FLY PC100 Service Manual

Fly Development department

Repair Manual Item: Fly PC 100

File NO

Secrecy Grade Secret

Total：

Effected Date 2006-10-27

Version Ver1.0

text

Charge NO

Department HW

Addenda

Originator Check Approval

Centel Internal Use Only

AMENDMENT HISTORY

S/N Rev

1 V1.0

V1.0 RUS Check 2007-10-27

File

Department

Description of Change

Repair Manual――PC 100-

Version

Date Originator Check Approval

2006-10-27

薛辰宇



E. Kozlov

Ver1.0

Page

File style

ATTENTION

Report

DCR No.

The product must be repaired by the experienced engineers, we will not responsible for the damage caused

by any other person using this manual as instruction to repair products.

The manual owned by TechFaith Wireless Communication Technology (BeiJing) Limited, no part may be reproduced except as authorized by written permission. The copyright and the foregoing restriction extend to reproduction in all media.

Whilst every care has been taken in the preparation and publication of this document, errors in content, typographical or otherwise, may occur. If you have comments concerning its accuracy, please write to:

Beijing Techfaith R&D CO.,LTD.

1/F M8 East No.1 Jiu Xian Qiao Dong Road, Chao Yang District.

Beijing, China.

P.C: 100016

1. Foreword

1.1. The purpose of the manual

The manual is just used for the experienced engineer not the general publication, providing basic

reference for electric and mechanic repairing.

1.2. General safety notice

For protecting safety of individual and commonality, everybody should pay attention to the items hereinafter: z The mobile phone should not close too much with exposed body especially face and eye. Don’t touch the

antenna part(right top of the phone) when using the phone, make sure it is under the best signal condition.

z Don’t use mobile phone on the airplane. Lest should disturb communication of aviation and navigation

system, lead to accident, endanger flying safety

z Don’t use mobile phone in he building site, avoid the contact bomb caused by radio signal. Pay attention

to the sign that forbid radio signal around before use mobile phone

z Don’t use mobile phone near flammable gas or oil(including fuel section, under the board on the ship, fuel

or other transfer and deposited area). For preventing the bomb caused by electromagnetic harmonic

z Don’t use the mobile phone in the operating room and other area with electric medical treatment. For

protect the electronic treatment from interference and medical accident

z Please don’t use mobile phone when driving Connect outer antenna on the car when using hand over z Don’t give the mobile phone to children. Some other people should use the mobile phone cautiously

(pregnant woman, neurasthenia sufferer, people with heart pacemaker in body etc.)

2. General character

2.1. Product description

PC 100 mobile phone is full duplex, using digital dem odulation technology, controlled by microprocessor. Support 900MHz/1800MHz/1900MHz cell radio system compatible and GPRS. Handset provide land connect telephone service to user through single base station when using it correct. All the base stations connect to a centre control room.

Primary chips in PC 100 contain below (according to the way of encapsulation)

BGA encapsulation：OMAP730－DBB(DBB－Digital BaseBand,encapsulate CPU and DSP manage function)、TWL3016B2GQW－ABB(ABB－Analog BaseBand，providing the interface between system analog and digital signal, and power manage function)、K4S51163PF-Y(P)F75 Memory(8M x 16Bit x 4 Banks Mobile-SDRAM); 、－MD4832-D512-V3Q18-X Memory(512Mbit Flash) 、和 BC41B143AXX-IXB-E42－Single Chip Bluetooth；

QFN encapsulation：TRF6151BRGZR－TRANSCEIVER 、BQ24020DRCR-smart charge

Special encapsulation: PF09016B-TB－PA、

Radio Frequency and Base band in PEAN is isolated by screen, micro SIM card box is protected by the battery

PC 100 has the same power step as usual

Radio Frequency circuit of antenna on the top of the mobile phone will cut automaticly when PEAN using RF accessory plug

2.2. Introduction of character and function

Character:

Supporting trio band：The mobile phone can automatic switch in GSM900 network, DCS1800 network and PCS1900 network. Choose best channel for calling. The mobile phone can also automatic switch during the call without disturbing users. And the ratio of connecting improves with the automatic switch. Using trio method GSM900／DCS1800/PCS1900 networks，not only ease up the high dense radio channel, but also provide wilder users for network operation vendor. Both user and operation vendor gain more benefit. Using of GPRS （General Packet Radio Service）change the mind of GSM network, which can provide more than circuit switch, It can combine mobile communication with digital network together through add corresponding function entities and limited changes about network. Import IP service in wild mobile market, bring wilder and faster message space for mobile phone user too

Function：

z GSM850 / GSM900 / DCS1800 / PCS1900 automatic switching z Full-rate/enhanced full-rate/half-rate coders z GPRS Class 10 z Inter antenna z 65K color 2.4” TFT display screen, 320×240

z Inter 200，0000 pixel camera z 64 tones ring bell z Microsoft operation system z Enhanced phone number book z WAP Explorer Ver 2.0 z MMS/SMS z Inter 2Games z Inter ring bell and wallpaper z WI-FI z Blue Tooth z MP3;MPG4 z STK Service

3. Technical Reference：

Function

Frequency

Range

Channel

Interval

Channel

Modulate

Transfer

phase error

Full duplex

interval

Frequency

stabilization

Battery voltage：3.7V Battery voltage：3.7V Battery voltage：3.7V Battery voltage：3.7V

Voltage

Transmit

current

Antenna

impedance

RF export

power

SIM Insert only Insert only Insert only Insert only

Temperature

Range

Table 3.1: basic technique parameter

RF power

export

Interference

radiation

Table 3.2: Transmitter

RF voltage < -102 dBm < -100 dBm < -100 dBm

Receive error

ratio (100

kbits )

Channel jump

time

Insert time around10 s

Table 3.3: Receiver

Sound coding

style

Ratio 13.0 kbps 13.0 kbps 13.0 kbps

GSM850

Technical Reference

Transmit Frequency

824-849 MHz

Receiver Frequency

869-894 MHz

200 KHz 200 KHz 200 KHz 200 KHz

119channel，

Every channel

contains 8 short

GMSK ( BT ＝ 0.3) GMSK ( BT ＝ 0.3) GMSK ( BT ＝ 0.3) GMSK ( BT ＝ 0.3)

RMS<5°, peak<20 RMS<5°, peak<20 RMS<5°, Peak<20 RMS<5°, Peak<°

45 MHz 45 MHz 95 MHz 85 MHz

±1ppm ±1ppm ±1ppm ±1ppm

Operation voltage：

3.4～4.2V

Peak value≤1.5A Peak value≤1.5A

50Ω 50Ω

most 2W most 2W most 1W most 1W

-10 °C to +55°C -10 °C to +55°C -10 °C to +55°C -10 °C to +55°C

33 dBm +/- 2dBm 30 dBm +/- 2dBm 30 dBm +/- 2dBm

1GHz should <-36 dBm, (>

1GHz should <-30dBm )

< 2% < 2% < 2%

500us

规则脉冲激励 /长时预测线性预

测编码。(采用 LTP 的 RPE )

Technical Reference

Transmit Frequency

Receiver Frequency

Operation voltage：

EGSM

880-915 MHz

925-960 MHz

174channel，

Every channel

contains 8 short

3.4～4.2V

规则脉冲激励 /长时预测线性预

测编码。(采用 LTP 的 RPE )

DCS

Technical Reference

Transmit Frequency

1710-1785MHz

Receiver Frequency

1805-1880 MHz

374channel，

Every channel

contains 8 short

Operation voltage：

3.4～4.2V

规则脉冲激励 /长时预测线性预

测编码。(采用 LTP 的 RPE )

PCS

Technical Reference

Transmit Frequency

1850~1910MHz

Receiver Frequency

1930~1990MHz

299channel，

Every channel

contains 8 short

Operation voltage：

3.4～4.2V

Frame

duration

Code length 260 bit 260 bit 260 bit

Kind

使用前向纠错码的编码比特

率

Table 3.4: Sound Coding

kind 1 为 182 bit，kind 2 为 78

20 ms 20 ms 20 ms

kind 1 为 182 bit，kind 2 为 78

bit

22.8 kbps 22.8 kbps 22.8 kbps

bit

kind 1 为 182 bit，kind 2 为 78

bit

4. Marking and Security:

4.1 Marking:

In order to protecting legitimate rights and interests of user, economic profit of manufacturer, and attacking smuggles and counterfeit, the domestic and foreign mobile phone manufacturers (according to the regulation of government department) should paste series of security marks on the production when after producing, for distinguishing and protection. There are two among them is the most important:

1） CMII

The abbreviation of CMII is the license issued by the information industries department. Both the domestic and foreign productions factory must apply this license to the information industries department if there mobile phone will sells in China (besides HongKong, Macao and Taiwan). The productions must paste the mark that accesses the net when they leave factory after acquiring the license. The actual mark (use after 1st Feb.1999) could be identified from these aspects as follow:

z The symbol is the rectangle, the bottom grain for the light blue net grain. z Four Chinese character ‘the permit of access the net’ are printed on right side relative to the middle. The

symbol is the only group of Chinese characters. z “CMII” is printed on the left side of the symbol "The permit of access the net ". There are three lines of

contents under the symbol "The permit of access the net": The first line permit number (each production

factory homogeneous model handset access net card number is only), its form is 02-XXXX-XXXXXX,

3-6th common representative factory serial number, second line handset model: Form like V998, N5110

and so on. The third line of form is group of numerical codes (each access net symbol not to be all same). z The typeface on the true symbol usually printed by the needle printer, the number is clear, and the color is

shallower. It is can be seen that hits by needle if carefully look on it. The imitate symbol usually printed by

common spray-ink printer, the number is unclear, the color is darker, and no hits by needle z The symbol uses the safety line to guard against false paper printing. This kind of paper touches different,

there is obvious convex-concave feeling on the safety line place, There is vertical lines obviously under

the ultraviolet lamp (e.g. 验钞机). Simultaneously, red fluorescence typeface ‘CMII’ appears on the right

side of the symbol (which is can not see with naked eye). There is non on the imitate one.

2）IMEI：

IMEI is the abbreviation of International Mobile Equipment Identification. The IMEI code is a kind of electrical character code made up of 15 digit number. Every code is unique in the world corresponds only one mobile phone. Every mobile phone will be match a unique IMEI code after assembly. This code will be recorded by manufacturer in the whole production. Its composition is as follows:

The first 6 digit (TAC) is the "model approves code", standing for the type of a mobile phone. The follow 2 digit (FAC) is "final assembly number", standing for the production factory or the final assembly place. The afterwards 6 digit (SNR) is "bunch number", standing for the production sequence number. The last 1 digit (SP) is set to "0" which is the examination code that standby temporarily usually now.

The IMEI code is pasted on the symbol at the back of the mobile phone, and saved in the memory. It is also the "file" and "ID card number" of the mobile phone in factory. The IMEI code can be read by pressing "*#06#" on the keyboard. The IMEI code will be changed when displace new main board. It is necessary to refresh new symbol for the equipment.

4.2 SIM card：

1）Brief introduction of SIM card

SIM is the abbreviation of Subscriber Identity Model (customer recognition module). SIM card is also called smart card, ID card of user. The GSM digital mobile phone can be used when inserting this card only. There are three kind of materials in the SIM card: Surface metallic circuit board, IC integrated circuit, black protective hard glue. The work of surface metallic circuit board is transmitting information between IC and the mobile phone. The black protective hard glue purely for protects IC. And IC is the important part in SIM card. IC saved user's information, encryption key and other information in the SIM card. It identify user for GSM network and encrypte voice information for user during the call. The work of the six blocks on the metallic

circuit is record input information, voice, instruction of network operation business respectively and so on. The using of SIM card prevent simultaneous calling and wire tapping. Facture of SIM card is according to GSM international standard and criterion strictly. It ensure common communication for user reliably. The using of SIM card divides card and mobile phone in the GSM system. One SIM card marks one user. SIM card can be inserted in every GSM mobile phone, and the fee of communication can be recorded to the marked account of the user. SIM card contain personal data of accessing GSM service that must be needed, they are:

z International mobile subscriber recognition

z Temporarily mobile subscriber recognition

z Main system

z Registration service

z The PIN reconciliation locks the code

z The call limits the code

z The user stores individual data. For instance, the short news, the fixed digit dialing, shrink the position

digit dialing, the performance parameter, the speech spends the register and so on

z Will access the net the numeral mobile phone, otherwise will have the possibility to cause the card to

receive the damage.

2）Security function

There is mobile phone SIM card lock function to prevent other people use the SIM card random. To unblocking it, just input PIN code easily. The PIN code (personal Identity Number) is called individual identification code. It is 4digit long, established by user himself. It belongs to the password of SIM card that protect security of SIM card. Its original estate is not activating. After its starting up, GSM system will identify the mobile phone automatically after turn on the phone every time. It will estimate validity of the SIM card, in other words, it will check password with mobile phone. It provides services to user after approving by the system only. There are 3 times of opportunities for input PIN code. It will lock automatically if the 3 times of opportunities failed all. The way of unblocking it is input PUK only. PUK (PIN Unblocking Key) is the master key for unblock the PIN code. Every SIM card has its corresponding PUK code. It is 8digit long, managed by user himself. It is controlled by network operation business too. At present, the domestic motion bureau has opened PUK inquire service that user could manage PUK code by themselves. There are 10 times of opportunities for input PUK code. The SIM card will start up self-destruction program automatically if the 10 of opportunities failed all. Then invalidate the SIM card. In this case, it is necessary to transact a new SIM card. Therefore, please do not decode without correct PUK code

Setting calling restriction is another way of protect the SIM card. The calling restriction is away of restrict call in and call out through establishing password. User could establish or cancel every kind of restriction of the mobile phone at will, preventing call out by mistake, stealing call, especially international long distance call, avoiding unnecessary loss. The password of calling restriction is 4digit long which the original estate is 0000. The user who transacts this service should modify the original password, for improving the security. The calling restriction could be set according to both file way and coding way. These two ways of setting have the same effect. It is noticed that this kind of service is for user only who use international long distance service, and it can not be used with calling diversion service at the same time

5. Introduction of GSM System：

5.1：The history and development of GSM：

1981 Analogue cellular introduced

Franco-German study of digital pan-European cellular system

1987 MoU signed by over 18 countries

1989 GSM was moved into the ETSI organization

GSM name changed to Global System for Mobile communications.

1990 DCS1800(edited GSM900) specification developed In 1981 analogue cellular was introduced and at about the same time there was a joint Franco-German study looking at digital cellular technology and the possibility of making a pan-European system..

In 1982 a special working committee, Groupe Spécial Mobile (GSM), was formed within the CEPT to look at and continue the Franco-German study. In 1986 the working committee was taken a step further by establishment of a permanent nucleus of people to continue the work and create standards for a digital system of the future. About a year later, the memorandum of understanding, or MoU, as it is referred to, was signed by over 18 countries. It stated that they would participate in the GSM system and get it into operation by 1991.

In 1989 GSM was moved into the ETSI (European Telecommunications Standards Institute) organization. Once under the control of ETSI, the GSM system had it's name changed to Global System for Mobile communications. The committees working on the system changed from GSM to SMG (Special Mobile Group). These changes avoided confusion between the system name (GSM), and the people working the specification (SMG). It also brought the naming in line with the official working language of ETSI (English).

In 1990 the GSM specification developed an offshoot - DCS1800. The Original DCS1800 specifications were developed simply as edited versions of the GSM900 documents. Interest in GSM quickly spread outside Europe. In 1992 Australia became the first non-European country to join the MoU. Since then, many other Asian countries have adopted GSM. There's now a Pan-Asian MoU, investigating international roaming agreements.

The Phase II specification for GSM has now been defined, merging GSM900 and DCS1800 documents, number of new features are added to the system, along with many minor adjustments. The next step, Phase II+ defines the addition of specific new services such as data and fax to GSM and DCS1800.

5.2： GSM Network

This is the GSM system. The Mobile Stations (MS), both hand held (portables) and traditional mobiles in a car, talk to the Base Station System (BSS) over the RF air interface. The Base Station System (BSS) consists of a Base Transceiver Station (BTS), and a Base Station Controller (BSC). It's typical for several BTS to be located at the same site, producing 2 to 4 sectored cells around a common antenna tower. BSC's are often connected to BTS via microwave links.

The BSC to BTS link is called the Abis interface. Typically 20 to 30 BTS will be controlled by one BSC. A number of BSS's would then report back to the Mobile Switching Center (MSC) which controls the traffic among a number of different cells. Each (MSC) will have a Visitors Location Register (VLR) in which mobiles that are out of their home cell will be listed, so that the network will know where to find them. The MSC will also be connected to the Home Location Register (HLR), the Authentication Center (AUC), and the Equipment Identity Register (EIR) so the system can verify that users and equipment are legal subscribers. This helps avoid the use of stolen or fraud mobiles. There are also facilities within the system for Operations and Maintenance (OMC) and Network Management (NMC) organizations. The Mobile Switching Center (MSC) also has the interface to other networks such as Private Land Mobile Networks (PLMN) and Public Switched Telephone Networks (PSTN) and ISDN networks.

5.3 ：GSM Air Interface：

In GSM, the GSM transmission between MS and BS is Radio Communication, let’s introduce the GSM Air Interface.

1）：Channel Plans：

Above is a table that shows the relative frequency plans of the three GSM networks: GSM900, DCS1800 and PCS1900.

The frequency range of the Uplink and Downlink show how the two bands are split into the two directions, rather than an uplink being followed by a downlink 200kHz later. Another difference is that the channel numbers are different. Remember this if you write any test control software and want to port from one system to another, as the channel numbers must be changed for correct operation.

2）：GSM FDMA and TDMA：

GSM uses TDMA (Time Division Multiple Access) and FDMA (Frequency Division Multiple Access). The slide shows part of one of these bands. Each band is divided into 200kHz slots called ARFCN’s (Absolute Radio Frequency Channel Numbers).

As well as dividing up the frequency, the ARFCN is also divided in time into 8 Timeslots (TS), each TS being used in turn by a different MS. The 8 TS’s together are known as a Frame.

3）：Physical Channel：

The combination of a TS number and ARFCN is called a physical channel. The corresponding Number is called ARFCN (Absoluteness RF Channel Number). One ARFCN assert a pair of channels, one is uplink, the other is downlink. This pair of channels is called physical channel.

In GSM system , the frequency interval is 200kHz.

The ARFCN of PGSM is 1~124，the center frequency of CH1 uplink is 890.2MHz. When the value of ARFCN is equal to n, center frequency uplink channel is fn=f1+(n-1) 200kHz　。The center frequency of corresponding downlink channel need to add duplex frequency separation, PGSM is 45MHz.

We need declare that, because of the PCD system is only used in North American, and no DCS system used, these two systems can not be exist at the same area, the ARFCN of DCS and PCS system can overlap with each other.

Modulation Mode：

4）：

Now the signal can be modulated with a 0.3GMSK modulation scheme.

5）：TDMA Burst： The burst can be divided into three distinct areas:

• Ramp Up

• Useful Part of the Burst

• Ramp Down All of these levels are controlled by the GSM standard. The Useful Part of the Burst is the area where the modulated data is present. There are 148 bits (each bit is represented by a single symbol in 0.3GMSK modulation) which will be examined more closely in a later section.

GSM is part of

6）：

Duplex Timing：

TDMA system，

Downlink and Uplink

¦Uplink Lags Downlink by 3 Timeslot periods ¦Uplink and Downlink use same Timeslot Number ¦Uplink and Downlink use same Channel Number (ARFCN)

¦Uplink and Downlink use different bands (45MHz apart for GSM900)

In the previous example we can see that the timeslots are offset by 3 between the downlink and the uplink. We receive information in timeslot two in the downlink we have two timeslots in which to switch to the uplink frequency and be ready to transmit information. Then, we have to get ready to receive our next time slot of information in the next frame.

7）：Power Control： As the mobile moves around the cell, its transmitter power needs to be varied. When it's close to the base station, power levels are set low to reduce the interference to other users. When the mobile is further from the base station, its power level needs to increase to overcome the increased path loss. However, if too much power is used, the user’s battery will run down too quickly. All GSM mobiles are able to control their output power in 2dB steps. The base station commands the mobile to a particular MS TX Level (power level) by watching the power level of the received signal at the BS.

There may be man y users in the same cell. If every Mobile phone has the same emission power,

ones closer to Base Station can block the ones which are farther; On the other hand, because if closer ones

emit more power

The table above shows the maximum and minimum power levels on the mobiles in different systems. The final row shows the power steps, which are all numbered, and how they relate to the max and min powers.

8）：Timing Control： If the burst arrives at the correct time, it will fit into its physical channel and not disturb any other burst that may follow it in the next timeslot. However, if it is delayed, due to a long distance to travel, it may arrive late and impact the following burst from another user. In this case the mobile is instructed by the BS to burst earlier which will correctly align the burst in the timeslot. The message sent by the BS is called the Timing Advance. The base station monitors the burst to see when it arrives at the base station. If it arrives late or early, the base station will note how many times it has changed since the last Timing Advance adjustment, and if there have been more than 4 x ¼ bit periods change in one direction, the adjustment will be made again.

Main parameter of GSM is showed as follows:

ARFCN Range 1~124 975~1023, 0,

PGSM EGSM DCS PCS

512~885 512~810

1~124 Uplink Band Range Downlink Band Range

Bandwidth duplex Interval

Frequency

TDMA User

890MHz~915MHz 880MHz~915MHz 1710MHz~1785MHz 1850MHz~1910MH

935MHz~960MHz 925MHz~960MHz 1805MHz~1880MHz 1930MHz~1990MH

z 200kHz 200kHz 200kHz 200kHz 45MHz 45MHz 95MHz 85MHz

8 8 8 8

Number

Modulation Mode

0.3GMSK 0.3GMSK 0.3GMSK 0.3GMSK

Power Grade Range Max Power 33dBm 33dBm 30dBm 30dBm Power Grade Difference

5.4：Identity：

If user want to connect to network, GSM need affirm users’ legality identity. Users’ identity information recorded in SIM. According to these information, network affirm user’s validity. Important Digital Identification used in GSM include:

1. IMSI（International Mobile Subscriber Identification）

This number is the exclusive number to indicate user’s identity. When user enter network, the system find user’s information according to this number. It is composed by three parts:

MCC（Mobile Country Code）Country Number, three digits, indicate user’s country.

MNC（Mobile Network Code）Mobile Network, two digits, indicate Network Operator.

MSIN（Mobile Subscriber Identification Number）User Identity Number, eleven digits, indicate Mobile Subscriber in network.

2. TMSI（Temporary Mobile Subscriber Identification）To safeties, we use TMSI instead of IMSI when

transmitted IMSI, TMSI is valid only in local area. Its structure is selected by manage department, and the whole size is not more than 4 bits.

3. IMEI（International Mobile Equipment Identity）exclusive number, system also can distinguish validity of

equipment by this number.

5.5：GSM Voice Path ：

There needs to be some way to encode the voice into data Next the data must have error protection added to it The Data has further error protection It is modulated It is bursted Again, this is very simplistic and other steps will be explored during this section.

5.6：logical channels

TCH ：Mobiles on a call use a Traffic Channel (TCH). The TCH is a two way channel used to exchange speech information between the mobile and base-station.

SACCH ：When the MS is on a call, it is constantly monitoring the Received Signal Quality (a bit error rate measurement known as RxQual) and the Received Signal Level (a power measurement call RxLev). These are constantly being sent back to the BS on a Slow Associated Control Channel (SACCH).

FACCH：The Fast Associated Control Channel is used to pass critical information to the mobile during a call, by taking over the TCH from the callers.

BCH：All BTS produce a Broadcast Channel (BCH). The BCH is like a lighthouse or beacon. It's on all the time and allows mobile to find the GSM network. The network for a variety of user functions also uses the BCH signal strength. It's a useful way of telling which is the closest BTS to the mobile. It also has information coded onto it, such as the identity of the network (e.g. Mannesmann, Detecon, or Optus), paging messages for any mobiles needing to accept a phone call, and a variety of other information. Each mobile will monitor the power of adjacent cell BCH’s to aid the network in making hand-off decisions.

FCH：Frequency Correction Channel

SCH：Synchronization Channel

BCCH：Broadcast Control Channel

CCCH：Common Control Channel The base-station posts a PCH (paging channel) on the CCCH part of the BCH. When the mobile receives the PCH, it responds by sending a RACH. The remainder of the process is identical to the mobile originated case.

AGCH:Access Grant Channel

RACH:Random Access Channel, When the mobile sends out a RACH, to start a call, to avoid collisions with bursts in adjacent TS, RACH bursts, that are shorter than normal are sent.

The Stand-Alone Dedicated Control Channel (SDCCH) is used during call set up as a stepping stone to the Traffic Channel. It is also used to pass signaling when the mobile is in IDLE mode. This is used for example for SMS Point-to-Point messages as well as Location Updates that we will look at later.

5~19 5~19 0~15 0~15

2dBm 2dBm 2dBm 2dBm

5.7 Mobile Turn-On

1)Mobile Searches for Broadcast Channels (BCH)

2)Synchronizes Frequency and Timing

3)Decodes BCH sub-channels (BCCH)

4)Checks if Network Allowed by SIM

5)Location Update

6)Authentication

When a mobile first turns on, it searches all 124 channels in the downlink for signals. It will then order the channels by received signal strengths and check to determine if the channel was a BCH (Broadcast CHannel). Once the MS finds a BCH, it adjusts internal frequency and timing from the FCH and SCH, then checks to determine if the BCH is from its PLMN (Public Land Mobile Network). This involves comparing the allowed network and country codes stored on the SIM card with the information encoded on the BCCH. The mobile repeats this cycle until a good broadcast channel is found. If the mobile recognizes that it's in a different cell from the last time it was used, it needs to tell the network where it is. The network has to keep track of where every mobile is so that it can route calls to the correct cell for any particular mobile. This process of telling the network "here I am" is called a location update. The mobile sends a RACH, gets assigned to an SDCCH, exchanges control information, then ends the call. The user will typically not be aware that this process is taking place. For Location Updates, this time showing which part of the network is involved in transactions.

The IMSI attach/detach process is a way of forcing all mobiles to inform the network when they have camped and when they have turned off (or just before they turn off!). The SIM stores the last location Area Code (LAC) when it is powered down and it compares this to the camping LAC on Power up and if they are different it will perform an IMSI attach.

Mobile Originated Call

Mobile Sends RACH Channel Assignment Posted on BCH (AGCH) Mobile and Base Station communicate on SDCCH Authentication Mobile Assigned to Traffic Channel (TCH) Speech Data sent and received Once camped, the mobile is ready to send or receive calls. When a user dials a number, and presses the send button on the mobile, call origination takes place. The mobile transmits a short RACH burst on the uplink, using the same ARFCN as the BCH is using on the downlink. The base station responds to the RACH by posting an AGCH (Access Grant CHannel) on the CCCH. These are logical channels on the BCH physical channel. The mobile listens on the BCH for the AGCH, when it receives it and decodes the instructions, it re-tunes to another ARFCN and/or timeslot and begins a two-way dialogue with the base station on an SDCCH. One of the first things that the mobile will mreceive is the SACCH associated with the SDCCH. Once it receives the SACCH, it will get timing advance and transmitter power information from the base station. The base station will have calculated the correct timing advance from the arrival time of the RACH. Once the mobile gets timing advance information, it can send normal length bursts. The SDCCH is used to send messages back and forth, taking care of alerting (making the mobile ring) and authentication (verifying that this mobile is allowed to use the network). After a short period of time (1 to 2 seconds), the mobile is commanded over the SDCCH to re-tune to a TCH. Once on the TCH, speech data is transferred on the uplink and downlink.

Mobile Terminated Call

Mobile Sees Page Mobile Sends RACH Channel Assignment Posted on BCH (AGCH) Mobile and Base Station communicate on SDCCH Authentication Mobile Assigned to Traffic Channel (TCH) Speech Data sent and received The process for base station originated calls is very similar. The base-station posts a PCH (paging CHannel) on the CCCH part of the BCH. When the mobile receives the PCH, it responds by sending a RACH. The remainder of the process is identical to the mobile originated case. If you can find a way to translate the GSM bursts into audio tones (AM demodulate), it's interesting to hear the difference between the channel types as a call is set up. A good way to do this is to use a GSM phone near an old TV set or a conventional wired phone.

The interference created in these devices amounts to AM demodulation. The RACH burst can be heard as a single 'Tick' sound. It's quickly followed by the SDCCH 'Tat, Tat-tattat, tat-tat-tat ...'. After a few seconds, the TCH is connected 'Buzzzzzzzzz'.

Mobile Handoff

We have covered mobile power on and call establishment, but there is one other important area. During a call the mobile may have to change base stations. If the call is between faces of the same base station, this is performed locally. The case shown here is that where the base station is not the same. The mobile reports its measurements and the serving BSC determines that it is time to perform a handoff. It will contact the new base station and get the information on the new channel and timeslot (along with midamble and timing information) and send this to the mobile. It then commends the mobile to switch base stations and then once the new call is established, close down the old link and reallocate it to another user if necessary.

6. Summary introduction of mostly chips used in PEAN

Chips used in PEAN can be divided into flat and application manage according to function. There is the

introduction of these two chips

6.1：Flat Chip：

U201：DBB——Digital Base Band, composed of ARM7 TDMIE CPU and TMS320C54X DSP dual inter

core. The chip integrate 4Mbit Memory inside、provide multi control interface outside. There is the basic structure as follows:

Figure6.1: DBB basic structure

Main structure characteristic and function of DBB (Part Number is D751992AGHHR ) including:

Nuclear working voltage 1.5V (1.35-1.65V ), IO voltage 2.8V( 2.5V-3V ) Working temperature range -40~ +85℃ CPU working at 52MHz, DSP working at 104MHz Integrate 4Mbit SPAM Memory inside 289 pin uStarBGA encapsulation

U201：ABB——Analog Base Band, is the bridge of digital and analog signal in the system. Audio, IQ and

other exterior analog signal can connect with DBB control centre through ABB. ABB controls system clock, A/D D/A conversion, background light of keyboard, provide system power and charge interface etc. There is the basic structure as follows:

Figure 6.2: ABB basic structure

U682:Transceiver: is a high integrated multi frequency low power cost transceiver, there is the structure

as follows:

Figure 6.3: Transceiver structure

Main function and characteristic of U682:

Support GSM850, GSM900, DCS1800, PCS1900 multi frequency cell system Support GPRS Class 12 and EDGE operation Contained a synthesizer, 4 fully compositive VCO, 3 regulator and PA controller 3 bios serial interface 48pin QFN48 encapsulation IO working voltage 2.8V(2.7-2.9V) Working temperature -30℃~ +85℃

U603：U603（PF09016B-TB）,is a 3 band power amplifier module integration with power control function.

With its control part, signal’s amplify and signal’s power control can be made by itself only. It is divided to low frequency band(GSM850/EGSM900) and high frequency band(DCS1800/PCS1900). Every part of the amplifier is combined with 3 sect amplifier. Export power is controlled by a inter power control module, which realize the control function through changing 3 sect amplifier’s deflection set. Power export of low frequency band could reach 37dB, power export of high frequency band could reach 34dB. Spec value of working voltage is 3.5V, in/out impedance is 50 ohm. There is the structure as follows:

Figure 6.4: PA structure

Definition of main pin: spec value of working voltage VBAT1、VBAT2 is 3.5V, provided by battery of mobile phone. TX-ON is the power set of amplifier, at high level is (1.5V～2.8V，spec level 2.0V) amplificatory state; at low level is (0V～0.5V，spec value 0V) idle state. Bandsel is band selecting signal, GSM band select pass at low level (0V～0.5V，spec value 0V), DCS band select pass at high level（1.9V～3.0V，spec value 2.0V）. VRAMP is frequency modulate control level, around 0.2V-1.8V

图 7.1：PEAN 基带电路原理示意图

Figure 7.1 shows basic control flow of PEAN mobile phone

It is shown in the picture that U201 is the core of control in the whole system. It carries out all programs storage in U307, and control the whole system through U202, U5(M-DOC), U4(SDRAM)

According to the difference of function, PEAN can be divided as: RF process circuit (including receiver part and transmit part), audio interface circuit (Mic、Receiver、ear phone Mic and ear phone Receiver) and charge circuit, Sim card interface circuit, backlight control circuit, display circuit and camera process circuit etc.

Before introduce these circuit cell, it is necessary to know clock circuit and power management in the system——because these two are the base or working

7.2 System clock circuit introduction:

Clock is the base of system control in every control system. So, it is necessary to know the output and control theory of clock in PEAN mobile phone.

There are 2 kind of clock in the system: one is 32.768KHz for display time — —provided by Y201(32.768KHz crystal); the other is work clock for system working——provided by(26MHz crystal)

1. RTC——Real Time Clock

Y201 connect to U200 through the matching network combined with C201, C204, C203, C204 and R201, provide RTC for U200 Power supply of Y203 is provided by H1 in U202, it is V-RTC in the theory structure V-RTC can be defined as 1.8V, 1.5V and 1.3V by software (There is 1.5V in PEAN) Power supply of RTC circuit provided by main battery VBAT usually, and provided by standby battery (standby battery provide V-RTC only) when main battery lack of electric power or take off the main battery (e.g. when changing Sim card) . Electric power provided by standby battery is limited (support RTC circuit for only a few hours). Therefore, it is necessary to keep power supply provided by VBAT in sure time interval that prevent RTC information missing.

2. System clock circuit

Y202 (26MHz crystal) provide base value for system clock

connect to pin C12 of U202, which provide AFC (AFC：Automatic Frequency Control) for 26MHz crystal; the

PF09016B (PA)

MIC

Speaker

Receiver T-Flash

Earphone

C206, R201, D201, C202, R220 and C205 provide matching circuit for Y202. One side of this circuit

155154NPTEBE (transcevier)

U202 TWL3027B2G WQ (ANALOG BASEBAND)

Supply Management BQ24070

Figure 7.1: PEAN base band circuit structure

U201

OMAP 850

LCD

WI-FI

Bluetooth

M-DOC

DDR

-SDRAM

Camera

+ 45 hidden pages