8.0 Cellular Phone Systems

8.01 Cellular Voice Reference Model

8.02 International Standards

8.03 The Cellular Concept


8.1 Cellular Telephones

8.1.1 Cellular Phone Services


8.2 Analog Cellular Systems

8.2.1 AMPS

8.2.2 TACS

8.2.3 NMT 450/900

8.2.4 C-450/C-Netz


8.3 Digital Cellular Systems

8.3.1 GSM

8.3.2 DCS 1800

8.3.3 IS-54/136 D-AMPS

8.4 DMS-MTX System

8.5 Cellular Standards Summary


8.4 DMS-MTX System

8.4.1 Cell Site Controller


8.5 Cellular Standards Summary


Assignment Questions


For Further Research



8.0 Cellular Phone Systems



This section will:

• Examine various analog and digital systems

• Discuss cellular radio techniques

• Examine the Nortel DMS-MTX

• Consider international approaches to cellular phones


Radio Telephony Tutorial by Nortel

Radio Standards Overview


Mobile radio service was introduced in St. Louis in 1946. This radio dispatching system had an operator who patched the caller to the PSTN. Later, IMTS allowed customers to dial their calls without an operator. From this humble beginning came the present cellular phone system.

The cellular network is viewed by the PSTN as just another end-office where calls originate and terminate.

The STP† handles the network routing by establishing the route to the HLR† for a specific mobile user. This simplifies network management, because only the routing tables in the STP need to be updated as the system grows. Each MSC† does not have to maintain full routing tables to all other MSCs.

8.01   Cellular Voice Reference Model

The essential parts in this model include:

AC — Authentication Center. This manages the authentication of the end user or equipment on behalf of the MS. It may serve many HLRs or in fact be an HLR itself.

BS — Base Station. The base station manages one or more cell sites and consists of a controller and one or more radio transceivers.

EIR — Equipment Identity Register. This is not presently well defined, but is used to identify end user equipment and reduce the incidents of fraud.

HLR — Home Location Register. This identifies the particular user and their service profile. It also records their current location and authorization period. The HLR may be distributed over more than one entity.

MS — Mobile Station. This is the actual radio based terminal that provides customer access to the network.

MSC — Mobile Switching Center. The telecommunications switch which routes calls between mobile users and the PSTN.

VLR — Visitor Location Register. This allows visitors to roam on other systems.

This reference model distinguishes between various tasks and does not necessarily reflect the actual physical equipment.

Unfortunately, there is a wide range of incompatible technologies being used at the Um air interface. Consequently, although it is possible to communicate with people all over the world, it is not possible to take your phone with you everywhere. This makes it difficult to adapt the present system to support global PCS.

The cellular infrastructure market is dominated by four major corporations: Lucent Technologies, Nortel, Ericsson, and Motorola.

8.02   International Standards

There are a number of different cellular standards used throughout the world.

Analog Cellular Systems




Digital Cellular Systems


DCS 1800




Some of these digital cellular systems are being marketed as PCS systems.

8.03   The Cellular Concept

Since it is not possible to assign a separate RF carrier to every user, the radio carriers must be shared. However, as more and more people demand service, it becomes necessary to reuse the frequencies.

Frequency reuse becomes possible if the transmission range is limited. A hexagonal pattern is often used to allocate the frequency distribution. In the illustration below, the available frequencies are distributed among 7 cells. These 7 cells are called a cluster.

The channels assigned to any one cell can be reused with minimal interference by reproducing the pattern such that each cell is as far away from its twin as possible.

The cluster size (N) is typically 4, 7, or 12. These values come from the equation:

8.1   Cellular Telephones

The current cellular system is experiencing unprecedented growth in subscribers, services, and technological innovation. Some of the offered services include:

• Paging, vehicle location

• Text, data, facsimile transmission

• Traffic, weather information

• Emergency aid dialing

• Electronic funds transfer for fare payment

There are however, some areas of concern:

• Computerized call hand-offs between cell sites

• Caller identification

• Remote diagnostics

• Reliability

• Technology mix [digital, analog, UHF, audio, computer]

• Billing

• Long distance paging

A telephone call requires a full duplex link, which allows for simultaneous transmission and reception. To do this, each subscriber is assigned transmit and receive frequencies for the duration of a call. The frequency pair is sometimes referred to as the forward and reverse channels or the up and down link. Under control of the cell site, the cellular phone must be able to tune to any of the hundreds of frequency channels in the system.

Some of the adjacent cells monitor the signal strength from the portable unit in order to help the MSC determine which cell site should handle the call. If the signal weakens because the customer has moved, a call hand–off will be necessary. This requires the phone switch to another frequency pair, and the calling path rerouted. All of this must occur without the user’s knowledge.

8.1.1  Cellular Phone Services

Cellular phones offer more services than conventional phones. Mobility is obviously the greatest service. However, providing this service increases the complexity of the phone system, and tasks that are relatively simple on the wired PSTN, become quite complex on a cellular system. Roaming

In some areas, there may be more than one cellular system. In other areas, two different systems may be adjacent to each other. Subscribers in one system may find it beneficial to be able to access both networks. This is normally accomplished by registering in both networks. This can be done in advance, on a per call basis, or by a prior agreement between the cellular carriers. DIMA†

This allows a telephone user to page any mobile user within the service area. Networking

As cellular systems become more wide spread, it may become necessary to offer the local MSC services over a multi host environment. For example, an MSC to MSC hand-off or DIMA can be expanded to include a wide area search to locate a customer who may have left the local MSC coverage area.

8.1.2  Access Techniques

Access techniques can be divided into two categories: fixed assignment, and random access. Fixed Assignment Access

There are three basic ways to combine customers on fixed channel radio links:

• FDMA† - analog or digital

• TDMA† - three conversation paths are time division multiplexed in 6.7 mSec time slots on a single carrier.

• CDMA† - this uses spread spectrum techniques to increase the subscriber density. The transmitter hops through a pseudo-random sequence of frequencies. The receiver is given the sequence list and is able to follow the transmitter. As more customers are added to the system, the signal to noise ratio gradually falls.

CDMA uses frequency hopping to spread the signal over the entire time-frequency window. The modulated bandwidth may be hundreds of times greater than that of the baseband signal. The frequency hopping pattern is determined by a code shared between the transmitter and designated receiver, consequently this system has high antijam and security properties.

There are two CDMA common air interface standards:

Cellular (849-894 MHz) - TIA/EIA/IS-95A

PCS (1850-1990 MHz) - ANSI J-STD-008

These systems are very similar except for their frequency plan, mobile identities, and message fields. Although these standards are quite stable, they are subject to change.

Spread spectrum systems generally fall into one of two categories: frequency hopping or direct sequence.

Frequency hopping is accomplished by rapid switching frequency synthesizers in a pseudo-random pattern.

DS-CDMA† multiplies the data source by a pseudo noise ±1 binary sequence. This sequence, made up of chips, occurs at a higher bit rate than the data. Consequently the bit rate is artificially increased, as is the corresponding spectrum.

Capacity Comparison[1]





Operating Cellular Bandwidth [MHz]




Frequency Reuse Factor [K]




RF Channel Bandwidth [MHz]




# RF Channels




# RF Channels per Cell




Voice Usable RF Channels per Cell




# Voice Channels per RF Channel




# Voice Channels per Cell




Sectors per Cell




Voice Calls per Sector




Capacity vs. AMPS





Eventually analog cellular systems will be replaced by digital technology. Some estimate that one third will be based on TDMA and the balance on CDMA.[2] Random Access

The random access techniques are found in time-multiplexed schemes and include:

• ALOHA [pure, slotted, reservation]


These techniques are used exclusively for data applications and will be considered later. Canada

AMPS is available throughout most of the country. Unfortunately, this compatibility will end with the modernization to all digital networks. Two incompatible schemes, namely CDMA and TDMA are being implemented.

Four PCS licenses were granted in Canada in 1996:

Mobility Canada: IS-95 CDMA, 10 MHz, primarily for the high tier

Clearnet: IS-95 CDMA, 30 MHz, primarily for the high tier

Cantel: IS-136 TDMA, 10 MHz, primarily for the high tier

Microcell 1-2-1: PCS1900, GSM in the 1900 band, 30 MHz, marketed as FIDO, scalable to needs, will offer worldwide roaming.

8.2   Analog Cellular Systems

Analog systems are often referred to as first generation systems. At the moment they dominate the cellular world, but are gradually being replaced or supplemented by second generation digital systems.

Analog Cellular Systems[3]


Principle Location

Mobile Tx/Rx [MHz]

# Channels




Americas Australia




TACS [1]










NMT 450





NMT-900 [2]





C-450 [2]

Germany, Portugal









Radiocom 2000 [3]











NTT [2, 3]











J/NTACS [2,3]












[1]   890-915/935-890 MHz is now allocated to GSM in Europe

[2]   The channel spacing is half the normal channel bandwidth, the system uses frequency interleaving to overlap channels

[3]   Different frequencies are used in different parts of the country

8.2.1  AMPS

AMPS† is an analog system developed by Bell Labs in the 1970’s. It is currently the most widely used standard in the world and is specified in TIA IS-41.

Frequency Band [MHz]

Rx: 869 - 894 Tx: 824 - 849

Access Method


Duplex Method


Number of Channels


Channel Spacing [KHz]




Channel Bit Rate



This standard has been slightly modified since its inception in the US in 1983.


Original AMPS

Present AMPS

Full duplex channels



Mobile Tx Frequency Range

825.03 - 844.98 MHz

824 - 851 MHz

Mobile Rx Frequency Range

870.07 - 889.98 MHz

869 - 896 MHz


The present system divides the 832 channels into two blocks of 416 channels. This was done to encourage competition between two service providers each granted a license to operate in one of the blocks. Within each block, 21 channels are reserved for signaling.

Some of the weaknesses associated with this system include:

• Call blocking during busy hours in urban areas

• Misconnect and disconnects due to rapidly fading signals

• Lack of privacy and security

• Limited data transmission [1200 bps] Cell Channel Allocation

The electric field intensity of radio waves in free space falls off as the square of the distance [r2]. However, the field intensity in cellular systems falls of slightly faster due to ground effects. The rate is somewhere in the region of r3 to  r5. This is actually a fortunate effect because it allows for frequency reuse.

It is not possible to assign all channels to each cell since adjacent cells using the same frequencies would interfere with each other. The channel distribution in the 832 channel system is as follows:

• A cell group of 7 adjacent cells, share 416 full duplex channels

• No cell contains any adjacent frequency channels

• 4 cells are assigned 56 channels

• 3 cells are assigned 57 channels

• 21 channels are reserved for control


The frequency reuse factor for this arrangement is 7.

Frequency utilization can be improved by cell splitting and sectoring. These approaches effectively reduce the size of the customer service area and allow frequencies reuse. This increases the number of hand-offs and other demands on the MTX.

Cell splitting involves the creation of a new smaller cell from two larger ones, while sectoring is the breakup of a single cell into smaller ones. Typically, cell sites are split 3 or 4 to 1.

To minimize spill over into nearby cells, the cell antennas are given a slight downward tilt, and the output power is limited to 100 Werp.

Another way to increase utilization is by channel borrowing. A few channels are allowed to violate the normal frequency assignments and move between cells. This allows the system to dynamically vary the number of customers that can be served in a given cell. Careful consideration must be given to potential co-channel interference

This principle can be further extended to provide dynamic channel assignment, where the assigned cell frequencies are continually changing to meet the shifting demand patterns. N-AMPS

N-AMPS† is an interim technology developed by Motorola to increase the utilization of AMPS until a suitable all digital replacement can be developed.

Some of the congestion problems now found in major urban areas can be resolved by reducing the broadcast channel bandwidth. N-AMPS increases system capacity by splitting each 30 KHz AMPS channel into three 10 KHz channels.

8.2.2  TACS

The TACS† system was developed by Motorola and is similar to AMPS but operates in a slightly higher frequency band. It was introduced into the UK in 1985. It is also deployed in Japan under the name JTAC.

The TACS system has a 25 MHz bandwidth and 25 KHz channel spacing, allowing for a possible 1000 subscribers in a cell cluster. ETACS

Enhanced TACS.

8.2.3  NMT 450/900

The NMT-450 system was developed by Ericsson and Nioka to provide cellular service in the rugged Scandinavian countries. The system has been upgraded to the NMT-900 to increase the system capacity and ease portable design.

The NMT-900† is considered by some to be the leading system in the world, covering large parts of Sweden, Norway, Finland, and Denmark. It is also found in Spain, Tunisia, Netherlands, Austria, and Ireland.

The MTX is an AXE-10 switch. The system has a maximum of 1999 channels in a cell cluster, nearly double that of TACS.

NMT450    450 - 470 MHz original system 180 channels

NMT900    860 - 960 MHz new system

• A 4 KHz tone is added to the speech channel to monitor transmission quality

• If the tone quality deteriorates, the mobile phone generates a hand-off request

8.2.4  C-450/C-Netz

C-450 was installed in South Africa in the 1980s, and now goes by the trade name Motorphone. The system is known as C-Netz in Germany and Austria.

This system is actually comprised of two networks running in two different frequency bands. The 450 MHz system can handle more than 100 thousand subscribers, and the 900 MHz one can handle more than 2 million.

The cell boundaries are not fixed, but are dynamically adjusted for load sharing, and hand-off can be forced on distance criteria alone. The mobile and cell site transmit power levels are automatically adjusted to match the calculated distance to the subscriber. Each cell regularly interrogates users within its boundaries, thus the network knows the location of all mobile users.

If co-channel interference occurs, the cell site can generate an intra-cell hand-off by reassigning the mobile frequency.

• Tx & Rx frequencies are assigned only after the con­nection through the PSTN is completed

• Speech is time compressed to include a 5.28 Kbps FSK data burst in the voice channel. This is used for intra-cell hand-off

• A 256 state scrambler is assigned on each speech channel to ensure privacy

• The system architecture is decentralized

8.3   Digital Cellular Systems

Digital cellular systems are second-generation mobile networks. In some areas, dual handsets are required in order to keep the present customer base and gradually upgrade the end-user. Unfortunately, there is no single standard that is universally accepted. To make matters even more confusing, many service providers are already planning the deployment of third generation or PCS networks.

The principle advantages of going digital are:

• Enhanced services: fax, data

• More efficient spectrum management to reduce congestion

Europe and a significant part of the world have standardized on GSM. Canada and the United States have fragmented the market and are implementing TDMA [IS-54] and CDMA [IS-95] in various areas.

There is no easy way to gracefully evolve from the present analog systems to digital ones. In many countries, new frequencies are being opened up. This allows service providers to directly go to all digital networks. These networks are often referred to by the generic term PCS in order to differentiate them from the existing cellular providers.

However, it is also necessary for existing analog cellular systems to modernize to all digital facilities. This is not particularly easy since they must provide digital channels on the same frequencies now used to carry analog signals. Consequently, dual mode phones are needed to switch between analog and digital facilities. Eventually, all of the existing analog phones will have to be replaced.

The TDMA systems being introduced in North America can coexist and use the same frequency assignments as the AMPS system. This however, is not true of CDMA systems. It is also interesting to note that the North American TDMA systems are quite similar to the GSM networks being developed elsewhere.

8.3.1  GSM

IEC GSM Tutorial

Map of North American GSM Service Areas

SystemView Application Note: AN-121B QPSK Transmitter & Receiver Smulation Using Ideal Components.

GSM is offered in the Ottawa area under the trade name of FIDO.

The GSM system in Canada provides coverage to about 94% of the population. However, at the moment this excludes large parts of the Maritimes, northern Ontario, Manitoba, and Saskatchewan.

Fido has signed roaming agreements with other GSM service providers in 3,122 foreign cities. These services are activated on request only and may require a different handset. Dual mode phones are needed to support roaming within the existing analog cellular system.

GSM† is a digital cellular system that allows roaming in 17 European countries[4] and supports:

• Voice and data integration over a single channel and ISDN

• Speech and data encryption

• Group 3 fax

GSM uses a TDMA access format. Base stations can handle a total of 124 frequency bands. Channel 0 is performs a dual role of providing a signaling channel and monitoring signal strength. All other channels can be assigned to subscribers.

In 1982 CEPT† formed the GSM† study group develop a pan-European public land mobile system.

GSM objectives included:

• Good subjective speech quality

• Low terminal and service cost

• Support for international roaming

• Ability to support hand held terminals

• Support for range of new services and facilities

• Spectral efficiency

• ISDN compatibility

In 1989, GSM was taken over by ETSI†, and in 1990 they published phase I of the GSM specifications. Commercial service started in 1991. By 1993 there were 36 GSM networks in 22 countries and 25 others were considering it.

Although initiated in Europe for services below 1 GHz, GSM has spread abroad and been adapted to higher bands. GSM networks [including DCS1800 and PCS1900] are operating in over 80 countries. By 1994, there were 1.3 million subscribers worldwide and by 1995 there were over 5 million. By 1996 there were over 10 million subscribers in Europe alone. North America has introduced a derivative of GSM called PCS1900. With all of this growth, the acronym GSM more aptly stands for Global System for Mobile communications. GSM Services

Although GSM is ISDN compatible, the standard B channel rate of 64 Kbps cannot be supported over the radio link.

The most basic service supported by GSM is telephony. There is also an emergency service, much like 911.

GSM users can send and receive data, at rates up to 9600 bps, to users on POTS, ISDN, Packet Switched Public Data Networks, and Circuit Switched Public Data Networks using a variety of access methods and protocols, such as X.25 or X.32.

Group 3 facsimile is supported by means of a fax adapter. GSM SMS† supports bi-directional messages up to 160 bytes. SMS supports point-to-point messages, providing an acknowledgment of receipt to the sender, and broadcast messages for traffic or news updates. Messages can also be stored in the SIM card for later retrieval.

Supplementary services include call forwarding, call barring, caller identification, call waiting, multi-party calling and so on. GSM Architecture

The GSM network consists of:

• Mobile station — carried by the subscriber

• Basestation — controls the radio link with the mobile station

• Mobile services switching center — performs the switching of calls between the mobile and other fixed or mobile network users, as well as mobility management

• Operations and maintenance center — oversees the proper operation and setup of the network     Mobile Station

The MS consists of the mobile terminal and a smart card called the SIM†. The SIM card allows a subscriber to use any GSM terminal. Each SIM contains a unique IMSI† code and may be password protected. Likewise, each piece of mobile equipment is identified by a unique IMEI† code.

Base Station

The base station is comprised of a BTS† and BSC†.

The BTS contains the radio transmitters and receivers and handles the radio-link protocols with the MS.

The BSC handles the channel setup, frequency hopping, handover, and communicates to the MSC.


The principle network component is the MSC. It functions like a normal PSTN switch and controls registration, authentication, location updating, handover, and call routing. The MSC connects to the PSTN and uses SS7 signaling.

The HLR†, VLR†, and MSC support call-routing and roaming. The VLR database is a subset of the HLR.

Besides this, two other registers are used for authentication and security purposes. The EIR† database contains a list of all valid mobile equipment on the network, each with its IMEI. The IMEI can be tagged invalid if it’s reported stolen or is not type approved. The AuC† database keeps a copy of the secret key stored in each subscriber's SIM card, which is used for authentication and encryption over the radio channel.

Radio Link

In Europe the ITU has allocated the 890-915 MHz band for the uplink (mobile to base station) and the 935-960 MHz band for the downlink (base station to mobile). At the moment, the GSM network uses the top 10 MHz of each band but eventually it will be allocated the entire 2x25 MHz band. Access and Channels

GSM uses TDMA/FDMA. The 25 MHz bandwidth is divided into 124 carrier frequencies spaced 200 KHz apart. One or more carrier frequencies are assigned to each base station. Each carrier is time division multiplexed into 26 slots.

The time slot or burst period is about 577 ΅Sec long and contains one TDD end-user channel. Eight burst periods form a frame about 4.615 mSec long. 12 frames are grouped into a TCH channel. In order to provide synchronization and control, 2 TCH channels and 2 control channels are organized into a 120-mSec multiframe.

There are two types of channels: dedicated channels, which are allocated to a mobile station, and common channels, which are used by mobile stations in idle mode. The channels are defined by the number and position of the burst period. The entire pattern repeats approximately every 3 hours.

Traffic Channels

The TCH† is used to carry speech and data traffic. They occupy frames 0 - 11 and 13 - 24 of the 26-frame multiframe. TCHs for the uplink and downlink are separated in time by 3 burst periods.

GSM also defines half-rate TCHs, which have not yet been implemented. Half-rate TCHs will effectively double the capacity of a system once half-rate speech coders operating at 7 Kbps are developed. Eighth-rate TCHs called  SDCCH† are also defined for signaling.

Control Channels

Common channels can be accessed both by idle mode and dedicated mode mobiles. The common channels are used by idle mode mobiles to exchange the signaling information required to change to dedicated mode. Mobiles already in dedicated mode monitor the surrounding base stations for handover and other information. The common channels are defined within a 51-frame multiframe, so that dedicated mobiles using the 26-frame multiframe TCH structure can still monitor control channels. The common channels include:

AGCH — Access Grant Channel. Used to allocate an SDCCH to a mobile following a request on the RACH.

BCCH — Broadcast Control Channel. This provides access information to the mobile station and is used to determine whether to request a handoff. It contains the base station identity, frequency allocations, and frequency-hopping sequences.

CBCH — Cell Broadcast Channel. Used by the ground network for occasional broadcasts.

FACCH — Fast Associated Control Channel. It is used for the control of handovers.

FCCH — Frequency Correction Channel. Provides frequency synchronization information.

PAGCH — Paging and Access Grant Channel. Used to request a call setup to convey paging information.

PCH — Paging Channel. Used to alert the mobile station to an incoming call.

RACH — Random Access Channel. A slotted aloha channel used by the mobile station to request network access.

SACCH — Slow Associated Control Channel

SCH — Synchronization Channel. This follows the frequency burst by 8 bits and provides a timing reference for the time slots.

TCH/F — Traffic Channel, Full rate. It contains speech at 13 Kbps or data at 3.6, 6, or 12 Kbps.

TCH/H — Traffic Channel, Half rate. It contains speech at 7 Kbps or data at 3.6 or 6 Kbps.

Burst Structure

There are four different types of bursts in GSM. The normal burst is used to carry data and most signaling. It has a total length of 156.25 bits, and is comprised of two 57 bit information blocks, a 26 bit equalization training sequence, 1 stealing bit for each information block (used for FACCH), 3 tail bits at each end, and an 8.25 bit guard sequence. The 156.25 bits are transmitted in 0.577 mSec, giving a gross bit rate of 270.833 Kbps.

The F burst, used on the FCCH, and the S burst, used on the SCH, are the same length as a normal burst. The access burst is used only on the RACH and is shorter than the normal burst.

Speech Coding

GSM uses RPE-LPC† coding with a long-term predictor loop. Since information does not change quickly from sample to sample, the present value is used to predict the next sample. The digitized signal is a combination of the difference between predicted and actual sampled values and pervious samples. Speech is sampled every 20 milliseconds and encoded as a 260 bit string. The resultant total bit rate is 13 Kbps.

Designing with the Voice Band Audio Processor by Texas Instruments Channel Coding and Modulation

Convolution encoding and block interleaving is used to protect the transmitted signal from radio interference. Three different algorithms are used depending on the data rate. The sampled block of 260 bits is not equally important in producing acceptable voice. From subjective testing, the bits were divided into three classes:

• Class Ia 50 bits - most sensitive to bit errors

• Class Ib 132 bits - moderately sensitive to bit errors

• Class II   78 bits - least sensitive to bit errors

Class Ia bits have a 3 bit CRC added for error detection. If an error is detected, the frame is discarded and replaced by a slightly attenuated version of the previous correctly received frame. These 53 bits, together with the 132 Class Ib bits and a 4 bit tail sequence (a total of 189 bits), are placed into a 1/2 rate convolutional encoder of constraint length 4. Each input bit is encoded as two output bits, based on a combination of the previous 4 input bits. The convolutional encoder thus produces 378 bits, to which are added the unprotected 78 Class II bits. Thus every 20 ms speech sample is encoded as 456 bits, giving a bit rate of 22.8 Kbps.

Each sample is interleaved to minimize radio interference. The 456 bits from the convolutional encoder are divided into 8 blocks of 57 bits, and transmitted in eight consecutive time-slot bursts. Since each time-slot burst can carry two 57-bit blocks, each burst carries traffic from two different speech samples.

The time-slot burst rate is 270.833 Kbps. This digital signal is modulated onto the analog carrier frequency using GMSK†.

Multipath Equalization

To minimize the effect of multipath fading caused by reflected radio signals, a 26-bit training sequence transmitted in the middle of every time-slot burst. The handset then uses this information to correct the actual transmitted signal. The GSM specifications do not state how this is to be done.

Frequency Hopping

A mobile station has to be frequency agile in order to switch between frequency channel assignments. GSM makes use of this inherent ability to implement slow frequency hopping, where the mobile and BTS transmit each TDMA frame on a different carrier frequency. The frequency-hopping algorithm is broadcast on the BCCH. This reduces the effect of frequency dependent multipath fading.

Discontinuous Transmission

Minimizing co-channel interference is important, since it can provide better service, reduce the cell size, or increase the system capacity. Co-channel interference can be reduced by means of DTX†. This takes advantage of the half duplex nature of conversation, by turning the transmitter off during silent periods. This helps conserves mobile power.

Voice activity detection. is essential to making this possible. The circuit must distinguish between voice and noise. If a voice signal is misinterpreted as noise, the transmitter is turned off and clipping occurs. If noise is misinterpreted as voice too often, the DTX advantage is lost. To assure the receiver at the other end that the connection is not dead during the turn off period, ‘comfort’ noise is added during the silent interval.

Discontinuous Reception

Discontinuous reception is another method used to conserve power. The paging channel, used by the base station to signal an incoming call, is structured into sub-channels. Each mobile station needs to listen only to its own sub-channel. Between successive paging sub-channels, the mobile goes into sleep mode.

Power Control

The five classes of mobile stations are defined according to their peak transmitter power rating of 0.8, 2, 5, 8, and 20 watts. Both the mobiles and the BTS operate at the lowest power level needed to maintain an acceptable signal quality. Power levels can be stepped up or down in steps of 2 dB from the peak power for the class down to a minimum of 13 dBm (20 milliwatts).

The mobile station determines the signal strength or signal quality based on the bit error ratio, and passes the information to the BSC, which then determines the power setting. Network Protocol Layers

Because mobile users can roam nationally and internationally in GSM requires that registration, authentication, call routing and location updating functions in the GSM network.

The signaling protocol in GSM is structured into three layers.

Layer 1 is the physical layer, which uses the above mentioned channel structures.

Layer 2 is the data link layer. A modified version of the ISDN LAPD protocol, called LAPDm is used across the Um interface. SS7 is used across the A interface.

Layer 3 is divided into 3 sublayers:

RRM† controls the setup, maintenance, and termination of radio and fixed channels, including handovers.

MM† manages the location updating and registration procedures, security and authentication.

CM† handles general call control, supplementary and short message service.

Signaling in the fixed part of the network is done through MAP†, which is built on top of TCAP†, the top layer of SS7.

Radio Resources Management

The RR layer oversees the establishment of links between the mobile station and the MSC. An RR session is initiated by a mobile through the access procedure. It handles the management of radio features such as power control, discontinuous transmission and reception, and timing advance.


There are four different types of hand-off in the GSM system:

• Channels (time slots) in the same cell

• Cells BTS under the control of the same BSC

• Cells under the control of different BSCs, but the same MSC

• Cells under the control of different MSCs.

The first two types of hand-offs are called internal handovers, since they involve only one BSC. To save signaling bandwidth, they are managed by the BSC without involving the MSC, except to notify it at the completion of the hand-off. The last two types of hand-offs are called external. They are handled by the MSCs involved. The original or anchor MSC, remains responsible for most call-related functions, with the exception of subsequent inter-BSC hand-offs under the control of the new MSC, called the relay MSC.

Hand-offs can be used as a means of traffic load balancing. During its idle time slots, the mobile scans the BCC of up to 16 neighboring cells, and forms a list of the six best candidates for possible hand-off, based on the received signal strength. This information is passed to the BSC and MSC, at least once per second, and is used by the handover algorithm.

The GSM recommendations do not define the specific hand-off algorithm. There are two algorithms used, both closely tied in with power control:

• Minimum acceptable performance algorithm — This increases the power level of the mobile until an acceptable signal level is achieved. If further power increases do not improve the signal, then a handover is considered. This simple method is quite common, but it creates 'smeared' cell boundaries when a mobile transmitting at peak power goes some distance beyond its original cell boundaries into another cell.

• Power budget method — This is more complicated but avoids the 'smeared' cell boundary problem and reduces co-channel interference. It forces hand-offs to maintain the signal quality at the lowest power level.

Mobility Management

The MM layer handles location management, authentication and security issues. Location management is needed to route incoming calls.

Location updating

A powered-on mobile is informed of an incoming call by a paging message sent over the PAGCH channel. In GSM, cells are grouped into location areas and updating messages are required when moving between them.

HLR VLR registers support location area paging. When a mobile station enters a new location area, it registers with the network to indicate its current position. Normally, a location update message is sent to the new MSC/VLR, which records the location area information, and then sends it to the subscriber's HLR. Normally the information sent to the HLR is SS7 address of the new VLR. If the subscriber is entitled to service, the HLR sends the subscriber information needed for call control to the new MSC/VLR and sends a message to the old MSC/VLR to cancel the old registration.

To assure reliability, GSM also has a periodic location updating procedure. The HLR database is updated as often as the service provider feels is necessary. It is a trade-off between signaling traffic and speed of recovery. If a mobile does not register after the updating time period, it is deregistered.

Another procedure is the IMSI attach and detach. A detach lets the network know that the mobile station is unreachable, thus avoiding needless messages. An attach is the reverse.

Authentication and Security

User authentication is a very important function. This involves the SIM card in the mobile, and the AuC†. Each subscriber is given a secret key, one copy is stored in the SIM card and the other in the AuC. During authentication, the AuC generates a random number and sends it to the mobile. Both the mobile and the AuC then use the random number, in conjunction with the subscriber's secret key and the A3 ciphering algorithm. The mobile set generates an SRES† and sends it back to the AuC. If this matches the one calculated by the AuC, the subscriber is authenticated.

The same initial random number and subscriber keys are also used to compute the ciphering key using an algorithm called A8. This ciphering key, together with the TDMA frame number, use the A5 algorithm to create a 114 bit sequence that is XORed with the 114 bit burst.

Another level of security is performed on the mobile equipment itself. Each GSM terminal is identified by a unique IMEI† number. A list of IMEIs in the network is stored in the EIR†. The MSU can respond in 3 ways:

White-listed — The terminal is allowed to connect to the network.

Gray-listed — The terminal is under observation from the network for possible problems.

Blacklisted — The terminal has either been reported stolen, or is not type approved for a GSM network. The terminal is not allowed to connect to the network.

Communication Management

The CM† layer is responsible for CC† supplementary service management, and short message service management. Call control follows the ISDN procedures specified in Q.931. Other CC functions include call establishment, selection of service type, and call release.

Call routing

GSM numbering follows the Mobile Subscriber ISDN numbering plan. This number includes a country code and a National Destination Code, which identifies the subscriber's operator. The next few digits may identify the subscriber's HLR within the home PLMN.

An incoming call is routed to the GMSC†. This switch is able to interrogate the subscriber's HLR to obtain routing information. It also contains a table linking MSISDNs to their corresponding HLR. The terminal returns the MSRN† to the GSMC. GSM Phase 2+

The GSM specification is currently being expanded to include the following features:


• Enhanced full rate codec

• CAMEL† IN† facilities

• ASCI† services

• SIM† application tool kit

• Support for optimal roaming

• Call interception

8.3.2  DCS 1800

Frequency Band [MHz]

Rx: 1805 - 1880       Tx: 1710 - 1785

Access Method


Duplex Method


Number of Channels


Users per Channel


Channel Spacing

200 KHz


0.3 GMSK

Channel Bit Rate

270.833 Kbps


This is a low power variation of GSM shifted to the 1.8 GHz band. It is currently being implemented in Europe by Mercury One-2-One.

DCS 1900

This is another variation of GSM shifted to the 1.9 GHz band.

8.3.3  IS-54/136     D-AMPS

IS-54 is similar to GSM however, it uses a lower bit rate, narrower channel, and less bit interleaving. IS-136 is being marketed by AT&T as a PCS system.

D-AMPS† is a digital upgrade to the analog AMPS system and is unfortunately often referred to by its access method, TDMA. Cell phones using this standard are expected to operate in either an analog or digital mode. In several ways, this standard is similar to the GSM system developed in Europe.

The voice quality is apparently inferior to that of the AMPS system.[5] To overcome this, IS-136 has been adopted. This is essentially a software upgrade which allows a wide range of data type services to be supported. It is expected that a new vocoder will eventually solve the voice quality concerns.

IS-136 adds a DQPSK digital control channel to the existing FSK AMPS control channel. It also has an improved speech coder, supports new features and protocols, and can be used in both the 800 MHz and 1.9 GHz band.

Some new features include:

• ‘Compatibility’ between 800 MHz cellular and 1.9 GHz PCS systems

• Improved speech quality

• 2-way short messaging or text paging

• Emergency calls

• Improved calling party ID

• Scaleable services for private and residential systems

In residential areas, IS-136 phones can act as standard cordless phones.

The Digital Control Channel (DCCH)

The digital control channel consists of three layers:

• Physical

• Network

• Call processing Physical Layer,

The physical channel uses 48 Kbps π/4 DQPSK modulation and 2:1 convolution coding. It is divided into 40 mSec frames, containing 6 slots.

π/4 DQPSK modulation is a form of QPSK where the phase transitions from one symbol to the next are restricted to ±π/4 and ±3π/4. Eliminating the ±π transitions, reduces amplitude variation on the output signal.

A full-rate digital control channel uses every third slot. About 125 data bits per slot are transmitted in the down link. In addition to carrying customer data, the link carries SCF† bits, which are used to determine the status of the uplink Network Layer

This layer performs four main functions:

• Monitoring and controlling the uplink

• Decoding the network packets

• Filtering packets not destined for the mobile

• Controlling mobile low power duration

The network superframe is 640 mSec long and contains 16 frames. A full-rate channel contains 32 slots per superframe. The superframe contains one of three message types: FBCCH, EBCCH, and SPACH.

FBCCH and EBCCH messages contain information required by all cell phones. SPACH messages are addressed and pertain to specific users.

There are three types of SPACH messages:

• PCH - notifies the mobile phone of an event

• SMSCH - used for short messages

• ARCH - used to acknowledge a mobile transmission

Two consecutive superframes, a primary and a secondary, form a hyperframe. PCH messages are transmitted in the paging slot of the primary and repeated in the secondary.

The mobile switches to a low power mode during the time between paging slots to conserve power. Call Processing Layer.

While in the standby or camping mode, the mobile is powered on, waits for incoming notices, and monitors the RSSI levels on neighboring control channels. The mobile automatically switches to the best channel.

The Digital Traffic Channel (DTC)

The DTC is constantly being modified as the cellular standard evolves. Originally based on IS-54B, it now has a new vocoder and enhanced signaling capabilities. IS-136 has added new control messages, thus providing new services and supporting ‘transparent extension’ of cellular services into the PCS band. AMPS Channels

IS-136 supports enhanced AMPS capabilities. The FSK control channel is renamed the ACC† and the FM voice channel is called the AVC†. Signaling has been added to the AMPS channels to allow the mobile phone to switch between digital and analog modes to find the channel that will provide the best service.

IS-136 builds on existing AMPS and D-AMPS technology. It uses the same modulation scheme and has the same coverage and footprint of IS-54B.

TDMA digital channels increase the system capacity because:

• Three TDMA Digital Traffic Channels use the same spectrum as one AMPS voice channel

• TDMA supports a wider range of power levels

• Service selection incorporates information about service capability in addition to signal strength

• Digital communication allows denser reuse of cellular spectrum

Quality of service is improved because the mobile constantly monitors signal strengths and relays its measurements to the basestation.

8.3.4  IS-95

IS-95 was developed primarily by Qualcomm. It owns a number of key patents, and any service provider using this technology is required to pay a license fee.

This system is sometimes referred to by its access method, CDMA

Frequency Band [MHz]

Rx: 869 - 894 Tx: 824 - 849

Access Method


Duplex Method


Number of Channels


Users per Channel


Channel Width

1.25 MHz



Channel Bit Rate

1.2288 Kbps


This system can be shifted to operate in the GHz region, in which case, it is often given the generic term PCS. In the U.S., Sprint will be deploying CDMA in its PCS network.

Although spread spectrum CDMA systems have been used by the military for decades, it is only recently that the technology has been adapted for commercial use. Some of its features include:

• The ability to support more channels than any other system

• It is extremely difficult to jam or to eavesdrop

• It has a soft capacity limit

CDMA was first used in Hong Kong in 1995 and has since spread to Korea and the U.S. There are several ways to create a spread spectrum: direct sequence, frequency hopping, chirp, and time hopping. Of these, the direct sequence is preferred.

The standard data rate in a CDMA channel is 9.6 Kbps.  This is artificially increased to about 1.23 Mbps by transmitting several chips per bit. Chips are used to increase the transmitted signal spectrum. The Near-Far Problem

FM receivers can lock on to a signal, even in the presence of a great deal of noise. This phenomenon is known as FM capture and is generally a good thing. Unfortunately it also means that a receiver can loose lock on weaker signals if a stronger FM source is nearby. As a result, the transmitted power must be controlled, and be no larger than necessary.

This means that the broadcast power is a function of range. In a typical cellular system, the received power is a function of range. This is subtle difference complicates the hand-off process in CDMA systems.

It also creates a significant problem when trying to implement ‘umbrella cells’. In some areas, it may be advantageous to have overlapping cells. In a downtown core for example, there may be a need for many low tier microcells to meet the needs of pedestrians. However, a larger high tier cell may be more appropriate for automotive users. CDMA Channels

Besides the actual channel assigned to carry the subscriber signal, there are a number of additional forward and reverse channels for call control type functions. These include:

Pilot channel – used by the mobile to obtain initial system synchronization, time, frequency and phase tracking information from the cell site.

Sync channel – provides cell site identification, pilot transmit power and pseudo-random phase offset.

Paging channel – Once a mobile receiver is synchronized, it monitors the paging channel for incoming calls.

Forward traffic channel – This channel carries the cell site signal and power control information to the mobile.

Access channel – This supports registration requests, paging responses, and call origination.

Reverse traffic channel ‑ This channel carries the mobile signal and power control information to the cell site.

The forward and reverse channels consist of 20 mSec frames. Although the initial data bit rate is 9.6 Kbps, it is dynamically adjusted throughout the call anywhere between 14.4 and 1.2 Kbps.

This dynamic rate adaption allows CDMA to support a wide range of vocoders.

8.3.5  PDC - Personal Digital Cellular

This Japanese system was formerly named JDC - Japanese Digital Cellular.

Frequency Band [MHz]

Rx: 810 - 826 Tx: 940 - 956

Rx: 1429 - 1453       Tx: 1477 - 1501

Access Method


Duplex Method


Number of Channels


Users per Channel


Channel Spacing

25 KHz



Channel Bit Rate

42 Kbps


Cellular System Comparison







System Bandwidth [MHz]






Channel Bandwidth [KHz]






Channels per System






Re-use Factor






Channels per Site






Erlang Density






Capacity Gain






Access Method






Carrier Spacing [KHz]






Users per Carrier






Voice Bit Rat [Kbps]






Total Bit Rate [Kbps]






Required C/I [dB]







8.4   DMS-MTX System[7] 

DMS-100 Wireless System


The DMS-MTX is based on the DMS-100 and can be configured in two basic ways:

• Stand-alone system interfaced to the PSTN, with a maximum of 50,000 subscribers

• A multi-function DMS such as the DMS-250/MTX, which acts as two distinct switches sharing the same CPU, memory, and network resources.

8.4.1  Cell Site Controller

The cell controller is based upon the XPM peripherals, occupies a dual shelf, and runs in the hot standby mode.

Each equipment shelf consists of:

• Signaling Processor

  Handles the Tx and Rx messages to the MTX by an HDLC controller and generates the system overhead messages

• HDLC Controller

  Performs link synchronization & control, error detec­tion & recovery, and sanity monitoring. It communi­cates to the signaling processor by an X.25 link.

• Master Processor

  Performs the call processing, maintenance & diag­nostics, and administrative functions

Radio Control Units

• Control Channel - handles paging/access functions and maintains the data stream

• Voice Channel - used to carry the conversation and process the SAT† , ST† and RSSI† 

• Locate Receiver - measures the RSSI for hand-off

Call sequence initiated by the mobile user:

• Mobile user enters the telephone number and de­pressed a SEND key

• The radio sends an access request to the cell site on a signaling channel including a MIN†

• The cell site relays the request to the MTX

• The MTX verifies the MIN and validates the number called, and allocates an idle voice channel at the cell site

• The cell site controller informs the mobile radio via the con­trol channel, of the frequency assignment and transmits a SAT on that channel

• The mobile radio loops back the SAT to the cell site to confirm the channel selection

• The cell site informs the MTX that the link has been estab­lished, and sends a ring back tone to the mobile unit

• The MTX seizes an idle outgoing trunk to the PSTN and for­wards the number called

• When the called party answers, the ring back tone is discon­tinued and the two parties are connected

If the mobile unit disconnects:

• A 1.8 second signaling tone is sent to the cell site

• The radio channel controller idles the voice path and mes­sages to the cell site controller

• The site controller relays the message to the MTX which then drops the PSTN trunk

If the far end disconnects the process direction is reversed.

To call a mobile user:

• The PSTN alerts the MTX

• The MTX sends a page request to all cell sites

• All cells broadcast the MIN over a signaling channel

• All cellular radios in the calling area are constantly scanning the control channels for their MIN

• The mobile unit generates a page response an call setup is initiated

Cellular Standards Summary

IS-3 Analog Cellular

The original analog cellular standard, now replaced by ANSI standard EIA/TIA-553 and TIA interim standard IS-91.

IS-34 Analog Cellular

The protocol for roaming within the AMPS system.

IS-54 TDMA Digital Cellular

Multiplexes three voice channels using TDMA. This may be increased to 6 by using digital speech interpolation.

IS-88 Narrowband Analog Cellular

Multiplexes three voice channels using FDMA. First standardized in TIA IS-88, and now in IS-91.

IS-91 Analog Cellular and PCS

Combines the functionality of IS-88 and IS-94 as well as PCS band operation.

IS-94 In-building Cellular

An in-building standard for low power analog cellular systems. Now incorporated into IS-91.

IS-95 CDMA Digital Cellular

A digital cellular system that places 10 - 20 voice channels into one 30 KHz cellular channel which is spread over 1.25 MHz channel using CDMA.

IS-136 TDMA Digital Cellular

Similar to IS-54 TDMA, but with a more advanced control channel DCCH.


TIA standard for an 800 MHz base station to switch interface. Supports CDMA.


TIA standard for the interface between a PCS switching center and radio base-station in a PCS network. It is applicable to both GSM and CDMA.

EIA/TIA-553 Analog Cellular

The ANSI version of the analog cellular standard.


Assignment Questions


Quick Quiz

1.  FDMA, TDMA, and CDMA access techniques are mutually exclusive. [True, False]

2.  Two radio carriers are required to support full duplex in the AMPS system. [True, False]

3.  In a cellular system, the electric field strength falls off as the square of the distance from the cell site. [True, False]

4.  TDMA systems do not use any form of FDMA. [True, False]

5.  The present AMPS system has [666, 832, 1024] full duplex channels.

6.  The AMPS broadcast bandwidth is [15, 30, 45] KHz wide.

7.  The TACS system increases subscriber density by reducing the broadcast channel bandwidth. [True, False]

8.  The TACS system uses FM while AMPS uses AM. [True, False]

9.  Deployment of NMT systems is limited to Scandinavian countries. [True, False]

10. DS-CDMA artificially increases the bit rate prior to transmission. [True, False]

11. DAMPS uses TDMA to increase the number of mobile users. [True, False]

12. NAMPS increases the number of mobile users by reducing the channel width. [True, False]

13. In the C-Netz system, only the transmitted power of mobile is adjusted as range increases.  [True, False]

14. IS-136 is largely a software upgrade from IS-54. [True, False]

15. IS-136 has [1, 2, 3] TDD channels per frame.

16. [IS-95, IS-136] uses DS-CDMA.

17. A pseudo noise code is used to spread the spectrum in DS-CDMA. [True, False]

18. The chip rate is [higher, lower] than the data rate.

19. GSM [does, does not] support a 64 Kbps data channel.

20. A GSM mobile terminal does not contain a SIM card. [True, False]

21. The capacity of GSM [can, can not] be doubled by using half rate vocoders.

22. Mobile requests are broadcast over a slotted aloha channel in GSM. [True, False]

23. Convolution coding [is, is not used] in GSM.

24. GSM does not use discontinuous transmission. [True, False]

25. In GSM the mobile not the BSC determines the transmit power level. [True, False]

26. GSM uses a secret key stored in the SIM card to gain access to the network. [True, False]

Composition Questions

1.  What types of technologies are found in a cellular phone?

2.  Do some research and find out how the π/4 DQPSK modulation scheme works.

3.  What is comfort noise?

4.  What is multipath fading?

5.  Why do you think GSM is so popular?

6.  List the advantages and disadvantages of GSM and CDMA.

For Further Research


Pahalavan, Kaveh and Levesque, Allen H.; Wireless Information Networks, Wiley, 1995

Prentiss, Stan; Introducing Cellular Communications

Lee, William C. Y.; Mobile Communications Design Fundamentals

IEEE Communications, January 1995, a special issue on Wireless Personal Communications




Site Lists:








Canada PCS


†     Signaling Transfer Point

†     Home Location Register

†     Mobile Switching Center

†     Direct Inward Mobile Access

†     Frequency Division Multiple Access

†     Time Division Multiple Access

†     Code Division Multiple Access

†     Direct Sequence CSMA

[1]     Telecommunications, March 1993


[3]     Based on Table 1, Overview of Wireless Personal Communications, IEEE Communications Magazine, January 1995

†     Advanced Mobile Phone Service

†     Narrow band AMPS

†     Total Access Communications System

†     Nordic Mobile Telephones

†     Groupe Speciale Mobile – now more correctly Global System Mobile

[4]     Europe’s GSM: Passage to Digital, TE&M, September 15, 1990

†     Conference of European Posts and Telegraphs

†     Groupe Spιcial Mobile

†     European Telecommunication Standards Institute

†     Short Message Service

†     Subscriber Identity Module

†     International Mobile Subscriber Identity

†     International Mobile Equipment Identity

†     Base Transceiver Station

†     Base Station Controller

†      Home Location Register

†     Visitor Location Register

†     Equipment Identity Register

†     Authentication Center

†     Traffic CHannel

†     Stand-alone Dedicated Control CHannels

†     Regular Pulse Excited — Linear Predictive Coder

†     Gaussian-filtered Minimum Shift Keying

†     Discontinuous transmission

†     Radio Resources Management

†     Mobility Management

†     Connection Management

†     Mobile Application Part

†     Transaction Capabilities Application Part

†     Authentication Center

†     Signed RESponse

†     International Mobile Equipment Identity

†     Equipment Identity Register

†     Communication Management

†     Call Control

†     Gateway MSC

†     Mobile Station Roaming Number

†     High Speed Circuit Switched Data

†     Customized Applications for Mobile Enhanced Logic

†     Intelligent Network

†     Advanced Speech Call Items

†     Subscriber Identification Module

†     Digital AMPS


†     Shared Channel Feedback

†     Analog Control Channel

†     Analog Voice Channel

[6]     Cellular Gets Personal, TE&M, February 15, 1992

[7]     DMS–MTX Cellular Mobile Telephone System, Telesis 1988 four

†     Supervisory Audio Tone

†     Signaling Tone

†     Received Signal Strength Indicator

†     Mobile Identification Number