Lecture 4:

2G, 2.5G and 3G Cellular

Mobile Networks
Dr. Reynold Cheng

This lecture is based on the lecture slides of Prof. Henry Chan, Prof. Victor Leung (with his
permission), the textbook “W. Stallings, Wireless Communications and Networks, Prentice
Hall, 2005”, and the slides (prepared by Tom Fronckowiak) and figures provided at the
Web site of the textbook.
Lesson Objectives
 In the last lecture we discussed general
concepts of a cellular system.
 We examine some practical systems today.
 2G systems: GSM, CDMA cellular, HSCSD
 2.5G systems: GPRS, EDGE
 3G systems: IMT-2000

2
Multipath Interference

courtesy of Figure 5.10, “W.

Stallings, Wireless Communications
and Networks, Prentice Hall, 2005”

3
Effect of Multipath Interfence
 Multipath propagation due to reflection,
scattering and refraction
 Multiple “copies” of the same signal can be
received, possibly creating destructive
interference
 Delay spread: difference in propagation delay
among multipath signals
 Handled by GSM and CDMA cellular systems to
reduce transmission error

4
Differences Between 1G and 2G
Cellular Systems
 Traffic channels – 1G systems use analog FM
modulation; 2G systems use low bit-rate voice
coding and digital transmission
 Encryption – all 2G systems provide encryption to
prevent eavesdropping
 Error detection and correction – 2G digital traffic
channels incorporate FEC for error detection and
correction, giving higher power and bandwidth
efficiency
 Channel access – 2G systems allow each
frequency channel to be shared by a number of
users, using TDMA or CDMA techniques 5
Global System for Mobile (GSM)
 Developed by ETSI as a pan-European 2G mobile standard
 Standard activity started in 1982, deployed in 1992
 A complete system standard for ISDN-like mobile services
(note: ISDN = Integrated Services Digital Network)
 Reference interfaces specified between network elements
to facilitate interoperability
 GSM services:
 Teleservices – includes full rate (13 Kbps) and half rate voice,
emergency “112” calls, short messaging service (SMS) etc.
 Bearer services – transferring bits across the digital channel up to
9600 bps
 Supplementary services – call forwarding, caller identification,
call waiting, call holding, multi-party call, etc.
 Personalized service based on Subscriber Identity Module (SIM)

6
 TDMA
 FDMA is used for supporting multiple users in 1G system; it is
wasteful when channels are idle
 In 2G systems, Time division multiple access (TDMA) is used
instead
 Each cell is allocated a number of channels; half reverse and half forward
 A mobile unit is assigned capacity on matching reverse and forward
channels
 Each physical channel is further subdivided into a number of logical
channels
 Repetitive sequence of frames are used
 Each frame is divided into a number of time slots
 Those slots with the same position across multiple frames form a separate
logical channel

7
Mobile Wireless TDMA Design
Considerations
 Objective: determine the length and composition of
the time slot to provide effective transmission of data
and speech with efficient use of radio spectrum
 Number of logical channels (number of time slots in
TDMA frame): 8
 Maximum cell radius (R): 35 km
 Frequency: region around 900 MHz
 Maximum vehicle speed (Vm):250 km/hr
 Maximum coding delay: approx. 20 ms
 Maximum delay spread (∆m): 10 µs
 Bandwidth: Not to exceed 200 kHz (25 kHz per
channel)
8
GSM Network Architecture

9
Mobile Station
 Mobile station communicates across Um interface (air
interface) with base station transceiver in same cell as mobile
unit
 Mobile equipment (ME) – physical terminal, such as a
telephone or PCS (personal communications service) device
 A ME includes radio transceiver, digital signal processors and
subscriber identity module (SIM) in the form of a smart card or plug-in
module
 SIM stores the subscriber’s ID number, the networks authorized to use,
encryption keys, and other information
 GSM subscriber units are generic until SIM is inserted
 SIMs can be used in various subscriber devices
 SIMs roam, not necessarily the subscriber devices

10
Base Station Subsystem (BSS)
 BSS consists of base station controller (BSC)
and one or more base transceiver stations
(BTS)
 Each BTS defines a single cell (with a radius
between 100m and 35km)
 It includes a radio antenna, a radio transceiver and a
link to a BSC
 A BSC controls one or more BTSs
 Itreserves radio frequencies, manages the handoff
of a mobile unit from one cell to another within the
same BSS (i.e. intra-BSS), and controls paging
11
Network Subsystem (NS)

 NS provides the link between the cellular network

and the public switched telecommunications networks
 Controls handoffs between cells in different BSSs (i.e.
inter-BSS)
 Authenticates users and validates accounts
 Enables worldwide roaming of mobile users
 Central element of NS is the mobile switching center
(MSC) and is supported by following databases:

12
Mobile Switching Center (MSC)
Databases
 Home location register (HLR) database – stores information
about each subscriber that belongs to it (since a telephone
number is associated with a home switching center)
 Visitor location register (VLR) database – maintains
information about subscribers currently physically in the
region
 For incoming calls: 1. identify the home switching center of the
subscriber using the telephone no., 2. find the location (i.e. the
switching center the subscriber currently located) from the HLR of the
home switching center, 3. make connection
 For outgoing calls: VLR is used to initiate the calls even the subscriber
is in the coverage of its home switching center

13
Mobile Switching Center (MSC) Databases
(cont.)
 Authentication center database (AuC) – used for authentication
activities
 Holds authentication and encryption keys for subscribers in both HLR
and VLR
 Controls access to user data
 A subscriber is authenticated when it joins the network using an A3
cipher
 The transmission from subscriber to base transceiver is encrypted using
an A5 cipher
 Equipment identity register database (EIR) –
 Keeps track of the type of equipment that exists at the mobile station
 Plays a role in security by
 Blocking calls from stolen mobile stations
 Preventing use of the network by stations not approved

14
Basic Authentication
 Each SIM card has:
 a secret key (K) for authentication
 an A3 algorithm for authentication
 an A8 algorithm for creating an encryption key
 an A5 algorithm for encryption
 General authentication procedures:
 The system obtains the corresponding K
 The system generates a random number R
 Based on K and R, an authenticator is generated by A3
 R is passed to the mobile terminal to generate the authenticator (based on K
and R)
 The mobile terminal can be authenticated by comparing the two
authenticators
 Upon authentication, the two sides can generate the same encryption key
using A8 based on K and R
 Subsequently data can be protected by A5 using the encryption key

Reference: R. Pandya, Mobile and Personal Communication Systems and Services, IEEE Press, 2000. 15
TDMA Format
 GSM uses a complex hierarchy of TDMA frames to
define logical channels
 Each 200-kHz frequency band is divided into 8 logical
channels defined by repetitive time slots
 A time slot is at the lowest level and contains the
following fields:
 Trailbits – allow synchronization of transmissions from
mobile units
 Encrypted bits – 114 plaintext bits are encrypted into 114
encrypted bits, which are then placed into two 57-bit fields

16
TDMA Format (cont.)
 Stealing bit – indicates whether block contains data or
is “stolen” for urgent control signaling
 Training sequence
 Used to adapt parameters of receiver to the current path
propagation characteristics and to select the strongest signal
in case of multipath propagation
 A known bit pattern that differs for different adjacent cells
 Enables the mobile units and base stations to determine that
the received signal is from the correct transmitter instead of a
interfering transmitter
 Guard bits – used to avoid overlapping with other
bursts
17
TDMA Format (cont.)

18
Functions Provided by Protocols
 Protocols above the link layer of the GSM signaling protocol
architecture provide specific functions:
 Radio resource management
 Controls the setup, maintenance, and termination of radio channels, including
handoffs
 Mobility management
 Manages the location updating and registration procedures, as well as security
and authentication
 Connection management
 Controls the setup, maintenance, and termination of calls
 Mobile application part (MAP)
 Handles the signaling between entities in the fixed part of the network, e.g.
between HLR and VLR
 BTS management
 Performs management functions at the base transceiver station

19
North American Cellular Standards
 Published by the Telecommunications Industry
Association (TIA) as “Interim Standards” (IS)
 2G air interface standards (PCS) include
 IS-54/136 – TDMA over 30 KHz channels
 IS-95 – CDMA standard developed by Qualcomm in 1991 and
adopted by TIA in 1993
 IS-634 standard for MSC-BSC interface
 IS-41 standard for MSC-MSC interface
 Services, interoperability, compatibility and performance
issues are addressed by TR-45/46 committees
 TR-45/46 reference model is similar to the GSM
architectural model

20
Properties of CDMA Cellular
 Frequency diversity – frequency-dependent transmission
impairments have less effect on wide-band signal
 Multipath resistance – can use RAKE receiver to
coherently combine multipath signals
 Privacy – privacy is inherent since spread spectrum is
obtained by use of noise-like signals
 Graceful degradation – system only gradually degrades as
more users access the system
 Soft handoff – mobile acquires new cell before
disconnecting from the old; diversity combining of signals
from the two cells enhance performance
 Near-far problem – without power control, signals from
BSs closer to the BS will overwhelm signals from BSs
farther away
21
Drawbacks of CDMA Cellular
 Self-jamming – arriving transmissions from multiple
users not aligned on chip boundaries unless users are
perfectly synchronized
 Near-far problem – signals closer to the receiver are
received with less attenuation than signals farther
away
 Soft handoff – requires that the mobile acquires the
new cell before it relinquishes the old; this is more
complex than hard handoff used in FDMA and
TDMA schemes
22
Global Wireless Services and
Network Evolution
First Generation Second Generation Third Generation Fourth Generation

Advanced Wireless Integrated Voice/Data Tele-Presenting

Voice Services & Wireless/Wireline
Mobile Telephone Distance Learning
Service Wireless Data Multimedia Services
Intelligent Agent
Services Services

?
Location Services

Digital Cellular Broader Bandwidth Channels

with High Spectrum Efficiency
Technology
Analog Cellular Advanced Network/Software Knowledge-Based
Technology Microcellular & Architectures Network Operations
Picocellular Advanced Coding & Signal
Macrocellular Technologies Processing Techniques Unified Service
Technology
Intelligent Antennas Networks
Wireless Intelligent
Network Wideband Radios

Mid-80s Mid-90s Year 2000+ Year 2010 ?

NMT GSM W-CDMA

TACS IS-54/ 136 TDMA UWC-136
Analog AMPS IS-95/ cdmaOne cdma2000 Source: IEEE Communications Magazin
PDC
DECT 23
Technology Road Map
from 2G to 3G

24
High Speed Circuit Switched
Data (HSCSD)
 Part of GSM Phase 2 development
 Use dedicated TDMA time slots for circuit switched data
 Each time slot yields a data rate of 14.4 Kbps
 Up to 4 time slots can be used for a data rate up to 57.6
Kbps
 HSCSD connection using multiple time slots can be pre-
empted by voice calls to give up the extra slots
 Suitable for streaming data applications such as digital
audio/video
 Inefficient for applications with bursty data traffic, such as
Web surfing
 The service is not widely supported 25
General Packet Radio Service
(GPRS)
 Part of GSM Phase 2 development
 Also supported by IS-136 TDMA in N. America
 Use shared TDMA time slots for packet switched data
 MS uses a reservation MAC protocol to indicate needs for
data bandwidth to BSC which schedules reserved time
slots for the MS
 Up to 8 time slots can be used for a data rate up to 171.2
Kbps; in practice MS’s are not assigned 8 time slots
 GPRS using multiple time slots can be pre-empted by
HSCSD or voice calls to give up the extra slots
 Much more efficient for applications with bursty data
traffic, such as Web surfing
26
 GPRS Network Architecture
SGSN: Serving GPRS Support
Node
GGSN: Gateway GPRS Support
SMS-GMSC
SMS-IWMSC SM-SC Node
MAP: Mobile Application Part
HLR: Home Location Register
VLR: Visitor Location Register
MAP-H MAP-C MSC: Mobile Switching Center
Gd BSS: Base Station System
GMSC: Gateway MSC
IWMSC: Interworking MSC
MSC/VLR HLR TE: Terminal Equipment
MT: Mobile Terminal
MAP-D EIR: Equipment Identity Register

A
GS Gc Gi
Gr

TE MT BSS SGSN GGSN PDN TE

R Um Gn
Gb Gp

EIR
Signaling + Information GGSN

Other PLMN
Signaling MAP-F

27
GPRS Terminal Classes
 Class A
 Supports GPRS and other GSM services (such as SMS and voice)
simultaneously
 Simultaneous attach, activation, monitor, and traffic supported
 Class B
 Monitors GSM and GPRS channels simultaneously, but supports
only one of these services at a time
 Simultaneous attach, activation, and monitor supported, but not
simultaneous traffic
 Class C
 Supports only non-simultaneous attach – user selects manually
which service to attach
 Service is not available if terminal is not attached

28
GPRS Protocol Stack

29
GPRS Network Elements
 Network elements shared with GSM
 BSS upgraded to support MAC protocol
 Mobility support through MSC/HLR/VLR
 Serving GPRS Support Node (SGSN)
 A "packet-switched MSC" that delivers packets to MSs within its
service area via the BSS
 Queries HLRs to obtain profile data of GPRS subscribers
 Performs mobility management functions such as mobile
subscriber attach/detach and location management
 Gateway GPRS Support Node (GGSN)
 Interface to external packet data networks
 Uses IP tunneling for protocol-transparent transport of packets to
SGSN and onward to MS

30
GPRS Packet Data Protocol
(PDP) Contexts
 PDP context activated to send or receive data
 PDP context activation for IP means activation of IP
address
 Between SGSN and MS, PDP data transferred with
SNDCP (e.g., by frame relay or ATM)
 Between SGSN and GGSN PDP data routed and
transferred by tunneling using either TCP/IP (for X.25
service) or UDP/IP (for IP service)
 User may have up to 15 simultaneous PDP contexts active
at a given time
 Contexts can serve different PDP protocols (IP, X.25, etc.)
31
GPRS Tunneling Protocol
 This is for supporting data transfer in a mobile
environment.
 It allows data transfer between the GGSN and SGSN
through a tunnel.
 Having received an IP packet for the user, the GGSN
adds a new IP header with the IP address of the
current SGSN.
 The packet is sent via the “tunnel” to the SGSN.
 When the user moves to another SGSN, the end point
of the tunnel is altered.
Reference: F. Muratore (editor), UMTS Mobile Communications for the Future, John Wiley & Sons, 2001.
32
GPRS Attach Protocol
 Essentially, this protocol is used by a mobile terminal for
registering with a network so as to use the GPRS
function.
 The terminal first sends a registration message to the
SGSN with necessary information e.g., encryption
algorithm, circuit/packet switching mode
 Having validated the user request, the user’s information
is obtained from the HLR.
 The SGSN and VLR store the information accordingly
for later use.
 After “attaching” to the network, the user can then
transmit data by invoking the PDP context activation
process.
Reference: F. Muratore (editor), UMTS Mobile Communications for the Future, John Wiley & Sons, 2001.
33
GPRS PDP Context Activation for IP

 A mobile terminal invokes a PDP context activation

by providing the required information to the SGSN.
 Upon authentication, the SGSN sets up a GTP tunnel
to the required GGSN.
 An IP address is assigned to the terminal by the
GGSN via the SGSN.
 Data can then be sent or received by the terminal.

Reference: F. Muratore (editor), UMTS Mobile Communications for the Future, John Wiley & Sons, 2001.
34
Quality of Service in GPRS
 GPRS provides a flexible and general QoS mechanism for
type of connection and purpose of connection
 Each PDP context has QoS profile defined by:
 delay class
 mean throughput class
 precedence class
 reliability class
 peak throughput class
 SGSN maps QoS profile into appropriate RLC/MAC
parameters such as access priority value
 SGSN indicates to MS what priority value to be used in
uplink

35
Enhanced Data Rates for Global
Evolution (EDGE)
 Provides an evolution path from existing GSM/TDMA standards
to deliver 3G services in existing spectrum bands
 Reuses GSM carrier bandwidth and time slot structure
 Can be introduced in GSM using a minimum of only one time
slot per BS
 Reuse of existing GSM and TDMA/IS-136 infrastructure
 Can be deployed using as little as 600 kHz of total bandwidth
 384 Kbps data capability to satisfy the IMT-2000 requirements
for pedestrian (microcell) and low speed vehicular (macrocell)
environments
 144 Kbps data capability for high speed vehicular environment

36
ITU’s View of Third-Generation (3G)
Cellular System Capabilities
 Voice quality comparable to the PSTN
 144 Kbps available to high-mobility users over large areas
 384 Kbps available to low-mobility users over small areas
 Support for 2.048 Mbps for office use
 Symmetrical / asymmetrical data transmission rates
 Support for both packet and circuit switched data services
 More efficient use of the available spectrum in general
 Support for a wide variety of mobile equipment
 Flexibility to allow the introduction of new services and
technologies
 IMT-2000 standards established to satisfy these needs

37
 ITU’s Model for IMT-2000 Standards
• Multiple Services
IMT2000 (1)

• Increasing Data Rate

• Unification of Multiple Standards
Satellite
• Broadband Core Infrastructure

Land Mobile IMT 2000

Public/Private Landline

Note 1: Formerly Global Personal Mobility &

FPLMTS Service Portability

Global Roaming Mobile & Fixed Services Security & Privacy

38
IMT-2000 Carrier Services
 Carrier services support ISDN and BISDN bearer services
 Circuit-switched services
 Voice
 3.1, 5 and 7 KHz audio
 Alternate voice or transparent data with user data rates of 8, 16,
32 and 64 Kbps
 Packet-switched services
 Virtual calls and permanent virtual channels
 Connectionless
 User signaling
 Interactiveservice – one-to-one communications
 Distribution service – one-to-many communications

39
IMT-2000 Teleservices
 Support three classes of teleservices
 Existing teleservices defined by ITU-T
 Telephony – voice, inband fax, inband data
 Teleconferencing
 UMTS teleservices and applications
 Audio/video transmissions
 Paging, broadcasts
 Emergency calls and emergency call broadcasts
 Data transmissions, database inquiry, e-mail
 Short-message services
 Teleaction and telemetry services (remote control and monitor)
 Mobility services (location-based, navigational)
 High bandwidth teleservices
 Multimedia and interactive multimedia

40
IMT-2000 Supplementary
Services
 Number identification, e.g.,
 Calling party identification
 Speed dial
 Blocking calls from specific numbers
 Call offering, e.g., call forwarding
 Call termination, e.g., call holding
 Call rejection, e.g.,
 Blocking all incoming calls
 Blocking selected outgoing calls
 Additional information, e.g.,
 Billing inquiry
 User-to-user signaling

41
IMT-2000 Value-Added Services
 Personal mobility – keep the same telephone number
regardless of service provider or mobile terminal equipment
 Virtual home environment (VHE) and service portability –
enables user to set up personalized service portfolios and use
them in any networks
 Bandwidth-on-demand
 Enable efficient use of resources for services with large
variations in bandwidth requirements
 Enable user to trade off high bandwidth for low cost

42
Quality of Service (QoS)
 QoS is defined for different traffic classes
 Four different traffic classes are:
 Conversational class (e.g., speech, voice over IP,
video conferencing)
 Streaming class (e.g., streaming video)
 Interactive class (e.g., Web browsing, database
retrieval, server access, polling for measurements)
 Background class (e.g., background download of e-
mails, SMS, download of databases)

43
QoS Characteristics of
Different Traffic Classes
 Conversational Class
 preserve time relation (variation) between information entities
 transfer delay significantly lower and more stringent than round-trip delay
of interactive traffic
 Streaming Class
 preserve time relation (variation) between information entities of the
stream
 acceptable delay is much greater than the delay limits of human
perception
 Interactive Class
 request response pattern (low round trip delay)
 preserve payload content (low BER)
 Background Class
 destination is not expecting the data within a certain time
44
 preserve payload content (low BER)
Major 3G Standards Bodies
Standard Organization Region

International Telecommunications International

Union (ITU)
European Telecommunications Europe
Standard Institute (ETSI)
Telecommunications Industry North America
Association (TIA)
Association of Radio Industries and Japan
Business (ARIB)
American National Standard Institute North America
(committee T1P1)

45
Focus of 3G Standard Efforts
 Standard organizations efforts are centered on how
to harmonize the following key and interrelated
issues:
 Architecture of radio interface and fixed network
 System evolution and backward compatibility
 Accommodation of user migration and global roaming
 Phased introduction of mobile services and capabilities
for terminal mobility support

46
ITU IMT-2000 Time Line

Possible Commercialization Timeframe

1999 2000 2001 2002 2003 2004

Proposals North America

Evaluation
Japan

Consensus Building
Rest of Asia/Pacific

Specifications Europe

47
 IMT-2000 Terrestrial Radio Interfaces

(Utra-FDD) (Utra-TDD)

Current focus is on CDMA-based networks 48

3G Standard Forums
 3rd Generation Partnership Project (3GPP)
 Focus on setting global standard for UMTS Terrestrial
Radio Access (UTRA)
 Involve ETSI (Europe), ARIB (Japan), T1P1 (USA), etc.

 3rd Generation Partnership Project 2 (3GPP2)

 Focuson setting global standard for cdma2000
 More of a N. American focus

49
UTRA Parameters
UTRA FDD UTRA TDD
Official name IMT-DS IMT-TC
Uplink frequency 1920 - 1980 MHz 2010 - 2025 MHz
Downlink frequency 2110 - 2170 MHz 2010 - 2025 MHz
Carrier spacing 5 MHz 5 MHz
Duplex scheme FDD TDD
Chip rate 3.84 Mcps 3.84 Mcps
Modulation QPSK QPSK
Frame length 10 ms 10 ms
Time slots/frame N/A 15

50
 UMTS Reference Model

SCP

CAP
Node B lucs
lub 3G MSC PSTN/ISDN
RNC
Node B
MAP
lur Gs HLR

lub MAP
Packet Data
Node B RNC
3G SGSN GGSN Network
lups
UTRAN Gn
Access Network Domain Core Network Domain External Networks

RNC = radio network controller

51
UTRAN Architecture
Core Network (CN)

Iu Iu
RNS Iur RNS

RNC RNC

Iub Iub Iub Iub

Node B Node B Node B Node B

RNC: Radio Network Controller

RNS: Radio Network Subsystem
52
RNS Functional Entities
 RNC is responsible for the use and allocation of all radio
resources of the RNS
 RNC is split into two distinct entities:
 Base Station Controller (BSC) – supports handover,
power control, frame synchronization, radio resource
management functions
 Traffic Processing Unit (TPU) – RLC and MAC
protocol processing functions
 Node B is responsible for radio transmission and reception
 Supports modulation, coding, synchronization, error
detection, channel estimation, signal condition
measurement, power control, etc.
53
CDMA 2000
 Specification developed by the Third Generation Partnership
Project 2 (3GPP2)
 CDMA 2000 1x
 currently deployed as 2.5G overlay on IS 95 systems
 1.25 MHz channel bandwidth same as IS 95
 max data rate 144 Kbps now increasing to 307 Kbps in the future
 CDMA 2000 1xEV (evolution using 1x channel bandwidth)
 1xEV-DO data only, 384 Kbps - 2.4 Mbps max
 1xEV-DV for data and voice, specified by 2003/4, up to 4.8 Mbps
 CDMA 2000 3x uses 3x1.25 MHz bandwidth, 2-4 Mbps
 CDMA 2000 1x EV-DO and CDMA 2000 3x are ITU
approved, IMT-2000 (3G) standards

54
CDMA 2000 System Architecture

55
Technology Trends
 Improvements in system capacity through advanced
signaling, detection and signal processing techniques:
 Orthogonal frequency division multiplexing OFDM
 Turbo coding
 Multiple-user detection (interference cancellation)
 Multiple-input multiple-output (MIMO) processing
 Software radio
 Improvements in features and capabilities for better services:
 Full integration into the Internet for multimedia services
 Seamless roaming between cellular, wireless LAN, and
satellite networks

56