Generations of Cellular Network

1. Generations of Cellular

Network
Mobile Networks, EC-425

| =o
A

2. Cellular System Overview 29

Operation of Cellular Systems

Base
transceiver
station

Public Mobile
telecommunications telecommun-

switching ications Base
network switching transceiver
office Station

Base
transceiver
station

3. Cellular System Overview a

Operation of Cellular Systems
Base Station (BS) - includes an antenna, a controller, and a
number of receivers

— The controller is used to handle the call process between the

mobile unit and the rest of the network

*Mobile telecommunications switching office (MTSO) —
connects calls between mobile units
*Two types of channels available between mobile unit and BS

— Control channels — used to exchange information having to do
with setting up and maintaining calls

— Traffic channels — carry voice or data connection between users

4. Steps in an MTSO
Controlled Call between / ,
Mobile Users 7

5. Cellular System Overview a

Steps in an MTSO Controlled Call between Mobile
Users

*Mobile unit initialization
— mobile unit turned on
* scans and selects the strongest setup control channel used for this system

— Cells with different frequency bands repetitively broadcast on
different setup channels (strongest signal and then BS antenna
selected)

— Then a handshake takes place between the mobile unit and the
MTSO controlling this cell, through the BS in this cell to identify
the user and register its location

— As long as the mobile unit is on, this scanning procedure is
repeated periodically to.account for the motion of the unit.

6. Cellular System Overview a

Steps in an MTSO Controlled Call between Mobile
Users

*Mobile-originated call

— A call is originated by sending the number of the called unit on the
preselected setup channel

— checks that the setup channel is idle by examining information in
the forward (from the BS) channel.

— When an idle is detected, the mobile unit may transmit on the
corresponding reverse (to BS) channel.

— The BS sends the request to the MTSO.

7. Cellular System Overview a

Steps in an MTSO Controlled Call between Mobile
Users
*Paging
— The MTSO sends a paging message to certain BSs depending on
the called mobile unit number.
— Each BS transmits the paging signal on its own assigned setup
channel.
Call accepted

— The called mobile unit recognizes its number on the setup channel
being monitored and responds to that BS, which sends the
response to the MTSO.

8. ia

Steps in an MTSO Controlled Call between Mobile
Users

"Ongoing call
— the two mobile units exchange voice or data signals, going through
their respective BSs and the MTSO
*Handoff

— the traffic channel has to change to one assigned to the BS in the
new cell

9. ia

* The second-generation (2G) mobile cellular systems use
digital radio transmission for traffic

2G o Global System for Mobile (GSM)
A Digital- AMPS (D-AMPS)
© Code Division Multiple Access

| | | | (CDMA)

Y Y Y * © Personal Digital Cellular (PDC)
GSM D-AMPS (IS-136) CDMA (IS-95) PDC

o

10. Second-Generation Zu

Key differences between 1* and 2" Generation
Digital traffic channels
— Support digital data; voice traffic is first encoded in
digital form before transmitting

+ But the user traffic (data or digitized voice) must be converted
to an analog signal for transmission between the mobile unit
and the base station (air interface is analog)

*Encryption

— it is a relatively simple matter to encrypt all of the traffic
to prevent eavesdropping because all of the user traffic,
as well as control traffic, is digitized.

11. ia

* Error detection and correction
— Very clear voice reception
* Channel access

— each channel is dynamically shared by a number of users using
TDMA or CDMA

12. Global System for Mobile "9
Communications (GSM) a
* Developed to provide a common second-generation
technology for Europe
— the same subscriber units could be used throughout the continent
* The most popular standard, worldwide, for new
implementations +

* GSM first appeared
in 1990 in Europe

MSC PSTN

i
|
„|!
|
|
I

{

|

1

I

| ss} | +
M tr + A interface

= Abis Interface (standardized)
dé. | (standardized)
+
GSM Radio Air Interface
(standardized)

13. AuC Authentication center

EIR Equipment identity register

HLR Home location register

ME. Mobile equipment

PSTN Public switched telephone network
SIM. Subscriber identity module

VLR Visitor location register

Mobile Station (MS)
+A MS communicates across
the Urn interface (air
interface) with BTS
*Mobile Equipment
includes:
* radio transceiver
* digital signal
processors
* subscriber identity
module (SIM)

14. GSM Network Architecture y 3

SIM is a portable device in the form of a smart card or

plug-in module that stores

+ the subscriber's identification number,

* the networks the subscriber is authorized to use,

* encryption keys

* other information specific to the subscriber

International Mobile Subscriber Identity (IMSI)

— The IMSI is how the subscriber is identified to the network.

— Uniquely identifies the subscriber within the GSM global
network.

— The IMSI is burned into the SIM card when the subscriber
registers with PLMN service provider.

15. GSM Network Architecture y 3

* The IMSI is composed of three parts:

* Mobile Country Code (MCC) - This number identifies which country the
subscriber's network is in. It has 3 digits.

Mobile Network Code (MNC) - This number identifies the home GSM PLMN of
the subscriber (Cingular, T-Mobile, etc.). It has 2 or 3 digits. Some networks may
have more than one MNC allocated to it.

Mobile Subscriber Identification Number (MSIN) - This number uniquely
identifies a user within the home GSM network.

* International Mobile Equipment Identity (IMEI)

— The IMEI uniquely identifies the Mobile Equipment itself. It is
essentially a serial number that is burned into the phone by the
manufacturer. The IMEI is composed of three parts:

16. GSM Network Architecture u
Type Allocation Code (TAC), 8 digits - This number uniquely
identifies the model of a wireless device. It is composed of 8 digits.

Serial Number (SNR), 6 digits - This number is a manufacturer
defined serial number for the model of wireless device.

Spare (SP), 1 digit This number is a check digit known as a Luhn
Check Digit. It is omitted during transmission within the GSM
network.

On many devices the IMEI number can be retrieved by entering
*#06#

17. GSM Network Architecture ¿y #

Abis

Base Station Subsystem

*BSS consists of:
— base station controller (BSC) - ss
— base transceiver stations (BTS) a Ea station E

*BTS

— defines a single cell, it includes:

* radio antenna

* radio transceiver (The GSM Recommendations allow for one BTS to host
up to 16 TRXs. In the field, the majority of the BTSs host between one and
four TRXs.)

* alink toa BSC.
— AGSM cell can have a radius of between 100 m and 35 km,
depending on the environment.

18. GSM Network Architecture y 3

* BSC

— from a technical perspective, a small digital exchange with some
mobile-specific extensions

— The BSC was defined with the intention of removing most of the
radio-related load from the MSC

— may be collocated with a BTS or may control multiple BTS units
and hence multiple cells

— The BSC reserves:

* radio frequencies

* manages the handoff of a mobile unit from one cell to another within the
BSS

* controls paging.

19. GSM Network Architecture ¿y #

Network Subsystem (NSS)

*Handles Switching of calls between external
networks and the BSCs in the radio subsystem

* Responsible for managing and providing

external access to several customer databases. Ed
The central element of the NSS is the

mobile switching centre (MSC). mm
“MSC

—It is supported by four databases that it controls:
* Home location register (HLR) database
* Visitor location register (VLR) database
+ Authentication centre database (AuC)
+ Equipment identity register database (EIR)

20. GSM Network Architecture ¿y #

* Home location register (HLR) database:

— The HLR stores information, both permanent and temporary, about each of the
subscribers that "belongs" to it (i.e., for which the subscriber has its telephone
number associated with the switching centre).

* Visitor location register (VLR) database:
— One important, temporary piece of information is the location of the subscriber.

— Temporary stores IMSI and customer information for subscriber (subscriber
information) who is visiting the coverage area of particular MSC.

— VLR is linked between several adjoining MSCs in particular geographic region

— Fora call coming to the subscriber, the system uses the telephone number
associated with the subscriber to identify the home switching center of the
subscriber. This switching center can find in its HLR the switching center in
which the subscriber is currently physically located.

— Fora call coming from the subscriber, the VLR is used to initiate the call. Even
if the subscriber is in the area covered by its home switching center, it is also
represented in the switching center's VLR, for consistency.

21. ia

— keeps track of the type of equipment that exists at the mobile station

° Authentication center database (AuC):
= used for authentication activities, holds encryption keys

* Equipment identity register database (EIR)

— Italso plays a role in security (e.g., blocking calls from stolen mobile stations
and preventing use of the network by stations that have not been approved).

22. GSM Network Architecture $

Radio Link Aspects

GSM450 |EGSM450 |GSM850 |GSM900 |EGSM900|GSM1800|GSM1900

Uplink
Freq. 450 to 458 |478 to 486 |824to 890 to 880 to 1710to |1850to
Range MHz MHz 849 MHz |915 MHz |915 MHz |1785 MHz|1910 MHz
Downlink
Freq. 460 to 468 |488 to 496 |869 to 935 to 925 to 1805to |1930to
Range MHz MHz 894 MHz [960 MHz |960 MHz |1880 MHz|1990 MHz
Oto 124

128 to &975to |512t0 512to

ARFCN |259to 293 [306 to 340 |251 1to124 |1023 885 810

Offset |10 MHz 10MHz |45MHz_|45 MHz |45MHz |95 MHz [80 MHz

23. Radio Link Aspects

Downlink - 935.20 MHz

Uplink— 890.20 MHz

GSM900 — ARFCN 1

24. GSM Network Architecture 29

Radio Link Aspects

«The GSM spectral allocation is 25 MHz for base
transmission (935-960 MHz)- downlink and 25 MHz for
mobile transmission (890-915 MHz)- uplink.

*There are radio-frequency carriers every 200 kHz,
which provide for 125 full-duplex channels.

*The channels are modulated at a data rate of 270.833
kbps

*The ARFCN is a number that describes a pair of
frequencies, one uplink and one downlink

25. GSM Network Architecture a

Radio Link Aspects
*Up = 890.0 + (ARFCN * 2)
Down = Up + 45.0
Example:
Given the ARFCN 72, and we know the offset is 45MHz for
the GSM900 band:
Up = 890.0 + (72 * .2) = 890.0 + (14.4)
Up = 904.40 MHz

Down = Up + Offset = 904.40 + 45.0
Down = 949.40 MHz

The uplink/downlink pair for GSM900 ARFCN72 is 904.40/949.40
(MHz)

26. ST encrypted bits I 26 training seq 57 encrypted bits fax]

stealing stealing guard
bit bit bits

trail
fppt.com ping

27. GSM Network Architecture a

TDMA Format

-Trail bits — allow synchronization of transmissions from
mobile units

*Encrypted bits — encrypted data

*Stealing bit - indicates whether block contains data or is
"stolen"
Training sequence — used to adapt parameters of receiver to
the current path propagation characteristics

— Strongest signal selected in case of multipath propagation
*Guard bits — used to avoid overlapping with other bursts

Note: Follow william stalling book as well

28. ia

* Two Types of Logical Channels

— Traffic Channels (TCH)

* Carries encoded user speech and user data and have identical
functions and format on forward and reverse link.

— Control Channels (CCH)
* Carry sync and signalling command between BS and MS
* Certain control channels are defined only for forward or reverse link.

29. TCH
(traffic)

Speech

Data 2.4 kbps

BCH FCCH(Frequency correction)

———SCH(Synchronization)
PCH(Paging)
CCCH

CCH
(control)

RACH(Random Access)
AGCH(Access Grant)

Dedicated SDCCH(Stand Alone)

SACCH(Slow-associated)

30. ia

— Full rate ------ data within one TS per frame

— Half rate ------ same time slot but sent in alternate frames

— Traffic channel may not be in TSO (serves as broadcast
station)

* Traffic Channels (TCH)

T,: n° TCH frame
S: Slow Associated Control Channel frame
1: Idle frame

31. GSM Channel Types 29

* Full rate (FR) ------ data within one TS per frame

— TCHIFS ------- The FR speech channel carries user speech
which is digitized at raw data rate of 13 kbps. Channel
coding + digitized speech = FR speech channel carries 22.8
kbps.

— (TCH/F9.6)/(TCH/F4.8)/(TCH/F2.4)

* carries raw user data which is sent at 9.6kbps (FEC coding
22.8kbps)

+ 4.8kbps (22.8kbps)
+ 2.4kbps (22.8 kbps)

32. ia

+ Half rate (HR) TCH

— TCH/HS ------- carry digitized speech at a rate half that of
FR. (carry 11.4kbps)

= (TCH/H4.8)/(TCH/H2.4)

* carries raw user data which is sent at 4.8kbps (FEC coding
11.4kbps)

* 2.4kbps (11.4 kbps)

33. GSM Channel Types ay

* Control Channels (CCH)
— Broadcast Channels (BCH)

.

Implemented only on certain ARFCN channels

Allocated timeslots in a very specific manners (TSO of certain frames)
— Other timeslots available for TCH data or DCCH data
— All eight frames on other AFCNs within the cell are available for TCH or DCCH

Used forward link just

Provide sync for all MS inside the cell

Occasionally monitored by mobiles in neighbouring cells (received
power and MAHO decisions)

Broadcast Control Channel (BCCH)

Frequency Correction Channel (FCCH)

Synchronization Channel (SCH)

34. GSM Channel Types

* BCCH

— Broadcast info such as
* cell and network identity

* Operating characteristics of the cell
— Current control channels structure
— Channel availability
— Congestion
* Broadcast list of channels that are currently in use

* Note: Read rest of the channels detail from
Rappaport book by yourself.

35. ‘Transmitter Receiver

radio waves

36. ia

* The speech signal is compressed using an algorithm
known as Regular Pulse Excited - Linear Predictive
Coder

— data from previous samples are used to predict the current
sample

37. ia

* Transmission is in the form of DS-SS
— Use chipping code to increase data rate of transmission
— Multiple access by assigning orthogonal chipping codes

38. Advantages of CDMA Cellulagg

Frequency diversity — frequency-dependent transmission
impairments (noise burst and selective fading) have less
effect on signal

Multipath resistance — chipping codes used for CDMA not
only exhibit low cross correlation but also low
autocorrelation

Privacy — privacy is inherent since spread spectrum is
obtained by use of noise-like signals

Graceful degradation — system only gradually degrades to
the point of an unacceptable error rate as more users access
the system (noise level and error rate increases)

39. Drawbacks of CDMA Cellular, 3

* Self-jamming — arriving transmissions from multiple users
not aligned on chip boundaries unless users are perfectly
synchronized

* Near-far problem — signals closer to the receiver are
received with less attenuation than signals farther away.

— Given the lack of complete orthogonality, the transmissions from
the more remote mobile units may be more difficult to recover.
— power control techniques are very important in a CDMA system.
* Soft handoff — requires that the mobile acquires the new cell
before it relinquishes the old; this is more complex than
hard handoff used in FDMA and TDMA schemes

40. * RAKE receiver — when multiple versions of a signal arrive
more than one chip interval apart, RAKE receiver attempts
to recover signals from multiple paths and combine them

— This method achieves better performance than simply recovering
dominant signal and treating remaining signals as noise

41. Binary
data

Figure 10.18 Principle of RAKE Receiver [PRA

42. * Soft Handoff— mobile station temporarily connected to
more than one base station simultaneously

ES Land Link

EN

8 Vocoder / Selector à
à 4
KE E

Base. Station 1 Bus Station 2

43. Types of Channels Supported by 3
Forward Link =

Pilot (channel 0) - allows the mobile unit to acquire timing
information, provides phase reference and provides means
for signal strength comparison

Synchronization (channel 32) - used by mobile station to
obtain identification information about cellular system
(system time, long code state, protocol revision, etc.)
Paging (channels 1 to 7) - contain messages for one or more
mobile stations

Traffic (channels 8 to 31 and 33 to 63) — the forward
channel supports 55 traffic channels

44. ia

Speech is encoded at a rate of 8550 bps
Additional bits added for error detection

Data transmitted in 20-ms blocks with forward error
correction provided by a convolutional encoder

Data interleaved in blocks to reduce effects of errors

Data bits are scrambled, serving as a privacy mask

45. Forward Traffic Channel =)
Processing Steps (cont.) a

* Power control information inserted into traffic channel
* DS-SS function spreads the 19.2 kbps to a rate of 1.2288
Mbps using one row of 64 x 64 Walsh matrix

* Digital bit stream modulated onto the carrier using QPSK
modulation scheme

Note: Must follow book William Stalling for reverse traffic
channels and for more understanding

46. ro
2.5G (GSM) ii

* “Generation 2.5” is a designation that broadly includes all advanced
upgrades for the 2G networks

+ Generally, a 2.5G GSM system includes at least one of the following
technologies: high-speed circuit-switched data (HSCSD), General Packet
Radio Services (GPRS), and Enhanced Data Rates for Global Evolution
(EDGE).

High Speed Circuit Switched Data
Dedicate up to 4 timesiots for data connection ~ 50 kbps
Good for real-time applications

Inefficient -> ties up resources, even when nothing sent
Not as popular as GPRS (many skipping HSCSD)

Enhanced Data Rates for Global Evolution

GSM {scsp | Uses 8PSK modulation

9.6kbps (one tmeslot) — 3x improvement in data rate on short distances
GSM Data Can fall back to GMSK for greater distances
Also called CSD Combine with GPRS (EGPRS) ~ 384 kbps

Can also be combined with HSCSD

GSM BR I —

General Packet Radio Services ug

Data rates up to ~ 115 kbps — EDGE
Max 8 timeslots used as amy one time

Packet switched: resources not tied up all the time

Contention based. Efficient, but variable delays

GSM / GPRS core network re-used by WCDMA (3G)

47. 2.5G: GPRS Architecture

Base Station

1

Mobile Station 1 Subsystem Network Subsystem
1
i

Other Networks

Y

;
'
'

[4 Ya E
1
I
1
1]

GPRS Mobile
Stations:
New Mobile Station are
required to use GPRS
packet data services.

4

SGSN: Serving GPRS Support Node
GGSN: Gateway GPRS Support Node

48. 2.5G: GPRS Architecture (11%

GPRS Base Station Subsystem:

*Each BSC requires the installation of one or more Packet Control Units (PCUs) and a software upgrade.
*The PCU provides a physical and logical data interface to the BSS for packet data traffic.

“The BTS can also require a software upgrade but typically does not require hardware enhancements.

«At the output of the BSC, the traffic is separated; voice is sent to the MSC per standard GSM, and data is sent
to anew device called the SGSN via the PCU over a Frame Relay interface.

GPRS Support Nodes:

Following two new components, called GPRS support nodes (GSNs), are added:

Gateway GPRS support node (GGSN):

*GGSN acts as interface between the GPRS backbone and the external packet data network (PDN)

“Converts the GPRS packet coming from the SGSN into proper packet data protocol (PDP) format (i.e. X.25 or
IP) before sending to the outside data network.

*Similarly it converts the external PDP addresses to the GSM address of the destination user. It sends these
packets to proper SGSN. For this purpose the GGSN stores the current SGSN address of the user and his
profile in its location register.

“Also performs the authentication and charging functions.

Serving GPRS support node (SGSN):

*The Serving GPRS Support Node is responsible for authentication of GPRS mobiles, registration of mobiles in
the network, mobility management, and collecting information for charging for the use of the air interface.

49. 3rd Generation

provide
fairly high speed wireless communications to support
multimedia, data, and video in
addition to voice

50. ITU’s View of Third-Generation»)
Capabilities aa
Voice quality comparable to the public switched telephone
network

144 kbps data rate available to users in high-speed motor
vehicles over large areas

384 kbps available to pedestrians standing or moving slowly
over small areas

Support for 2.048 Mbps for office use
Symmetrical / asymmetrical data transmission rates

Support for both packet switched and circuit switched data
services

51. ITU’s View of Third-Generatio a
Capabilities =

An adaptive interface to the Internet to reflect efficiently the
common asymmetry between inbound and outbound traffic

More efficient use of the available spectrum in general
Support for a wide variety of mobile equipment

Flexibility to allow the introduction of new services and
technologies

53. 3 Generation (3G) a

* 3G is created by ITU-T and is called IMT-2000.

* The ITU accepted the following proposals as IMT-2000 compatible
— IMT Multicarrier (IMT-MC; also known as CDMA2000)

IMT Direct Spread (IMT-DS; also known as UTRA FDD);

— IMT Time Code (IMT-TC; also known as UTRA-TDD/TD-SCDMA
“narrowband TDD”)

IMT Single Carrier (IMT-SC; also known as UWC-136)
— IMT Frequency Time (IMT-FT; also known as DECT)

IMT2000 Terrestral
Radio Interfaces

TD.CDMA \
TRA TOD) | UWC-136
comazono | |UTRA TODA | UNE DECT

ME
A 20 TD-SCOMA N

CDMA TOMA FOMA

54. CDMA Design Considerationaa

* Bandwidth — limit channel usage to 5 MHz

* Chip rate — depends on desired data rate, need for error
control, and bandwidth limitations; 3 Mcps or more is
reasonable

° Multirate — advantage is that the system can flexibly support
multiple simultaneous applications from a given user and
can efficiently use available capacity by only providing the
capacity required for each service

55. CDMA2000 Ix EV-DO ao

Also known as CDMA/HDR (CDMA high data rate) and as
IS-856 (1* 3G deployed)

To offer near-broadband packet data speeds for wireless
access to the internet

The Ix prefix refers to its use of Ix (1 times) the 1.2288
Mcps spreading rate of a standard IS-95 CDMA channel
Geared toward the use of IP for packet transmission and for
Internet access.

56. a

° A well-engineered IxEV-DO network delivers average
download data rates of between 600 kbps and 1.2 Mbps
during off-peak hours

* between 150 kbps and 300 kbps during peak hours
* Instantaneous data rates are as high as 2.4 Mbps

57. ia

* The IxEV-DO design focuses on integration with IP-
based networks

Mobile user

/
~ > controller

u Central office

fppt.com

58. CDMA2000 Ix EV-DO ay

* Because it is data-only, the transmission scheme can be
optimized for data transfer and need not support voice
requirements

— voice frames are short, typically on the order of 20 ms, in order to
minimize delays.
* use of short frames increases overhead, resulting in reduced efficiency
— Ina data-only network, longer average delays can be tolerated, and
QoS facilities can be used to accommodate transmissions that
require tight delay values.

* adata-only network can use longer frames, reducing overhead,

59. CDMA2000 kEV-DO 2

* Ina typical data-only application, the amount of traffic from
the network to the user significantly exceeds user-to-
network traffic

— To optimize throughput and make the best use of the available
bandwidth, 1xEV-DO sends and receives at different data rates.

* Download (forward channel) rates vary from 38.4 kbps to 2.4576 Mbps and
* upload (reverse channel) rates vary from 9.6 kbps to 156.3 kbps.

60. ia

° A major difference in a data-only design as compared to a
voice-optimized
— Voice-optimized systems use power control (path loss and/or
fading, close to the base station reduce power)

— In contrast, 1xEV-DO alters the data rate rather than the power
when signal levels change (forward and reverse channels).

61. 3G: UMTS ay

Universal Mobile Telecommunications System (UMTS)
UMTS is an upgrade from GSM via GPRS or EDGE

The standardization work for UMTS is carried out by Third Generation
Partnership Project (GPP)

Data rates of UMTS are:

— 144 kbps for rural

— 384 kbps for urban outdoor

— 2048 kbps for indoor and low range outdoor

UMTS Band

— 1900-2025 MHz and 2110-2200 MHz for 3G transmission

= Inthe US, 1710-1755 MHz and 2110-2155 MHz will be used instead,
as the 1900 MHz band was already used.

62. UMTS Architecture y

63. UMTS Network Architecture. 3

UMTS network architecture consists of three domains
— Core Network (CN): Provide switching, routing and transit for user traffic

— UMTS Terrestrial Radio Access Network (UTRAN): Provides the air
interface access method for user equipment.

— User Equipment (UE): Terminals work as air interface counterpart for

base stations.
UTRAN

Wide band CDMA technology is selected for UTRAN air interface
— WCDMA

Base stations are referred to as Node-B and control equipment for Node-B
is called as Radio Network Controller (RNC).

64. UMTS Network Architecture: UTRAN'

WCDMA

«WCDMA is a wideband Direct-Sequence Code Division Multiple Access (DS-
CDMA)system, i.e. user information bits are spread over a wide bandwidth by
multiplying the user data with quasi-random bits (called chips) derived from CDMA
spreading codes.

*The chip rate of 3.84 Mcps leads to a carrier bandwidth of approximately 5 MHz
which is wider than 15-95 (CDMA), that's why “Wide”.

Functions of Node-B are:

* Air Interface Tx/Rx

* Modulation/Demodulation
Functions of RNC are:

* Radio Resource Control

* Channel Allocation

* Power Control Settings

* Handover Control

* Ciphering

* Segmentation and reassembly