Wireless & Mobile Communication Systems

CHAPTER THREE
3. REVIEW OF CELLULAR WIRELESS NETWORKS
3.1 First Generation (1G) System

3.1.1 AMPS and ETACS

In the late 1970s, AT&T Bell laboratories developed the first U.S cellular telephone systems called
the advanced mobile phone service (AMPS). AMPS was first deployed in late 1983 in the urban and
suburban areas of Chicago by Ameritech. A total of 40 MHz of spectrum in the 800 MHz band was
allocated by the Federal Communication Commission for the AMPS. As demand for cellular
telephone increased, the FCC allocated an additional 10 MHZ (called the extended spectrum) for
cellular telecommunications in 1989. The first AMPS cellular system used large cells and omni-
directional base station (BS) antennas to minimize initial equipment needs, and the system was
deployed in Chicago to cover approximately 2100 square miles.

AMPS system uses a 7-cell reuse pattern with provision for sectoring and cell splitting to increase
capacity as needed. Experimental results show that AMPS 30 KHz channel requires a signal-to-
interference ratio (SIR) of 18dB for satisfactory system performance. The smallest reuse factor
which satisfies this requirement using 120o directional antennas is 𝑁 = 7 and hence a 7-cell reuse
pattern has been adopted.

AMPS is used throughout the world and particularly popular in the U.S., South America, Australia,
and China. While the U.S system has been designed for a duopoly market (e.g., two competing
carriers per market), many countries have just a single provider. Thus, while U.S AMPS restricts the
A and B side carriers to a subset of 416 channels each, other implementations of AMPS allow all
possible channels to be used. Furthermore, the exact frequency allocations for AMPS differ from
country to country. Nevertheless, the air interface standard remains identical throughout the world.

The European Total Access Communication System (ETACS) was developed in the mid 1980s, and
is virtually identical to AMPS, except it is scaled to fit in 25 KHz (as opposed to 30 KHz) channels
used throughout Europe. Another difference is that how the telephone number for each subscriber
(called the mobile identification number or MIN) is formatted, due to the need to accommodate
different country codes throughout Europe and area codes in the U.S.

3.1.2 AMP and ETACS System Overview

Like all other first generation, analog, cellular systems, AMPS and ETACS use frequency
modulation. In U.S, transmission from mobiles to base stations (reverse link) use frequencies
between 824 MHz and 849 MHz, while base stations transmit to mobiles (forward link) using
frequencies between 869 MHz to 894 MHz. ETACS uses 890 MHz to 915 MHz for the reverse link
and 935 MHz to 960 MHz for the forward link. Every radio channel consists of a pair of simplex
channels separated by 45 MHz between the forward and the reverse channels was chosen to make
use of inexpensive but highly selective duplexers in the subscriber units. The maximum deviation of
16
Fraol B. Feb, 2024
 Wireless & Mobile Communication Systems

the FM modulator is ±12 and ±10 for AMPS and ETACS respectively. The control channel
transmissions and blank-and-burst data streams are transmitted at 10 kbps and 8 kbps for AMPS and
ETACS respectively. These wideband data streams have a maximum frequency deviation of ±8
KHz and ±6.4 KHz for AMPS and ETACS, respectively.

AMPS and ETACS cellular systems generally have tall towers which support several receiving
antennas and have transmitting antenna which typically radiate a few hundred watts of effective
radiated power. Each BS typically has one control channel transmitter (that broadcasts on the
forward control channel), one control channel receiver (that listens on the reverse control channel for
any cellular phone switching to set-up a call), and eight or more FM duplex voice channels.
Commercial BSs support as many as fifty-seven voice channels. Forward voice channels (FVC)
carry the portion of the telephone conversation originating from the landline telephone network
caller and going to the cellular subscriber. Reverse voice channel (RVC) carry the portion of the
telephone conversation originating from the cellular subscriber and going to the landline telephone
networks caller. The actual number of control and voice channels used at a particular BS varies
widely in different system installations depending on traffic, maturity of the system, and locations of
other BSs. The number of BSs in a service area varies widely, as well, from as few as one cellular
tower in a rural area to several hundred or more BSs in a large city.

Each BS in AMPS or ETACS system continuously transmits digital FSK data on the forward control
channel (FCC) at all times so that idle cellular subscriber units can lock onto the strongest FCC
whenever they are. All subscribers must be locked or “camped” onto FCC in order to originate or
receive calls. The BS revers control channel (RCC) receives constantly monitors transmissions from
cellular subscribers that are locked onto the matching FCC. In U.S, AMPS system, there are twenty-
one control channels for each of the two service providers in each market, and these control channels
standardized throughout the country. ETACS supports forty-two control channels for a single
provider. Thus any cellular telephone in the system only needs to scan a limited number of control
channels to find the best serving BS. It is up to the service provider to ensure that neighboring BS
within a system are assigned forward control channels that do not cause adjacent channel
interference to subscribers which monitor different control channels in nearby BS.

3.2 Second Generation (2G) Systems

3.2.1 The GSM system

The early 1980s were marked by the development of a number of national and incompatible
networks in Europe (C450: Germany, NMT 450 & NMT 900: Scandinavia, Total Access
Communication system (TACS) & E-TACS: GB, AMPS: USA, Radiocom (RC) 2000: France). The
seven different mobile radio networks made the prospect of the mobile telephone unattractive to
many potential customers because of high tariff and equipment costs. From the general CEPT
(European Conference of Postal and Telecommunication Administration) meeting in 1982, it was
decided to develop a pan-European cellular mobile radio network that operates at 900 MHz and the
Group Special Mobile (GSM) working group was set up to work in this research task. Six working
17
Fraol B. Feb, 2024
 Wireless & Mobile Communication Systems

groups and three supporting groups were formed to cope with the enormity of the standardization
work.

Tasks of GSM working groups

GSM Working Groups Tasks

Working party 1 Definition of services and service quality
Working party 2 Definition of access, modulation and coding procedures
Working party 3 Definition of protocols for signaling b/n mobile stations, mobile
functions and fixed communications networks
Working party 4 Specification of data services
Working party 5 Development of UMTS
Working party 6 Specification of network management features
Speech coder experts Definition of technique for digitization of speech at low bit error
group rate
Security experts group Responsibility for all aspects of security (access, coding,
authentication)
Satellite earth system Support for GSM through satellite system

The GSM objectives for its PLMN were to offer:

• A broad offering of speech and data services

• Compatibility with the wire-line networks (ISDN, telephone networks, data networks) using
standardized interfaces.
• Cross-border access system access for all mobile phone users.
• Automatic roaming and handover
• Highly efficient use of frequency spectrum
• Support of different types of mobile terminal equipment (e.g. car, portable and hand-held
telephones).
• Digital transmission of signals as well as of user information.
• Supplier-independent
• Low costs for infrastructure terminal equipment.

Definitions of Terms Used In Wireless Communications

1. Mobile stations (MS): The mobile station (MS) communicates information with the user and
modifies it to the transmission protocols of the air interface to communicate with the BSS. The
user information is communicated with the MS through a microphone and speaker for the
speech, keypad and display for short messaging, and the cable connection for other data
terminals. The mobile station has two elements.
(a) Mobile equipment (ME): It is a piece of hardware that the customer purchases from the
equipment manufacturer of their dealers (Nokia, Samsung etc.) This hardware piece contains all
the components needed for the implementation of the protocols to interface with the user and the

18
Fraol B. Feb, 2024
 Wireless & Mobile Communication Systems

air-interface to the base stations. The components include speaker, microphone, keypad and the
radio modem. So we can say that, the ME is an expensive piece of hardware.
(b) Subscriber identity module (SIM): This is a smart card issued at the subscription times
identifying the specifications for a user such as address and type of service. The calls in the GSM
are directed to the SIM rather than the terminal. SMS are also stored in the SIM card. SIM card
is not used in CDMA. A SIM card carries every user’s personal information which enables a
number of useful applications. Mobile stations may be hand-hold personal units (portables) or
installed in vehicles (mobiles).
2. Base station: Base stations are fixed-position transceivers with relatively high-power transmitters
and sensitive receivers. It is used for a radio communication with mobile stations. Base stations
are located at the center or on the edge of a coverage region and consist of radio channels and
transmitter and receiver antennas mounted on a tower. Cellular telephones communicate directly
with base stations.
3. Mobile switching center: A MSC is the hardware part of the wireless switch that can
communicate with PSTN switches using the signaling system-7 (SS-7) protocol, as well as other
MSCs in the coverage area of a service provider. The MSC also provides the specific information
on the status of the mobile terminals. It provides for communications with other wired and
wireless networks as well as support for registration and maintenance of the connection with the
mobile stations. It is a switching centre which coordinates the routing of calls in a large service
area. In a cellular radio system, the MSC connects the cellular base stations and the mobiles to the
PSTN. It is also known as mobile telephone switching office (MTSO).
4. Channels: It is a range of frequency allotted to particular service or systems. Basically two types
of channels are used in wireless communication.
(a) Control channel: Radio channel used for transmission of call setup, call request, call initiation,
and other beacon or control purposes.
This is again divided into two parts forward control channel (FCC) and reverse control channel
(RCC).
Forward channel: Radio channel used for transmission of information from the base station to the
mobile.
Reverse channel: Radio channel used for transmission of information from the mobile to base
station.
(b) Voice channel: Radio channel used for voice or data transmission.
5. Page: A brief message which is broadcast over the entire service area, usually in a simulcast
(apposite to broadcast) fashion by many base stations at the same time.
6. Handoff: It is defined as the transferring of a call (mobile stations) from one channel or base
station to another channel or base station.
7. Roamer: A mobile station which operates in a service area (market) other than that from which
service has been subscribed.
8. Transceiver: A device capable of simultaneously transmitting and receiving radio signals.

19
Fraol B. Feb, 2024
 Wireless & Mobile Communication Systems

Mobile radio transmission systems may be divided into three basic categories:
1. Simplex system: It is a communication system which provide only one-way
communication (i.e., communication is possible in only one direction) for example radio, TV
and paging system.
2. Half duplex: It is a communication system which allows two-way communication by
using the same radio channel for both transmission and reception. At any given time, the user
can only either transmit or receive information. Ex–Walkie-talkie i.e., “push to talk” and
“release-to-listen” fundamentals are used.
3. Full duplex: It is a communication system which allows simultaneous two-way
communication. By providing two simultaneous but separate channels (frequency division
duplex or FDD) or adjacent time slots on a single radio channel (time division duplex or
TDD) for communication to and from user.

Some of the important features of the GSM include:

✓ Frequency band: 935-960MHz for downlink and 890-915MHz for uplink. Each FDM
channel has 200 KHz providing an overall of 124 FDM channels. With TDM, eight
communication channels (time slots) are supported per FDM channel.
✓ Handover: Handover from one BS (Base Station) to another is a mechanism that allows
the connection quality of calls between users to be maintained, interference to be
minimized and traffic distribution to be controlled.
✓ Power control: in the area over 30 dB the equipment of the mobile user and the base
station controls power in 2 dB steps in order to minimize interference.

3.2.2 The Architecture of GSM System

The GSM system consists of the following three major interconnected subsystems that interact
between themselves and with the users through certain network interfaces.
A. The Radio Subsystem (MS, BSS)
B. The network and switching subsystem (NSS)
C. The operation subsystem (OSS)

A. The Radio Subsystem

The radio subsystem is made up of the mobile station (MS) and the base station subsystem
(BSS).

20
Fraol B. Feb, 2024
 Wireless & Mobile Communication Systems

Figure 3.1 a Simplified GSM Network Architecture

The Mobile Station (MS)

Mobile stations, Mobile equipment (ME) or as they are most widely known, cell or mobile phones
are the section of a GSM cellular network that the user sees and operates. It includes the mobile
terminal and the user interface that the subscriber needs in order to access PLMN services. In recent
years their size has fallen dramatically while the level of functionality has greatly increased.

There are a number of elements to the cell phone, although the two main elements are the main
hardware and the SIM. The hardware itself contains the main elements of the mobile phone
including the display, case, battery, and the electronics used to generate the signal, and process the
data received and to be transmitted. It also contains a number known as the International Mobile
Equipment Identity (IMEI). This is installed in the phone at manufacture and "cannot" be changed. It
is accessed by the network during registration to check whether the equipment has been reported as
stolen.

The SIM or Subscriber Identity Module contains the information that provides the identity of the
user to the network. It contains a variety of information including a number known as the
International Mobile Subscriber Identity (IMSI).

21
Fraol B. Feb, 2024
 Wireless & Mobile Communication Systems

Base Station Subsystem (BSS)

The Base Station Subsystem (BSS) section of the GSM network architecture that is fundamentally
associated with communicating with the mobiles on the network. It consists of two elements:

• Base Transceiver Station (BTS): The BTS used in a GSM network comprises the radio
transmitters, receivers, and their associated antennas that transmit and receive to directly
communicate with the mobiles. The BTS is the defining element for each cell. The BTS
communicates with the mobiles and the interface between the two is known as the Um
interface with its associated protocols.
• Base Station Controller (BSC): The BSC forms the next stage back into the GSM network.
It controls a group of BTSs, and is often co-located with one of the BTSs in its group. It
manages the radio resources and controls items such as handover within the group of BTSs,
allocates channels and the like. It communicates with the BTSs over what is termed the A-bis
interface.

B. Network Switching Subsystem (NSS)

The GSM network and switching subsystem contains a variety of different elements, and is often
termed the core network. It provides the main control and interfacing for the whole mobile network.
The major elements within the core network include:

• Mobile Switching Centre (MSC): The main element within the core network area of the
overall GSM network architecture is the Mobile Switching Centre (MSC). The MSC acts like a
normal switching node within a PSTN or ISDN, but also provides additional functionality to
enable the requirements of a mobile user to be supported. These include registration,
authentication, call location, inter-MSC handovers and call routing to a mobile subscriber. It
also provides an interface to the PSTN so that calls can be routed from the mobile network to a
phone connected to a landline. Interfaces to other MSCs are provided to enable calls to be
made to mobiles on different networks.
• Home Location Register (HLR): This database contains all the administrative information
about each subscriber along with their last known location. In this way, the GSM network is
able to route calls to the relevant base station for the MS. When a user switches on their phone,
the phone registers with the network and from this it is possible to determine which BTS it
communicates with so that incoming calls can be routed appropriately. Even when the phone is
not active (but switched on) it re-registers periodically to ensure that the network (HLR) is
aware of its latest position. There is one HLR per network, although it may be distributed
across various sub-centers for operational reasons.
• Visitor Location Register (VLR): This contains selected information from the HLR that
enables the selected services for the individual subscriber to be provided. The VLR can be
implemented as a separate entity, but it is commonly realized as an integral part of the MSC,
rather than a separate entity. In this way access is made faster and more convenient.
22
Fraol B. Feb, 2024
 Wireless & Mobile Communication Systems

• Equipment Identity Register (EIR): The EIR is the entity that decides whether a given
mobile equipment may be allowed onto the network. Each mobile equipment has a number
known as the International Mobile Equipment Identity. This number, as mentioned above, is
installed in the equipment and is checked by the network during registration. Dependent upon
the information held in the EIR, the mobile may be allocated one of three states - allowed onto
the network, barred access, or monitored in case its problems.
• Authentication Centre (AuC): The AuC is a protected database that contains the secret key
also contained in the user's SIM card. It is used for authentication and for ciphering on the
radio channel.
• Gateway Mobile Switching Centre (GMSC): The GMSC is the point to which a ME
terminating call is initially routed, without any knowledge of the MS's location. The GMSC is
thus in charge of obtaining the MSRN (Mobile Station Roaming Number) from the HLR based
on the MSISDN (Mobile Station ISDN number, the "directory number" of a MS) and routing
the call to the correct visited MSC. The "MSC" part of the term GMSC is misleading, since the
gateway operation does not require any linking to an MSC.
• SMS Gateway (SMS-G): The SMS-G or SMS gateway is the term that is used to collectively
describe the two Short Message Services Gateways defined in the GSM standards. The two
gateways handle messages directed in different directions. The SMS-GMSC (Short Message
Service Gateway Mobile Switching Centre) is for short messages being sent to an ME. The
SMS-IWMSC (Short Message Service Inter-Working Mobile Switching Centre) is used for
short messages originated with a mobile on that network. The SMS-GMSC role is similar to
that of the GMSC, whereas the SMS-IWMSC provides a fixed access point to the Short
Message Service Centre.

C. Operation and Support Subsystem (OSS)

The OSS or operation support subsystem is an element within the overall GSM network architecture
that is connected to components of the NSS and the BSC. It is used to control and monitor the
overall GSM network and it is also used to control the traffic load of the BSS. It must be noted that
as the number of BS increases with the scaling of the subscriber population some of the maintenance
tasks are transferred to the BTS, allowing savings in the cost of ownership of the system.

3.2.3 The GSM Channel Types

There are two types of GSM logical channels. These are the GSM traffic channel (TCH) and control
channel (CCH). Traffic channels carry digitally encoded user speech or user data and have identical
functions and formats on both the forward and reverse link. Control channels carry signaling and
synchronizing commands between the base station and the mobile station. Certain types of control
channels are defined for just the forward or reverse link. There are six different types of TCHs in
GSM and an even larger number of CCHs.

23
Fraol B. Feb, 2024
 Wireless & Mobile Communication Systems

3.2.3.1 GSM Traffic Channels

The GSM traffic channels may be either full-rate or half-rate and may carry either digitized speech
or user data. When transmitted as full-rate, user data is contained within one time slot per frame.
When transmitted as half-rate, user data is mapped onto the same time slot, but is sent in alternate
frames. That means two half-rate channel users would share the same time slot, but would
alternately transmit during every other frame. In GSM standard, TCH data may not be sent in TS 0
within a TDMA frame on certain Absolute Radio Frequency channel Numbers (ARFCNs) which
serves as the broadcast station for each cell (since this time slot is reserved for control channel bursts
in most every frame). Furthermore, frames of TCH data are broken up every thirteenth frame by
either slow associated control channel data or idle frames. Each group of twenty-six consecutive
TDMA frames is called a multiframe (speech multiframe). For every twenty-six frames, the
thirteenth and the twenty-sixth frames consists of Slow Associated Control Channel (SACCH) data
or the idle frame, respectively. The twenty-sixth frame contains idle bits for the case when full-rate
TCHs are used, and contains SACCH data when half-rate TCHs are used.

Full-Rate TCH
The following full-rate speech and data channels are supported:

• Full-rate speech channel (TCH/FS):- it carries user speech which is digitized at a raw
data rate of 13kbps.with GSM channel coding added to digitized speech, the full-rate
speech channel carries 22.8kbps.
• Full-rate data channel for 9600bps (TCH/F9.6):- the full-rate traffic data channel carries
raw user data which is sent at 9600bps. With additional forward error correction coding
applied by GSM standard, the 9600bps data is sent at 22.8kbps.
• Full-rate data channel for 4800bps (TCH/F4.8):- the full-rate traffic data channel carries
raw user data which is sent at 4800bps. With additional forward error correction coding
applied by GSM standard, the 4800bps data is sent at 22.8kbps.
• Full-rate data channel for 2400bps (TCH/F2.4):- it carries raw user data which is sent at
2400bps. With additional forward error correction coding applied by GSM standard, the
2400bps data is sent at 22.8kbps.

Half-Rate TCH
The following half-rate speech and data channels are supported:

• Half-rate speech channel (TCH/HS):- it has been designed to carry digitized speech
which is sampled at a rate half that of the full-rate channel. GSM anticipates the
availability of speech coders which can digitize speech at about 6.5kbps. With GSM
channel coding added to digitized speech, the half-rate speech will carry 11.4 kbps.

24
Fraol B. Feb, 2024
 Wireless & Mobile Communication Systems

• Half-rate data channel for 4800bps (TCH/H4.8):- the half-rate traffic data channel
carries raw user data which is sent at 4800bps. With additional forward error
correction coding applied by GSM standard, the 4800bps data is sent at 11.4kbps.
• Half-Rate data channel for 2400bps (TCH/H2.4):- this traffic data channel carries
raw user data which is sent at 2400bps. With additional forward error correction
coding applied by GSM standard, the 2400bps data is sent at 11.4kbps.

3.2.3.2 GSM Control Channel

There are three main control channels in GSM systems. These are the broadcast channel (BCH), the
common control channel (CCCH), and the dedicated control channel (DCCH). Each control channel
consists of several logical channels which are distributed in time to provide the necessary GSM
control functions.

Broadcast channels (BCH):- the broadcast channel operates on the forward link of a specific
ARFCN within each cell and transmits data only in the first time slot (TS 0) of certain GSM frames.
Unlike TCHs which are duplex, BCHs only use the forward link. BCH provides synchronization for
all mobiles within the cell and is occasionally monitored by mobiles in neighboring cells so that
receiver power and MAHO decisions may be made by out-of-cell users. Although BCH data is
transmitted in TS 0, the other seven timeslots in a GSM frame for that same ARFCN are available
for TCH data, DCCH data or are field with dummy bursts. Furthermore, all eight timeslots on all
other ARFCNs within the cell are available for TCH or DCCH data. The BCH is defined by three
separate channels which are given access to TS 0 during various frames of 51 frame sequence. There
are three types of BCH which will be discussed as follows.

(a) Broadcast control channel (BCCH):- the BCCH is a forward control channel that is used to
broadcast information such as cell and network identity, and operating characteristics of cell
(current control channel structure, channel availability and congestion). It also broadcasts a list
of channels that are currently in use within the cell. Frame 2 through 5 in a control multiframe
(4 out of every 51 frames) contains BCCH data. It should be noted from figure 3.2 that TS 0
contains BCCH data during specific frames and contains other BCH channels (FCCH and
SCH), common control channels (CCCH) or an idle frame (sent every 51st frame) during other
specific frames.
(b) Frequency correction channel (FCCH):- the FCCH is a special data burst which occupies TS 0
for the every first GSM frame (frame 0) and is repeated every ten frames within a control
channel multiframe. FCCH allows each subscriber unit to synchronize its internal frequency
standard (local oscillator) to the exact frequency of base station.
(c) Synchronization Channel (SCH):- SCH is broadcast in TS 0 of the frame immediately
following the FCCH frame and is used to identify the serving base station while allowing each
mobile to frame synchronize with the base station. The frame number (FN), which ranges from
0 to 2,715,647, is sent with the base station identity code (BSIC) during SCH burst. The BSIC is
uniquely assigned to each BST in a GSM system. Since a mobile may be as far as 30km away
from a serving base station, it is often necessary to adjust the timing of a particular mobile user
25
Fraol B. Feb, 2024
 Wireless & Mobile Communication Systems

such that the received signal at the base station is synchronized with the base station clock. The
BS issues coarse timing advancement commands to the MS over the SCH, as well. SCH is
transmitted once every ten frames within the control channel multiframe, as shown in figure 3.2.

Common Control Channels (CCCH):- the CCCH occupies TS 0 of every GSM frame that is not
used by the BCH or the idle frame. It consists of three different channels namely, the paging channel
(PCH), the random access channel (RACH), and the grant access channel (GACH). Out of these,
PCH and GACH are a forward link channels whereas RACH is a reverse link channel. As shown in
figure 3.2, CCCHs are the most commonly used control channels and are used to page specific
subscribers, assign signaling channels to specific users, and receive mobile requests for service.

a. Paging channel (PCH):- it provides paging signals from the base stations to all mobiles in the
cell and notifies a specific mobile of an incoming call which originates from the PSTN. It also
be used to provide cell broadcast ASCII text messages to all subscribers as part of SMS feature
of GSM.
b. Random Access Channel (RACH):- the RACH is used by a subscriber unit to acknowledge a
page from the PCH and is also used by mobiles to originate a call. All mobiles must request or
respond to a PCH alert within TS 0 of a GSM frame. At BTS, every frame (even the idle
frame) will accept RACH transmission from mobile during TS 0. In establishing service, the
GSM base station must respond to the RACH transmission by allocating a channel and
assigning a stand-alone dedicated control channel (SDCCH) for signaling during a call. This
connection is confirmed by the base station over the AGCH.
c. Access Grant Channel (AGCH):- it is used by the BS to provide forward link communication
to the mobile and carries data which instructs the mobile to operate in a particular physical
channel (time slot and ARFCN) with a particular dedicated control channel. The AGCH is the
final CCCH message sent by the base station before a subscriber is moved off the control
channel. It is used also by BS to respond to a RACH sent by a MS in a previous CCCH frame.

Dedicated control channels (DCCH):- DCCHs are bidirectional and have the same format and
function on both links (forward and reverse). Like TCHs, DCCHs may exist in any TS and on any
ARFCN except TS 0 of the BCH ARFCN. There are three types of DCCHs in GSM.

a. Stand-alone Dedicated Control Channels (SDCCH):- are used for providing signaling services
required by the users. It carries signaling data following the connection of the mobile with the
BS and just before a TCH assignment is issued by the BS. The SDCCH ensures that the MS and
the BS remains connected while the base station and MSC verify the subscriber unit and
allocate resources for the mobile. SDCCH is an intermediate and temporary channel which
accepts a newly completed call from the BCH and holds the traffic while waiting for the BS to
allocate a TCH channel. Furthermore, SDCCH is used to send authentication and alert messages
(but not speech) as the mobile synchronizes itself with the frame structure and waits for a TCH.
b. Slow Associated Control Channel (SACCH):- it is used for supervisory data transmissions
between the MS and the BS during a call. The SACCH is always associated with a TCH or a
SDCCH and maps onto the same physical channel. Thus, each ARFCN systematically carries
26
Fraol B. Feb, 2024
 Wireless & Mobile Communication Systems

SACCH data for all of its current users. On the forward link, SACCH is used to send slow but
regularly changing control information to the mobile such as transmit power level instructions
and specific timing advance instructions for each user. The reverse SACCH carries information
about the received signal strength and quality of the TCH as well as BCH measurement results
from neighboring cells. The SACCH is transmitted during the thirteenth frame (and the twenty
sixth frame when half-rate traffic is used) of every speech/DCCH multiframe.
c. Fast Associated Control Channel (FACCH):- Like SACCH, FACCH is used for supervisory
data transmissions between the MS and the BS during a call. It carries urgent messages and
contains especially the same type of information as the SDCCH. A FACCH is assigned
whenever a SDCCH has not been dedicated for a particular user and there is an urgent message
(such as handoff request). It gains access to a time slot by “stealing” frames from the traffic
channel to which it is assigned. This is done by setting two special bits, called stealing bits, in a
TCH forward channel burst. If the stealing bits are set, the time slot is known to contain
FACCH data, not a TCH, for that frame.

Control multiframe = 51 TDMA Frames (235ms)

0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 20 21 22 39 40 41 42 49 50
F S B B B B C C C C F S C C C … F S C … C F S C … C I

F: FCCH burst (BCH)

S: SCH burst (BCH)
B: BCCH burst (BCH)
C: PCH/AGCH burst (CCCH)
I: Idle
a)

Control multiframe = 51 TDMA Frames (235ms)

0 1 2 3 4 5 6 …………………… 46 47 48 49 50
R R R R R R R R R R R R
R: reverse RACH burst (CCCH)

b)

Figure 3.2 a) The control channel multiframe (forward link for TS 0)

b) The control channel multiframe (reverse link for TS 0)
3.2.4 The GSM frame structure
As shown in figure 3.3, there are eight time slots per TDMA frame, and the frame period is 4.615ms.
A frame contains 8 x 156.25 = 1250bits, although some bit periods are not used. The frame rate is
270.833kbps/1250bits/frame, or 216.66 frames per second. The thirteenth or twenty sixth frames are
not used for traffic, but for control purpose. Each of normal frames is grouped into larger structures
called multiframes which in turn are grouped into superframes and hyperframes. One multiframe
contains 26 TDMA frames, and one superframe contains 51 multiframes, or 1326 TDMA frames. A
hyperframe contains 2048 superframes or 2,715,648 TDMA frames. A complete hyperframe is sent
27
Fraol B. Feb, 2024
 Wireless & Mobile Communication Systems

about every 3 hours, 28 minutes and 54 seconds and is important to GSM since the inscription
algorithms rely on the particular frame number, and sufficient security can only be obtained by using
a larger number of frames as provided by the hyperframe.

Figure 3.3 a typical GSM frame structure

3.2.5 GSM signal processing

Figure 3.4 illustrates all of the GSM signal operations from transmitter to receiver.

Speech Speech

Digitizing and Source

Source Coding Decoding

Channel Channel
Coding Decoding

Interleaving De-interleaving

Burst Formatting Burst Formatting

Ciphering De-ciphering
Radio
Channel
Modulation Demodulation

28
Fraol B. Feb, 2024
 Wireless & Mobile Communication Systems

Speech coder- the GSM speech coder is based on the residually excited linear predictive coder
(RELP), which is enhanced by including a long-term predictor (LTP). The coder provides 256
bits for each 20ms block of speech, which yields a bit rate of 13kbps. The GSM speech coder
takes advantages of the fact that in a normal conversation each person speaks less than 40% of
the time. By incorporating a voice activity detector (VAD) in the speech coder, GSM systems
operate in a discontinuous transmission (DTX) which provides a longer subscriber battery life
and reduces instantaneous radio interference since the GSM transmitter is not active during
silent periods.
Channel Coding- the output bits of speech coder are ordered into groups for error protection
based upon their significance in contributing to speech quality. Out of the total 256 bits in a
frame, the most important 50bits, called type Ia bits, have 3 parity check (CRC) bits added to
them. This facilitates the detection of non-correctable errors at the receiver. The next 132 bits
along with the first 53 (50 type Ia bits + parity bits) are reordered and appended by 4 trailing
zero bits, thus providing a data block of 189 bits. This block is then encoded for error protection
using a rate ½ convolutional encoder with constant length k=5, thus providing a sequence of 378
bits. The least important 78 bits do not have any error protection and are contained to the
existing sequence to form a block of 456 bits in a 20ms frame. The error protection scheme is
illustrated as follows in figure 3.5.

Type Ia Type Ib Type II

Parity check 50 bits 132 bits 78 bits

50 3 132 4

Convolution code rate ½ constraint length 5

378 78
456 bits per 20 ms speech frame

Figure 3.5 Error protection for speech signals in GSM

Interleaving- in order to minimize the effect of sudden fades on the received data, the total of
456 encoded bits within each 20 ms speech frame or control message frame are broken into
eight 57 bit sub-blocks. These eight sub-blocks which make up a single speech frame are spread
over eight consecutive TCH time slots. If a burst is lost due to interference or fading, channel
coding ensures that enough bits will still be received correctly to allow the error correction to
work.
Ciphering- it modifies the contents of the eight interleaved blocks through the use of inscription
techniques known only to the particular mobile station and base transceiver station. Security is
further enhanced by the fact that the encryption algorithm is changed from call to call. A3 and

29
Fraol B. Feb, 2024
 Wireless & Mobile Communication Systems

A5 ciphering algorithms are used in GSM to prevent unauthorized network access and privacy
for the radio transmissions respectively.
Burst Formatting- adds binary data to the ciphered blocks in order to help synchronization and
equalization of the received signal.
Modulation- the modulation scheme used by GSM is 0.3 GMSK where 0.3 describes the 3 dB
bandwidth of the Gaussian pulse shaping filter with relation to the bit rate. GMSK is a special
type of digital FM modulation.
Demodulation- the appropriate TS is demodulated with the aid of synchronization data provided
by the burst formatting. After demodulation, the binary information is deciphered, de-
interleaved, channel decoded and speech decoded.

3.3 IS-95/CDMA System/

CDMA offers some advantages over TDMA and FDMA. A U.S digital cellular system based on
CDMA which promises increased capacity has been standardized as interim standard 95 (IS-95) by
the U.S Telecommunications Industry Association (TIA) in 1993. The IS-95 system is designed to
be compatible with the existing U.S analog cellular system (AMPS) frequency band, hence mobiles
and base stations can economically produced for dual mode operation. Dual mode CDMA/AMPS
were made available by Qualcomm in 1994.

IS-95 allows each user within a cell to use the same radio channel and users in adjacent cells also use
the same radio channel, since this is a direct sequence spread spectrum CDMA system. The intention
of CDMA was to completely eliminate the need for frequency planning within a market. To facilitate
graceful transmission from AMPS to CDMA, each IS-95 channel occupies 1.25 MHz of spectrum on
each one-way link, or 10% of available cellular spectrum for U.S cellular provider (U.S cellular
system is allocated 25 MHz where each service provider receives half the spectrum or 12.5 MHz). In
practice, AMPS carriers must provide a 270 kHz guard band (typically 9 AMPS channels) on each
side of the spectrum dedicated for IS-95.

Unlike other cellular standards, the user data rate (but not the channel chip rate) changes in real-time,
depending on the voice activity and requirements in the network. Also IS-95 uses a different
modulation and spreading technique for the forward and reverse links. On the forward link, the BS
simultaneously transmits the user data for all mobiles in the cell by using a different spreading
sequence for each mobile. A pilot code is also transmitted simultaneously and at a higher power
level, thereby allowing all mobiles to use coherent carrier detection while estimating the channel
conditions. On the reverse link, all mobiles respond in an asynchronous fashion and have ideally a
constant signal level due to power control applied by the BS.

The speech coder used in IS-95 system is the Qualcomm 9600 bps code excited linear predictive
(QCELP) coder. The original implementation of this vocoder detects voice activity and reduces the
data rate to 1200 bps during silent periods. Intermediate user data rates of 2400, 4800 and 9600 bps
are also used for special purposes. In 1995, a 13.4 kbps of speech data was introduced by
Qualcomm.
30
Fraol B. Feb, 2024
 Wireless & Mobile Communication Systems

3.3.1 Frequency and Channel Specifications

In IS-95 CDMA system, the forward link uses the same frequency spectrum as AMPS (824-849
MHz) and the reverse link uses 869-894 MHz. A forward and reverse channel pair is separated by 45
MHz. Many users share a common channel for transmission and the maximum user data rate is 9.6
kbps. On the forward link, the user data stream is encoded using a rate ½ convolutional code,
interleaved, and spread by one of 64 orthogonal spreading sequences (Walsh functions). Each
mobile in a given cell is assigned a different spreading sequence, providing perfect separation among
the signals from different users, at least for the case where multipath does not exist. To reduce
interference between mobiles that uses the same spreading sequence in different cells, and to provide
the desired wideband spectral characteristics (not all of the Walsh function yield a wideband power
spectrum), all signals in a particular cell are scrambled using a pseudorandom sequence of length 215
chips.

Orthogonality among all forward channel users within a cell is preserved because their signals are
scrambled synchronously. A pilot channel (code) is provided on the forward link so that each
subscriber within the cell can determine and react to the channel characteristics while employing
coherent detection.

On the reverse link, a different spreading strategy is used since each received signal arrives at the BS
via a different propagation path. The reverse channel user data stream is first convolutionally
encoded with a rate 1/3 code. After interleaving, each block of six encoded symbols is mapped to
one of the 64 orthogonal Walsh functions, providing sixty-four-ary orthogonal signaling. At both BS
and the subscriber, RAKE receivers are used to resolve and combine multipath components, thereby
reducing the degree of fading.

3.3.2 IS-95 CDMA Forward Channel

The forward CDMA channel consists of a pilot channel, a synchronization channel, up to seven
paging channels, and up to sixty-three forward traffic channels. The pilot chanmnel allows a mobile
station to acquire timing for the forward CDMA channel, provides a phase reference for coherent
demodulation, and provides each mobile with a means for signal strength comparisons between BSs
for determining when to handoff. The synchronization channel broadcasts synchronization messages
to the MSs and operates at 1200 bps. The paging channel is used to send control information and
paging messages from BS to the mobiles and operates at 9600, 4800, 2400, or 1200 bps.

3.3.3 IS-95 CDMA Reverse Channel

User data on the reverse channel are convolutionally encoded, block interleaved, modulated by a
64-ary orthogonal modulation, and spread prior to transmission. The speech or user data rate in the
reverse channel may be sent at 9600, 4800, 2400 or 1200 bps. The reverse channels are made up of
access channels (AC) and reverse traffic channels (RTC). Both share the same frequency assignment
and traffic/access channel is identified by a distinct user long code. The access channel is used by the
31
Fraol B. Feb, 2024
 Wireless & Mobile Communication Systems

mobile to initiate communication with the BS and to respond to paging channel messages. The
access channel is a random access channel with each channel user uniquely identified by their long
codes. The reverse CDMA channel may contain a maximum of 32 ACs per supported paging
channel. RTC operates on available data rate while the AC works at a fixed data rate of 4800 bps.

3.3.4 Personal Digital Cellular (PDC)

It was formerly called Japanese Digital Cellular (JDC) and also known as Pacific Digital Cellular
(PDC). It was developed in 1991 to provide for need capacity in congested cellular bands in Japan.
PDC is somewhat similar to the IS-54 standard, but uses 4-ary modulation for voice and control
channels, making it more like IS-136 in North America. Frequency division duplexing and TDMA
are used to provide three time slots for three users in a 20 ms frame (6.67 ms per user slot) on a 25
kHz radio channel.

PDC is allocated 80 MHz in Japan. The low PDC band uses 130 MHz forward/reverse channel
splits. The forward band uses 940-956 MHZ and the reverse band uses 810 MHz to 826 MHz. the
high PDC band uses 48 MHz channel splits and operates in 1477 MHz to 1501 MHz for the forward
link and 1429 MHz to 1453 MHz for the reverse link. PDC uses mobile assisted handoff (MAHO)
and is able to support 4-cell reuse.

3.4 2.5 Generation System: GPRS, EDGE

2.4.1 General Packet Radio Service (GPRS)
GPRS was evolved in the frame work of the evolution from GSM towards 3G or UMTS mobile
communication systems. The driving force for this development is the predicted user demand for the
mobile data services: mobile multimedia application and mobile internet access. GPRS has been
standardized by European telecommunications standard institute (ETSI). There are two
enhancements to GSM for data: High speed circuit switched data (HSCD) and general packet radio
service (GPRS). Both have the capacity to use new coding schemes and to make multi-slot
allocation. GPRS represents the first implementation of packet switching within GSM which is
essentially a circuit switched technology. Packet switching means GPRS resources are used only
when users are actually sending or receiving data. That means rather than dedicating a radio channel
to a mobile data user for a fixed period of time, the available radio resources can be used shared
between several users. Through multiplexing of several logical connections to one or more GSM
physical channels, GPRS reaches a flexible use of channel capacity to applications with variable bit
rates. It integrates a packet based air interface in the existing circuit switched GSM network. The
GSM infrastructure had not replaced and only a couple of new network elements have been added.

GPRS Features

• Radio resources are allocated for only one or few packets at a time, so GPRS enables:
- Many users to share radio resources and allow efficient transport of packets
- Fast setup/access time

32
Fraol B. Feb, 2024
 Wireless & Mobile Communication Systems

- Connectivity to external packet data networks

- Volume-based (data in mega or kilobyte) charging in contrast to circuit
switched data transfer where billing is per second or per connection time.
• GPRS also carries SMS in data channels rather than signaling channels as in GSM.
• It is ideal for bursty type data application email, internet access or wireless access protocol
(WAP) based applications.
• It brings IP capability to GSM network for the first time and enables connection to a wide
range of public and private data networks using industry standard protocols such as TCP/IP
and X.25

GPRS System Architecture

Figure 3.6 GPRS interfaces and system architecture.

▪ Requires addition of a new class of nodes called GPRS support nodes (GSNs). These are:
- Serving GPRS Support Node (SGSN)
- Gateway GPRS Support Node (GGSN)
▪ BSC requires a Packet Control Unit (PCU) and various other elements of GSM network
require software upgrades
▪ All GSNs are connected via an IP based backbone
▪ Protocol data units (PDUs) are encapsulated and tunneled between GSNs
▪ SGSN and GGSN encapsulate (decapsulate respectively) the packets using special protocol
called the GPRS Tunneling Protocol (GTP) that operates on top of standard transport control
protocol (TCP) or IP protocols
▪ In GPRS the proper data traffic is handled by SGSN. The MSC serves only for signaling.

GGSN
✓ Serves as the interface to external IP networks which see the GGSN as an IP router serving
all IP addresses of the mobile stations.

33
Fraol B. Feb, 2024
 Wireless & Mobile Communication Systems

✓ Stores current SGSN address and profile of the user in its location register.
✓ It tunnels protocol data packets to and from SGSN currently serving the MS.
✓ It also performs authentication and charging.
✓ Can also include firewall and packet-filtering mechanism.

SGSN
▪ Routes incoming and outgoing packets addressed to and from any GPRS subscriber located
within the geographical area served by the SGSN.
▪ Location register of the SGSN stores information (e.g. current cell and VLR) and user
profiles (e.g. IMSI, addresses) and all GPRS users registered with this SGSN.

BSC

• Must get a packet control unit (PCU) to:

- Set up, supervise and disconnect packet switched calls
- Support cell change, radio resource configuration and channel
assignment.

HLR

• Shared data with GSM

• Enhanced with GPRS subscriber data and routing information
• For all users registered with the network, HLR keeps user profile, current SGSN and Packet
Data Protocol (PDP) address information.
• Exchanges information with SGSN, e.g. informs HLR the current location of the MS.
• When MS registers with a new SGSN, the HLR sends the user profile to the new SGSN.

VLR
➢ Is responsible for a group of location areas.
➢ It stores data of only those users in its area of responsibility
➢ MSC/VLR can be enhanced with functions and register entities that allow efficient
coordination between GPRS and GSM services;
- Combined location updates
- Combined attachment procedures

GPRS MS
➢ Transceiver consists of two sections
➢ RF front end:
- Converts the GSM /TDMA signal into baseband signal in I/Q form
➢ GPRS signaling and data codec:
- Encodes/decodes signaling messages for GSM/TDMA BS
- Transcodes data into packets confirming with GPRS specifications
34
Fraol B. Feb, 2024
 Wireless & Mobile Communication Systems

3.4.2 Enhanced Data Rate for GSM Evolution (EDGE)

EDGE is a digital mobile phone technology that allows it to increase data transfer rate and improves
data transmission reliability. It is a further development of GSM data services (HSCSD and GPRS).
The circuit oriented part is Enhanced-CSD (ECSD) and the packet oriented part is Enhanced-GPRS
(EGPRS). Although technically a 3G network technology, it is generally classified as the unofficial
standard 2.75G, due to its slower network speed. EDGE has been introduced into GSM networks
around the world since 2003, initially in North America. It can be used for any packet switched data
application such as internet connection. High speed data applications such as video service and other
multimedia benefit from EGPRS increased data capacity.

EDGE/EGPRS is a superset to GPRS and can function on any network with GPRS deployed on it,
provided the carrier implements the necessary upgrade. Although EDGE requires no hardware or
software changes to be made in GSM core networks, base stations must be modified. That means
EDGE compatible transceivers units must be installed and the base station subsystem needs to be
upgraded to support EDGE. New mobile terminal hardware and software are also required to
encode/decode the new modulation and coding schemes and carry the higher user data rates to
implement new services. In addition to Gaussian minimum-Shift keying (GMSK), EDGE uses 8
phase shift keying (8PSK). EDGE, like GPRS, uses a rate adaptation algorithm that adapts the
modulation and the coding schemes (MCS) according to the quality of the radio channel. It
introduces a new technology that is not found in GPRS, incremental redundancy, which instead of
retransmitting distributed packets, sends more redundancy information to be combined in the
receiver. Thus increases probability of correct decoding. EDGE can carry data speeds up to
236.8kbps for 4 timeslots (theoretical maximum is 473.6 kbps for 8 timeslots) in packet mode.

3.5 3G System
3.5.1 CDMA2000
CDMA2000 is a hybrid 2.5G/3G protocol of mobile telecommunications standard that uses CDMA.
CDMA is a mobile digital radio technology where channels are defined with codes (PN sequences)
that permits many simultaneously transmitters on the same frequency channel. Since more phones
can be served by fewer cell sites, CDMA based standards have a significant economic advantage
over TDMA/FDMA based standards. CDMA2000 is considered as a 2.5G protocol in 1x Radio
Transmission Technology (RTT) and a 3G protocol in Evolution Data Optimized (EVDO). It is
compatible with IS-95 (cdmaone).

CDMA standards are CDMA2000 1xRTT, CDMA2000 EVDO, and CDMA2000 Evolution Data
and Voice (EVDV). They are approved radio interfaces for the ITU’s IMT-2000 standard and direct
successor to 2G CDMA, IS-95 (cdmaone). CDMA2000 is a registered trade mark of the TIA-USA
in the United States. It is an incompatible competitor of the other major 3G standard UMTS. It is
defined to operate at 450 MHz, 700 MHz, 800 MHz, 900 MHz, 1700 MHz, 1800 MHz, 1900 MHz,
and 2100 MHz.

35
Fraol B. Feb, 2024
 Wireless & Mobile Communication Systems

CDMA2000 1xRTT:

• Is the core CDMA2000 wireless air interface standard and also called IS 2000.
• 1xRTT indicates the same RF bandwidth as IS-95; a duplex pair of 1.25 MHz radio channels.
• 1xRTT almost doubles the capacity of IS-95 by adding 64 more traffic channels to the
forward link, orthogonal to the original set of 64.
• Most 1xRTT deployments are limited to a peak of 144kbps.
• It also made changes to the data link layer for the greater use of data services, including
medium and link access control protocols and QoS.

EVDO Rev A:

• Fast packet establishment on both forward and reverse links

• Downlink rate is from 2.45 Mbit/s to 3.1 Mbit/s
• Uplink data rate is from 153 kbps to a maximum uplink burst rate of 1.8 Mbit/s.

EVDO Rev B:

• Is a multi-carrier evolution of the Rev A specification

• Higher rates per carrier (up to 4.9 Mbit/s on the downlink per carrier)
• Enables new services such as high definition video streaming.
• Efficient support for services that have asymmetric download and upload requirements such
as file transfers, web browsing, and broadband multimedia content delivery.

CDMA2000 EVDV:

• Supports downlink data rates up to 3.1 Mbit/s and uplink data rates up to 1.8 Mbit/s
• Can also support concurrent operation of legacy 1x voice users, 1x data users and high speed
EVDO data users within the same radio channels.

2.5.2 Universal Mobile Telecommunications System (UMTS)

UMTS is one of the 3G cell phone technologies. It uses W-CDMA as the underlying air interface. It
is standardized by the 3GPP, and is the European answer to the ITU IMT-2000 requirements for 3G
cellular radio systems. Using W-CDMA it supports up to 14 Mbit/s data transfer rate in theory (with
high speed downlink packet access - HSDPA). At the moment users in deployed network can expect
a transfer rate of up to 384 kbps for R99 handsets and 3.6 Mbit/s for HSDPA handsets in the
downlink connection. Since 2006, UMTS networks in many countries have been or are in the
process of being upgraded with HSDPA, sometimes known as 3.5G.

Work is also progressing on improving the uplink transfer speed with the high speed uplink packet
access (HSUPA). The 3GPP long term evolution project plans to move UMTS to 4G speeds of 100
Mbit/s downlink and 50 Mbit/s uplink using a next generation air interface technology based upon
OFDM – high speed OFDM packet access (HSOPA) technology. UMTS supports mobile video
conferencing, downloading of music and video content, as well as live TV. UMTS over W-CDMA
36
Fraol B. Feb, 2024
 Wireless & Mobile Communication Systems

uses a pair of 5 MHz channels. UMTS frequency bands are 1855-2025 MHz for the uplink and
2110-2200 MHz for the downlink. In the US, 1710-1755 MHz and 2110-2155 MHz will be used
instead, as 1900 MHz band was already utilized.

For the existing GSM operators, it is a simple but costly migration path to UMTS. Much of the
infrastructure is shared with GSM, but the cost of obtaining new spectrum license and overlying
UMTS at existing towers can be prohibitively expensive. A major difference of UMTS compared to
GSM is the air interface forming generic radio access network (GeRAN). It can be connected to
various backbone networks such as the internet, ISDN, GSM, or to a UMTS network. At the air
interface level, UMTS itself is incompatible with GSM. UMTS/GSM dual-mode phones, hence they
can also make a receive calls on regular GSM networks.

HSDPA
It is a 3G mobile telephony communications protocol in the high speed packet access (HSPA)
family, which allows networks based on UMTS to have higher data transfer speeds and capacity.
Current HSDPA deployments support downlink speeds of 1.8, 3.6, 7.2, and 14.4 Mbit/s. in the near
future, the networks are to be upgraded to Evolved HSPA, which provides speeds of 42 Mbit/s
downlink in its first release. It delivers the improved downlink performance using:

• Adaptive modulation and coding (AMC)

• Fast packet scheduling at the BS
• Fast retransmissions from base station known as hybrid automatic repeat – request (HARQ)

HSUPA
It is a 3G mobile telephony protocol in the HSPA family with uplink speeds up to 5.76 Mbit/s. the
specification for HSUPA are included in UMTS release 6 standard published by 3GPP. HSUPA is
expected to use an uplink enhanced dedicated channel (E-DCH) on which it will employ link
adaptation methods similar to those employed by HSDPA, namely:

• Shorter transmission time interval enabling faster link adaptation

• Hybrid ARQ (HARQ) with incremental redundancy making retransmissions more
effective.

37
Fraol B. Feb, 2024