Module 3 — Study Notes

Wireless Systems & Standards | Sections 10.3 – 10.4.4

GSM • IS-95 CDMA

10.3 Global System for Mobile (GSM)

GSM (Global System for Mobile Communications) is a second-generation (2G) cellular standard
originally developed to eliminate the fragmentation problem of first-generation analog systems in
Europe, where each country used a different, incompatible standard. Before GSM, a subscriber could
not use a single handset across the continent. GSM solved this by being the world's first cellular
standard to define digital modulation, network-level architecture, and service interfaces all in one
specification.
GSM was developed by the Groupe Special Mobile committee under the Conference Europeenne des
Postes et Telecommunications (CEPT), and its standards are now maintained by the European
Technical Standards Institute (ETSI). It was introduced in Europe in 1991 and quickly became the
world's most widely adopted cellular standard. By the mid-1990s it had spread to South America, Asia,
Australia, and beyond, including via the DCS 1800 variant that supports Personal Communication
Services (PCS) in the 1.8–2.0 GHz bands.

📌 GSM's success came from being the first to offer a complete, standardized, interoperable
digital cellular solution. Every aspect — from air interface to network switching to subscriber
identity — was standardized, allowing any compliant handset to work on any compliant network.

10.3.1 GSM Services and Features

GSM services follow ISDN guidelines and are grouped into Teleservices and Data Services.
Teleservices cover standard voice telephony and mobile-originated/base-originated traffic. Data
services handle computer-to-computer communication and packet-switched traffic.
User services fall into three major categories:

Category Description Examples

Telephone Services Standard voice and emergency calls Voice calls, emergency calling,
over the GSM network facsimile (Videotex/Teletex
supported but not integral)

Bearer / Data Services Data transfer using OSI layers 1, 2, Packet-switched protocols at 300
and 3. Supports transparent mode bps – 9.6 kbps
(standard channel coding) and non-
transparent mode (GSM-specific
coding efficiency)

Supplementary ISDN Digital features unavailable in Call diversion, closed user groups,
Services analog networks caller ID, SMS, cell broadcast
Two features of GSM stand out from a user perspective:

• SIM Card (Subscriber Identity Module): This is arguably GSM's most innovative feature. The
SIM is a removable smart card that stores the subscriber's International Mobile Subscriber
Identity (IMSI), authentication keys, network access permissions, and user-specific data.
Without a SIM inserted, a GSM handset is completely non-functional and has no identity. The
subscriber activates service using a 4-digit PIN. Crucially, a subscriber can insert their SIM into
any compatible GSM handset anywhere in the world — hotel phone, rented phone, borrowed
phone — and all calls will be billed to their home account. This portability of identity was
revolutionary.
• On-Air Privacy: Unlike analog FM cellular (AMPS) which could be trivially monitored with a
radio scanner, GSM encrypts the digital bit stream transmitted over the air. The encryption uses
a secret cryptographic key that is known only to the cellular carrier and changes with each user
and each call. This makes eavesdropping on a GSM radio link virtually impossible. All GSM
equipment manufacturers must sign a Memorandum of Understanding (MoU) before receiving
the cryptographic algorithms.
• Short Message Service (SMS): GSM introduced SMS as part of its supplementary services.
Messages up to 160 characters (7-bit ASCII) can be sent while the phone simultaneously
carries a voice call. The cell broadcast variant allows the base station to send the same
message to all subscribers in a coverage area — used for highway alerts, weather warnings,
etc.
• Discontinuous Transmission (DTX): In a typical conversation, each party speaks less than
40% of the time. GSM exploits this by incorporating a Voice Activity Detector (VAD) in the
speech coder. When no voice activity is detected, the transmitter is switched off, saving battery
power and reducing interference to other users. At the receiving end, a Comfort Noise
Subsystem (CNS) generates low-level background noise to avoid the unnatural silence that
would otherwise occur.

10.3.2 GSM System Architecture

The GSM system architecture consists of three major interconnected subsystems. These subsystems
interact with each other and with the user through well-defined network interfaces. Understanding this
architecture is key to understanding how a GSM call is set up, maintained, and handed off.

Subsystem Also Known As Primary Role

Base Station Subsystem Radio Subsystem Manages all radio transmission between mobile
(BSS) stations and the MSC. Contains BSCs and
BTSs.

Network & Switching — Handles call switching and routing. Manages

Subsystem (NSS) subscriber databases (HLR, VLR, AUC).

Operation Support — Monitors, maintains, and bills the entire GSM

Subsystem (OSS) system via Operation Maintenance Centers
(OMCs).

Base Station Subsystem (BSS)

The BSS is the radio part of GSM. It is made up of Base Station Controllers (BSCs) and Base
Transceiver Stations (BTSs). Each BSC controls multiple BTSs — typically up to several hundred. The
BTS is the actual radio tower/antenna that communicates with the mobile. The BSC handles radio
resource management: it decides which radio channel (ARFCN and time slot) is assigned to each call,
manages handovers between BTSs within its own domain (without involving the MSC), and adjusts
transmit power. This division of labor significantly reduces the signaling load on the MSC.
BTSs may be co-located with the BSC or distributed remotely, connected via microwave link or
dedicated leased lines. The interface between a BTS and its BSC is the standardized Abis interface,
which carries both traffic and maintenance data.

Network and Switching Subsystem (NSS)

The NSS is the brain of the GSM network. The Mobile Switching Center (MSC) is the central unit — it is
essentially a large telephone exchange that connects GSM calls to the PSTN, ISDN, or other data
networks. The NSS also manages three critical databases:

• HLR (Home Location Register): A permanent database that stores the service profile and
current location of every subscriber who calls this network home. When a subscriber is assigned
an IMSI number, a record is created in the HLR. The HLR knows the current VLR address for
each roaming subscriber, allowing incoming calls to be correctly routed.
• VLR (Visitor Location Register): A temporary database that stores subscriber information for
every roaming mobile currently in the coverage area of a particular MSC. When a mobile enters
a new MSC area, the VLR requests the subscriber's profile from the HLR and stores it locally.
This avoids the need to query the HLR (which may be geographically distant) for every call.
• AUC (Authentication Center): A highly secured database that stores and manages the
encryption and authentication keys (Ki) for every subscriber in the HLR/VLR. It generates
authentication triplets used to verify a subscriber's identity and produce the encryption key for
that session. It also contains the Equipment Identity Register (EIR), which identifies stolen or
fraudulently modified handsets by checking their IMEI.

Operation Support Subsystem (OSS)

The OSS supports one or more Operation Maintenance Centers (OMCs) used by the network
operator's staff to monitor and maintain system performance. It has three main functions: (1)
maintaining all telecommunications hardware and network operations, (2) managing all charging and
billing procedures, and (3) managing all mobile equipment in the system. The OSS interacts with all
other GSM subsystems but is used exclusively by the operating staff, not by subscribers.

📌 Key insight: Handovers between two BTSs controlled by the same BSC are handled by the
BSC alone — the MSC is not involved. This is called intra-BSC handover and greatly reduces
MSC load. Only inter-BSC handovers (between BTSs of different BSCs) require MSC
involvement.

GSM Interfaces
 Interface Connects Standard / Protocol Key Point

GSM Radio Air Mobile Station ↔ Standardized The over-the-air interface.

Interface BTS Standardized so any GSM
handset works with any GSM
BTS.

Abis Interface BTS ↔ BSC Standardized (with Carries traffic and

manufacturer-specific maintenance data. Subtle
variations) differences between
manufacturers force
operators to use same-brand
BTS/BSC.

A Interface BSC ↔ MSC SS7 / SCCP (Signaling Fully standardized — allows

Correction Control Part) mixing equipment from
different manufacturers at
BSC/MSC boundary.

10.3.3 GSM Radio Subsystem

GSM uses two 25 MHz bands of spectrum, one for each direction of transmission (Frequency Division
Duplex — FDD). The 890–915 MHz band is used for the reverse link (subscriber-to-base) and the 935–
960 MHz band for the forward link (base-to-subscriber). The two bands are separated by 45 MHz,
which provides sufficient isolation so that a handset can transmit and receive simultaneously without
self-interference.
Within each 25 MHz band, the spectrum is divided into 200 kHz wide channels called ARFCNs
(Absolute Radio Frequency Channel Numbers). Each ARFCN is a forward/reverse channel pair, and
GSM uses a combination of TDMA (Time Division Multiple Access) and FHMA (Frequency Hopping
Multiple Access) on top of FDMA to allow up to 8 users per ARFCN simultaneously. This is the key:
each ARFCN is shared in time between 8 subscribers, each occupying a unique time slot (TS0 through
TS7) within each 4.615 ms TDMA frame.

📌 Think of an ARFCN as a highway lane (200 kHz wide). TDMA divides time on that lane into 8
turns. Each subscriber gets one turn per frame. This means each user has a raw channel bit rate
of 270.833 / 8 = 33.854 kbps, of which only 24.7 kbps is actual user data (the rest is overhead).

GSM Air Interface Key Parameters (Table 10.3)

Parameter Value

Reverse Channel Frequency 890 – 915 MHz

Forward Channel Frequency 935 – 960 MHz

Tx/Rx Frequency Spacing 45 MHz

ARFCN Channel Spacing 200 kHz

Total ARFCNs in 25 MHz band 124 (practical, with 100 kHz guard bands at
edges)
 Parameter Value

Users per Frame (Full Rate) 8

Total Traffic Channels 124 ARFCNs × 8 slots = 992

Modulation Data Rate 270.833 kbps

Frame Period 4.615 ms

Time Slot Period 576.92 µs

Bit Period 3.692 µs

Modulation Scheme 0.3 GMSK

Voice Coder Bit Rate 13.4 kbps

Max Interleaving Delay 40 ms

10.3.4 GSM Channel Types

Each physical channel in GSM (defined by a specific ARFCN + time slot combination) can be mapped
to different logical channels at different times. A logical channel is defined by what it carries and how it
is used — it can carry user traffic, signaling data, or control information. GSM defines two major
categories of logical channels: Traffic Channels (TCH) and Control Channels (CCH).

[Link] Traffic Channels (TCH)

Traffic channels carry the user's actual voice or data. They are bidirectional (same function on both
forward and reverse links). TCHs come in two variants based on spectral efficiency:

• Full-Rate TCH: User data occupies one time slot per frame. A full-rate speech channel
(TCH/FS) carries digitized speech at 13 kbps raw, which becomes 22.8 kbps after GSM channel
coding. This is the standard mode.
• Half-Rate TCH: User data occupies one time slot but only in every other frame (alternating
frames). Two half-rate users share the same time slot. A half-rate speech channel (TCH/HS) is
designed to carry ~6.5 kbps raw speech (using a more advanced codec), becoming 11.4 kbps
after coding. This effectively doubles capacity at some voice quality cost.

Channel Name Raw Data Rate After GSM Channel Notes

Coding

TCH/FS (Full-Rate 13 kbps 22.8 kbps Standard voice call

Speech)

TCH/F9.6 (Full-Rate 9600 bps 22.8 kbps Fax / modem data

Data)

TCH/F4.8 (Full-Rate 4800 bps 22.8 kbps Data call

Data)

TCH/F2.4 (Full-Rate 2400 bps 22.8 kbps Low-speed data

Data)
 Channel Name Raw Data Rate After GSM Channel Notes
Coding

TCH/HS (Half-Rate ~6.5 kbps 11.4 kbps Doubles capacity

Speech)

TCH/H4.8 (Half-Rate 4800 bps 11.4 kbps Half-rate data

Data)

TCH/H2.4 (Half-Rate 2400 bps 11.4 kbps Half-rate data

Data)

In the speech multiframe (26 TDMA frames = 120 ms), TCH data occupies 24 of the 26 frames. The
13th frame carries SACCH data and the 26th is idle (for full-rate) or carries SACCH for half-rate.

[Link] Control Channels (CCH)

Control channels carry signaling and synchronization commands between the base station and mobile
stations. Unlike TCHs, certain control channels are defined only for the forward or reverse link. There
are three main types of CCH: Broadcast Channels (BCH), Common Control Channels (CCCH), and
Dedicated Control Channels (DCCH). These channels are allocated in very specific ways — BCH and
CCCH only use TS0 of designated broadcast ARFCNs, while DCCH can use any time slot and ARFCN.

A) Broadcast Channels (BCH) — Forward Link Only

The BCH operates only on the forward link of specific ARFCNs designated as broadcast channels. It
acts as a beacon that all nearby mobiles monitor to synchronize with the network. It consists of three
sub-channels:

• FCCH (Frequency Correction Channel): Transmits a special data burst of all zeros, which
appears as a pure unmodulated tone. Mobiles use this to synchronize their internal local
oscillator to the exact frequency of the base station. It occupies TS0 of frame 0 and repeats
every 10 frames.
• SCH (Synchronization Channel): Transmitted in TS0 of the frame immediately following the
FCCH frame. It carries the Frame Number (FN, ranging 0 to 2,715,647) and the Base Station
Identity Code (BSIC). The mobile uses the FN to synchronize its TDMA frame counter with the
base station. Since a mobile can be up to 30 km from the BTS, timing advance commands are
also sent via SCH.
• BCCH (Broadcast Control Channel): Broadcasts cell identity, network identity, current control
channel structure, channel availability, and congestion information. Frames 2–5 of every 51-
frame control multiframe contain BCCH data.

B) Common Control Channels (CCCH)

CCCHs occupy TS0 of all GSM frames not used by BCH or the idle frame. They handle the initial
access and paging procedures, and consist of three sub-channels:

• PCH (Paging Channel — Forward Link): Used by the base station to alert a specific mobile of
an incoming call (originated from PSTN). The base station broadcasts the IMSI of the target
mobile. All mobiles in the cell monitor the PCH during their assigned paging slot.
 • RACH (Random Access Channel — Reverse Link): Used by a mobile to request service
(make a call) or to acknowledge a page. Since multiple mobiles may attempt to access the
RACH simultaneously, it uses a slotted ALOHA access scheme. All mobiles must transmit
RACH within TS0 of any GSM frame.
• AGCH (Access Grant Channel — Forward Link): The base station's response to a RACH
transmission. It assigns the mobile to a specific ARFCN and time slot for SDCCH signaling. This
is the final CCCH message before a subscriber moves off the control channel.

C) Dedicated Control Channels (DCCH)

DCCHs are bidirectional and can exist on any time slot and ARFCN except TS0 of the BCH ARFCN.
They carry the actual per-subscriber signaling during and around a call:

• SDCCH (Stand-alone Dedicated Control Channel): A temporary, dedicated channel

established after the AGCH assigns resources. Before a TCH is assigned, the SDCCH handles
authentication, ciphering activation, location updating, and SMS delivery. Think of it as the
"waiting room" before voice traffic starts. The SDCCH ensures the mobile and base station stay
connected while the MSC verifies the subscriber and allocates resources.
• SACCH (Slow Associated Control Channel): Always associated with either a TCH or
SDCCH. On the forward link, the SACCH carries slow but regularly updated control information
— specifically transmit power level instructions and timing advance adjustments — to each
active user on that ARFCN. On the reverse link, the mobile reports received signal strength
(RSSI) of the current TCH and up to 6 neighboring cells' BCH signals, which the network uses
to make handoff decisions. Transmitted during the 13th frame of each 26-frame speech
multiframe.
• FACCH (Fast Associated Control Channel): Carries urgent signaling that cannot wait for the
next SACCH frame — most importantly, handoff commands. The FACCH "steals" frames from
the TCH by setting two special stealing-flag bits in the burst. When stealing bits are set, the
receiver knows the time slot contains FACCH data rather than voice data. The stolen voice
frames are concealed by the speech decoder.

CCH Type Direction Sub-channels Key Purpose

BCH Forward only FCCH, SCH, BCCH Frequency sync, frame sync, cell info
broadcast

CCCH Both (PCH/AGCH fwd, PCH, RACH, AGCH Paging, random access, channel
RACH rev) assignment

DCCH Both SDCCH, SACCH, FACCH Per-subscriber signaling, power/timing

control, handoff

10.3.5 Example of a GSM Call (Mobile-Originated)

To understand how all channels work together, consider a mobile-originated call. Before any call can be
made, the subscriber unit must be synchronized to a nearby base station by monitoring the BCH —
receiving the FCCH (frequency sync), SCH (frame sync + BSIC), and BCCH (cell info). Once locked,
the mobile knows the cell's ARFCN and frame structure.
 St Action Channel(s) Used
ep

1 Mobile is powered on and idle. Monitors FCCH → SCH → BCCH

BCH of the strongest ARFCN.

2 User dials number and presses Send. RACH (reverse)

Mobile transmits a RACH burst on TS0.

3 Base station detects RACH, determines AGCH (forward, on

timing advance from burst timing, assigns CCCH)
mobile to SDCCH.

4 Mobile retunes to the new ARFCN/TS SDCCH + SACCH

(SDCCH). Waits up to 26 frames (120 ms)
for SACCH frame with timing advance and
power level.

5 SDCCH carries authentication, ciphering SDCCH

activation, and call setup messages. PSTN
connects the dialed party to the MSC.

6 BTS commands mobile to retune to TCH SDCCH → TCH

(new ARFCN + TS). Voice path switched at
MSC.

7 Speech flows on forward and reverse links. TCH (+ SACCH on 13th

SDCCH is vacated. frame)

For PSTN-originated calls, the process is similar but starts with the base station broadcasting a PCH
paging message. The mobile acknowledges on the RACH, receives an AGCH assignment, and the rest
of the procedure follows the same SDCCH → TCH path.

📌 The SDCCH is critical: it prevents the base station from assigning a precious TCH until the
subscriber has been fully authenticated and all call setup signaling is complete. This keeps TCH
resources available for active speech.

10.3.6 Frame Structure for GSM

GSM organizes time into a strict hierarchy of frames. Each level groups the level below it, creating a
structure that efficiently multiplexes traffic, control, and synchronization data.

Level Composition Duration Notes

Time Slot (TS) 156.25 bits = 1 burst 576.92 µs Basic unit. 8 TSs make one
frame.

TDMA Frame 8 Time Slots 4.615 ms 8 users share one ARFCN per
frame.

Speech Multiframe 26 TDMA Frames 120 ms Used for TCH/SACCH. 24

TCH + 1 SACCH + 1 idle.
 Level Composition Duration Notes

Control Multiframe 51 TDMA Frames 235 ms Used for BCH/CCCH. Different

length prevents collision.

Superframe 51 speech multiframes (or 6.12 s Syncs the two multiframe

26 control multiframes) types.

Hyperframe 2048 Superframes ~3 hr 28 min Encryption relies on frame

54 s number within hyperframe.

The control multiframe is deliberately 51 frames (235 ms) while the speech multiframe is 26 frames
(120 ms). These are different lengths to guarantee that any GSM subscriber — regardless of which
time slot they are using for TCH data — will always receive the SCH and FCCH transmissions from the
BCH, since the two multiframe lengths are coprime. This ensures robust synchronization for all users.
The hyperframe is important for security: GSM encryption algorithms use the frame number (FN) as
part of the key stream generation. A hyperframe contains 2,715,648 TDMA frames, providing sufficient
key stream length to make the encryption secure without key repetition for any practical conversation
length.

Normal Burst Structure (Figure 10.9 / 10.10)

Each time slot carries one data burst. For TCH and DCCH, this is a Normal Burst consisting of 156.25
bits:

Field Bits Purpose

Tail Bits (start) 3 Fixed zero bits to clear the convolutional decoder state

Coded Data Block 1 57 First half of encrypted user data

Stealing Flag 1 1 If set: this TS contains FACCH not TCH data

Training Sequence 26 Known bit pattern. Receiver uses it to estimate and

(Midamble) equalize the channel (combat multipath).

Stealing Flag 2 1 If set: this TS contains FACCH data

Coded Data Block 2 57 Second half of encrypted user data

Tail Bits (end) 3 Fixed zero bits

Guard Period 8.25 Empty period to prevent overlap with adjacent time
slots

📌 The 26-bit training sequence (midamble) is the key to GSM's robustness. By knowing exactly
what sequence was sent, the receiver's adaptive equalizer can measure the channel distortion
(multipath delay spread) and correct for it — crucial for reliable reception even in urban
environments with heavy reflections.

10.3.7 Signal Processing in GSM

Figure 10.11 in the textbook illustrates the complete chain of operations that a speech signal goes
through from the transmitter microphone to the receiver speaker. Each stage serves a specific purpose
in making the transmission reliable and efficient over the hostile mobile radio channel.

Stage What It Does Key Detail

Speech Compresses voice from PCM Uses Residually Excited Linear Predictive
Coding(RELP-LTP) (64 kbps) down to 13 kbps. coder enhanced with a Long-Term Predictor.
The coder analyzes 20 ms Chosen after extensive subjective listening
blocks of speech and tests.
produces 260 bits.

Channel Adds redundancy to protect The 260 bits are classified by importance:
Coding(Error against channel errors. 260 Type Ia (50 most important) get 3 CRC parity
Protection) bits → 456 bits per 20 ms bits + convolutional coding. Type Ib (132 bits)
frame. get convolutional coding only. Type II (78
least important) pass uncoded. Rate 1/2 conv.
code, K=5.

Interleaving Spreads the 456 bits across 8 If a burst is lost due to a fade, only 1/8th of the
consecutive time slots (8 × 57- bits from each speech frame are lost — within
bit sub-blocks). Adjacent the error correction capability of the code.
bursts carry data from two Without interleaving, a single lost burst would
different speech frames. wipe out an entire speech frame.

Ciphering(A3 and Encrypts the interleaved data. Encryption key changes call-to-call. A5
A5) A3 authenticates the user. A5 algorithm is secret. Security enhanced by
generates the keystream that hyperframe-length key stream.
is XOR'd with the 114 data bits
in each burst.

Burst Formatting Adds tail bits, training The midamble is essential for equalization.
sequence (midamble), stealing Guard period prevents inter-slot interference.
flags, and guard period to form
the 156.25-bit normal burst.

Modulation(0.3 Converts bits to an RF signal. GMSK minimizes bandwidth by using

GMSK) Binary 1/0 shifts the carrier Gaussian pulse shaping (BT = 0.3). Channel
frequency by ±67.708 kHz. data rate = 270.833 kbps = 4 × 67.708 kHz
The Gaussian filter smooths shift, ensuring spectral efficiency.
the transitions.

Frequency Optionally changes the Combats frequency-selective fading and co-

Hopping ARFCN on a frame-by-frame channel interference. Network operator
basis (slow hopping at up to decides whether to enable it.
217.6 hops/s, up to 64
different channels before
repeating).

Equalization At the receiver, the training Type of equalizer not specified in GSM
sequence is used to estimate standard — left to manufacturer. Typically a
the channel impulse response. Viterbi algorithm (MLSE) equalizer.
The equalizer compensates
for multipath distortion.
10.4 CDMA Digital Cellular Standard (IS-95)
IS-95 (Interim Standard 95), standardized by the Telecommunications Industry Association (TIA), is a
U.S. digital cellular system based on Code Division Multiple Access (CDMA). Unlike GSM's TDMA
approach — where users share a channel by taking turns in time — CDMA allows all users to transmit
simultaneously on the same frequency, distinguishing them by unique spreading codes. This is the
fundamental difference between the two systems.
IS-95 is designed to be backward-compatible with the existing U.S. AMPS analog system, so mobiles
and base stations can be produced economically for dual-mode operation. Each IS-95 CDMA channel
occupies 1.25 MHz of spectrum on each one-way link — compared to AMPS channels of 30 kHz. IS-95
is also fully compatible with the IS-41 networking standard used in North America.

📌 The key insight of CDMA: interference from other users looks like broadband noise. By
spreading data over a wide band (1.25 MHz), each user's signal appears as low-level noise to
others. The receiver uses the unique code to "despread" and recover the desired signal, while all
other users' signals remain as noise — the near-far problem must be carefully managed via
power control.

• User data rate varies: Unlike other standards where the channel chip rate is fixed and data
rate varies, in IS-95 the chip rate is always 1.2288 Mchip/s. User data rates (9600, 4800, 2400,
1200 bps) vary based on voice activity, and the spreading factor adjusts accordingly.
• No frequency planning: Because every cell uses the same 1.25 MHz channel, operators do
not need to plan frequency reuse patterns (unlike GSM where adjacent cells must use different
ARFCNs to avoid co-channel interference).
• Soft handoff: A CDMA mobile can maintain simultaneous links with two or more base stations
during a cell boundary transition. RAKE receivers at both the mobile and base stations combine
the signals, providing diversity gain rather than the abrupt "make-before-break" of GSM hard
handoffs.
• Variable data rate: The speech coder (QCELP) reduces its output rate to 1200 bps during
silence. The mobile transmits at lower power during these periods, directly reducing interference
to all other users in the system.

10.4.1 Frequency and Channel Specifications

IS-95 operates in the cellular band. The reverse link (mobile-to-base) uses 824–849 MHz and the
forward link (base-to-mobile) uses 869–894 MHz. Forward and reverse channels are separated by 45
MHz, just as in AMPS. Many users share a single 1.25 MHz channel, distinguished only by their
spreading codes.

Parameter Value

Reverse Link (Uplink) 824 – 849 MHz

Forward Link (Downlink) 869 – 894 MHz

Tx/Rx Frequency Separation 45 MHz

Channel Bandwidth 1.25 MHz (per one-way link)

 Parameter Value

Chip Rate 1.2288 Mchip/s

Maximum User Data Rate 9.6 kbps (14.4 kbps with QCELP13)

Total Spreading Factor (fwd) 128 (from 9600 bps → 1.2288 Mcps)

Guard Band (AMPS boundary) 270 kHz (9 AMPS channels each side)

10.4.2 Forward CDMA Channel

The forward CDMA channel (base-to-mobile) consists of exactly 64 code channels, each defined by a
unique Walsh function. Because all forward-link signals originate from the same base station antenna
and are transmitted synchronously, all 64 Walsh functions maintain perfect orthogonality — one user's
signal causes zero interference to any other user on the same cell's forward link (assuming no
multipath). The 64 channels are assigned as follows:

Channel Walsh Data Rate Purpose

Function #

Pilot Channel 0 (all-zeros Continuous Always transmitted at higher power. No

code) data — just a PN-spread signal mobiles use
to acquire timing, measure signal strength,
and enable coherent detection.

Synchronization 32 1200 bps Broadcasts system time, PN offset, and

Channel paging channel data rate. Allows mobiles to
synchronize to the system.

Paging Channels 1 – 7 (up to 7) 9600, 4800, or Send paging and control messages from
2400 bps base station to mobiles. Also used for
system parameter messages.

Forward Traffic Remaining 9600 / 4800 / Carry actual user voice/data. Variable rate
Channels codes 2400 / 1200 bps depending on voice activity.

Forward Traffic Channel (FTC) — Processing Chain

The forward traffic channel data goes through the following stages before transmission:

• Convolutional Encoding (Rate 1/2, K=9): User data at 9600/4800/2400/1200 bps is encoded
using a rate 1/2 convolutional code with constraint length 9. Generator vectors are G0=753
(octal) and G1=561 (octal). This doubles the bit rate but adds error correction capability.
• Symbol Repetition: To maintain a constant baseband symbol rate of 19.2 kbps, symbols are
repeated for lower data rates. At 4800 bps, each symbol is repeated once (×2). At 2400 bps,
each is repeated 3 times (×4). At 1200 bps, each is repeated 7 times (×8).
• Block Interleaving: Symbols are written into a 24×16 array (20 ms block) by columns and read
out by rows. This separates originally adjacent symbols so that a burst error affects spread-out
positions, within the correction capability of the convolutional code.
 • Data Scrambling (Long PN): The interleaved data is XOR'd with a decimated version of the
2^42-1 chip long PN code. The long code is unique per user (based on their ESN/MIN),
providing privacy. The 1.2288 Mcps long code is decimated by 64 to produce 19.2 ksps for
scrambling.
• Power Control Subchannel Insertion: One power control bit is inserted every 1.25 ms (800
b/s total) by puncturing (replacing) a data symbol. This bit instructs the mobile to raise (0) or
lower (1) its transmit power by 1 dB.
• Orthogonal Covering (Walsh Function): Each traffic channel is spread by a 64-chip Walsh
function at 1.2288 Mcps. Each data symbol (52.083 µs) is replaced by 64 Walsh chips. Different
users in the same cell use different Walsh functions — providing perfect code-division
separation on the forward link.
• Quadrature Spreading (Pilot PN): The Walsh-spread signal is further spread by the short I-
channel and Q-channel pilot PN sequences (period 2^15 - 1 chips). All base stations in the
system use the same pilot PN sequences but with different time offsets, allowing mobiles to
distinguish base stations.

[Link] Long PN Sequence

The long PN code has a period of 2^42 - 1 chips (approximately once per century at 1.2288 Mchip/s). It
is uniquely assigned to each user and serves dual purposes: data scrambling for privacy on the forward
channel, and user identification on the reverse channel. Two types of masks are used:

• Public Mask: Based on the mobile's Electronic Serial Number (ESN). Used for all initial CDMA
calls. The upper 9 bits are set to 1100011000 and the remaining 32 bits are a permuted version
of the 32-bit ESN.
• Private Mask: Based on the mobile's MIN (Mobile Identification Number). Transition to private
mask occurs after authentication. Provides stronger privacy than public mask.

[Link] Power Control Subchannel

Power control in IS-95 is critical because of the near-far problem: if a mobile close to the base station
transmits too strongly, it overwhelms signals from distant mobiles. IS-95 uses a two-level power control
strategy:

• Open-Loop Power Control: The mobile estimates path loss by measuring the pilot channel
received power and sets its initial transmit power inversely proportional to the received signal.
This handles large-scale path loss and shadowing.
• Closed-Loop Power Control: The base station measures each mobile's received signal-to-
interference ratio every 1.25 ms and sends a 1-bit update (via the forward traffic channel power
control subchannel). The mobile adjusts in 1 dB steps. With 800 updates/second, this can track
rapid fading variations.

📌 IS-95 power control is far more aggressive than GSM's SACCH-based power control (which
updates every ~480 ms). The 800 updates/second closed-loop rate is fast enough to track
Rayleigh fading at typical mobile speeds, which GSM cannot do.
[Link] Orthogonal Covering
The 64 Walsh functions used for forward-link orthogonal covering form a 64×64 Hadamard matrix.
Each row is a binary sequence of length 64 that is completely orthogonal (zero cross-correlation) with
every other row. Walsh function 0 (all zeros) is assigned to the pilot channel. Walsh function 32 goes to
the synchronization channel. Paging channels use the lowest-numbered remaining Walsh functions,
and traffic channels use the rest. Each 52.083 µs data symbol is spread to 64 chips at 1.2288 Mcps,
providing a processing gain of 64.

10.4.3 Reverse CDMA Channel

The reverse CDMA channel (mobile-to-base) is fundamentally different from the forward link in one
critical way: each mobile transmits independently, arriving at the base station via different propagation
paths with different delays. This means perfect synchronization between users is impossible, and
Walsh function orthogonality cannot be maintained. IS-95 therefore uses Walsh functions differently on
the reverse link — not for user separation (as on the forward link) but for 64-ary modulation.

Aspect Forward Link Reverse Link

Walsh Functions Orthogonal spreading (user 64-ary orthogonal modulation (data

Used For separation) encoding)

Synchronization Synchronous — all from same Asynchronous — each mobile

BTS independent

Convolutional Code 1/2 1/3 (more redundancy needed for

Rate reverse)

Modulation QPSK OQPSK (offset by half chip to reduce

envelope fluctuation)

Pilot Channel Yes (shared by cell) No pilot — base uses special correlator

Power Control Pilot-based open loop + forward Open loop + closed loop (800 bits/s from
subchannel base)

Reverse Traffic Channel (RTC) Processing Chain

• Rate 1/3 Convolutional Code (K=9): Stronger coding rate than forward link (1/3 vs 1/2)
because the reverse link has no pilot-aided coherent detection — noncoherent detection is
used, which requires more coding gain to achieve the same BER. Fixed output = 28,800 sps.
• Block Interleaving (32×18 array): 20 ms block interleaver. Symbols written by columns, read
by rows.
• 64-ary Orthogonal Modulation: Every group of 6 coded bits selects one of 64 Walsh functions
to transmit. The Walsh function number = c0 + 2c1 + 4c2 + 8c3 + 16c4 + 32c5. Instead of
transmitting 6 bits directly, the system transmits 64 Walsh chips — providing significant coding
gain (6 bits → 64 chips = ~10.7 dB gain). Walsh chips are transmitted at 307.2 kcps.
• Variable Rate / Data Burst Randomizer: At lower data rates, only some power control groups
(1.25 ms slots) are transmitted. A 14-bit block taken from the long PN code determines
randomly which slots are active — the data burst randomizer ensures each repeated code
symbol is transmitted exactly once.
 • Direct Sequence Spreading: Walsh chips are spread by the user's long PN code running at
1.2288 Mchip/s. Each Walsh chip is spread by 4 long code chips (1.2288/0.3072 = 4).
• Quadrature Modulation (OQPSK): The spread signal is modulated using Offset QPSK. The Q
channel is delayed by half a chip (406.9 ns) relative to the I channel. This offset prevents the
signal envelope from passing through zero during transitions, reducing the peak-to-average
power ratio and making the power amplifier more efficient.

10.4.4 IS-95 with 14.4 kbps Speech Coder (QCELP13)

The original IS-95 air interface was designed around a 9600 bps maximum user data rate. To
accommodate higher data rates for PCS applications and to improve speech quality, the IS-95 air
interface was modified for a 14.4 kbps maximum rate. The changes are:

• Forward Link: Convolutional code rate changed from 1/2 to 3/4 by puncturing (deleting) 2 out
of every 6 symbols from the original rate 1/2 encoded stream. Effective information rates
become 14,400 / 7200 / 3600 / 1800 bps.
• Reverse Link: Convolutional code rate changed from 1/3 to 1/2. Effective information rates
similarly increase.

The 14.4 kbps channel is used with the QCELP13 variable-rate speech coder:

• QCELP13 (Qualcomm Code Excited Linear Predictive Coder 13): An improved version of
the original QCELP. It operates at variable rates — highest rate (13.4 kbps equivalent) when
speech is active, lowest when idle — just like the original QCELP. Improvements include better
spectral quantization, improved voice activity detection, better pitch prediction, and pitch post-
filtering. The coder has multiple operating modes — Mode 0 behaves identically to the original
QCELP for backward compatibility.
• Intermediate rates: Used for stationary voiced frames, unvoiced frames, and transition frames,
reducing the average data rate and thus average interference in the system — directly
increasing system capacity.

📌 QCELP13 in Mode 0 is identical to the original 9600 bps QCELP — this backward
compatibility means networks can use QCELP13 without breaking connections to older handsets.

Summary: GSM vs IS-95 CDMA — Key Comparison

Feature GSM (10.3) IS-95 CDMA (10.4)

Access Technique TDMA + FDMA + FDD CDMA (DSSS) + FDD

Channel Bandwidth 200 kHz per ARFCN 1.25 MHz per CDMA channel

Users per Channel 8 per ARFCN (full-rate) Theoretically limited by interference

(typically 30–40 users per 1.25 MHz)
Feature GSM (10.3) IS-95 CDMA (10.4)

Uplink Frequency 890–915 MHz 824–849 MHz

Downlink Frequency 935–960 MHz 869–894 MHz

Modulation 0.3 GMSK QPSK (forward) / OQPSK (reverse)

Chip/Bit Rate 270.833 kbps 1.2288 Mchip/s

Speech Coder RELP-LTP @ 13 kbps (22.8 QCELP @ 9.6 kbps variable (QCELP13
kbps with coding) @ 14.4 kbps)

Channel Coding Rate 1/2 conv., K=5 (speech) Rate 1/2 K=9 (fwd), Rate 1/3 K=9 (rev)

Handoff Type Hard handoff (BSC-controlled) Soft handoff (RAKE combining at 2+

BTSs simultaneously)

Frequency Planning Required — adjacent cells use Not needed — frequency reuse factor = 1
different ARFCNs

Power Control Slow (~2 updates/s via Fast closed-loop (800 updates/s)
SACCH)

Synchronization TDMA frame-based (FCCH, Pilot PN code (short period 2^15-1)

SCH)

Privacy A5 stream cipher (ciphering) Long PN code scrambling (public/private

mask)

Subscriber ID SIM card (removable) ESN + MIN (in handset)