Voxtel W420 Operating instructions

Voxtel
Repair Manual
Item: W420

2
1. Foreword
1.1. The purpose of the manual
The manual is just used for the experienced engineer not the general publication, providing basic
reference for electric and mechanic repairing.
1.2. General safety notice
For protecting safety of individual and commonality, everybody should pay attention to the items hereinafter:
 The mobile phone should not close too much with exposed body especially face and eye. Don’t touch the
antenna part(right top of the phone) when using the phone, make sure it is under the best signal condition.
 Don’t use mobile phone on the airplane. Lest should disturb communication of aviation and navigation
system, lead to accident, endanger flying safety
 Don’t use mobile phone in he building site, avoid the contact bomb caused by radio signal. Pay attention
to the sign that forbid radio signal around before use mobile phone
 Don’t use mobile phone near flammable gas or oil(including fuel section, under the board on the ship, fuel
or other transfer and deposited area). For preventing the bomb caused by electromagnetic harmonic
 Don’t use the mobile phone in the operating room and other area with electric medical treatment. For
protect the electronic treatment from interference and medical accident
 Please don’t use mobile phone when driving Connect outer antenna on the car when using hand over
 Don’t give the mobile phone to children. Some other people should use the mobile phone cautiously
(pregnant woman, neurasthenia sufferer, people with heart pacemaker in body etc.)

3
2. General character
2.1. Product description
W420 mobile phone is full duplex, using digital demodulation technology, controlled by microprocessor.
Support 900MHz/1800MHz/1900MHz cell radio system compatible and GPRS. Handset provide land connect
telephone service to user through single base station when using it correct. All the base stations connect to a
centre control room.
Primary chips in W420 contain below (according to the way of encapsulation)
BGA encapsulation：OMAP730－DBB(DBB－Digital BaseBand,encapsulate CPU and DSP manage
function)、TWL3016B2GQW－ABB(ABB－Analog BaseBand，providing the interface between system analog
and digital signal, and power manage function)、K4S51163PF-Y(P)F75 Memory(8M x 16Bit x 4 Banks
Mobile-SDRAM); 、－MD4832-D512-V3Q18-X Memory(512Mbit Flash) 、和 BC41B143AXX-IXB-E42－Single
Chip Bluetooth；
QFN encapsulation：TRF6151BRGZR－TRANSCEIVER 、BQ24020DRCR-smart charge
Special encapsulation: RF3133－PA、
Radio Frequency and Base band in W420 is isolated by screen, micro SIM card box is protected by the
battery
W420 has the same power step as usual
Radio Frequency circuit of antenna on the top of the mobile phone will cut automaticly when W420 using
RF accessory plug
2.2. Introduction of character and function
Character:
Supporting trio band：The mobile phone can automatic switch in GSM900 network, DCS1800 network and
PCS1900 network. Choose best channel for calling. The mobile phone can also automatic switch during the
call without disturbing users. And the ratio of connecting improves with the automatic switch. Using trio method
GSM900／DCS1800/PCS1900 networks，not only ease up the high dense radio channel, but also provide
wilder users for network operation vendor. Both user and operation vendor gain more benefit. Using of GPRS
（General Packet Radio Service）change the mind of GSM network, which can provide more than circuit
switch, It can combine mobile communication with digital network together through add corresponding function
entities and limited changes about network. Import IP service in wild mobile market, bring wilder and faster
message space for mobile phone user too
Function：
 GSM900/1800MHz/PCS1900 automatic switching
 Full-rate/enhanced full-rate/half-rate coders
 GPRS Class 12
 Inter antenna
 260K color 2.8” TFT display screen, 176×220
 Inter 200，0000 pixel camera
 64 tones ring bell
 Microsoft operation system
 Enhanced phone number book
 WAP Explorer Ver 1.2.1
 MMS/SMS
 Inter 2Games
 Inter ring bell and wallpaper
 ZI Chinese input
 Blue Tooth
 MP3;MPG4
 STK Service
 Infrared function

4
3. Technical Reference：
Function EGSM
Technical Reference DCS Technical Reference PCS Technical Reference
Transmit Frequency
880-915 MHz Transmit Frequency 1710-1785MHz Transmit Frequency 1850~1910MHz
Frequency
Range Receiver Frequency
925-960 MHz Receiver Frequency 1805-1880 MHz Receiver Frequency 1930~1990MHz
Channel
Interval 200 KHz 200 KHz 200 KHz
Channel 174channel，
Every channel contains 8 short 374channel， Every channel contains 8 short 299channel， Every channel contains 8 short
Modulate GMSK ( BT ＝0.3) GMSK ( BT ＝0.3) GMSK ( BT ＝0.3)
Transfer
phase error RMS<5°, peak<20 RMS<5°, Peak<20 RMS<5°, Peak<°
Full duplex
interval 45 MHz 95 MHz 85 MHz
Frequency
stabilization ±1ppm ±1ppm ±1ppm
Battery voltage：3.7V Battery voltage：3.7V Battery voltage：3.7V
Voltage Operation voltage：3.4～4.2V Operation voltage：3.4～4.2V Operation voltage：3.4～4.2V
Transmit
current Peak value≤1.5A
Antenna
impedance 50Ω
RF export
power most 2W most 1W most 1W
SIM Insert only Insert only Insert only
Temperature
Range -10 °C to +55°C -10 °C to +55°C -10 °C to +55°C
Table3.1:basictechniqueparameter
RF power
export 33 dBm +/- 2dBm 30 dBm +/- 2dBm 30 dBm +/- 2dBm
Interference
radiation 1GHz should <-36 dBm, (> 1GHz should <-30dBm )
Table3.2:Transmitter
RF voltage < -102 dBm < -100 dBm < -100 dBm
Receive error
ratio (100
kbits )
< 2% < 2% < 2%
Channel jump
time 500us
Insert time around10 s
Table 3.3: Receiver
Sound coding
style Regular Pulse Excited-Long Term
Predition-Linear Predictive
Coding (RPE of LTP)
Regular Pulse Excited-Long Term
Predition-Linear Predictive
Coding (RPE of LTP)
Regular Pulse Excited-Long Term
Predition-Linear Predictive
Coding (RPE of LTP)
Ratio 13.0 kbps 13.0 kbps 13.0 kbps

5
Frame
duration 20 ms 20 ms 20 ms
Code length 260 bit 260 bit 260 bit
Kind kind 1 为182 bit，kind 2 为78
bit kind 1 为182 bit，kind 2 为78 bit kind 1 为182 bit，kind 2 为78 bit
forward errata
coding 22.8 kbps 22.8 kbps 22.8 kbps
Table 3.4: Sound Coding
4. Marking and Security:
4.1 Marking:
In order to protecting legitimate rights and interests of user, economic profit of manufacturer, and attacking
smuggles and counterfeit, the domestic and foreign mobile phone manufacturers (according to the regulation
of government department) should paste series of security marks on the production when after producing, for
distinguishing and protection. There are two among them is the most important:
1）CMII
The abbreviation of CMII is the license issued by the information industries department. Both the domestic
and foreign productions factory must apply this license to the information industries department if there mobile
phone will sells in China (besides HongKong, Macao and Taiwan). The productions must paste the mark that
accesses the net when they leave factory after acquiring the license. The actual mark (use after 1st Feb.1999)
could be identified from these aspects as follow:
 The symbol is the rectangle, the bottom grain for the light blue net grain.
 Four Chinese character ‘the permit of access the net’ are printed on right side relative to the middle. The
symbol is the only group of Chinese characters.
 “CMII” is printed on the left side of the symbol "The permit of access the net ". There are three lines of
contents under the symbol "The permit of access the net": The first line permit number (each production
factory homogeneous model handset access net card number is only), its form is 02-XXXX-XXXXXX,
3-6th common representative factory serial number, second line handset model: Form like V998, N5110
and so on. The third line of form is group of numerical codes (each access net symbol not to be all same).
 The typeface on the true symbol usually printed by the needle printer, the number is clear, and the color is
shallower. It is can be seen that hits by needle if carefully look on it. The imitate symbol usually printed by
common spray-ink printer, the number is unclear, the color is darker, and no hits by needle
 The symbol uses the safety line to guard against false paper printing. This kind of paper touches different,
there is obvious convex-concave feeling on the safety line place, There is vertical lines obviously under
the ultraviolet lamp. Simultaneously, red fluorescence typeface ‘CMII’ appears on the right side of the
symbol (which is can not see with naked eye). There is non on the imitate one.
2）IMEI：
IMEI is the abbreviation of International Mobile Equipment Identification. The IMEI code is a kind of
electrical character code made up of 15 digit number. Every code is unique in the world corresponds only one
mobile phone. Every mobile phone will be match a unique IMEI code after assembly. This code will be
recorded by manufacturer in the whole production. Its composition is as follows:
The first 6 digit (TAC) is the "model approves code", standing for the type of a mobile phone. The follow 2
digit (FAC) is "final assembly number", standing for the production factory or the final assembly place. The
afterwards 6 digit (SNR) is "bunch number", standing for the production sequence number. The last 1 digit (SP)
is set to "0" which is the examination code that standby temporarily usually now.
The IMEI code is pasted on the symbol at the back of the mobile phone, and saved in the memory. It is
also the "file" and "ID card number" of the mobile phone in factory. The IMEI code can be read by pressing

6
"*#06#" on the keyboard. The IMEI code will be changed when displace new main board. It is necessary to
refresh new symbol for the equipment.
4.2 SIM card：
1）Brief introduction of SIM card
SIM is the abbreviation of Subscriber Identity Model (customer recognition module). SIM card is also
called smart card, ID card of user. The GSM digital mobile phone can be used when inserting this card only.
There are three kind of materials in the SIM card: Surface metallic circuit board, IC integrated circuit, black
protective hard glue. The work of surface metallic circuit board is transmitting information between IC and the
mobile phone. The black protective hard glue purely for protects IC. And IC is the important part in SIM card.
IC saved user's information, encryption key and other information in the SIM card. It identify user for GSM
network and encrypte voice information for user during the call. The work of the six blocks on the metallic
circuit is record input information, voice, instruction of network operation business respectively and so on. The
using of SIM card prevent simultaneous calling and wire tapping. Facture of SIM card is according to GSM
international standard and criterion strictly. It ensure common communication for user reliably. The using of
SIM card divides card and mobile phone in the GSM system. One SIM card marks one user. SIM card can be
inserted in every GSM mobile phone, and the fee of communication can be recorded to the marked account of
the user. SIM card contain personal data of accessing GSM service that must be needed, they are:
 International mobile subscriber recognition
 Temporarily mobile subscriber recognition
 Main system
 Registration service
 The PIN reconciliation locks the code
 The call limits the code
 The user stores individual data. For instance, the short news, the fixed digit dialing, shrink the position
digit dialing, the performance parameter, the speech spends the register and so on
 Will access the net the numeral mobile phone, otherwise will have the possibility to cause the card to
receive the damage.
2）Security function
There is mobile phone SIM card lock function to prevent other people use the SIM card random. To
unblocking it, just input PIN code easily. The PIN code (personal Identity Number) is called individual
identification code. It is 4digit long, established by user himself. It belongs to the password of SIM card that
protect security of SIM card. Its original estate is not activating. After its starting up, GSM system will identify
the mobile phone automatically after turn on the phone every time. It will estimate validity of the SIM card, in
other words, it will check password with mobile phone. It provides services to user after approving by the
system only. There are 3 times of opportunities for input PIN code. It will lock automatically if the 3 times of
opportunities failed all. The way of unblocking it is input PUK only. PUK (PIN Unblocking Key) is the master key
for unblock the PIN code. Every SIM card has its corresponding PUK code. It is 8digit long, managed by user
himself. It is controlled by network operation business too. At present, the domestic motion bureau has opened
PUK inquire service that user could manage PUK code by themselves. There are 10 times of opportunities for
input PUK code. The SIM card will start up self-destruction program automatically if the 10 of opportunities
failed all. Then invalidate the SIM card. In this case, it is necessary to transact a new SIM card. Therefore,
please do not decode without correct PUK code
Setting calling restriction is another way of protect the SIM card. The calling restriction is away of restrict
call in and call out through establishing password. User could establish or cancel every kind of restriction of the
mobile phone at will, preventing call out by mistake, stealing call, especially international long distance call,
avoiding unnecessary loss. The password of calling restriction is 4digit long which the original estate is 0000.
The user who transacts this service should modify the original password, for improving the security. The calling
restriction could be set according to both file way and coding way. These two ways of setting have the same
effect. It is noticed that this kind of service is for user only who use international long distance service, and it
can not be used with calling diversion service at the same time
5. Introduction of GSM System：
5.1：The history and development of GSM：
1981 Analogue cellular introduced
Franco-German study of digital pan-European cellular system
1987 MoU signed by over 18 countries

7
1989 GSM was moved into the ETSI organization
GSM name changed to Global System for Mobile communications.
1990 DCS1800(edited GSM900) specification developed
In 1981 analogue cellular was introduced and at about the same time there was a joint Franco-German
study looking at digital cellular technology and the possibility of making a pan-European system..
In 1982 a special working committee, Groupe Spécial Mobile (GSM), was formed within the CEPT to look
at and continue the Franco-German study. In 1986 the working committee was taken a step further by
establishment of a permanent nucleus of people to continue the work and create standards for a digital system
of the future. About a year later, the memorandum of understanding, or MoU, as it is referred to, was signed by
over 18 countries. It stated that they would participate in the GSM system and get it into operation by 1991.
In 1989 GSM was moved into the ETSI (European Telecommunications Standards Institute) organization.
Once under the control of ETSI, the GSM system had it's name changed to Global System for Mobile
communications. The committees working on the system changed from GSM to SMG (Special Mobile Group).
These changes avoided confusion between the system name (GSM), and the people working the specification
(SMG). It also brought the naming in line with the official working language of ETSI (English).
In 1990 the GSM specification developed an offshoot - DCS1800. The Original DCS1800 specifications
were developed simply as edited versions of the GSM900 documents. Interest in GSM quickly spread outside
Europe. In 1992 Australia became the first non-European country to join the MoU. Since then, many other
Asian countries have adopted GSM. There's now a Pan-Asian MoU, investigating international roaming
agreements.
The Phase II specification for GSM has now been defined, merging GSM900 and DCS1800 documents,
number of new features are added to the system, along with many minor adjustments. The next step, Phase
II+ defines the addition of specific new services such as data and fax to GSM and DCS1800.
5.2：GSM Network
This is the GSM system. The Mobile Stations (MS), both hand held (portables) and traditional mobiles in a
car, talk to the Base Station System (BSS) over the RF air interface. The Base Station System (BSS) consists
of a Base Transceiver Station (BTS), and a Base Station Controller (BSC). It's typical for several BTS to be
located at the same site, producing 2 to 4 sectored cells around a common antenna tower. BSC's are often
connected to BTS via microwave links.
The BSC to BTS link is called the Abis interface. Typically 20 to 30 BTS will be controlled by one BSC. A
number of BSS's would then report back to the Mobile Switching Center (MSC) which controls the traffic
among a number of different cells. Each (MSC) will have a Visitors Location Register (VLR) in which mobiles
that are out of their home cell will be listed, so that the network will know where to find them. The MSC will also
be connected to the Home Location Register (HLR), the Authentication Center (AUC), and the Equipment
Identity Register (EIR) so the system can verify that users and equipment are legal subscribers. This helps
avoid the use of stolen or fraud mobiles. There are also facilities within the system for Operations and
Maintenance (OMC) and Network Management (NMC) organizations. The Mobile Switching Center (MSC)
also has the interface to other networks such as Private Land Mobile Networks (PLMN) and Public Switched
Telephone Networks (PSTN) and ISDN networks.
5.3 ：GSM Air Interface：
In GSM, the GSM transmission between MS and BS is Radio Communication, let’s introduce the GSM Air
Interface.
1）：Channel Plans：

8
Above is a table that shows the relative frequency plans of the three GSM networks: GSM900, DCS1800
and PCS1900.
The frequency range of the Uplink and Downlink show how the two bands are split into the two directions,
rather than an uplink being followed by a downlink 200kHz later. Another difference is that the channel
numbers are different. Remember this if you write any test control software and want to port from one system
to another, as the channel numbers must be changed for correct operation.
2）：GSM FDMA and TDMA：
GSM uses TDMA (Time Division Multiple Access) and FDMA (Frequency Division Multiple Access). The
slide shows part of one of these bands. Each band is divided into 200kHz slots called ARFCN’s (Absolute
Radio Frequency Channel Numbers).
As well as dividing up the frequency, the ARFCN is also divided in time into 8 Timeslots (TS), each TS
being used in turn by a different MS. The 8 TS’s together are known as a Frame.
3）：Physical Channel：
The combination of a TS number and ARFCN is called a physical channel. The corresponding Number is
called ARFCN (Absoluteness RF Channel Number). One ARFCN assert a pair of channels, one is uplink, the
other is downlink. This pair of channels is called physical channel.
In GSM system , the frequency interval is 200kHz.
The ARFCN of PGSM is 1~124，the center frequency of CH1 uplink is 890.2MHz. When the value of
ARFCN is equal to n, center frequency uplink channel is fn=f1+(n-1) 200kHz 。The center frequency of
corresponding downlink channel need to add duplex frequency separation, PGSM is 45MHz.
We need declare that, because of the PCD system is only used in North American, and no DCS system
used, these two systems can not be exist at the same area, the ARFCN of DCS and PCS system can overlap
with each other.
4）：Modulation Mode：
Now the signal can be modulated with a 0.3GMSK modulation scheme.
5）：TDMA Burst：
The burst can be divided into three distinct areas:
• Ramp Up
• Useful Part of the Burst
• Ramp Down
All of these levels are controlled by the GSM standard.
The Useful Part of the Burst is the area where the modulated data is present. There are 148 bits (each bit is
represented by a single symbol in 0.3GMSK modulation) which will be examined more closely in a later
section.
GSM is part of TDMA system，
6）：Duplex Timing：
Downlink and Uplink
Uplink Lags Downlink by 3 Timeslot periods
Uplink and Downlink use same Timeslot Number
Uplink and Downlink use same Channel Number (ARFCN)

9
Uplink and Downlink use different bands (45MHz apart for GSM900)
In the previous example we can see that the timeslots are offset by 3 between the downlink and the
uplink. We receive information in timeslot two in the downlink we have two timeslots in which to switch to
the uplink frequency and be ready to transmit information. Then, we have to get ready to receive our next
time slot of information in the next frame.
7）：Power Control：
As the mobile moves around the cell, its transmitter power needs to be varied. When it's close to the base
station, power levels are set low to reduce the interference to other users. When the mobile is further from the
base station, its power level needs to increase to overcome the increased path loss. However, if too much
power is used, the user’s battery will run down too quickly. All GSM mobiles are able to control their output
power in 2dB steps. The base station commands the mobile to a particular MS TX Level (power level) by
watching the power level of the received signal at the BS.
There may be many users in the same cell. If every Mobile phone has the same emission power,
ones closer to Base Station can block the ones which are farther; On the other hand, because if closer ones
emit more power
The table above shows the maximum and minimum power levels on the mobiles in different systems. The final
row shows the power steps, which are all numbered, and how they relate to the max and min powers.
8）：Timing Control：
If the burst arrives at the correct time, it will fit into its physical channel and not disturb any other burst that may
follow it in the next timeslot. However, if it is delayed, due to a long distance to travel, it may arrive late and
impact the following burst from another user. In this case the mobile is instructed by the BS to burst earlier
which will correctly align the burst in the timeslot. The message sent by the BS is called the Timing Advance.
The base station monitors the burst to see when it arrives at the base station. If it arrives late or early, the base
station will note how many times it has changed since the last Timing Advance adjustment, and if there have
been more than 4 x ¼ bit periods change in one direction, the adjustment will be made again.
Main parameter of GSM is showed as follows:
PGSM EGSM DCS PCS
ARFCN Range 1~124 975~1023, 0,
1~124 512~885 512~810
Uplink Band
Range 890MHz~915MHz 880MHz~915MHz 1710MHz~1785MH
z 1850MHz~1910MH z
Downlink Band
Range 935MHz~960MHz 925MHz~960MHz 1805MHz~1880MH
z 1930MHz~1990MH z
Bandwidth 200kHz 200kHz 200kHz 200kHz
duplex Interval
Frequency 45MHz 45MHz 95MHz 85MHz
TDMA User
Number 8 8 8 8
Modulation Mode 0.3GMSK 0.3GMSK 0.3GMSK 0.3GMSK

10
Power Grade
Range 5~19 5~19 0~15 0~15
Max Power 33dBm 33dBm 30dBm 30dBm
Power Grade
Difference 2dBm 2dBm 2dBm 2dBm
5.4：Identity：
If user want to connect to network, GSM need affirm users’ legality identity. Users’ identity information
recorded in SIM. According to these information, network affirm user’s validity. Important Digital Identification
used in GSM include:
1. IMSI（International Mobile Subscriber Identification）
This number is the exclusive number to indicate user’s identity. When user enter network, the system find
user’s information according to this number. It is composed by three parts:
MCC（Mobile Country Code）Country Number, three digits, indicate user’s country.
MNC（Mobile Network Code）Mobile Network, two digits, indicate Network Operator.
MSIN（Mobile Subscriber Identification Number）User Identity Number, eleven digits, indicate Mobile
Subscriber in network.
2. TMSI（Temporary Mobile Subscriber Identification）To safeties, we use TMSI instead of IMSI when
transmitted IMSI, TMSI is valid only in local area. Its structure is selected by manage department, and the
whole size is not more than 4 bits.
3. IMEI（International Mobile Equipment Identity）exclusive number, system also can distinguish validity of
equipment by this number.
5.5：GSM Voice Path ：
There needs to be some way to encode the voice into data
Next the data must have error protection added to it
The Data has further error protection
It is modulated
It is bursted
Again, this is very simplistic and other steps will be explored during this section.
5.6：logical channels
TCH ：Mobiles on a call use a Traffic Channel (TCH). The TCH is a two way channel used to exchange
speech information between the mobile and base-station.
SACCH ：When the MS is on a call, it is constantly monitoring the Received Signal Quality (a bit error rate
measurement known as RxQual) and the Received Signal Level (a power measurement call RxLev). These
are constantly being sent back to the BS on a Slow Associated Control Channel (SACCH).
FACCH：The Fast Associated Control Channel is used to pass critical information to the mobile during a
call, by taking over the TCH from the callers.
BCH：All BTS produce a Broadcast Channel (BCH). The BCH is like a lighthouse or beacon. It's on all the
time and allows mobile to find the GSM network. The network for a variety of user functions also uses the BCH
signal strength. It's a useful way of telling which is the closest BTS to the mobile. It also has information coded
onto it, such as the identity of the network (e.g. Mannesmann, Detecon, or Optus), paging messages for any
mobiles needing to accept a phone call, and a variety of other information. Each mobile will monitor the power
of adjacent cell BCH’s to aid the network in making hand-off decisions.
FCH：Frequency Correction Channel
SCH：Synchronization Channel
BCCH：Broadcast Control Channel
CCCH：Common Control Channel
The base-station posts a PCH (paging channel) on the CCCH part of the BCH. When the mobile receives the
PCH, it responds by sending a RACH. The remainder of the process is identical to the mobile originated case.
AGCH:Access Grant Channel
RACH:Random Access Channel, When the mobile sends out a RACH, to start a call, to avoid collisions
with bursts in adjacent TS, RACH bursts, that are shorter than normal are sent.
The Stand-Alone Dedicated Control Channel (SDCCH) is used during call set up as a stepping stone to
the Traffic Channel. It is also used to pass signaling when the mobile is in IDLE mode. This is used for example
for SMS Point-to-Point messages as well as Location Updates that we will look at later.

11
5.7 Mobile Turn-On
1)Mobile Searches for Broadcast Channels (BCH)
2)Synchronizes Frequency and Timing
3)Decodes BCH sub-channels (BCCH)
4)Checks if Network Allowed by SIM
5)Location Update
6)Authentication
When a mobile first turns on, it searches all 124 channels in the downlink for signals. It will then order the
channels by received signal strengths and check to determine if the channel was a BCH (Broadcast CHannel).
Once the MS finds a BCH, it adjusts internal frequency and timing from the FCH and SCH, then checks to
determine if the BCH is from its PLMN (Public Land Mobile Network). This involves comparing the allowed
network and country codes stored on the SIM card with the information encoded on the BCCH. The mobile
repeats this cycle until a good broadcast channel is found. If the mobile recognizes that it's in a different cell
from the last time it was used, it needs to tell the network where it is. The network has to keep track of where
every mobile is so that it can route calls to the correct cell for any particular mobile. This process of telling the
network "here I am" is called a location update. The mobile sends a RACH, gets assigned to an SDCCH,
exchanges control information, then ends the call. The user will typically not be aware that this process is
taking place.
For Location Updates, this time showing which part of the network is involved in transactions.
The IMSI attach/detach process is a way of forcing all mobiles to inform the network when they have
camped and when they have turned off (or just before they turn off!). The SIM stores the last location Area
Code (LAC) when it is powered down and it compares this to the camping LAC on Power up and if they are
different it will perform an IMSI attach.
Mobile Originated Call
Mobile Sends RACH
Channel Assignment Posted on BCH (AGCH)
Mobile and Base Station communicate on SDCCH
Authentication
Mobile Assigned to Traffic Channel (TCH)
Speech Data sent and received
Once camped, the mobile is ready to send or receive calls.
When a user dials a number, and presses the send button on the mobile, call origination takes place. The
mobile transmits a short RACH burst on the uplink, using the same ARFCN as the BCH is using on the
downlink. The base station responds to the RACH by posting an AGCH (Access Grant CHannel) on the CCCH.
These are logical channels on the BCH physical channel. The mobile listens on the BCH for the AGCH, when it
receives it and decodes the instructions, it re-tunes to another ARFCN and/or timeslot and begins a two-way
dialogue with the base station on an SDCCH. One of the first things that the mobile will mreceive is the SACCH
associated with the SDCCH. Once it receives the SACCH, it will get timing advance and transmitter power
information from the base station. The base station will have calculated the correct timing advance from the
arrival time of the RACH. Once the mobile gets timing advance information, it can send normal length bursts.
The SDCCH is used to send messages back and forth, taking care of alerting (making the mobile ring) and
authentication (verifying that this mobile is allowed to use the network). After a short period of time (1 to 2
seconds), the mobile is commanded over the SDCCH to re-tune to a TCH. Once on the TCH, speech data is
transferred on the uplink and downlink.
Mobile Terminated Call
Mobile Sees Page
Mobile Sends RACH
Channel Assignment Posted on BCH (AGCH)
Mobile and Base Station communicate on SDCCH
Authentication
Mobile Assigned to Traffic Channel (TCH)
Speech Data sent and received
The process for base station originated calls is very similar. The base-station posts a PCH (paging CHannel)
on the CCCH part of the BCH. When the mobile receives the PCH, it responds by sending a RACH. The
remainder of the process is identical to the mobile originated case. If you can find a way to translate the GSM
bursts into audio tones (AM demodulate), it's interesting to hear the difference between the channel types as a
call is set up. A good way to do this is to use a GSM phone near an old TV set or a conventional wired phone.

12
The interference created in these devices amounts to AM demodulation.
The RACH burst can be heard as a single 'Tick' sound. It's quickly followed by the SDCCH 'Tat, Tat-tattat,
tat-tat-tat ...'. After a few seconds, the TCH is connected 'Buzzzzzzzzz'.
Mobile Handoff
We have covered mobile power on and call establishment, but there is one other important area. During
a call the mobile may have to change base stations. If the call is between faces of the same base station, this
is performed locally. The case shown here is that where the base station is not the same. The mobile reports
its measurements and the serving BSC determines that it is time to perform a handoff. It will contact the new
base station and get the information on the new channel and timeslot (along with midamble and timing
information) and send this to the mobile. It then commends the mobile to switch base stations and then once
the new call is established, close down the old link and reallocate it to another user if necessary.
6. Summary introduction of mostly chips used in W420
Chips used in W420 can be divided into flat and application manage according to function. There is the
introduction of these two chips
6.1：Flat Chip：
U201：DBB——Digital Base Band, composed of ARM7 TDMIE CPU and TMS320C54X DSP dual inter
core. The chip integrate 4Mbit Memory inside、provide multi control interface outside. There is the basic
structure as follows:
Figure6.1: DBB basic structure
Main structure characteristic and function of DBB (Part Number is D751992AGHHR ) including:
Nuclear working voltage 1.5V (1.35-1.65V ), IO voltage 2.8V( 2.5V-3V )
Working temperature range -40~ +85℃
CPU working at 52MHz, DSP working at 104MHz
Integrate 4Mbit SPAM Memory inside
289 pin uStarBGA encapsulation

13
U201：ABB——Analog Base Band, is the bridge of digital and analog signal in the system. Audio, IQ and
other exterior analog signal can connect with DBB control centre through ABB. ABB controls system clock, A/D
D/A conversion, background light of keyboard, provide system power and charge interface etc. There is the
basic structure as follows:
Figure 6.2: ABB basic structure
U602:Transceiver: is a high integrated multi frequency low power cost transceiver, there is the structure
as follows:

14
Figure 6.3: Transceiver structure
Main function and characteristic of U602:
Support GSM, DCS, PCS multi frequency cell system
Support GPRS Class 12 and EDGE operation
Contained a synthesizer, 4 fully compositive VCO, 3 regulator and PA controller
3 bios serial interface
48pin QFN48 encapsulation
IO working voltage 2.8V(2.7-2.9V)
Working temperature -25℃~ +85℃
U603：U603（RF3133）,is a 3 band power amplifier module integration with power control function. With
its control part, signal’s amplify and signal’s power control can be made by itself only. It is divided to low
frequency band(EGSM900) and high frequency band(DCS1800/PCS1900). Every part of the amplifier is
combined with 3 sect amplifier. Export power is controlled by a inter power control module, which realize the
control function through changing 3 sect amplifier’s deflection set. Power export of low frequency band could
reach 35dB, power export of high frequency band could reach 33dB. Spec value of working voltage is 3.5V,
in/out impedance is 50 ohm. There is the structure as follows:

15
Figure6.4:PAstructure
Definition of main pin: spec value of working voltage VBAT1、VBAT2 is 3.5V, provided by battery of mobile
phone. TX-EN is the power set of amplifier, at high level is (1.9V～3.0V，spec level 2.0V), at low level is (0V～
0.5V，spec value 0V). GSM band select pass, at high level（1.9V～3.0V，spec value 2.0V）, DCS band select
pass. VRAMP is frequency modulate control level, around 0.2V-1.8V
图7.1：W420 基带电路原理示意图
Figure 7.1: W420 base band circuit structure
Figure 7.1 shows basic control flow of W420 mobile phone
It is shown in the picture that U201 is the core of control in the whole system. It carries out all programs
storage in U307, and control the whole system through U202, U304 and U302
According to the difference of function, W420 can be divided as: RF process circuit (including receiver part
and transmit part), audio interface circuit (Mic、Receiver、ear phone Mic and ear phone Receiver) and charge
RF313
3
(PA)
MIC
Speak
e
r
Receiver
T-Flash
M-DOC
Bluetoot
h
IrDA
U202
TWL3016B2G
WQ
(ANALOG
BASEBAND)
U201
OMAP 730
Earphone Supply
Management
BQ24026
LCD 2M
Camera
TRF6151CRGA
(transcevier)
U307
S-DRAM

16
circuit, Sim card interface circuit, backlight control circuit, display circuit and camera process circuit etc.
Before introduce these circuit cell, it is necessary to know clock circuit and power management in the
system——because these two are the base or working
7.2 System clock circuit introduction:
Clock is the base of system control in every control system. So, it is necessary to know the output and
control theory of clock in W420 mobile phone.
There are 2 kind of clock in the system: one is 32.768KHz for display time——provided by
Y201(32.768KHz crystal); the other is work clock for system working——provided by(26MHz crystal)
1. RTC——Real Time Clock
Y201 connect to U200 through the matching network combined with C201, C204, C203, C204 and
R201, provide RTC for U200
Power supply of Y203 is provided by H1 in U202, it is V-RTC in the theory structure
V-RTC can be defined as 1.8V, 1.5V and 1.3V by software (There is 1.5V in W420)
Power supply of RTC circuit provided by main battery VBAT usually, and provided by standby battery
(standby battery provide V-RTC only) when main battery lack of electric power or take off the main battery (e.g.
when changing Sim card) . Electric power provided by standby battery is limited (support RTC circuit for only a
few hours). Therefore, it is necessary to keep power supply provided by VBAT in sure time interval that prevent
RTC information missing.
2. System clock circuit
Y202 (26MHz crystal) provide base value for system clock
C206, R201, D201, C202, R220 and C205 provide matching circuit for Y202. One side of this circuit
connect to pin C12 of U202, which provide AFC (AFC：Automatic Frequency Control) for 26MHz crystal; the
other side of this circuit pass through a more complicated path to provide system working clock:
a: first, input 48pin on U602, provide working clock for U602
b: then, processed in U602, pass through 47pin on U602 input Y9 on U200——provide 26MHz working
clock for DBB
c: and then, processed in U201, pass through N1 output 13MHz clock for other exterior equipments:
pass through E1 on U202 provideABB clock
7.3: System power management introduction:
In the mobile phone system, because of using many equipment and interface, lead to considering many
kinds of power is necessary (generally 6 or 7). As the technology improved, now, most of these electrical
source are provided by flat chip. Using power management provide additional power only when the flat chip
can not match design conditions
According to the classify principle above, introduce power management of W420 follows:
a: Source from flat
Source from flat is provided by U202(ABB), its power and use are in the table:
Title Pin voltage Current Benefited Chip
V_DBB J1、H2 1.5V 170mA
U201：main working voltage
V_ABB H10 2.8V 80mA U202：analog circuit working voltage
V_IO B1、B2 2.8V 100mA
U104、U200、U301、U302 和U305：system digital
IO interface working voltage
V_FLASH G1 2.8V 60mA U300：Flash working voltage
V_SRAM F1 2.8V 50mA U300：RAM working voltage
V_SIM B4 2.9V 10mA
U201：Sim interface working voltage
V_RTC D1 1.5/1.3V U203：RTC circuit working voltage
Table7.1:A19systemflatpowerdistribute
b: Source outside the flat
W420 use U309,U301,U303——LDO(Low Dropout) provide system additional power needing 2.8V,
1.8V and 1.578V, for prevent lack of power in system

17
1U200(CPU) VDDSHV9,VDDSHV2,VDDSHV6,VDDSHV4,VDDSHV8
2U310(LDO enable)
U490,VCC,2.8V
3U307(SDRAM) U491,VCC,2.8V
4J403( T-FLASH)
5Q430(EARPHONE) R481,SDMC-DAT0,SDMC-DAT1,SDMC-DAT2,SDMC-DAT3
6U500(IRDA) VIO,VCC
7CN1(LCD) CN700
8J740(KEYPAD) KBR0,KBR1,KBR2,KBR3,KBR4
SW720(UP)
SW721(DOWN)
U309
(V-1O-2)
9SW723(CAMERA)
1OMAP(CPU) VDDSH1,VDDSH3
2U302(SDRAM)
3U307(M-DOC)
U301
(MEMARY)
4U402(CHARGE)
U303(V-CORD)1U200(OMAP730) VDDOMPE,VDD
Note: This LDO encapsulation is very small, it may weld unstable when jointing, then lead system working
abnormally. Therefore, make sure this LDO output normally first before adjusting hardware
7.4: RF process circuit----receiver circuit
Figure 7.2: W420 receiver structure

18
As the figure shows: downlink from base station to mobile phone leaded into receiver circuit by antenna.
The receiver circuit mainly contains Antenna, RF-Connector(CN600), RF-Switch(FE600), Transceiver(U602),
DBB(U201) and ABB(U202) etc.
W420 use inter antenna. The antenna is paste on back cover of the mobile phone in the antenna area
through glue on back of antenna. After main board’s assemble, feed point of antenna must be pressed well
with input of antenna on main board. Signal intension rest with connecting between antenna and main board,
so make sure of the two contacts well
CN600 is test jack match with factory when calibrating RF. The switching inside is mechanical, break up
when the test probe insert, signal input to mobile phone or output from mobile phone through probe. After
probe exiting, switching close up, signal output from antenna. The max impedance of CN600 is 50 ohm, max
insert loss is 0.1dB
FE600 is a RD-switch controlled by DBB(U200), its working band is GSM, DCS and PCS, structure as
follows:
DDB(U201) set voltage for V_TX_LOW and V_TX_HIGH which is two control unit of FE600 through
external gate circuit Q600_A and Q601_A indirect. Control signal TSPACT01 and TSPACT02 from U200
control if set high to V_TX_lOW and V_TX_HIGH for RF source through estate (connect/cut off) of Q600-A and
Q601-A. Then realize to control working estate of U101
Logic of control is as follows:
When the mobile working, high frequency signals are divided into two paths balanceable output by FE600
after received by antenna. These two paths of signals input U602 from pin LNAGSMP and LNAGSMN (or
LNADCSP and LNADCSN or LNAPCSP and LNAPCSN) respective. First, do low noise magnify, after magnify

19
input I.Q mixer (which contains high/low paratactic two mixer part), mix with surge signal caused by local
oscillator in U104, these surge signals must match the currently working frequency of mobile phone. Modulate
them into four low frequency I.Q signal around 100KHz after mix (there is phase relation in these four paths of
signal). Second, I.Q must input in low pass filter for eliminate syntonic interfere. After this process, input signals
into channel filter. Channel filter is a five-class belt passes filter with self adjust function. Its center frequency is
100KHz. For avoid leading distortion caused by signal attenuated too much after many times sieve, before
sieve, it should match 8dB step magnify for each class. Signals after sieve match 4dB step magnify for
compensate direct current excursion. Finally, these signals input intermediate frequency buffer waiting for input
U201 ABB which will manage them.
I.Q signal is transfer into digital signal by ADC when input in ABB, then output from ABB to U201 DBB.
DBB do farther digital sieve to these signals, GMSK demodulating, complect removing, decoding, channel
decoding, PCM decoding etc. voice decode arithmetic manage. Then the signals passes VSP port (Voiceband
serial port) between U201 and U202 into U202 and managed by DAC in U202. Finally, analogy signal are sent
to earphone or headphone and transfer them into voice signal.
7.5: RF manage circuit----transmit circuit:
As the picture shows: transmit circuit is made up of: DBB(U201)、ABB(U202)、Transceiver(U602)、
PA(U603)，RF-Switch(FE600)，RF-Connector(CN600)，Antenna etc.
Voice signal from user is transmit into analogy electronic signal, and then input in ABB U202. After
transferred by ADC in U202, pass VSP port into DBB U201. In U201, signals will be impulse sampling, PCM
coding, channel coding, coding, complecting, GMSK modulating etc. voice demodulating manage, and then
pass BSP path into ABB U202. Managed signals by DAC in ABB, divided into four paths of analogy base band
I.Q signal after passing low frequency filter. Finally, input these signals into transceiver U602
In U602, base band signal is modulated to transmit intermediate frequency by I.Q modulation. This I.Q
modulation with low harmonic wave distortion, low carrier wave divulge, high syntonic interference restrain etc.
can reduce phase error furthest. Then pass high frequency modulate, signal are modulated to final frequency
needed. Finally, the signals are sent to PA for magnifying.

20
RF signal after PA magnifying pass RF-Switch (Now RF-Switch should be transmit elect connect estate)
to antenna then send out.
Mini USB connector:
Charging circuit:
SIM card interface circuit: