Wireless Systems and Standards

GSM (Global System for Mobile communications) is a 2G digital cellular system using TDMA/FDMA with 200 kHz carriers (8 time slots each), GMSK modulation and FDD (890–915 MHz uplink, 935–960 MHz downlink for GSM-900). Its architecture has four parts: Mobile Station (MS), Base Station Subsystem (BSS), Network and Switching Subsystem (NSS) and Operation Support Subsystem (OSS).

       Um          Abis          A
 [MS]~~~~~~[BTS]-------[BSC]-------[MSC]----[GMSC]--PSTN/
 ME+SIM     [BTS]------'  (TRAU)      |  |      ISDN
                                      |  +--[VLR]
 |<---- BSS ---------------->|        +--[HLR]--[AuC]
                                      +--[EIR]
                      |<-------- NSS -------->|
                [OMC] (OSS) monitors BSS & NSS

1. Mobile Station (MS)

• Mobile Equipment (ME): the handset hardware – radio, speech codec, display; identified by the IMEI.
• SIM card: holds the IMSI, secret key Ki, A3/A8 algorithms, PIN and user data. Any ME works with any SIM, so the subscription is portable.

2. Base Station Subsystem (BSS)

• BTS (Base Transceiver Station): radio transceivers and antennas for one cell; does modulation/demodulation, channel coding, interleaving, encryption, frequency hopping and measurements over the Um (air) interface.
• BSC (Base Station Controller): controls many BTSs over the Abis interface; allocates radio channels, sets transmit power, manages frequency hopping and handles handoffs between its BTSs.
• TRAU (Transcoder and Rate Adaptation Unit): converts 13 kbps GSM speech to 64 kbps PCM for the MSC.

3. Network and Switching Subsystem (NSS)

Connected to the BSC by the A interface.

• MSC (Mobile Switching Centre) – the central switch. Sets up, routes and releases calls; handles handoff between BSCs/MSCs, billing records, and mobility management. Works with HLR/VLR to locate users.
• GMSC (Gateway MSC) – the MSC that connects the GSM network to PSTN/ISDN/other networks; for incoming calls it asks the HLR where the subscriber is.
• HLR (Home Location Register) – permanent database of every subscriber of the operator: IMSI, MSISDN, subscribed services, and the current VLR/MSC area of the user.
• VLR (Visitor Location Register) – temporary database attached to an MSC; holds data of subscribers currently roaming in its area (copied from HLR), TMSI and location area. Reduces queries to the HLR.
• AuC (Authentication Centre) – stores each subscriber's secret key Ki and runs the A3/A8 algorithms to generate authentication triplets (RAND, SRES, Kc) for authentication and ciphering.
• EIR (Equipment Identity Register) – list of IMEI numbers: white (allowed), grey (monitored) and black (stolen/blocked) handsets.

4. Operation Support Subsystem (OSS)

• OMC (Operation and Maintenance Centre): monitors and configures all network elements; handles fault, performance, configuration, security and billing management, and subscriber administration.

Interfaces

Call flow example (mobile terminated): PSTN → GMSC asks HLR → HLR asks current VLR for roaming number → GMSC routes to the serving MSC → MSC pages the MS via BSC/BTS → authentication with AuC data → channel assignment → call connected.

The forward (downlink) channel of IS-95 carries signals from the base station to the mobiles on a 1.25 MHz carrier at 1.2288 Mcps. It is divided into 64 logical channels using 64-chip Walsh codes (orthogonal), so the downlink users do not interfere with each other within a cell. Each base station is told apart by the time offset of its short PN code.

Forward traffic channel processing

 speech 9600 bps (rate set 1, also 4800/2400/1200)
   |
 [Conv. encoder r=1/2, K=9] -> 19.2 ksps
   |
 [Symbol repetition] (for lower rates) -> 19.2 ksps
   |
 [Block interleaver, 20 ms]
   |
 (XOR)<--[Long code gen]->[Decimator 64:1] (user mask)
   |                         |
 [MUX] <--power ctrl bits 800 bps (decimated long code
   |       picks position)
 (XOR)<-- Walsh code Wn (64 chips) -> 1.2288 Mcps
   |
  +--> (x) I short PN -> [Baseband filter] -> cos wct
  +--> (x) Q short PN -> [Baseband filter] -> sin wct
                              |
                       (+) -> QPSK RF out

Steps

1. Vocoder: variable-rate speech coder (QCELP) gives 9600, 4800, 2400 or 1200 bps in 20 ms frames.
2. Convolutional coding: rate 1/2, constraint length 9 → 19.2 ksps; lower rates are repeated to keep 19.2 ksps.
3. Block interleaving over 20 ms to fight burst errors.
4. Data scrambling: XOR with the user's long PN code (2⁴² − 1), decimated to 19.2 ksps; gives privacy.
5. Power control subchannel: power control bits (800 bps) are punctured into the stream; they tell the mobile to raise or lower power by 1 dB.
6. Walsh spreading: each symbol is multiplied by 64-chip Walsh code → 1.2288 Mcps; gives orthogonal channelisation.
7. Quadrature spreading: the same chips are spread by I and Q short PN codes (2¹⁵ length, base-station specific offset).
8. Filtering and QPSK modulation onto the carrier; all channels are summed and transmitted.

Pilot channel: all-zero data spread by W0 – it lets the mobile acquire timing and do coherent detection and RAKE combining.

GSM logical channels are mapped onto the physical TDMA time slots. They are of two kinds: traffic channels (TCH) that carry user speech/data, and control channels (CCH) that carry signalling for synchronisation, access, call setup and mobility.

Traffic channels (TCH)

Carry user speech or data; they use the 26-frame multiframe (24 TCH frames, frame 12 for SACCH, frame 25 idle).

• Full-rate TCH (TCH/F): 22.8 kbps gross. Speech at 13 kbps (TCH/FS); data at 9.6, 4.8, 2.4 kbps (TCH/F9.6, F4.8, F2.4).
• Half-rate TCH (TCH/H): 11.4 kbps gross, uses alternate frames so two users share one slot. Speech at about 6.5 kbps (TCH/HS); data at 4.8 and 2.4 kbps.

Control channels (CCH)

Use the 51-frame multiframe, mostly on time slot 0 of the beacon carrier (C0).

(a) Broadcast Channels (BCH) – downlink only, point-to-multipoint:

• BCCH (Broadcast Control Channel): broadcasts cell identity, location area code, network code, list of neighbour cell frequencies, control channel structure, access parameters.
• FCCH (Frequency Correction Channel): a burst of all zeros that gives a pure tone (carrier + 67.7 kHz); the mobile uses it to correct its oscillator frequency. Sent in frames 0, 10, 20, 30, 40.
• SCH (Synchronization Channel): sent in the frame after each FCCH; carries the BSIC (base station identity code) and the TDMA frame number so the mobile can synchronise with the frame structure.

(b) Common Control Channels (CCCH) – shared, for call setup:

• PCH (Paging Channel), downlink: pages a mobile for an incoming call or SMS.
• RACH (Random Access Channel), uplink: mobile requests a channel (to answer a page or start a call) using slotted ALOHA and the short access burst.
• AGCH (Access Grant Channel), downlink: base station replies to RACH and assigns an SDCCH.
• (CBCH: cell broadcast messages.)

(c) Dedicated Control Channels (DCCH) – bidirectional, for one user:

• SDCCH (Standalone DCCH): signalling during call setup: authentication, ciphering, location update, SMS, before a TCH is assigned.
• SACCH (Slow Associated CCH): tied to a TCH or SDCCH. Downlink: power control level and timing advance; uplink: signal strength/quality reports of serving and neighbour cells (for handoff).
• FACCH (Fast Associated CCH): urgent signalling (e.g. handoff command) sent by stealing TCH bursts; stealing flags mark these bursts.

How they work together (mobile-terminated call)

 MS                                   BTS/Network
 |  FCCH, SCH, BCCH (sync, cell info) <-----|
 |  PCH: page (incoming call)        <-----|
 |-----> RACH: channel request             |
 |  AGCH: SDCCH assigned             <-----|
 |<====> SDCCH: authentication, ciphering, |
 |        call setup messages              |
 |  TCH assigned (on SDCCH/FACCH)    <-----|
 |<====> TCH: speech; SACCH alongside      |
 |  FACCH: handoff command / release <-----|

1. On power-on, the mobile finds FCCH (frequency lock), then SCH (frame sync), then reads BCCH.
2. An incoming call is announced on PCH.
3. The mobile sends a request on RACH; the network assigns an SDCCH on AGCH.
4. Authentication and call setup are done on SDCCH.
5. A TCH is assigned; speech flows, with SACCH carrying measurements and power control.
6. Handoff and release commands go on FACCH.

WiMAX (Worldwide Interoperability for Microwave Access) is a broadband wireless access technology based on the IEEE 802.16 standard. It provides high-speed data over metropolitan areas (WMAN) as a wireless alternative to cable and DSL, for "last mile" access.

Key features

• Standards: 802.16d (2004) for fixed access; 802.16e (2005) "Mobile WiMAX" with handoff; 802.16m (WiMAX 2) aimed at 4G.
• Physical layer: OFDM (fixed) and OFDMA (mobile, scalable FFT 128–2048); adaptive modulation and coding (BPSK, QPSK, 16-QAM, 64-QAM).
• Spectrum: 2–11 GHz for non-line-of-sight; 10–66 GHz for line-of-sight. Common bands 2.3, 2.5, 3.5 GHz; channel widths 1.25–20 MHz.
• Range and rate: up to about 50 km (fixed, LOS) and typically 5–10 km NLOS; data rates up to ~70 Mbps shared (802.16e), ~1 Gbps target in 802.16m.
• Duplexing: TDD and FDD.
• MIMO and smart antennas for capacity and coverage.
• QoS classes: UGS, rtPS, nrtPS, ertPS and best effort; connection-oriented MAC with scheduling by the base station.
• Security: PKM authentication, AES encryption.

 Internet--[WiMAX BS]~~~~~~~~[CPE]--home LAN
               ~~~~~~~~~~[laptop/mobile]
               ~~~~[relay]~~~[remote user]

Applications: broadband in rural areas, backhaul for Wi-Fi hotspots and cell sites, mobile broadband. WiMAX lost the 4G market to LTE, but is still used for fixed wireless access in some places.

GSM control channels carry signalling between the mobile and the network for synchronisation, access, paging, call setup and handoff. They are grouped into three types: Broadcast channels (BCH), Common control channels (CCCH) and Dedicated control channels (DCCH).

                 Control channels
       +----------------+------------------+
      BCH             CCCH               DCCH
  FCCH,SCH,BCCH   PCH,RACH,AGCH    SDCCH,SACCH,FACCH

(a) Broadcast channels – downlink only, to all mobiles

• FCCH (Frequency Correction Channel): an all-zero burst that gives a pure sine wave 67.7 kHz above the carrier. Purpose: the mobile finds the beacon carrier and corrects its local oscillator frequency.
• SCH (Synchronization Channel): sent in the frame after FCCH; carries the BSIC and the reduced TDMA frame number. Purpose: frame synchronisation and identification of the base station.
• BCCH (Broadcast Control Channel): carries cell identity, location area identity, network code, neighbour cell list, control channel configuration and access parameters. Purpose: lets an idle mobile camp on the cell and monitor neighbours.

(b) Common control channels – shared, used for access

• PCH (Paging Channel), downlink. Purpose: alerts a particular mobile (by IMSI/TMSI) of an incoming call or SMS.
• RACH (Random Access Channel), uplink. Purpose: the mobile requests a dedicated channel, using slotted ALOHA and the short access burst (to answer a page or make a call).
• AGCH (Access Grant Channel), downlink. Purpose: answers a RACH request by assigning an SDCCH (or TCH).

(c) Dedicated control channels – one per user, bidirectional

• SDCCH (Stand-alone Dedicated Control Channel). Purpose: signalling before a traffic channel exists – authentication, ciphering, location updating, call setup, SMS.
• SACCH (Slow Associated Control Channel): always paired with a TCH or SDCCH (one frame in each 26-multiframe). Purpose: uplink measurement reports (signal level/quality of serving and neighbour cells); downlink power control and timing advance commands.
• FACCH (Fast Associated Control Channel): steals bursts from the TCH (stealing flags set). Purpose: urgent messages such as handoff commands and call release.

In GSM, speech goes through a chain of digital operations that compress it, protect it against errors, secure it and fit it into TDMA bursts before GMSK modulation. The receiver reverses the chain.

 TRANSMITTER
 speech->[A/D 8kHz,13bit]->[Speech coder RPE-LTP]
   ->[Channel coder]->[Interleaver]->[Ciphering A5]
   ->[Burst formatting]->[GMSK mod]->[Freq hop/RF]
                                           |
                                         channel
 RECEIVER                                  |
 speech<-[D/A]<-[Speech decoder]<-[Channel decoder]
   <-[De-interleaver]<-[Deciphering]<-[Burst
   disassembly]<-[Equalizer+GMSK demod]<-[RF]

1. Speech coding

• Speech is sampled at 8 kHz, 13 bits (104 kbps).
• The RPE-LTP (Regular Pulse Excited – Long Term Prediction) coder compresses each 20 ms block into 260 bits → 13 kbps.
• Bits are graded by importance: Class Ia (50 bits), Class Ib (132 bits), Class II (78 bits).

2. Channel coding

• Class Ia: 3 parity (CRC) bits added for error detection.
• Class Ia + parity + Class Ib + 4 tail bits = 189 bits → rate 1/2 convolutional code (K = 5) → 378 bits.
• Class II (78 bits) sent uncoded.
• Total = 378 + 78 = 456 bits per 20 ms = 22.8 kbps.

3. Interleaving

• The 456 bits are split into 8 blocks of 57 bits and spread diagonally over 8 consecutive bursts (each burst carries halves from two speech frames). A burst lost in a deep fade only damages 1/8 of a frame, which the decoder can correct.

4. Ciphering

• Data is XORed with a key stream from the A5 algorithm using the session key Kc (from A8 and the SIM's Ki), giving privacy over the air.

5. Burst formatting

• Each 114-bit pair (2 × 57) gets 3+3 tail bits, 2 stealing flags, 26-bit training sequence and 8.25 guard bits → 156.25-bit normal burst, sent in one time slot (576.9 µs).

6. Modulation

• GMSK with BT = 0.3 at 270.833 kbps; constant envelope allows efficient non-linear amplifiers; 200 kHz channel.
• Optional slow frequency hopping (217 hops/s) adds diversity.

Receiver side

1. RF reception and down-conversion.
2. Adaptive equalizer (Viterbi/MLSE) uses the 26-bit training sequence to undo multipath ISI; GMSK demodulation.
3. Burst disassembly, deciphering with the same A5/Kc.
4. De-interleaving of 8 bursts.
5. Channel decoding (Viterbi decoder) and CRC check; a bad frame is replaced by extrapolation of the previous one.
6. Speech decoding (RPE-LTP) and D/A conversion back to audio.

Components of the Network Switching Subsystem (NSS)

The NSS performs call switching, mobility management and subscriber database functions in GSM. It connects to the BSS over the A interface and to external networks (PSTN/ISDN).

 BSC --A--> [MSC] ----- [GMSC] --- PSTN/ISDN
              |  \
            [VLR] [EIR]
              |
            [HLR]--[AuC]

• MSC (Mobile Switching Centre) – the central switch. Sets up, routes and releases calls; handles handoff between BSCs/MSCs, billing records, and mobility management. Works with HLR/VLR to locate users.
• GMSC (Gateway MSC) – the MSC that connects the GSM network to PSTN/ISDN/other networks; for incoming calls it asks the HLR where the subscriber is.
• HLR (Home Location Register) – permanent database of every subscriber of the operator: IMSI, MSISDN, subscribed services, and the current VLR/MSC area of the user.
• VLR (Visitor Location Register) – temporary database attached to an MSC; holds data of subscribers currently roaming in its area (copied from HLR), TMSI and location area. Reduces queries to the HLR.
• AuC (Authentication Centre) – stores each subscriber's secret key Ki and runs the A3/A8 algorithms to generate authentication triplets (RAND, SRES, Kc) for authentication and ciphering.
• EIR (Equipment Identity Register) – list of IMEI numbers: white (allowed), grey (monitored) and black (stolen/blocked) handsets.

GSM frame hierarchy

GSM uses FDMA + TDMA: each 200 kHz carrier is divided into 8 time slots, gross bit rate 270.833 kbps (bit period 3.69 µs).

 Hyperframe = 2048 superframes = 3 h 28 min 53.76 s
        |
 Superframe = 26 x 51-MF = 51 x 26-MF = 6.12 s
        |
 +------------------+--------------------+
 26-multiframe       51-multiframe
 (traffic) 120 ms    (control) 235.4 ms
        |
 TDMA frame = 8 slots = 4.615 ms
 | TS0 | TS1 | TS2 | TS3 | TS4 | TS5 | TS6 | TS7 |
        |
 Time slot = 156.25 bits = 576.9 µs

Normal burst (one time slot):

|T |  Data  |S| Training |S|  Data  |T |Guard|
|3 |   57   |1|    26    |1|   57   |3 |8.25 |

• Tail bits (3+3): all zeros; let the equalizer/Viterbi decoder start and end in a known state, and give time for power ramp.
• Data (2 × 57): coded speech/data bits.
• Stealing flags (1+1): show whether the data half-burst carries traffic or has been "stolen" for FACCH signalling.
• Training sequence (26): known pattern in the middle of the burst, used by the adaptive equalizer to estimate the channel.
• Guard period (8.25 bits ≈ 30 µs): prevents overlap of bursts from mobiles at different distances.

Other bursts: frequency correction burst (FCCH, all zeros), synchronisation burst (SCH, long 64-bit training), access burst (RACH, short, long guard of 68.25 bits), dummy burst.

• 26-multiframe (120 ms): frames 0–11 and 13–24 TCH, frame 12 SACCH, frame 25 idle.
• 51-multiframe (235.4 ms): carries FCCH, SCH, BCCH, CCCH and SDCCH control channels on TS0 of the beacon carrier.

The reverse (uplink) channel of IS-95 carries signals from the mobile to the base station on a 1.25 MHz carrier at 1.2288 Mcps. It has two kinds of channels: access channels (4800 bps, for call origination and replies to pages) and reverse traffic channels (user data). Users are separated by their long PN code (user-specific mask); since there is no pilot, the base station uses non-coherent 64-ary orthogonal (Walsh) modulation.

 data 9600/4800/2400/1200 bps
    |
 [Conv. encoder r=1/3, K=9] -> 28.8 ksps
    |
 [Symbol repetition] -> 28.8 ksps
    |
 [Block interleaver, 20 ms]
    |
 [64-ary orthogonal modulator]
   6 code symbols -> 1 Walsh word (64 chips)
   4.8 ksym/s -> 307.2 kcps
    |
 [Data burst randomizer] (gating for low rates)
    |
 (XOR)<--[Long code generator] (user mask)
    |      1.2288 Mcps
    +--(x) I short PN --[filter]--> cos wct --+
    |                                         (+)-> out
    +--(x) Q short PN-[1/2 chip delay]-[filter]
                         --> sin wct ---------+
                (OQPSK)

Steps

1. Variable-rate vocoder data in 20 ms frames.
2. Rate 1/3, K = 9 convolutional coding → 28.8 ksps (lower rates repeated).
3. Block interleaving over 20 ms.
4. 64-ary orthogonal modulation: each group of 6 symbols selects one of 64 Walsh codes → 307.2 kcps.
5. Data burst randomizer: at lower rates, only the needed power-control groups are sent (pseudo-random gating), saving power and reducing interference.
6. Long code spreading (42-bit, user mask from ESN) → 1.2288 Mcps; identifies the user.
7. Quadrature spreading by I and Q short PN codes, Q branch delayed by half a chip → OQPSK, which reduces envelope variations and suits the mobile's power amplifier.

Broadcast Control Channels (BCH)

BCH are downlink-only, point-to-multipoint channels sent on TS0 of the beacon carrier (C0) in the 51-frame multiframe. They let an idle mobile find the cell, synchronise and read cell information.

 51-MF on TS0 (downlink), frames:
 0  1  2-5   6-9  10 11 ...  40 41 ... 50
 F  S  BCCH  CCCH  F  S  ...  F  S  ... idle
 (F=FCCH, S=SCH)

1. FCCH (Frequency Correction Channel) – an all-zero burst which, with GMSK, gives a pure tone 67.7 kHz above the carrier. The mobile detects it to find the beacon and lock its oscillator frequency. Sent in frames 0, 10, 20, 30, 40.
2. SCH (Synchronization Channel) – the frame after each FCCH. Carries the BSIC (base station identity code) and the TDMA frame number, so the mobile aligns its timing with the frame/multiframe structure.
3. BCCH (Broadcast Control Channel) – carries system information: cell identity, location area identity, network code, neighbour cell BCCH list, CCCH configuration, cell selection and access parameters.

Operation: on switch-on the mobile scans carriers, finds FCCH, then reads SCH, then BCCH, and "camps" on the best cell. In idle mode it keeps reading BCCH and measuring neighbours listed there.

Common Control Channels (CCCH)

CCCH are shared by all mobiles in the cell and are used to set up a connection. They also sit on TS0 of C0 (frames not used by BCH).

1. PCH (Paging Channel) – downlink. The network pages a mobile (by IMSI or TMSI) for an incoming call or SMS. Each mobile listens only to its paging group, saving battery (discontinuous reception).
2. RACH (Random Access Channel) – uplink. The mobile sends a channel request (short access burst with long guard time since timing advance is not yet known) using slotted ALOHA. Used to answer a page, start a call, update location or send SMS.
3. AGCH (Access Grant Channel) – downlink. The network replies to the RACH request and assigns a dedicated channel (SDCCH), also giving the initial timing advance.

 Network --PCH: page-->        MS
 Network <--RACH: request--    MS
 Network --AGCH: SDCCH no.-->  MS
 then signalling continues on SDCCH

(CBCH, the cell broadcast channel, also uses CCCH resources for broadcast text messages.)

The Broadcast Control Channel (BCCH) is a downlink, point-to-multipoint control channel that each GSM cell transmits continuously so that every mobile in the cell can learn about the cell and the network.

Where it is sent: on time slot 0 (TS0) of the beacon carrier (C0) of each cell, inside the 51-frame control multiframe. The beacon carrier is always transmitted at constant power (dummy bursts fill unused slots) so mobiles can measure it.

Information carried (system information messages)

• Cell identity (CI) and Location Area Identity (LAI: MCC + MNC + LAC).
• List of BCCH frequencies of neighbouring cells (for measurements and handoff).
• Configuration of the common control channels (how many CCCH, paging groups).
• Cell selection parameters: minimum received level, maximum transmit power allowed (MS_TXPWR_MAX).
• Random access parameters (max retransmissions, access classes barred).
• Frequency hopping information and options supported by the cell.

Related broadcast channels (sent with BCCH on TS0):

• FCCH – frequency correction tone used by the mobile to find the beacon and correct its frequency.
• SCH – carries BSIC and frame number for synchronisation.

How a mobile uses it

 power on -> scan carriers -> find FCCH
   -> read SCH (sync, BSIC) -> read BCCH
   -> select/camp on cell -> monitor PCH,
      measure neighbours from BCCH list

The BCCH is never assigned to one user; it is read in idle mode, and in dedicated mode similar information is sent on the SACCH.

Frame structure of GSM

GSM uses FDMA + TDMA: each 200 kHz carrier is divided into 8 time slots, gross bit rate 270.833 kbps (bit period 3.69 µs).

 Hyperframe = 2048 superframes = 3 h 28 min 53.76 s
        |
 Superframe = 26 x 51-MF = 51 x 26-MF = 6.12 s
        |
 +------------------+--------------------+
 26-multiframe       51-multiframe
 (traffic) 120 ms    (control) 235.4 ms
        |
 TDMA frame = 8 slots = 4.615 ms
 | TS0 | TS1 | TS2 | TS3 | TS4 | TS5 | TS6 | TS7 |
        |
 Time slot = 156.25 bits = 576.9 µs

Normal burst (one time slot):

|T |  Data  |S| Training |S|  Data  |T |Guard|
|3 |   57   |1|    26    |1|   57   |3 |8.25 |

• Tail bits (3+3): all zeros; let the equalizer/Viterbi decoder start and end in a known state, and give time for power ramp.
• Data (2 × 57): coded speech/data bits.
• Stealing flags (1+1): show whether the data half-burst carries traffic or has been "stolen" for FACCH signalling.
• Training sequence (26): known pattern in the middle of the burst, used by the adaptive equalizer to estimate the channel.
• Guard period (8.25 bits ≈ 30 µs): prevents overlap of bursts from mobiles at different distances.

Other bursts: frequency correction burst (FCCH, all zeros), synchronisation burst (SCH, long 64-bit training), access burst (RACH, short, long guard of 68.25 bits), dummy burst.

• 26-multiframe (120 ms): frames 0–11 and 13–24 TCH, frame 12 SACCH, frame 25 idle.
• 51-multiframe (235.4 ms): carries FCCH, SCH, BCCH, CCCH and SDCCH control channels on TS0 of the beacon carrier.

Traffic and control channels

Traffic channels (TCH)

Carry user speech or data; they use the 26-frame multiframe (24 TCH frames, frame 12 for SACCH, frame 25 idle).

• Full-rate TCH (TCH/F): 22.8 kbps gross. Speech at 13 kbps (TCH/FS); data at 9.6, 4.8, 2.4 kbps (TCH/F9.6, F4.8, F2.4).
• Half-rate TCH (TCH/H): 11.4 kbps gross, uses alternate frames so two users share one slot. Speech at about 6.5 kbps (TCH/HS); data at 4.8 and 2.4 kbps.

Control channels (CCH)

Use the 51-frame multiframe, mostly on time slot 0 of the beacon carrier (C0).

(a) Broadcast Channels (BCH) – downlink only, point-to-multipoint:

• BCCH (Broadcast Control Channel): broadcasts cell identity, location area code, network code, list of neighbour cell frequencies, control channel structure, access parameters.
• FCCH (Frequency Correction Channel): a burst of all zeros that gives a pure tone (carrier + 67.7 kHz); the mobile uses it to correct its oscillator frequency. Sent in frames 0, 10, 20, 30, 40.
• SCH (Synchronization Channel): sent in the frame after each FCCH; carries the BSIC (base station identity code) and the TDMA frame number so the mobile can synchronise with the frame structure.

(b) Common Control Channels (CCCH) – shared, for call setup:

• PCH (Paging Channel), downlink: pages a mobile for an incoming call or SMS.
• RACH (Random Access Channel), uplink: mobile requests a channel (to answer a page or start a call) using slotted ALOHA and the short access burst.
• AGCH (Access Grant Channel), downlink: base station replies to RACH and assigns an SDCCH.
• (CBCH: cell broadcast messages.)

(c) Dedicated Control Channels (DCCH) – bidirectional, for one user:

• SDCCH (Standalone DCCH): signalling during call setup: authentication, ciphering, location update, SMS, before a TCH is assigned.
• SACCH (Slow Associated CCH): tied to a TCH or SDCCH. Downlink: power control level and timing advance; uplink: signal strength/quality reports of serving and neighbour cells (for handoff).
• FACCH (Fast Associated CCH): urgent signalling (e.g. handoff command) sent by stealing TCH bursts; stealing flags mark these bursts.

Working during a call: the mobile syncs using FCCH/SCH and reads BCCH; an incoming call is paged on PCH; the mobile requests access on RACH and gets an SDCCH on AGCH; authentication and setup run on SDCCH; then speech flows on TCH with SACCH reports, and handoff commands come on FACCH.

Frame structure of GSM

GSM uses FDMA + TDMA: each 200 kHz carrier is divided into 8 time slots, gross bit rate 270.833 kbps (bit period 3.69 µs).

 Hyperframe = 2048 superframes = 3 h 28 min 53.76 s
        |
 Superframe = 26 x 51-MF = 51 x 26-MF = 6.12 s
        |
 +------------------+--------------------+
 26-multiframe       51-multiframe
 (traffic) 120 ms    (control) 235.4 ms
        |
 TDMA frame = 8 slots = 4.615 ms
 | TS0 | TS1 | TS2 | TS3 | TS4 | TS5 | TS6 | TS7 |
        |
 Time slot = 156.25 bits = 576.9 µs

Normal burst (one time slot):

|T |  Data  |S| Training |S|  Data  |T |Guard|
|3 |   57   |1|    26    |1|   57   |3 |8.25 |

• Tail bits (3+3): all zeros; let the equalizer/Viterbi decoder start and end in a known state, and give time for power ramp.
• Data (2 × 57): coded speech/data bits.
• Stealing flags (1+1): show whether the data half-burst carries traffic or has been "stolen" for FACCH signalling.
• Training sequence (26): known pattern in the middle of the burst, used by the adaptive equalizer to estimate the channel.
• Guard period (8.25 bits ≈ 30 µs): prevents overlap of bursts from mobiles at different distances.

Other bursts: frequency correction burst (FCCH, all zeros), synchronisation burst (SCH, long 64-bit training), access burst (RACH, short, long guard of 68.25 bits), dummy burst.

• 26-multiframe (120 ms): frames 0–11 and 13–24 TCH, frame 12 SACCH, frame 25 idle.
• 51-multiframe (235.4 ms): carries FCCH, SCH, BCCH, CCCH and SDCCH control channels on TS0 of the beacon carrier.

GSM vs CDMA standards

Wi-Fi is the trade name (Wi-Fi Alliance) for wireless local area networks based on the IEEE 802.11 standards. It connects laptops, phones and other devices to each other and to the Internet over short range (about 30–100 m) using unlicensed ISM bands.

Versions

Architecture

 [STA]~~\
 [STA]~~~[Access Point]---Ethernet---Internet
 [STA]~~/     (BSS)
 Ad hoc: [STA]~~~[STA] (IBSS, no AP)

• Infrastructure mode: stations connect through an access point (AP); several APs linked by a distribution system form an ESS.
• Ad hoc mode: stations talk directly.

MAC: CSMA/CA (carrier sense multiple access with collision avoidance) with optional RTS/CTS to solve the hidden-terminal problem; acknowledgements for each frame.

Security: WEP (weak, obsolete) → WPA → WPA2 (AES-CCMP) → WPA3.

Advantages: no cabling, mobility, cheap, high data rates. Limitations: short range, interference in the crowded 2.4 GHz band, shared capacity, security concerns.

Applications: home and office networks, public hotspots, campus networks, offloading mobile data, IoT devices.

A Wireless Local Area Network (WLAN) links devices within a limited area (home, office, campus) using radio waves instead of cables. Most WLANs follow IEEE 802.11 (Wi-Fi) and operate in the unlicensed 2.4 GHz and 5 GHz bands.

• Components: stations (STA) and access points (AP); an AP connects wireless users to the wired LAN.
• Modes: infrastructure (via AP, BSS/ESS) and ad hoc (IBSS, device to device).
• MAC: CSMA/CA with ACKs and optional RTS/CTS.
• PHY: DSSS (802.11b), OFDM (802.11a/g), OFDM + MIMO (802.11n/ac), OFDMA (802.11ax); rates from 11 Mbps to several Gbps.
• Security: WPA2/WPA3 with AES encryption.

 [Laptop]~~\
 [Phone]~~~[AP]---LAN/Internet

Advantages: mobility, easy installation, low cost. Drawbacks: limited range (~100 m), interference and shared bandwidth.

GSM (Global System for Mobile communications) is the 2G digital cellular standard developed by ETSI. Its main specifications:

Other features: SIM-based subscriber identity and roaming, SMS, mobile-assisted hard handoff, discontinuous transmission (DTX) with voice activity detection, and power control.

Channel structure of GSM

GSM has 124 carriers of 200 kHz in GSM-900 (890–915 MHz uplink, 935–960 MHz downlink). Each carrier is divided into 8 time slots; one slot on one carrier is a physical channel (a burst of 156.25 bits every 4.615 ms frame). Logical channels are mapped onto these physical channels.

 Logical channels
 +-- Traffic (TCH): TCH/F 22.8 kbps, TCH/H 11.4 kbps
 +-- Control (CCH)
      +-- BCH : FCCH, SCH, BCCH        (down)
      +-- CCCH: PCH, AGCH (down), RACH (up)
      +-- DCCH: SDCCH, SACCH, FACCH     (both)

• TCH: carry speech (13 kbps full rate, ~6.5 kbps half rate) or data; organised in the 26-frame multiframe (24 TCH, 1 SACCH, 1 idle; 120 ms).
• BCH: FCCH (frequency correction), SCH (frame sync and BSIC), BCCH (cell and network information).
• CCCH: PCH (paging), RACH (random access request, slotted ALOHA), AGCH (channel assignment).
• DCCH: SDCCH (call setup, authentication, location update, SMS), SACCH (measurement reports, power control, timing advance), FACCH (urgent signalling by stealing TCH bursts).
• Control channels use the 51-frame multiframe (235.4 ms) on TS0 of the beacon carrier.

Why TDMA frame efficiency cannot reach 100%

Frame efficiency is the fraction of transmitted bits that carry user data:

η_f = (1 − b_OH / b_T) × 100%

Each normal burst must contain overhead bits that carry no data: 3 + 3 tail bits, 26 training bits and 8.25 guard bits (stealing flags are counted with the data here).

Bits per slot   = 156.25
Overhead/slot   = 6 + 26 + 8.25 = 40.25
Per frame: b_T  = 8 × 156.25 = 1250 bits
           b_OH = 8 × 40.25  = 322 bits
η_f = (1 − 322/1250) × 100% = 74.24 %

(If the 2 stealing flags are also treated as overhead, η = 114/156.25 = 72.96 %.)

Since training bits (for equalization), tail bits (for the decoder) and guard time (for timing differences and power ramping) are essential, b_OH can never be zero, so η < 100%; for GSM η ≈ 74%.

Comparison of CDMA and LTE architectures

CDMA (IS-95/CDMA2000) is a 2G/3G hierarchical, circuit-switched architecture; LTE (4G) is a flat, all-IP, packet-switched architecture.

 CDMA (CDMA2000 1x)
 [MS]~~[BTS]--[BSC/PCF]--[MSC]--PSTN
                  |        |-[HLR/AuC] [VLR]
                  +--[PDSN]--IP net (AAA, HA)

 LTE (EPS)
 [UE]~~[eNodeB]==X2==[eNodeB]
          |S1-MME   |S1-U
        [MME]----[S-GW]--S5--[P-GW]--Internet
          |                    |
        [HSS]               [PCRF]

Functions of CDMA entities

• MS: user terminal; does spreading, RAKE reception and power control.
• BTS: radio transceivers, spreading/despreading, pilot transmission.
• BSC: radio resource management, soft handoff (frame selection/distribution), vocoding, power control.
• MSC: call switching, mobility, link to PSTN; HLR/VLR/AuC store subscriber data, location and keys.
• PCF/PDSN (CDMA2000): packet control and gateway to IP networks; AAA for authentication/billing and HA for Mobile IP.

Functions of LTE entities

• UE: user equipment with USIM.
• eNodeB: the only radio node; radio resource control, scheduling, header compression, ciphering, handoff decisions; eNodeBs linked by X2.
• MME (Mobility Management Entity): control plane – attach, authentication with HSS, tracking area updates, paging, bearer setup, S-GW selection.
• S-GW (Serving Gateway): routes user packets; mobility anchor during handoff between eNodeBs.
• P-GW (PDN Gateway): connects to external IP networks; IP address allocation, policy enforcement, charging.
• HSS (Home Subscriber Server): subscriber database (like HLR + AuC).
• PCRF: policy and charging rules (QoS).

Channelization code

A channelization code is a spreading code used to separate the different channels (users) transmitted from the same source on one carrier. In IS-95 the forward link uses 64 orthogonal Walsh codes of length 64 chips (1.2288 Mcps). Because Walsh codes are mutually orthogonal (zero cross-correlation when time-aligned), channels from one base station do not interfere with each other. Cells are separated by a different code – the short PN code offset – so channelization codes can be reused in every cell.

 Walsh (order 4): W0 = + + + +
                  W1 = + - + -
                  W2 = + + - -
                  W3 = + - - +
 W1·W2 = (1 −1 −1 +1) sum = 0 → orthogonal

Forward channels in IS-95

The 64 Walsh codes give up to 64 logical channels on each 1.25 MHz forward carrier:

Traffic data (9600 bps) is convolutionally coded (r = 1/2), interleaved, scrambled by the long code, Walsh-spread and then quadrature-spread by the I/Q short PN codes before QPSK transmission.

LTE (Long Term Evolution) is the 4G mobile broadband standard of 3GPP (Release 8 onward), designed for high data rates, low latency and an all-IP network.

• Air interface: OFDMA in the downlink and SC-FDMA in the uplink (lower peak-to-average power for mobile batteries); QPSK, 16-QAM, 64-QAM; MIMO (up to 4×4).
• Bandwidth: flexible 1.4, 3, 5, 10, 15, 20 MHz; FDD and TDD.
• Peak rates: about 300 Mbps down and 75 Mbps up (Rel-8); LTE-Advanced reaches 1 Gbps with carrier aggregation.
• Latency: under 10 ms on the radio side.
• Architecture: flat — UE, eNodeB, and the Evolved Packet Core (MME, S-GW, P-GW, HSS); voice carried as VoLTE.

 [UE]~~[eNodeB]--[MME / S-GW]--[P-GW]--Internet

GSM and CDMA standards

• GSM (Global System for Mobile communications): 2G digital cellular standard from ETSI (Europe, 1991). Uses FDMA/TDMA with 200 kHz carriers, 8 time slots per carrier, GMSK modulation, FDD (890–915 / 935–960 MHz in GSM-900), RPE-LTP 13 kbps speech, SIM-based subscriber identity, hard handoff. It became the most widely used 2G system (in Nepal, used by Nepal Telecom and Ncell).
• CDMA (IS-95 / cdmaOne): 2G standard from Qualcomm/TIA (USA, 1993). Uses DS-CDMA: all users share a 1.25 MHz carrier at the same time and are separated by codes (64 Walsh codes on forward link, long PN codes on reverse link), chip rate 1.2288 Mcps. Features frequency reuse 1, soft handoff, fast power control and RAKE receivers. It evolved to CDMA2000.

Architecture of GSM

       Um          Abis          A
 [MS]~~~~~~[BTS]-------[BSC]-------[MSC]----[GMSC]--PSTN/
 ME+SIM     [BTS]------'  (TRAU)      |  |      ISDN
                                      |  +--[VLR]
 |<---- BSS ---------------->|        +--[HLR]--[AuC]
                                      +--[EIR]
                      |<-------- NSS -------->|
                [OMC] (OSS) monitors BSS & NSS

• MS = Mobile Equipment (IMEI) + SIM (IMSI, Ki).
• BSS: BTS – radio transceivers of a cell (Um interface); BSC – controls many BTSs (Abis), channel allocation, power control, handoff; TRAU – speech transcoding.
• NSS (via A interface): MSC – call switching, handoff, billing; GMSC – link to PSTN; HLR – permanent subscriber database; VLR – temporary data of visiting users; AuC – authentication and ciphering keys; EIR – IMEI check (stolen phones).
• OSS: OMC – operation, maintenance and network management.

Frame structure of GSM

GSM uses FDMA + TDMA: each 200 kHz carrier is divided into 8 time slots, gross bit rate 270.833 kbps (bit period 3.69 µs).

 Hyperframe = 2048 superframes = 3 h 28 min 53.76 s
        |
 Superframe = 26 x 51-MF = 51 x 26-MF = 6.12 s
        |
 +------------------+--------------------+
 26-multiframe       51-multiframe
 (traffic) 120 ms    (control) 235.4 ms
        |
 TDMA frame = 8 slots = 4.615 ms
 | TS0 | TS1 | TS2 | TS3 | TS4 | TS5 | TS6 | TS7 |
        |
 Time slot = 156.25 bits = 576.9 µs

Normal burst (one time slot):

|T |  Data  |S| Training |S|  Data  |T |Guard|
|3 |   57   |1|    26    |1|   57   |3 |8.25 |

• Tail bits (3+3): all zeros; let the equalizer/Viterbi decoder start and end in a known state, and give time for power ramp.
• Data (2 × 57): coded speech/data bits.
• Stealing flags (1+1): show whether the data half-burst carries traffic or has been "stolen" for FACCH signalling.
• Training sequence (26): known pattern in the middle of the burst, used by the adaptive equalizer to estimate the channel.
• Guard period (8.25 bits ≈ 30 µs): prevents overlap of bursts from mobiles at different distances.

Other bursts: frequency correction burst (FCCH, all zeros), synchronisation burst (SCH, long 64-bit training), access burst (RACH, short, long guard of 68.25 bits), dummy burst.

• 26-multiframe (120 ms): frames 0–11 and 13–24 TCH, frame 12 SACCH, frame 25 idle.
• 51-multiframe (235.4 ms): carries FCCH, SCH, BCCH, CCCH and SDCCH control channels on TS0 of the beacon carrier.

Use of traffic and control channels while making a call

Mobile-originated call (user dials a number):

 MS                                   Network
 |<--- FCCH, SCH, BCCH (sync, info) ----|
 |---- RACH: channel request ---------->|
 |<--- AGCH: SDCCH assigned ------------|
 |<--> SDCCH: authentication, ciphering,|
 |          setup (called number)       |
 |<--- SDCCH: TCH assignment -----------|
 |<==> TCH: speech  (+ SACCH reports)   |
 |<--- FACCH: handoff / release --------|

1. FCCH – the mobile finds the beacon carrier and corrects its frequency.
2. SCH – it reads BSIC and frame number and synchronises.
3. BCCH – it reads cell/network information and camps on the cell.
4. RACH – it sends a channel request (access burst, slotted ALOHA).
5. AGCH – the network assigns an SDCCH.
6. SDCCH – authentication (RAND/SRES), ciphering start, and call setup messages with the dialled number; the network then assigns a TCH.
7. TCH – speech flows at 13 kbps (22.8 kbps coded); SACCH runs with it carrying measurement reports (uplink) and power control/timing advance (downlink).
8. FACCH – steals TCH bursts for urgent signalling such as handoff commands and call disconnection.

For a mobile-terminated call, the only change is that the network first sends a page on PCH; the mobile answers on RACH and the rest is the same.