1 matches the broadcast cellular paged number, and Con1 is a qualifier for extra control on the behavior of the radio.

[0158] Each Action byte value can range from 0 to 255 in the illustrated embodiment since it is an unsigned 8-bit quantity. The range 0 to 63 is reserved for actions to be taken by the RF Module, and values 64 to 255 are available to be utilized by Application Service Providers developing products using the RF Module 300, often under control of an external host controller. The bits in the Control byte are used to determine extra control and reporting when a particular action is taken upon receipt of a cellular page which matches the MIN.

[0159] It should be noted that one embodiment of the RF Module responds up to a predefined maximum number of events (e.g., ten) since not all slots in the table need to be filled and active. The Action byte only determines what specific action (of a choice of 256) is to be taken upon receipt of a cellular page that matches the corresponding MIN.

[0160] It is also important to note that the Application Service Providers are not prohibited from using the values of 0 to 63; on the contrary, in many cases, these values will be correct for their particular needs, and they should use the value if the action is what they desire. It is merely the definition and actual action (taken by the firmware/software in the RF Module) that is restricted for this number range.

[0161] Primary MIN. The MIN stored in Slot 0, or MIN0, in one embodiment is the Primary MIN, or identifier, of the RF Module. When transmitting packets in this embodiment, the MIN0 is always used for the Mobile Identification Number (MIN) field in the packet.

[0162] The primary MIN should not be a global MIN—i.e., bit 1 of the control byte for this slot should not be set in normal use. If desired, the radio firmware/software can choose to disallow setting bit 1 for the first MIN slot.

[0163] Action Byte. The table illustrated in FIG. 5 lists an exemplary set of actions to be taken by an RF Module when a given MIN is polled. As indicated at action byte values 21 and 23, at least two mechanisms exist for disabling RF modules (listed as “Disable Module 1” and “Disable Module 2,” respectively).

[0164] Using the “Disable Module 1” feature (i.e. by transmitting an action byte with a value of 21), the Module 300 does not allow the serial Data Interface to request transmissions (i.e., from the host controller). It may, however, register, and continue to listen to FOCC transmissions, and respond to FMTP device control instructions, particularly the “Enable Module 1” instruction generated by action byte 21. The Module in this embodiment may be enabled by a serial Data Interface instruction (e.g., from the host controller).

[0165] Using the “Disable Module 2” feature (i.e. by transmitting an action byte with a value of 23), the Module 300 does not allow the serial Data Interface to request transmissions. One primary different here is that the Module 300 cannot be enabled by any serial Data Interface instruction. Thus, the host controller is not capable of enabling the module 300 once it has been disabled using the Disable Module 2 feature. As such, this feature may be more appropriate for high security applications than the Disable Module 1 feature.

[0166] Control Byte. The table illustrated in FIG. 6 describes the extra modifiers to be applied to the action taken by the RF Module 300 (as determined by the Action byte). Unlike the actual parameter values shown above in the Action byte, the individual bit values (i.e., 1 or 0) of the Control byte are relevant.

[0167] Note that the automatic over-the-air responses for global MIN pages may be delayed for automatic responses. As previously described, in one embodiment, the Module must buffer the counter value and state of pins at the time of receipt of the page—not when finally transmitting the data after the delay. If the Module is connected to an external host controller and the host requests a data transmission while waiting to transmit a scheduled response, this transmit buffer will be overwritten and the automatic response transmission, scheduled for later delivery, will be cancelled.

[0168] Min Matches and Wild-Cards. When processing the received FOCC cellular page, the RF Module 300 of one embodiment will start searching for a match with the MIN in Slot 0 (MIN0). If a match occurs, the action represented in the corresponding slot in the Action byte table will be taken. After this action is complete, the RF Module 300 will consider the action complete (without searching the rest of the MIN tables), and then the RF Module 300 will wait for the next cellular page to be received before searching the MIN tables for another match.

[0169] The Module 300 in one embodiment is capable of responding to Forward Message Transport Protocol (FMTP) messages. This protocol enables an in-band (i.e., the MIN is sent in the pages), multiple-page (minimum of three cellular pages are required—five are possible for the full FMTP protocol) data transmission scheme for enabling certain radio behavior. The MIN transmitted can be a global secondary MIN for the purpose of transmitting the information to more than one RF Module.

[0170] The mechanism provides four digits of data in the forward direction, by encoding the target MIN, the command digit and four data digits in a series of three pages. When all the pages are received and decoded, the Module 300 reports the receipt of a successful FMTP page to the application host controller on the serial Data Interface. The Module may directly interpret certain FMTP pages, depending on the command digit value.

[0171] The FMTP Page Formats. The format of each of the pages (the slots) in one embodiment and the interpretation of the paged cellular digits received by the Module 300 are as follows:

[0172] where:

[0173] M1-M3 Identical to the three most significant digits of the MIN being sent the FMTP page. For example, if the primary MIN of the Module is 175, then M1=1, M2=7, M3=5. Note that all the cellular pages of an FMTP transmission have the same M1 through M3 values.

[0174] F1-F2 These two digits are the digits denoting the line ranges used for the FMTP protocol. In one particular implementation, F1=9 and F2=9. The Module manufacturer must set this in the Module.

[0175] A1-A7 The 7 lower digits of the MIN (the 3 upper digits are assumed to be the same as the M1-M3 values) being sent the FMTP page. The MIN being sent the FMTP page may be a Primary MIN or a secondary MIN.

[0176] C Command digit (‘0’ through ‘9’). The interpretation of this digit is described shortly.

[0177] D1-D4 Data digits (‘0’ through ‘9’). The interpretation of these digits depends on the value of the command digit.

[0178] D5-D12 Data digits (‘0’ through ‘9’). The interpretation of these digits depends on the value of the command digit—it should be noted that the 8 and 12 digit sequences are not currently available to the Application Service Provider.

[0179] The least significant digit of the page (shown as Digit 10 in the above table) will determine the specific page slot being sent. For Modules listening to the even MIN stream on the FOCC, digits 0, 2, 4, 6 and 8 will be used. For Modules listening to the odd MIN stream, digits 1, 3, 5, 7 and 9 will be used for this digit field.

[0180] Commands and Data Messages. Illustrated in FIG. 7 are FMTP commands and data messages which are provided for the full eight and twelve digit data embodiments. The following functions apply:

[0181] Command A single digit representing the specific command to be executed. With the exception of the Factory Disable and Device Control subsets of the Device Control command, all received commands and values are sent to the host controller on the Data Interface (if one is attached). The Device Control command is directly used by the RF Module (to disable/enable operation as directed by the data parameters.) The command digits ‘8’ and ‘9’ are shown as reserved. However, as mentioned above, the radio must simply pass the received message to the external host controller on the Data Interface—an application interpretation for these commands will be provided.

[0182] H1-H2 Hour. From ‘00’ to ‘23’ (however, the full ‘00’ to ‘99’ range is allowed.) Also see next field description.

[0183] M1-M2 Minutes. From ‘00’ to ‘59’ (however, the full ‘00’ to ‘99’ is allowed.) The Module can store the time (in an internal real time clock, for example, if it is available), but the primary intention of this command is to send the information to an external host controller via the Data Interface. In this case, the application can interpret the digits as desired.

[0184] MO1-MO2 Month. From ‘01’ to ‘12’ (however, the full ‘00’ to ‘99’ is allowed.) Also see next field description.

[0185] DY1-DY2 Day. From ‘01’ to ‘31’ (however, the full ‘00’ to ‘99’ is allowed.) The Module can store the date (in an internal real time clock, for example, if it is available), but the primary intention of this command is to send the information through to an external host controller via the Data Interface. In this case, the application can interpret the digits as needed. The RF Module 300 is “Year 2000” compliant since it does not store date or time. If application level “Year 2000” compliance is desired, the external host controller and/or application must implement “Year 2000” compliance.

[0186] SD1-SD4 New Home SID to be set in the RF Module. The data sent in this field is the low 13 bits of the SID only, excluding the country code, encoded as four decimal digits.

[0187] F1-F2 Factory Disable. RF Modules disabled in this manner require “return to factory” to enable and is strictly intended for serious disasters (e.g., stolen Modules, “runaway” applications . . . etc). A transmitted value of ‘9’ for F1, ‘8’ for F2, and checksum values for A1 and A2 (as described below), disables the RF module. When this disable command is received, the Module will not operate (Module will not register or transmit on the RECC or listen to the FOCC) and must be returned to the manufacturer for “repair.” When F1 and F2 are both ‘0’, the Factory Disable command does not apply and the values in A1 and A2 are used to perform specific actions (as described below).

[0188] D1-D12 Data digits. Numeric values only in the range ‘0’ through ‘9’ for each digit. The “ASP Data” command is used by the Application Service Provider to send data to the Module and the “HLR Data” command is used by the HLR to send data to the Module (for future use.) Note that D5 through D12 are not available in all the FMTP messages described here.

[0189] In a four digit embodiment, the FMTP commands and data messages illustrated in FIG. 8 are available (the interpretation of the digit fields are as described above).

[0190] The table illustrated in FIG. 9 identifies the actions performed by one embodiment of the Module 300 upon receiving a Device Control FMTP page that is not a Factory Disable (i.e., the command digit is ‘3’, and the data digits field begin with the digits ‘0’ and ‘0’). It should be noted that this embodiment of a device control table corresponds to the action byte table (see, e.g., FIG. 5) associated with each MIN. As before, some of the actions are not possible if the Module 300 is not equipped with the appropriate number of pins, etc.

[0191] FMTP Timer Interval. When a cellular page is received in one embodiment, and the five most significant digits of the paged MIN matches the device NPA, the FMTP timer will be started and the Module will wait for the next FMTP message. This FMTP timer duration will be programmable via the serial Data Interface and stored in non-volatile memory. This duration can be changed from 5 to 120 seconds, with a factory default setting of 30 seconds.

[0192] The Module 300 will re-start the timer after each FMTP page is received. If the timer expires, all received FMTP Pages will be cleared from the buffer memory of the Module, and the timer will not start again until it receives a new FMTP page.

[0193] Before expiring, the timer of this embodiment can be turned off given the following conditions:

[0194] All the FMTP pages have been received and the Module has decoded the complete FMTP message being sent.

[0195] An FMTP page has been received and it occupies the same page slot location of an existing FMTP page. This is an error condition and all previous FMTP pages will be deleted from memory, and the new FMTP page will be saved in the slot location. The timer will then be re-started.

[0196] When the Module receives three FMTP pages that fill slots 1, 2 and 3, the Module will check for a complete message based on the command digit. If the message is complete (i.e. the command digit is not ‘6’ or ‘7’ meaning that there should be additional pages for slots 4 and/or 5), the timer will be canceled and the Module will process the FMTP message if the MIN encoded in the message matches the Module primary or secondary MIN.

[0197] When using this sequence of timer events and FMTP page slots, the following conditions are true:

[0198] The multiple pages for an FMTP message can arrive at the radio in any order. The Module stores them in the correct page slot based on value of the least significant digit of the paged MIN.

[0199] The timer waits 30 seconds for each page, but the receipt of the “final” one (third for the 3 page sequence, fourth in the 4 page sequence, and fifth in the 5 page sequence) will immediately reset the timer so that it is ready to listen for new FMTP pages. Generally, this allows the multiple page sequences to be sent in batches sooner than 30 seconds apart. In one embodiment this separation of FMTP pages can be reduced below 30 seconds without impact, as long as the Module immediately resets the timer upon receipt of the “final” page.

[0200] FMTP Page Duplication Filter. All received pages received by the Module that match the primary or secondary MIN's of the Module should be saved in “duplication filter” buffers. In the various AMPS cellular carrier markets, the pages are usually sent in pairs (one local page and one global/zone page). The duplication filter prevents the Module from recognizing the same page twice—a timer for the filter must elapse before the duplicate page is considered to be a separate event. This is particularly important for the FMTP protocol to prevent the page slots from being cleared too quickly. The value for timer must range from 10 to 15 seconds and programmable via the serial Data Interface, with a default of 10 seconds.

[0201] FMTP Factory Disable Checksum Calculation. In one embodiment, when the Module 300 is sent a Factory Disable (e.g., when the command digit is ‘3’ and the first two digits of the data field are ‘9’ and ‘8’), the final two digits of the data field calculated with a unique process to ensure that accidental disables do not occur. This section describes the method to be used for calculating the checksum to see if the Module 300 should obey the Factory Disable command.

[0202] This process is actually relatively simple to execute in code—the purpose of the method is to prevent accidental invocation of the Factory Disable capability. As can be imagined, the result of operating on the instruction is rather drastic, and it should be used with great care.

[0203] Step 1. The least significant 7 digits of the Primary MIN (i.e., discarding the NPA) and the least significant 7 digits of the ESN (i.e., discarding the Manufacturer code) are identified as follows:

[0204] N1-N3 The “office code” of the Primary MIN. For example, if the Primary MIN is 175-421-1710, then N1=4, N2=2 and N3=1.

[0205] X1-X4 The least significant four digits of Primary MIN. For example, if the MIN is 175-421-1710, then X1=1, X2=7, X3=1 and X4=0.

[0206] E1-E7 The least significant 7 digits of the ESN of the device.

[0207] For example, if the ESN is 123-0264067, then E1=0, E2=2, E3=6, E4=4, E5=0, E6=6 and E7=7.

[0208] Step 2. The above digits are accessed sixteen times in a specific pattern (identical pattern each time) to extract digits from the Primary MIN and ESN. Each initial value is the result of taking digits in pairs. The pattern for each access is as follows:

[0209] For example, with the Primary MIN of 175-421-1710, and an ESN of 123-0264067, the calculations for the initial values are as follows:

[0210] In the above example, in access 1, the E1 digit is ‘0’ and the N1 digit is ‘4’. Hence, the initial value is ‘04’. In access 2, the E6 digit is ‘6’ and the X2 digit is ‘7’. Hence, the initial value is ‘67’. In access 3, the E7 digit is ‘7’ and N2 digit is ‘2’. Hence the initial value is ‘72’ . . . etc.

[0211] Step 3. These initial values are then multiplied by a “Multiplier” (distinct but identical for each access) to randomize the result, and the lower two digits (i.e., modulo 100) of each result are noted. The multipliers for each access are hard-wired in one embodiment as follows:

[0212] For example, with the Primary MIN of 175-421-1710, and an ESN of 123-0264067, the calculations for the values are as follows:

[0213] In the above example, with access 1, the El digit is ‘0’ and the N1 digit is ‘4’. Hence, the initial value is ‘04’. This is multiplied by the access multiplier of ‘3’resulting in a value of ‘12’. In access 2, the E6 digit is ‘6’ and the X2 digit is ‘7’. Hence, the initial value is ‘67’. This is multiplied by the access multiplier value of ‘5’, resulting in ‘335’, whose lowest two digits are taken—hence the multiplied value is ‘35’. In access 3, the E7 digit is ‘7’ and N2 digit is ‘2’. Hence the initial value is ‘72’. This is multiplied by the access multiplier of ‘7’, resulting in ‘504’, whose lowest two digits are taken—hence the multiplied value is ‘04’ . . . etc.

[0214] Step 4. The resulting sixteen multiplied value numbers are added and the lowest two digits (i.e., modulo 100) becomes the two digits that are sent in the FMTP digit positions for the checksum. In the above example, the lowest two digits of the sum of the sixteen “Multiplied values” shown, are ‘4’ and ‘4’. Thus the FMTP page to the above device sends the command digit ‘3’ and data digits of ‘9844’—this Factory Disables the device.

[0215] The following describes the overall transmission call process implemented in one particular embodiment of the invention (obeying the requirements of EIA-553 processing):

[0216] The Module initiates a call origination, with a “reach-back”character in the first digit location. This is effectively a remote feature access request.

[0217] The Module waits for a voice-channel designation.

[0218] Upon receipt of a voice-channel designation, the Module tunes to the voice-channel.

[0219] The Module transmits SAT for 50 milliseconds, selectable from 50 to 100 ms in 5 ms steps (value stored in non-volatile memory).

[0220] The Module transmits SAT for 1000 milliseconds.

[0221] The Module transmits a call terminate (audio tone) for 1.8 seconds.

[0222] The Module reports a call transmission success to the attached host controller.

[0223] The RF Module 300 in one embodiment must be capable of operating on both block A and block B carrier frequencies, stored as a parameter (like a normal cell-phone) in non-volatile memory. It must be also capable of scanning the standard cellular control channels to use what channels are available at the site where it is used to transmit data.

[0224] Power supply requirements are flexible. For example, devices with lower supply currents, both at idle and during transmission, are entirely acceptable. Lower supply voltages, such as 5 Volt DC, can also be considered; however, these may encounter nominal difficulty with simple automotive applications since they would require external voltage regulators.

[0225] Serial Data/control Interface. If a serial Data Interface is provided in one embodiment, use of the interface protocol below can be used. However, the CMOS logic level may be replaced with RS-232 levels.

[0226] Moreover, additional baud rates or different logic levels are also possible: 1200, 2400, and 4800 bps as well as RS-232 logic levels may be implemented.

[0227] Throughout the foregoing description, for the purposes of explanation, numerous specific details were set forth in order to provide a thorough understanding of the invention. It will be apparent, however, to one skilled in the art that the invention may be practiced without some of these specific details. For example, although described in the context of a system which uses cellular control channels to transmit packetized data, the underlying invention is not limited to such a system. Accordingly, the scope and spirit of the invention should be judged in terms of the claims which follow.