Introduction to Mobile Communications TCOM 552, Lecture #7 Hung Nguyen, Ph.D. 23 October, 2006

10/23/2006 Hung Nguyen, TCOM 552, Fall Outline AMPS (cont’d) TDMA –IS-136 –GSM

10/23/2006 Hung Nguyen, TCOM 552, Fall AMPS Parameters

10/23/2006 Hung Nguyen, TCOM 552, Fall Bursty control info can also be transmitted in the voice channel for power control and/or handoff

10/23/2006 Hung Nguyen, TCOM 552, Fall Differences Between First (1G) and Second Generation (2G) Systems Digital traffic channels – first-generation systems are analog; second-generation systems are digital Channel access – second-generation systems use TDMA or CDMA, first uses FDMA First in MHz band, second also there plus MHz band Encryption – all second generation systems provide encryption to prevent eavesdropping Error detection and correction – second-generation digital traffic allows for detection and correction, giving clear voice reception

10/23/2006 Hung Nguyen, TCOM 552, Fall

10/23/2006 Hung Nguyen, TCOM 552, Fall Cellular vs. PCS Coverage Free Space loss is proportional to 20log 10 f. Difference between PCS (1900 MHz) and cellular (880 MHz) is around 7 dB PCS base stations Cellular base station On average ratio of PCS stations to cellular 3:1

10/23/2006 Hung Nguyen, TCOM 552, Fall Cellular vs. PCS Cellular designed for cars Cellular –Analog modulation –portable power: 1/2 to 3 watts FDMA access Large cell sizes PCS goal is for a user not a place or vehicle PCS –digital modulation –portable power: 100 to 300 milli-watts TDMA access – (IS-54/136 and GSM) CDMA access (IS-95) Often cells closer together

10/23/2006 Hung Nguyen, TCOM 552, Fall Steps in Design of TDMA Timeslot

10/23/2006 Hung Nguyen, TCOM 552, Fall TDMA Time Slots

10/23/2006 Hung Nguyen, TCOM 552, Fall DIGITAL CELLULAR DAMPS - also called US TDMA IS-54 later renamed IS-136 TDMA, 8 kb/s voice, x2 overhead Three 16 kb/s TDMA channels in 30 kHz - Reuse factor 7 with sectoring 48 kb/s in 30 kHz = 1.6 bits/sec/Hz –3 times more spectrum efficient than analog (AMPS) –Approx. 7 calls/MHz/cell –Approx. 210 max calls/cell Used by AT&T, Cingular and others in US See TDMA Tutorial at – See PCS Tutorial at – orhttp:// –

10/23/2006 Hung Nguyen, TCOM 552, Fall US TDMA Architecture US TDMA started as IS-54, dual mode terminals, after GSM Adopted mobile assisted handoff (MAHO), encryption, associated control channels (instead of FVC/RVC), but uses the AMPS forward and reverse control channels to set up calls and for MM Later established IS-136, with digital control channels (DCCH) separate from the AMPS control channels, and added sleep modes, allowing all digital phones, and various supplementary services like voice mail, caller ID, and short message service IS-136 also specifies an air interface, and a base station, MSC and interworking function, and going to public, private or residential networks (PSTN, PBX, or cordless) Identifiers: AMPS plus others: A-key to each subscriber (for encryption and authentication), location areas (for easier location tracking and registration), IMSI (international mobile subscriber ID), others

10/23/2006 Hung Nguyen, TCOM 552, Fall Radio Transmission (1) 30 KHz, 6 slots per frame, each user 2 slots, 40 msec frame Some time offset between reverse and forward to not transmit and receive at same time, still do full duplex 324 bits per slot, 6 slots/frame, in 40 msec = 48.6 kbps Full rate channel is 2 slots/frame = 16.2 kbps; also half rate, 2X, 3X No fixed assignment of frequencies to control channels

10/23/2006 Hung Nguyen, TCOM 552, Fall IS-54 (IS-136) TDMA Slot Structure 6 time slots (interleaving of 2 voice samples) 3 users/ frame 324 bits/ time slot ms/slot IS-136 Slots

10/23/2006 Hung Nguyen, TCOM 552, Fall Radio Transmission (2) Uses DQPSK with possible 45 degree, 45+90, and -45 degree shifts from each phase angle (max phase shift is 135 degree), so 4 possible next symbols, so 2 bits each, called  /4 shifted DQPSK - a 1.62 bps/Hz modulation spectral efficiency –Differential phase detection, no absolute phase reference or detector needed –But not very energy efficient - BER for given Eb/No not great, reuse still 7 Mobile transmits 0.25 mw up to 4 w, in 4 dB steps, but only 1/3 the time Spectral efficiency: in terms of voice calls: –About 3* better than AMPS ( a bit higher, if it uses 21 control channels for one provider in 25 MHz, instead of 21*3), with 7 factor reuse

10/23/2006 Hung Nguyen, TCOM 552, Fall Logical Channels (1) Digital traffic channels –Data (including voice), associated control channels, sync and other information –Typically all in one slot, e.g., 28 bit sync, 260 data bits, 12 SACCH (Slow Associated Control Channel), some guard time SYNC does frame sync, and is training sequence for equalizer SACH is control, at 600 b/s per user, like FVC/RVC in AMPS –Mobile only transmits on its slot, power off rest of time –FACCH (Forward Access Control Channel) does a blank and burst on the traffic channel Faster rate control for handoffs (about x6), with rate 1/4 code

10/23/2006 Hung Nguyen, TCOM 552, Fall Logical Channels (2) DCCH (Digital Control Channel) –Forward are both broadcast as well as addressed to one, reverse are random access - all have SYNC, some preamble, control data –Organized hierarchically in half frames (blocks), super-frames (32 frames) and hyper-frames (64 frames) - control data is MUXed in into super- frames Different types of control data are called logical channels e.g., SPACH is Short message service, Paging and Access response Channel Terminals listen to a specific paging sub-channels in the SPACH, sleep otherwise

10/23/2006 Hung Nguyen, TCOM 552, Fall Messages and Authentication On AMPS logical channels, on SACCH and FACCH, on DCCH’s Table 5.5 for SACCH and FACCH - includes call management RRM, authentication, handoff, etc –e.g., Handoff: includes new frequency for handoff, power to radiate, half rate or full rate, time slot number, color code of new BS, other On DCCH: system info on broadcast channels, call management messages, message waiting and paging on SPACH, authentication, etc Authentication and privacy in IS-136: due to A-key, in phone and in authentication center (AC) –Used by both mobile and AC to generate a shared secret key, SSD, from A-key and a random number generator (random number is transmitted) - but can not be reversed to A-key - used for authentication and privacy

10/23/2006 Hung Nguyen, TCOM 552, Fall MAHO - MACA - Some RRM (Radio Resource Management) Terminal measures signal quality on the active traffic channel During time slots it is not active it monitors other BS’s Transmits channel quality information to its BS on the SACCH Mobile is told which other channels to monitor by BS - 6 or 12 Signal quality is from power level and BER –BER is better than just power levels: interference could give good power levels, but bad BER - better than AMPS BS also measures signal quality on active traffic channel Since in TDMA the BS knows signal quality at nearby BS’s it knows who to handoff to In TDMA most of the processing done at BS, in AMPS at MSC Mobile - assisted channel allocation (MACA) is similar, for channel allocation, helping the BS assign channels; the mobiles measure idle channels and tell the BS SACCH and FACCH have also power adjustment and time alignment messages

10/23/2006 Hung Nguyen, TCOM 552, Fall GSM (Europe/US)) Global System for Mobile Agreed TDMA standard devised for European environment 200 kHz channels with kbits/s. eight TDMA users 13kb/s vocoder, 20kb/s w/overhead Reuse factor 3-4 About 5 calls/MHz/cell with sectoring, or 150 calls/cell (30 MHz) See GSM Tutorial –Available at

10/23/2006 Hung Nguyen, TCOM 552, Fall Mobile Wireless TDMA Design Considerations - for GSM Number of logical channels (number of time slots in TDMA frame): 8 Maximum cell radius (R): 35 km Frequency: region around 900 MHz Maximum vehicle speed (V m ):250 km/hr Maximum coding delay: approx. 20 ms –Really, this is also max. speech sample delay so that one can not distinguish breaks Maximum delay spread (  m): 10  s Bandwidth: Not to exceed 200 kHz (25 kHz per channel)

10/23/2006 Hung Nguyen, TCOM 552, Fall Logic for GSM Rate and Modulation Max. delay of 20 msec >>> How much data in 20 msec? If 12 kbps speech codec, that’s 260 bits Add rate 1/2 convolutional code, that’s 480 bits Put in 8 speech slots, that’s 8*480 bits, all in 20 msec That’s 192 kbps –Notice that data rate is high enough that 20 msec worth of speech is included, multiplexed in with 7 other users, for each user’s sample Really with 13 kbps and other overhead it turns into kbps It uses GMSK modulation - Gaussian weighted Minimum Shift Keying - like FSK, but changes frequency while maintaining continuous phase, and shifts the minimum possible - used because more spectrally efficient than PSK or FSK, and fits data rate into 200 KHz BW, but power efficient (see later)

10/23/2006 Hung Nguyen, TCOM 552, Fall GSM Speech Signal Processing RPE-LPC (Linear Predictive Coding) In 20 msec, 260 bits, turned into (with rate ½ coding+other) 189*2+78=456 bits, in 20 msec is 22.8 kbps (traffic channel) Interleaved over multiple slot timeperiods, within 20 msec protects against bursts Encrypted 114 bits at a time Into time slots or bursts GMSK modulation

10/23/2006 Hung Nguyen, TCOM 552, Fall Radio Transmission – GSM (1) 200 KHz carriers, so fewer transmitters and receivers at a BS GMSK does 1.35 bps/Hz, worse than US TDMA, but has better BER for a given Eb/No (so better frequency reuse), and has constant envelope modulation which allows more efficient amplifiers and is better on battery drain than US TDMA Can do slow frequency hoping - network directed Slot is msec, then a frame is 8 slots at msec Slot has 2*57 bits of data, 26 bits training sequence (8 different ones, also used as SAT/DCC function), guard time and tail bits, flags

10/23/2006 Hung Nguyen, TCOM 552, Fall Radio Transmission – GSM (2) Then organized as multi-frames (26 or 51 frames), superframes(26 or 51 multiframes) and hyperframes (2048 super-frames - about 3+1/2 hours, used for encryption periods) –Traffic multi-frame (26 frames ) is 120 msec –A full rate traffic channel (TCH/F) carries one time slot in 24 of 26 traffic frames, in every multiframe - each TCH/F has its SACCH in one frame of every multi-frame

10/23/2006 Hung Nguyen, TCOM 552, Fall Spectrum Efficiency GMSK is more power efficient than US TDMA, providing good voice quality at S/I of about 7 dB Thus allows frequency reuse of With 4 it is 5 calls/cell/MHz –8 calls/200 KHz or 40 in 1 MHz, one way –20 two ways, and with 4 reuse it’s 5 calls/MHz/cell Actually one carrier left as guard, slightly smaller (4.96)

10/23/2006 Hung Nguyen, TCOM 552, Fall TDMA Format – Time Slot Fields - GSM Trail bits – 3 - allow synchronization of transmissions from mobile units Encrypted bits – encrypted data, same number of bits in two groups of 57 Stealing bit - indicates whether block contains data or is "stolen” for control signaling Training sequence – used to adapt parameters of receiver to the current path propagation characteristics - in the middle –Ground rule is that it 6*max. delay spread for equalizer training - that’s 60usec, at 270 kbps or so it’s about 16 bits - actually 26 Guard bits – used to avoid overlapping with other bursts

10/23/2006 Hung Nguyen, TCOM 552, Fall Logical Channels Traffic channels, half and full rate Signaling channels –Broadcast e.g., frequency correction (pure sine wave, used to match the BS, SYNC, some control –Common Control Channels Paging, Random access, Access –Dedicated Control Channels Slow, fast, stand-alone

10/23/2006 Hung Nguyen, TCOM 552, Fall GSM Network Architecture

10/23/2006 Hung Nguyen, TCOM 552, Fall Mobile Station Mobile station communicates across Um interface (air interface) with base station transceiver in same cell as mobile unit Mobile equipment (ME) – physical terminal, such as a telephone or PCS –ME includes radio transceiver, digital signal processors and subscriber identity module (SIM) GSM subscriber units are generic until SIM is inserted –SIMs roam, not necessarily the subscriber devices

10/23/2006 Hung Nguyen, TCOM 552, Fall Base Station Subsystem (BSS) BSS consists of base station controller and one or more base transceiver stations (BTS) Each BTS defines a single cell –Includes radio antenna, radio transceiver and a link to a base station controller (BSC) BSC reserves radio frequencies, manages handoff of mobile unit from one cell to another within BSS, and controls paging

10/23/2006 Hung Nguyen, TCOM 552, Fall Network Subsystem (NS) NS provides link between cellular network and public switched telecommunications networks –Controls handoffs between cells in different BSSs –Authenticates users and validates accounts –Enables worldwide roaming of mobile users Central element of NS is the mobile switching center (MSC)

10/23/2006 Hung Nguyen, TCOM 552, Fall Mobile Switching Center (MSC) Databases Home location register (HLR) database – stores information about each subscriber that belongs to it Visitor location register (VLR) database – maintains information about subscribers currently physically in the region Authentication center database (AuC) – used for authentication activities, holds encryption keys Equipment identity register database (EIR) – keeps track of the type of equipment that exists at the mobile station

10/23/2006 Hung Nguyen, TCOM 552, Fall GSM Signaling Protocol Architecture (m - modified/mobile from ISDN) (Uses CRC, ARQ)

10/23/2006 Hung Nguyen, TCOM 552, Fall Functions Provided by Protocols Protocols above the link layer of the GSM signaling protocol architecture provide specific functions: –Radio resource management: Does radio channel management, including for handoffs –Mobility management: Roaming, location databases, authentication –Connection management: sets up calls between users –Mobile application part (MAP) - Core Network functions, like IS-41 in US systems –BTS management –SCCP (Signal connection control part) and MTP (message transfer part) are from SS7, for control signaling