gsm overview
DESCRIPTION
for the new person in the telecom field overview of the gsmTRANSCRIPT
1
Global System for Mobiles
GSM
2
TOPICS
• GSM CONCEPTS• GSM SYSTEM ARCHITECTURE• IDENTITIES USED IN GSM• GSM CHANNELS• GSM RADIO LINK• MOBILITY MANAGEMENT• CALL MANAGEMENT• RADIO RESOURCE MANAGEMENT
3
TOPICS
• GSM CONCEPTS• GSM SYSTEM ARCHITECTURE• IDENTITIES USED IN GSM• GSM CHANNELS• GSM RADIO LINK• MOBILITY MANAGEMENT• CALL MANAGEMENT• RADIO RESOURCE MANAGEMENT
5
Background to GSM
• 1G : Advanced Mobile Phone Service (AMPS)• Analog, Circuit Switched, FDMA, FDD
• 2G : Digital Advanced Mobile Phone Service (D-AMPS)• Digital, Circuit Switched, FDMA, FDD
• 2G : Global System for Mobile (GSM)• Digital, Circuit Switched, FDMA and TDMA, FDD
• 2G : Code Division Multiple Access (CDMA)• Digital, Circuit Switched, FDMA, SS, FDD
Cellular Network Basics • There are many types of cellular services; • Cellular network/telephony is a radio-based technology;
radio waves are electromagnetic waves that antennas propagate
• Most signals are in the 850 MHz, 900 MHz, 1800 MHz, and 1900 MHz frequency bands
Cell phones operate in this frequency range (note the logarithmic scale)
Cellular Network• Base stations transmit to and receive from mobiles at the
assigned spectrum• Multiple base stations use the same spectrum (spectral
reuse)• The service area of each base station is called a cell• Each mobile terminal is typically served by the ‘closest’
base stations• Handoff when terminals move
3G, 3.5G and 4G (LTE)
3G Overview• 3G is created by ITU-T and is called IMT-2000
Evolution from 2G
IS-95 IS-136 & PDCGSM-
EDGE
GPRS
HSCSDIS-95B
Cdma2000-1xRTT
Cdma2000-1xEV,DV,DO
Cdma2000-3xRTT
W-CDMA
EDGE
TD-SCDMA
2G
3G
2.5G
3GPP3GPP2
Service RoadmapImproved performance, decreasing cost of delivery
Typical average bit
rates (peak rates
higher)
WEB browsingCorporate data accessStreaming audio/video
Voice & SMS Presence/location
xHTML browsingApplication downloadingE-mail
MMS picture / video
Multitasking
3G-specific services take advantage of higher bandwidth
and/or real-time QoS
3G-specific services take advantage of higher bandwidth
and/or real-time QoS
A number of mobile services are bearer
independent in nature
A number of mobile services are bearer
independent in nature
HSDPA1-10
Mbps
WCDMA2
Mbps
EGPRS473
kbps
GPRS171
kbps
GSM9.6
kbps
Push-to-talk
Broadbandin wide area
Video sharing Video telephony
Real-time IPmultimedia and games
Multicasting
CD
MA
200
0-E
VD
O
CD
MA
200
0-E
VD
V
CD
MA
200
0 1
x
GSM Evolution to 3G
GSM9.6kbps (one
timeslot)GSM Data
Also called CSD
GSM
General Packet Radio ServicesData rates up to ~ 115 kbps
Max: 8 timeslots used as any one timePacket switched; resources not tied up all the
timeContention based. Efficient, but variable
delaysGSM / GPRS core network re-used by
WCDMA (3G)
GPRS
HSCSD
High Speed Circuit Switched DataDedicate up to 4 timeslots for data
connection ~ 50 kbpsGood for real-time applications c.w. GPRSInefficient -> ties up resources, even when
nothing sentNot as popular as GPRS (many skipping
HSCSD)
EDGE
Enhanced Data Rates for Global EvolutionUses 8PSK modulation
3x improvement in data rate on short distances
Can fall back to GMSK for greater distances
Combine with GPRS (EGPRS) ~ 384 kbpsCan also be combined with HSCSD
WCDMA
UMTS• Universal Mobile Telecommunications System (UMTS)• UMTS is an upgrade from GSM via GPRS or EDGE• The standardization work for UMTS is carried out by Third
Generation Partnership Project (3GPP)• Data rates of UMTS are:
– 144 kbps for rural– 384 kbps for urban outdoor– 2048 kbps for indoor and low range outdoor
• Virtual Home Environment (VHE)
UMTS Frequency Spectrum
• UMTS Band – 1900-2025 MHz and 2110-2200 MHz for 3G transmission– In the US, 1710–1755 MHz and 2110–2155 MHz will be used
instead, as the 1900 MHz band was already used.
UMTS Architecture
SD
Mobile Station
MSC/VLR
Base StationSubsystem
GMSC
Network Subsystem
AUCEIR HLR
Other Networks
Note: Interfaces have been omitted for clarity purposes.
GGSNSGSN
BTS BSC
NodeB
RNC
RNS
UTRAN
SIM ME
USIMME
+
PSTN
PLMN
Internet
UMTS Network Architecture• UMTS network architecture consists of three domains
– Core Network (CN): Provide switching, routing and transit for user traffic
– UMTS Terrestrial Radio Access Network (UTRAN): Provides the air interface access method for user equipment.
– User Equipment (UE): Terminals work as air interface counterpart for base stations. The various identities are: IMSI, TMSI, P-TMSI, TLLI, MSISDN, IMEI, IMEISV
UTRAN• Wide band CDMA technology is selected for UTRAN air interface
– WCDMA– TD-SCDMA
• Base stations are referred to as Node-B and control equipment for Node-B is called as Radio Network Controller (RNC).– Functions of Node-B are
• Air Interface Tx/Rx• Modulation/Demodulation
– Functions of RNC are:• Radio Resource Control• Channel Allocation• Power Control Settings• Handover Control• Ciphering• Segmentation and reassembly
3.5G (HSPA)High Speed Packet Access (HSPA) is an amalgamation of two mobile telephony protocols, High Speed Downlink Packet Access (HSDPA) and High Speed Uplink Packet Access (HSUPA), that extends and improves the performance of existing WCDMA protocols3.5G introduces many new features that will enhance the UMTS technology in future. 1xEV-DV already supports most of the features that will be provided in 3.5G. These include:
- Adaptive Modulation and Coding- Fast Scheduling- Backward compatibility with 3G- Enhanced Air Interface
4G (LTE)
• LTE stands for Long Term Evolution• Next Generation mobile broadband technology• Promises data transfer rates of 100 Mbps• Based on UMTS 3G technology• Optimized for All-IP traffic
Advantages of LTE
Comparison of LTE Speed
Major LTE Radio Technogies• Uses Orthogonal Frequency Division Multiplexing (OFDM)
for downlink• Uses Single Carrier Frequency Division Multiple Access
(SC-FDMA) for uplink• Uses Multi-input Multi-output(MIMO) for enhanced
throughput• Reduced power consumption• Higher RF power amplifier efficiency (less battery power
used by handsets)
23
GSM History
24
1982: Groupe Spécial Mobile (GSM) created
1984: Description of GSM features
1985: List of recommendations settled
1987: Initial MoU (Memorandum of Understanding) aside the drafting of technical specifications was signed by network operators of 13 countries:
1988: Validation and trials, of the radio interface.
1991: First system trials are demonstrated at the Telecom 91 exhibition.
1992: Official commercial launch of GSM service in Europe. First Launch in Finland
1993: The GSM-MoU has 62 signatories in 39 countries worldwide.
1995: Specifications of GSM phase 2 are frozen.
1999: GSM MoU joins 3GPP (UMTS)GPRS Trials begins
2000: 480M GSM subscribers WorldwideFirst GPRS Networks roll out
End 2002: 792M GSM subscribers Worldwide
Development of the GSM Standard
12 SERIESOPERATION ANDMAINTENANCE
01 SERIESGENERAL 02 SERIES
SERVICE ASPECTS
03 SERIESNETWORK ASPECTS
04 SERIESMS-BSS INTERFACE AND
PROTOCOLS
05 SERIESPHYSICAL LAYER ON THE
RADIO PATH.
06 SERIESSPEECH CODINGSPECIFICATIONS
07 SERIESTERMINAL ADAPTERS
FOR MOBILE STATIONS
11 SERIESEQUIPMENT AND TYPE
APPROVAL SPECIFICATIONS
10 SERIESSERVICE INTERWORKING
09 SERIESNETWORK
INTERWORKING
08 SERIESBSS TO MSC INTERFACES
GSM Specifications
Increasing GSM Data Rates
Transmission Time
GPRS = General Packet Radio ServiceHSCSD = High Speed Circuit Switched DataEDGE = Enhanced Data rate for GSM EvolutionUMTS = Universal Mobile Telecommunication System
10 sec 1 min 10 min 1 hour0
UMTS
E/GPRS
ISDN
PSTN
GSM
webe-mail photo
web photoe-mail
web photo
video clipreportphoto
web photoe-mail
video clipreport
video clipreport
video clipreport
video clipreport
27
thro
ug
hp
ut
kbp
s
10 k
100 k64 k
1 M
2 M
1 k1998 1999 2000 2001 2002
Time frame
UMTS
GPRS
HSCSD
9.614.4
packet
GPRS = General Packet Radio ServiceHSCSD = High Speed Circuit Switched DataEDGE = Enhanced Data rate for GSM EvolutionUMTS = Universal Mobile Telecommunication System
EDGEcircuit
Wireless Data Technology Options
28
Circuit mode
Packet mode
A→FD→H
C→G
C→G
C→G
C→G
C→G
D→H
D→H
A→FD→H
D→H
A→F
A→F
A→F
A
B
C
D
E
F
G
H
Circuit-Switched or Packet-Switched
29
Multiple Access Technique
• Multiple Access – Achieved by dividing the available radio frequency spectrum, so that multiple users can be given access at the same time.
• FDMA - Frequency Division Multiple Access– ( eg: GSM each Frequency channel is 200KHz)
• TDMA - Time Division Multiple Access– ( eg: GSM each frequency channel is divided into
8 timeslots)• CDMA - Code Division Multiple Access
– (eg: IS95- Each User data is coded with a unique code)
30
Duplex Technique
• Duplex - How the up link and Down link of a user is separated
• FDD - Frequency Division Duplex– (eg:In GSM the up link and down link of a user is
separated by 45MHz )
• TDD - Time Division Duplex – (the up link and down link of a user will be at the same
frequency but at different Time )
32
What are the types in GSM Network?
• GSM-900 (Channels 125 operating band 900Mhz carrier spacing 200khz spacing 45Mhz)
• GSM -1800 (Channels 374 spacing 95Mhz)
• GSM -1900(Used in USA)
GSM Band Allocations (MHz)
Carrier frequency = ARFCN = Absolute Radio Frequency Channel Number
Frequencies are in MHz
GSM systems Uplink Downlink Band DuplexSpacing
Duplex channels
GSM 450GSM 480GSM 850
450.4-457.6 478.8-486 824-849
460.4-467.6488.8-496869-894
2x7.22x7.2 2x25
101045
3535124
GSM 900E-GSM (900)R-GSM (900)
890-915 880-915 876-880
935-960 925-960 921-925
2x25 2x35 2x04
454541
12417440
GSM 1800GSM 1900
1710-1785 1850-1910
1805-1880 1930-1990
2x75 2x60
9580
374299
GSM Family Radio Band Spectrum
Uplink
Downlink
880 890 915 1710 1785
925 935 960 1805 1880MHz
P-GSM
GSM 1800 GSM 1900
1850 1910
1930 1990
R-GSM
876
921
960
960
915
915
E-GSM
Uplink
Downlink
824 849
869 894 MHz
GSM 850
478.8 486
488.8 496
450.4 457.6
460.4 467.6
GSM 450 GSM 480
Traffic/Signaling
Signaling
«bla bla bla...»
« RING ! »
riiiiing
Network
Traffic
36
AuC
MS
MS
BTS
BTS
BTS
BSC
BSC
MSC
MSC
VLR
VLR
GMSC
HLR
PSTN
EIR
Um
Abis
Abis
A
A
OMC Server
Um
GSM - Network Structure
B
E
E
X.25
C
F
H
X.25
37
Frequency band Uplink 890 - 915 MHz Downlink 935 - 960MHzDuplex Frequency Spacing 45MHzCarrier separation 200KHzFrequency Channels 124Time Slots /Frame(Full Rate) 8Voice Coder Bit Rate 13KbpsModulation GMSKAir transmission rate 270.833333 KbpsAccess method FDMA/TDMASpeech Coder RPE-LTP-LPC
GSM System specifications
38
890 MHz 915 MHz 935 MHz 960 MHz
Uplink Downlink
Example:Channel 48
0 124channel # 0 124channel #
Frequency Frequency
Duplex spacing = 45 MHzFrequency band spectrum = 2 x 25 MHzChannel spacing = 200 kHz
BTS
Paired Radio Channels in GSMCase of GSM 900
GSM Time Division Multiplex
Frame and Physical ChannelsTS TS TS TS TS TS TS TS
0 1 2 3 4 5 6 7
Time4.615 ms
TDMA frame
Physical channel # 2 = recurrence of time-slot # 2
TDMA frame
0 9.23 ms
Time-slot
(frames repeat continuously)
TS TS TS TS TS TS TS TS
0 1 2 3 4 5 6 7
Physical Channel
MS3
//ARFCN1 2 124FDMA
BTSWithout FH
0
TDMAs
TS7
n
n-1
n+1
MS2
MS1
timeBTSWith FH
Radio Link Aspects• From Speech to RF Signal
Blah… Blah… Blah...Blah... Blah... Blah...
Digitizing andSource Coding
Channel Coding
Interleaving
Ciphering
Burst Formatting
Modulating Demodulating
Burst De-formatting
Deciphering
De-interleaving
Channel Decoding
Source Decoding
43
Uplink 890 MHz to 915 MHzDown Link 935 MHz to 960 MHz25 MHz divided into 125 channels of 200 KHz bandwidth
890.0 890.2 890.4 914.8 915.0
935.0 935.2 935.4 959.8 960.0
UP
DOWN
Access Techniques
44
Time Division Multiple AccessEach carrier frequency subdivided in time domain into 8 time slots Each mobile transmits data in a frequency, in its particular time slot - Burst period = 0.577 milli secs.8 time slots called a TDMA frame. Period is .577 * 8 = 4.616 milli secs
0 1 2 3 4 5 6 7
4.616 ms
0.577 ms
Access Techniques ...
45
46
GSM utilizes two bands of 25 MHz. 890-915 MHz band is used for uplink while the 935-960 MHz is used for downlink.
The frequency bands are divided into 200 KHz wide channels called ARFCNs (Absolute Radio Frequency Channel Numbers) i.e. there are 125 ARFCNs out of which only 124 are used.
Each ARFCN supports 8 users with each user transmitting / receiving on a particular time slot (TS).
Fundamentals
124
123
…….
……
2
1
124
123
…….
……
2
1
0
1
2
3 4
5
6
7
0
1
2
3 4
5
6
7
Data burst = 156.25 bit periods = 576.9s
960 MHz
959.8MHz
200KHz
935 MHz
935.2 Mhz
915 MHz
200KHz
45 MHz
Downlink (TDMA frame) = 8 TS
Uplink (TDMA frame)
Delay
TS: Time slot
914.8 MHz
890.2 MHz
890 MHz
DOWNLINK
UPLINK
Therefore 1 TDMA frame = 156.25 x 8 = 1250 bits and has a duration of 576.92s x 8 = 4.615 msThe technology
GSM Delays Uplink TDMA Frames
Downlink TDMA
T T T T T T T T
R TMS1
R TMS2
Downlink
Uplink
Fixed transmitdelay of three
time-slots
R R R R R R R R
0 1 2 3 4 5 6 7
The start of the uplink TDMAis delayed of three time-slots
BTS side
MSs side
BTS
TDMA Frame (4.615 ms)
Timing Advance1 - Propagation Delay
M2 M1d1>>d2d2
BTS Frame reference
MSs transmit
Propagation Delay tp
TS0 TS1 TS2 TS3 TS4 TS6TS5 TS7
Bits Overlapping
49
TX BTS CAN WHAT GSM HOW WHEN WHATRX BTS yes the ms-isdn
RX MS1 CANTX MS1 yes
RX MS2 WHATTX MS2 the
RX MS3 GSMTX MS3 ms-isdn
RX MS4 HOWTX MS4
RX MS5 WHENTX MS5
RX MS6 WHATTX MS6
RX MS7TX MS7
RX MS8TX MS8
Propagation Delay
DD
+3TS
TA
Timing Advance2 - Without Timing Advance: Collision
50
CAN WHAT HOW WHEN WHAT
CAN
WHAT
HOW
WHEN
WHAT
TX BTSRX BTS
RX MS1TX MS1
RX MS2TX MS2
RX MS3TX MS3
RX MS4TX MS4
RX MS5TX MS5
RX MS6TX MS6
RX MS7TX MS7
RX MS8TX MS8
yes
the
Propagation Delay
D
D
+3TS - TA
yes the
Timing Advance = 2 * Propagation Delay
GSMms-isdn
ms-isdnGSM
Timing Advance3 - With Timing Advance: No Collision
51
GSM in comparison with other Standards• GSM gives mobility without any loss in Audio quality • Encryption techniques used gives high security in the
air Interface and also use of SIM.• Bit Interleaving for high efficiency in Transmission.• Variable Power (Power budgeting- extend battery life)• Minimum Interference.• Features-CCS7 Signaling
– SMS (Short Message Services)– Emergency Calls– CELL Broadcast
52
TOPICS
• GSM CONCEPTS• GSM SYSTEM ARCHITECTURE• IDENTITIES USED IN GSM• GSM CHANNELS• GSM RADIO LINK• MOBILITY MANAGEMENT• CALL MANAGEMENT• RADIO RESOURCE MANAGEMENT
53
AuC
MS
MS
BTS
BTS
BTS
BSC
BSC
MSC
MSC
VLR
VLR
GMSC
HLR
PSTN
EIR
Um
Abis
Abis
A
A
OMC Server
Um
GSM - Network Structure
B
E
E
X.25
C
F
H
X.25
54
GSM Network
OMC
AUC
HLR
MSC
EIRVLR
BSC
BTS
MS
ExternalPSTN &PDN N/W
SS
BSS
SwitchingSystem
Base StationSystem
MS Mobile Station
BTS Base transceiver System
BSC Base Station Controller
MSC Mobile Switching Center
HLR Home Location Register
VLR Visitor Location Register
EIR Equipment Identity Register
AUC Authentication Center
OMC Operation And Maintenance Center
55
GSM Architecture
HLR
VLR
EIR
AUC
MSC
BSC
BSC
SMSC
PSTN
VMSC
MobileStation
GSM
Air interface
OMCR
TRAU
Base Station System
Network and switching subsystem
A interface SS7 / speech
SS7
X.25
BTSBTS
BTS
BTS
BTSBTS
Abis interface
A interface
OMCS
56
Mobile Equipment(ME)
• Frequency and Time Synchronization• Voice encoding and transmission• Voice encryption/decryption functions• Power measurements of adjacent cells• Display of short messages• International Mobile Equipment Identifier (IMEI)
57
SIM• Portable Smart Card with memory (ROM-6KB to
16KB-A3/A8 algorithm, RAM- 128KB TO 256KB, EEPROM- 3KB to 8KB )
• Static Information– International Mobile Subscriber Identity(IMSI)– Personal Identification Number (PIN)– Authentication Key (Ki)
• Dynamic Information– Temporary Mobile Subscriber Identity(TMSI)– Location Area Identity (LAI)– Phone memories, billing information– Ability to store Short Messages received
SIM-Card and GSM Mobile Equipment
G S M
Global GSM MobilityCardThe Smart Card to use
+
SIM-Card
Contains:- IMSI
=
The SIM-Card Functions
Microchip with storeduser information
Credit Card Size
Permanent data:Unique mobile subscriber identitythrough IMSI number and PIMSI for Packet Mode
Authentication parameter Ki,Authentication algorithm A3,Generating encryption key Kc algorithm A8,
PIN code.
Removable data:- Temporary Mobile Subscriber Number,- Location Area Identification - Routing Area Identification (Packet mode)
µ SIM-Card
G S M
Global GSM MobilityCardThe Smart Card to use
25 mm
15 mm
Subscriber Identification
NatureInternational Mobile Subscriber Identity
Conformity with E212
Mobile Station - Integrated Services Digital Network Nb
Similar to ISDN, Conformity with E164/E213
Nb. digits 3 2 max 10 1 to 3 2 to 4 total max 15
*This code does not identify a geographical areabut an operator
MS - ISDN
Format MCC MNC MSINH1 H2 x x x ......... x x x
CC NDC SNM1 M2 x x x x x x x x
MeaningMobile
CountryCode
MobileNetwork
Code
Mobile SubscriberIdent. Nb
H1 H2 = Identity of HLR within the home PLMN
CountryCode
(where subscription
has been made)
NationalDestination
Code *
Mobile Subscriber(national definition)
M1 M2 = nbr of logical HLR
IMSI
National Significant Mobile NumberIdentify a PLMN worldwide
Identify the subscriber of a PLMN
Description Stored in SIM Card
MobileCountryCode
3 digits
MobileNetworkCode
2 digits
Mobile Subscriber Identification Number (MSIN)
H1 H2 X X X X X X 10 digits max
Location Area CodeLAC
Temporary MobileSubscriber Identity
4 octets
G S M
Global GSM MobilityCardThe Smart Card to useMCC
= 208 (France)
234 (G-B)262 (Germany)404,405(India)
MNC =
71(APBSNL)72(TNBSNL)
20 (Bytel) IMSI = 15 digits max
NMSI
LAI
MobileCountryCode
3 digits
MobileNetworkCode
2 digits
Routing Area CodeRAC
RAI
62
CountryCode
3 digits max
NationalDestinationCode2 or 3 digits
Subscriber Number (SN)
Roaming Number (RN)
HO-number
Must be dialed to make a call to mobile subscriber
Is a PSTN-like number to track the MS that hands over to another MSC during call-in-state
Is a PSTN-like number used to reach a roamingMS
CC = 33 (France)091(India)001(US)
NDC = 9448(BSNL-karnataka)9845,9880(Airtel)
9886(Hutch)
= 660, 661, 618 (Bytel)
M1 M2 X X X X X X X X X X X X X10 digits max
CountryCode
NationalDestinationCode
CountryCode
NationalDestinationCode
MS-ISDN (15 digits max)
MSRN
Description Stored in the Network
Descriptor Embodied in the Mobile Equipment
Type ApprovalCode
TAC FAC SNR SP
Final AssemblyCode
Serial NumbeR (SPare)
TYPE
APPROVED
IMEI enables the operator to check the Mobile Equipment Identityat call setup and make sure that no stolen or unauthorized MS is used in the GSM network
International Mobile Equipment Identity (IMEI)
Type ApprovalCode
TAC FAC SNR SP
Final AssemblyCode
Serial number (SPare)
TYPE
APPROVED
IMEI: * # 0 6 #351475 60 926514 4
MS Classmark
Revision level
RF power
Encryption algorithm
Frequency
Short message
LoCation Services
MS Positioning Method
8-PSK modulation
Multi-slot class
Multi-band
Classmark
Power classes
ClassGSM
400/850/900
1
2
3
4
5
8 W*
5 W
2 W**
0.8 W
GSM1800
GSM1900
1 W**
0.25 W
4 W
1 W**
0.25 W
2 W
* Typical value for car mounted** Typical value for handheld
ClassGSM
400/850/900GSM1800
GSM1900
E1
E2
E3
2 W
0.5 W
0.2 W
1 W
0.4 W
0.16 W
1 W
0.4 W
0.16 W
For GMSK modulation
For 8-PSK modulation
66
Base Transceiver Station (BTS)• Handles the radio interface to the mobile station.• Consists of one or more radio terminals for
transmission and reception• Each Radio terminal represents an RF Channel• TRX and MS communicates over Um interface• Received data transcoding• Voice encryption/decryption• Signal processing functions of the radio interface• Uplink Radio channel power measurements
67
Base Station Controller (BSC)• Provides all the control functions and physical links
between the MSC and BTS • External Interfaces
– ‘Abis’ interface towards the BTS– ‘A’ interface towards the MSC
• Monitors and controls several BTSs• Management of channels on the radio interface• Alarm Handling from the external interfaces• Performs inter-cell Handover• Switching from ‘Abis’ link to the ‘A’ link• Interface to OMC for BSS Management
68
Mobile Switching Center (MSC)
• Performs call switching • Interface of the cellular network to PSTN• Routes calls between PLMN and PSTN• Queries HLR when calls come from PSTN to mobile
user• Inter-BSC Handover• Paging• Billing
69
Home Location Register (HLR)• Stores user data of all Subscribers related to the
GMSC– International Mobile Subscriber Identity(IMSI)– Users telephone number (MS ISDN)– Subscription information and services– VLR address– Reference to Authentication center for key (Ki)
• Referred when call comes from public land network
70
Visitor Location Register (VLR)
• Database that contains Subscriber parameters and location information for all mobile subscribers currently located in the geographical area controlled by that VLR
• Identity of Mobile Subscriber• Copy of subscriber data from HLR• Generates and allocates a Temporary
Mobile Subscriber Identity(TMSI)• Location Area Code• Provides necessary data when mobile
originates call
71
Authentication Center (AuC)
• Stores Subscriber authentication data called Ki, a copy of which is also stored in in the SIM card
• Generates security related parameters to authorize a subscriber (SRES-Signed RESponse)
• Generates unique data pattern called Cipher key (Kc) for user data encryption
• Provides triplets - RAND, SRES & Kc, to the HLR on request.
72
EIR (Equipment Identity Register)
• EIR is a database that contains a list of all valid mobile station equipment within the network,
where each mobile station is identified by its International Mobile Equipment Identity(IMEI).
• EIR has three databases.,– White list - For all known,good IMEI’s– Black list - For all bad or stolen handsets– Grey list - For handsets/IMEI’s that are
on observation
73
Location Area Identity• LAI identifies a location area which is a group of
cells..• It is transmitted in the BCCH. • When the MS moves into another LA (detected by
monitoring LAI transmitted on the BCCH) it must perform a LU.
• LAI = MCC + MNC + LAC – MCC= Mobile Country Code(3 digits), identifies the country– MNC= Mobile Network Code(1-2 digits), identifies the GSM-
PLMN– LAC= Location Area Code, identifies a location area within a
GSM PLMN network. The maximum length of LAC is 16 bits,enabling 65536 different location areas to be defined in one GSM PLMN.
74
Interfaces and Protocols
Um
Abis A
CB
E
D
F
Digital Networks
POTS
TUP
ISUP
MAP
MAPMAP
BSSAPLAPD
LAPDm
G
75
GSM Entities and Signaling Architecture
76
GSM Protocols• CM - Connection Management• MM - Mobility Management• RR - Radio resource • LAPDm - LAPD for mobile• LAPD - Link Access Procedure for D channel• BTSM - BTS Management Part• BSSAP - BSS Application Part (BSC - MSC)• DTAP - Direct Transfer Application Part (MS - MSC)• MAP - Mobile Application Part• MTP - Message Transfer part of SS7• SCCP - Signalling Connection Control Part of SS7• TCAP - Transaction Capabilities Application Part• ISUP - ISDN User Part
77
Functional Plane of GSM
MS BTS BSC MSC/ HLR GMSC VLR
MS BTS BSC MSC/VLR HLR GMSC
CC
MM
RR
Trans
78
TOPICS• GSM CONCEPTS• GSM SYSTEM ARCHITECTURE• IDENTIFIERS USED IN GSM• GSM CHANNELS• GSM RADIO LINK• MOBILITY MANAGEMENT• CALL MANAGEMENT• RADIO RESOURCE MANAGEMENT
79
TOPICS• GSM CONCEPTS• GSM SYSTEM ARCHITECTURE• IDENTITIES USED IN GSM• GSM CHANNELS• GSM RADIO LINK• MOBILITY MANAGEMENT• CALL MANAGEMENT• RADIO RESOURCE MANAGEMENT
80
Channels : differentiating between Physical and Logical channelsPhysical channels : The combination of an ARFCN and a time slot defines a physical channel.
Logical channels : These are channels specified by GSM which are mapped on physical channels.
81
Physical channel:One timeslot of a TDMA-frame on one carrieris referred to as a physical channel.There are 8 physical channels per carrier inGSM,channel 0-7(timeslot 0-7)
Logical channel:A great variety of information must be transmitted between BTS and the MS,for e.g.user data and control signaling.Dependingon the kind of information transmitted we refer to different logical channels.These logicalchannels are mapped on physical channel.
Channel concept
82
Logical Channels on Air interface
LOGICALCHANNELS
COMMONCHANNELS
DEDICATED CHANNELS
BROADCAST CHANNELS
COMMONCONTROLCHANNELS
DEDICATED CONTROL CHANNELS
TRAFFIC CHANNELS
FCCH BCCHSCH SDCCH SACCH FACCH
PCH AGCHRACH TCH/F TCH/EFRTCH/H
83
FCCH
Logical channelsLogical channels
Control channels Traffic channels
BCH CCCH DCCHHalf
rate
Full
rate
SCH BCCH PCH AGCH RACH SDCCH SACCHFACCHCBCH
84
Broadcast channels BCH • Broadcast Channel-BCH
– Alloted one ARFCN & is ON all the time in every cell. Present in TS0 and other 7 TS used by TCH.
• Frequency correction channel-FCCH – To make sure this is the BCCH carrier.– Allow the MS to synchronize to the frequency.– Carries a 142 bit zero sequence and repeats once in every
10 frames on the BCH.
• Synchronization Channel-SCH– This is used by the MS to synchronize to the TDMA frame
structure within the particular cell.– Listening to the SCH the MS receives the TDMA frame
number and also the BSIC ( in the coded part- 39 bits).– Repeats once in every 10 frames.
85
Broadcast channels BCH ...• BCCH
– The last information the MS must receive in order to receive calls or make calls is some information concerning the cell. This is BCCH.
– This include the information of Max power allowed in the cell.
– List of channels in use in the cell.– BCCH carriers for the neighboring cells,Location Area
Identity etc.– BCCH occupies 4 frames (normal bursts) on BCH and
repeats once every Multiframe.– This is transmitted Downlink point to multipoint.
• Cell Broadcast Channel - CBCH– Used for the Transmission of generally accessible
information like Short Message Services(SMS)
86
Common Control Channels CCCH• CCCH-
– Shares TS-0 with BCH on a Multiframe.
• Random access channel-RACH:– Used by Mobile Station for requesting for a channel. When
the mobile realizes it is paged it answers by requesting a signaling channel (SDCCH) on RACH. RACH is also used by the MS if it wants to originate a call.
– Initially MS doesn’t know the path delay (timing advance), hence uses a short burst (with a large guard period = 68.25 bits).
– MS sends normal burst only after getting the timing advance info on the SACCH.
– It is transmitted in Uplink point to point.
87
Common Control Channels CCCH ..• Access Grant Channel-AGCH
– On request for a signaling channel by MS the network assigns a signaling channel(SDCCH) through AGCH. AGCH is transmitted on the downlink point to point.
• Paging Channel-PCH– The information on this channel is a paging message
including the MS’s identity(IMSI/TMSI).This is transmitted on Downlink, point-to-multipoint.
88
Dedicated Control Channels-DCCH• Stand alone dedicated control channel(SDCCH)• AGCH assigns SDCCH as signaling channel on
request by MS.The MS is informed about which frequency(ARFCN) & timeslot to use for traffic.
• Used for location update, subscriber authentication, ciphering information, equipment validation and assignment of TCH.
• This is used both sides, up and Downlink point-point.
89
Dedicated Control Channels-DCCH• Slow associated control channel-SACCH
– Transmission of radio link signal measurement, power control etc.
– Average signal strengths(RXLev) and quality of service (RXQual) of the serving base station and of the neighboring cells is sent on SACCH (on uplink).
– Mobile receives information like what TX power it has to transmit and the timing advance. It is associated with TCH or SDCCH
• Fast associated control channel-FACCH– Used for Hand over commands and during call setup and
release. FACCH data is sent over TCH with stealing flag set
90
Traffic Channels-TCH
• TCH carries the voice data.• Two blocks of 57 bits contain voice data in the normal
burst.• One TCH is allocated for every active call.• Full rate traffic channel occupies one physical
channel(one TS on a carrier) and carries voice data at 13kbps
• Two half rate (6.5kbps) TCHs can share one physical channel.
91
GSM Channels
Control ChannelsTraffic Channels(TCHs)
Fullrate
Halfrate
Dedicated ControlChannels(DCCHs)
SlowFast
Downlink
BroadcastChannels
(BCHs)
Common ControlChannels(CCCHs)
Downlink Uplink
TCH /F TCH /H FCCH SCH BCCH PCH CBCH RACHAGCH SDCCH SACCHFACCH
Traffic Multiframing Signaling Multiframing Traffic Multiframing
(down uplink)
GSM Channels
92FACCH
BTS
0 1 2 3 4 5 6 7TS
MS
FCCH
SCH
BCCH
PCH
AGCH
CBCH
SDCCH
SACCH
TCH
TCH
FACCH
SDCCHSACCH
FCCH
SCH
BCCH
RACH
PCH
AGCH
RACH
CBCH
Synchronization
Frequency correction
Broadcast control
Access request
Subscriber paging
Answer to Access request
Broadcast info
Dedicated Signaling
Sys InFo 5, 6 + SMS
Traffic (speech data)
Associated Signaling
Associated Signaling
Traffic (speech-data)
Radio Measurement + SMS
Dedicated Signaling
Broadcast info
M.S. Pre-synchronization
Access request
Subscriber paging
Answer to Access request
The Logical Channels on Radio Interface
93
FACCH MESSAGES
• Connection establishment from SDCCH to TCH
• End validation of a SDCCH-TCH commutation
• Characteristics of the future used BS after handover
• Connection establishment to BS after handover
• Validation of an handover
SACCH MESSAGES
Measures:
power level of the communication
quality level of the communication
level on the beacon frequency of the neighboring cells
• Timing Advance
• Power Control
• SMS
TCH MESSAGES
• Speech
• Data
• Handover Access message (uplink)
SDCCH MESSAGES• Request for a SDCCH assignment
• Request for the end of channel assignment
• Order of commutation from SDCCH to TCH
• SMS
Logical Channel Description (1/2)
94
FCCH MESSAGES
• no message is sent (all bits 0)
BCCH MESSAGES
• System Information type 1, 2, 2bis,2ter, 3, 4, 7, 8
(idle mode)
SCH MESSAGES
• Frame Number
• Base Station Identity Code (BSIC)
AGCH MESSAGES
• For dedicated channel assignment:frequency numberslot numberfrequency hopping descriptionTiming Advance (1st estimation)MS identification
PCH MESSAGES
• messages containing a mobileidentity for a call, a short messageor an authentication
RACH MESSAGES
• Service request:emergency call answer to an incoming calloutgoing callshort messagecall re-establishmentinscription
CBCH MESSAGES
• Specific information (weather, road information
Logical Channel Description (2/2)
96
0 1 2 3 4 21 22 23 24 25 0 1 2 3 4 46 47 48 49 50
26 traffic frames = 120 ms
1 Hyperframe = 2,715,648 frames= 3h 28 min. 53 s 760 ms
0 1 2 3 5 2042 2043 2044 2045 2046 20474
1326 frames
0 1 2 3
46 47 48 49 500 1 3 42
22 23 2524
TS0
TS1
TS2
TS3
TS5
TS6
TS7
TS0
TS1
TS2
TS3
TS4
TS5
TS6
TS7
TS0
TS1
TS2
TS3
TS4
TS5
TS6
TS7
TS4
TS0
TS1
TS2
TS3
TS4
TS5
TS6
TS7
TS0
TS1
TS2
TS3
TS4
TS5
TS6
TS7
Frame4.615 ms
Control channelTraffic channel
51 x 26 traffic frames = 6.12 s
26 x 51 control frames = 6.12 s
Traffic and Control Multiframing
97
99
Full Rate - Downlink & Uplink
T : TCH A : SACCH : IDLETi: TCH sub-channel no. i
Ai: SACCH sub-channel no. i
time
26 frames = 120 ms
T0 A0T0 T0 T0 T0 T0 T0 T0 T0 T0 T0 T0T1 T1 T1 T1 T1 T1 T1 T1 T1 T1 T1 T1 A1 time
Half Rate - Downlink & Uplink
T AT T T T T T T T T T TT T T T T T T T T T T T
T
26 frames = 120 ms
Logical Channel Mapping1 - Traffic Channel Combination
100
A : SACCH D : SDCCH : IDLE
51 frames = 235 ms
A1 A2 A3A0D7D6D5D4D3D2D1D0
A5 A6 A7A4D7D6D5D4D3D2D1D0
time
Downlink
51 frames = 235 ms
A5 A6 A7 A0
A4
D7D6D5D4D3D2D1D0
D7D6D5D4D3D2D1D0A1 A2 A3
time
Uplink
AAAA
Logical Channel Mapping2 - Dedicated Signaling Channel Combination
101
51 frames = 235.38 ms
Downlink
time
51 frames = 235.38 ms
RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR RRRRRRRRRRRRRRRRRR
Uplink
time
B : BCCHS : SCH F : FCCH : IDLE: PCH /AGCHC R : RACH
BTS MSPhysical Channel
ARFCN (n) TS (s)
FCCH
SCH BCCH
PCH/AGCH
Frames repeat continuously
Multiframe m+1
Multiframe m-1
Multiframe m
C CF SC CFSC CFSC CCBFS FS BFSC
Logical Channel Mapping3 - Common Channel Combination
102
A3A2
A1D3D2
D3D2
D1
D1
D0
D0 FS FS FSC CC FSB FS
FS FS FSC CC FSB FS
51 frames = 235 ms
A0
time
Downlink
R R
R R D2
D2
D1
D1
D0
D0A1
A3
A0
A2R
R
R
R
D3
D3
51 frames = 235 ms
time
Uplink
R
R
R
R
R
R
R
R
R
R
R
R
R
R
R
R
R
R
R
R
R
R
R
R
R
R
R
R
R
R
R
R
R
R
R
R
R
R
R
R
R
R
R
R
R
R
A : SACCH D : SDCCH : IDLEB : BCCHS : SCH F : FCCH: AGCH/PCHC R : RACH
Logical Channel Mapping4 - Common Channel Combination
103
104
Downlink message
Uplink message
Neighboring BTS(downlink)
Measurement Windows
C CF SC CF SC CF SC CCBF S F S F S
0 1 12 25 0 1 12 25
0 1 10 20 30 40 50 0 1
T AT T T T T T T T T T TT T T T T T T T T T T T T AT T T T T T T T T T TT T T T T T T T T T T T
Mobile activity
Rx Rx Tx Rx Rx Tx Rx Rx Tx (n) (n) (n)
Why 26 and 51 Frames per Multiframe?
105
TOPICS• GSM CONCEPTS• GSM SYSTEM ARCHITECTURE• IDENTITIES USED IN GSM• GSM CHANNELS• GSM RADIO LINK• MOBILITY MANAGEMENT• CALL MANAGEMENT• RADIO RESOURCE MANAGEMENT
106
Speech
Sourcedecoding
Channeldecoding
De-interleaving
Burst deformatting
Deciphering
Demodulationequalization
Digitizing andsource coding
Channelcoding
Modulation
Ciphering
Burst formatting
Interleaving
Step 1
Step 2
Step 3
Step 4
Transmission
Step 5
Step 6 Diversity
From Speech to Radio Transmission
107
GSM Radio Link
• Speech Coding -Done at Transcoder of BSC and MS– The Linear Predictive Coder uses RPE-LTP(Regular Pulse
Excitation- Long Term Prediction)– Converts 64kbps voice to 13kbps(260 bits every 20ms)
• Channel Coding - Done at BTS and MS– Uses Convolution Coding and CRC (Cyclic Redundancy
Check)– Converts 13 kbps to 22.8 kbps (456 bits per 20ms)
108
GSM Radio Link
• Bit Interleaving - Done at BTS and MS• Encryption - Done at BTS and MS
– EX OR data with cipher block, which is generated by applying A5 Algorithm to the Ciphering Key(Kc)
• Multiplexing - Done at BTS • Modulation - Done at BTS and MS
– GMSK(Gaussian filtered Minimum Shift Keying)– Phase change of +90 for 0 and -90 for 1
111
Speech Coding
BP A/D SPEECHENCODER
CHANNEL CODING
LP D/A SPEECHDECODER
CHANNEL DECODING
BAND PASS
300 Hz - 3.4 kHZ
Every 125 s value issampled from analog signal and quantised by 13 bit wordData rate = 13/125*10 -6
= 104 kbps
Every 20ms 160 samples takenData rate = 160 * 13/20ms = 104 kbps
Linear Predictive Coding & Regular Pulse Excitation Analysis
1. Generates 160 filter coeff2. These blocks sorted in 4 sequence 1,5,9,…37 / 2,6,10----38/ 3,7,11…39/8,12,16…403. Selects the sequence with most energy
So data rate = 104/4 = 26 kbps
Long term prediction analysis1. Previous sequences stored in memory2. Find out the correlation between the present seq. And previous sequences3. Select the highest correlation sequence4. Find a value representing the differencebetween the two sequences.
Reduces data rate = 26 kbps/2 = 13 kbpsie 260 bits in 20ms
50 132 78
1A 1B 2
1A = Filter Coeff block ampl, LTP params1B = RPE pointers &pulses2 = RPE pulse & filterparams
50 3 132 4
3 crc bitsFour 0 bits for codec
378 coded bits
Conv coding rate = 1/2 delay = 4
78
456 bits in 20 ms = 22.8 kbps57 x 8 = 456
To modulator
112
C
20 ms20 ms
A
A8
A7
A6
A5
B4
B3
B2
B1
B8
B7
B6
B5
C4
C3
C2
C1
57 bits
Information
1 1
CRL CRL
3 3
Tail Tail
26 bits
Training
8 Bursts
8 Sub blocksof 57 bits
Source coding
Channel coding
Interleaving
Normalburst
20 ms
B
456 bitsA 456 bitsB 456 bitsC
57 bits
Information
A8B4
A7B3
A6B2
A5B1
B8C4
B7C3
B6C2
B5C1
Speech blocks
Codec dependent Codec dependentCodec dependent
Channel Processing in GSMOverview for Full Rate
113
114
C
20 ms20 ms
A
A4
A3
A2
A1
B2
B1
B4
B3
C4
C3
C2
C1
4 Bursts
4 Sub blocksof 57 bits
Source coding
Channel coding
Interleaving
20 ms
B
228 bitsA 228 bitsB 228 bitsC
A4B2
A3B1
B4C2
B3C1
Speech blocks
Codec dependent Codec dependentCodec dependent
Normalburst 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7
Channel Processing in GSMOverview for Half Rate
115
0 1 2 3 4 5 6 7 8 ... ... 452 453 454 455
0 1 2 3 4 56 7
8 9 10 11 12 1314 15 • • • • • •• •• • • • • •• •• • • • • •• •
448 449 450 451 452 453454 455
57
Ro
ws
Divide 456 bits in 8 sub-blocks
765432107654 0 1 2 3
reordering&
partitioningout
diagonalinterleaving
456coded bits
burst
b0 b1 b56 b1 b56b0
bitinterleaving
Interleaving: TCH Full Rate
116
1 frame:4.615 ms
0 1 2 3 4 5 6 7
Guard
157 126 57
DATA
156.25 bits duration(0.577 ms)
Trainingsequence
33
DATA
8.25
S SGuardBand
Burst148 bits
Burst FormattingNormal Burst
117
Synchronization Burst(SCH)
Tail Data Extended Training Sequence Data Tail
156.25 bits duration(0.577 ms)
3 bits 39 encrypted bits 64 synchronization bits 39 bits 3 bits 8.25 bits
Guard Period
Frequency Correction Burst(FCCH)
Tail Data Tail
156.25 bits duration(0.577 ms)
3 bits 142 fixed bits (0) 3 bits 8.25 bits
Guard Period
Burst Formats
118
Access Burst
TailTraining
Sequence Guard PeriodTail
156.25 bits (0.577 ms)
8 bits 36 encrypted bits 68.25 bits3 bits41 synch bits
Data
Dummy Burst
Tail Dummy Sequence Training Sequence Dummy Sequence Tail
3 bits 58 mixed bits 26 midamble bits 58 mixed bits 3 bits 8.25 bits
Guard Period
156.25 bits (0.577 ms)
156.25 bits (0.577 ms)
13 bits 57 encrypted bits 1 26 bits 57 encrypted bits 3 bits 8.25 bits
Tail Data Training Sequence Data Tail Guard Period
Normal Burst
Burst Formats
119
Plain data: 0 1 1 1 0 0 1 0.....Ciphering sequence: 0 0 0 1 1 0 1 0.....XOR:Ciphered data (transmitted): 0 1 1 0 1 0 0 0.....Ciphered sequence: 0 0 0 1 1 0 1 0..... XOR: Recovered data: 0 1 1 1 0 0 1 0.....
Data S S DataBurst to betransmitted
Data S STrainingsequence
DataReceived
burst
Ciphering
120
Interleaving
57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57
57 57 57 57
57 57 57 57
57 57 57 57
57 57 57 5757 57 57 57
57 57 57 57 57 57 57 57
57 57 57 57
Encoded speech blocks - Diagonal Interleaving
Even bitsOdd bits
Tb 3
Coded Data 57
F 1
Training Sequence26
F 1
Coded Data 57
Tb 3
Gp8.25
Bn-4 Bn-3 Bn-2 Bn-1 Bn Bn+1 Bn+2 Bn+3
57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57
57 57 57 57
57 57 57 57
57 57 57 57
57 57 57 5757 57 57 57
57 57 57 57
Encoded control channel blocks - Rectangular Interleaving
Even bitsOdd bits
Bn-4 Bn-3 Bn-2 Bn-1 Bn Bn+1 Bn+2 Bn+3
121
Burst• The information format transmitted during one
timeslot in the TDMA frame is called a burst.• Different Types of Bursts
– Normal Burst– Random Access Burst– Frequency Correction Burst– Synchronization Burst
122
Normal Burst
T3
Coded Data57
S1
T. Seq.26
S1
Coded Data57
T3
GP8.25
Tail Bit(T) :Used as Guard TimeCoded Data :It is the Data part associated with the burstStealing Flag :This indicates whether the burst is carrying
Signaling data (FACCH) or user info (TCH).Training Seq. :This is a fixed bit sequence known both to
the BTS & the MS.This takes care of the signal deterioration.
156.25 bits 0.577 ms
123
T3
Training Sequence41
Coded Data36
T3
GP68.25
Random Access Burst
T3
Fixed Bit Sequence142
T3
GP8.25
T3
Coded Data39
Training Sequence64
CodedData 39
T3
GP8.25
Freq. Correc. Burst
Synchronization Burst
156.25 bits 0.577 ms
156.25 bits 0.577 ms
156.25 bits 0.577 ms
124
Transmission on the radio channels
• A timeslot has a duration of .577 m seconds (148 Bits)• 8 timeslots(8 x 0.577 = 4.62 ms) form a TDMA frame• If a mobile is assigned one TS it transmits only in this time
slot• and stays idle for the other 7 with its transmitter off, called
bursting• The start on the uplink is delayed from downlink by 3 TS
periods• One TS = duration of 156.25 bits, and its physical contents
is • called a burst
0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7
0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7
DownlinkBTS > MS
UplinkMS > BTS
Offset
125
0 1 2 3 4 5 6 7
0 1 2 3 4 5 6 7
MS1 near
MS2far
0 1 2 3 4 5 6 7
0 1 2 3 4 5 6 7
AtBTS
0 1 2 3 4 5 6 7MS1 near
0 1 2 3 4 5 6 7MS2far
0 1 2 3 4 5 6 7
0 1 2 3 4 5 6 7
AtBTS
Timing Advance
126
Frames Types On Um Interface• TDMA Frame
– 8 Time slots (Burst Period)– Length is 4.62 ms(8 * 0.577ms)
• 26-TDMA Multiframe– 26 TDMA Frames (24 TCH, SACCH, Idle)– 120 ms (26 * 4.62ms)
• 51-TDMA Multiframe– 26 TDMA Frames (FCCH, SCH, BCCH, SDCCH, CCCH)– 235.6 ms (51 * 4.62ms)
127
Frames Types On Um Interface• Super Frame
– 51* 26 TDMA Frames– 6.12 S
• Hyper Frame– 2048 * 51* 26 TDMA Frames– 3 Hours, 28 Minutes, 53 Secs and 760 ms
128
TOPICS• GSM CONCEPTS• GSM SYSTEM ARCHITECTURE• IDENTITIES USED IN GSM• GSM CHANNELS• GSM RADIO LINK• MOBILITY MANAGEMENT• CALL MANAGEMENT• RADIO RESOURCE MANAGEMENT
129
Mobility Management
• Mobility Management (MM)• Location updating- normal,periodic, IMSI attach• Paging• Security Management
– Preventing unauthorized users- authentication– Maintaining Privacy of users- ciphering
• Providing roaming facility• MM functionality mainly handled by MS, HLR,
MSC/VLR.
130
Network Attachment
· Cell Identification· MS scans complete GSM frequency band for
highest power· Tunes to highest powered frequency and looks
for FCCH. Synchronizes in frequency domain· Get training sequence from SCH which follows
FCCH. Synchronizes in time domain.· Accesses BCCH for network id, location area and
frequencies of the neighboring cells. · Stores a list of 30 BCCH channels
131
Network Attachment…..· PLMN Selection
· Get the operator information from SIM.
· Cell Selection· Selected cell should be a cell of the selected
PLMN· Signal strength should be above the threshold.· Cell should not be barred
· Location Update· Register with the network by means of location
updation procedures.
132
MS BTS BSC (G)MSC VLR HLR
Action
Channel Request (RACH)
Channel Assignment (AGCH)
Authentication Request (SDCCH)
Authentication Response (SDCCH)
Comparison of Authentication params
Accept LUP and allocTMSI (SDCCH)
Ack of LUP and TMSI (SDCCH)
Entry of new area and identity into VLR and HLR
Channel Release (SDCCH)
MS Location Update (registration)
Location Update Request (SDCCH)TMSI + old LAI
133
Security - Authentication
Authentication center provides RAND to MobileAuC generates SRES using Ki of subscriber and RANDMobile generates SRES using Ki and RANDMobile transmits SRES to BTSBTS compares received SRES with one generated by AuC
MSKi RAND
A3
SRES
RAND
SRES
SRES
Auth Result
AuCBTSMS
134
Security - Ciphering
Data sent on air interface ciphered for security A5 and A8 algorithms used to cipher dataCiphering Key is never transmitted on air
MSKi RAND
A8
Kc
MS NetworkUm interface
A5 A5
Kc Kc
Data DataCiphered
Data
135
TOPICS• GSM CONCEPTS• GSM SYSTEM ARCHITECTURE• IDENTITIES USED IN GSM• GSM CHANNELS• GSM RADIO LINK• MOBILITY MANAGEMENT• CALL MANAGEMENT• RADIO RESOURCE MANAGEMENT
136
Communication Management (CM)• Setup of calls between users on request• Routing function i.e. Choice of transmission
segments linking users• Point to Point Short message services
PLMN Selection
No
automatic mode
The MS selects the first PLMN from the preferred PLMNs list (if it is not in
the forbidden PLMNs list)
The user selects a PLMN from the
displayed PLMNs
manual mode
YesYes
Creation of a found PLMN list
Is there an up to date found PLMNs list?
End of PLMN selection
YesNo (automatic)
Cell Selection succeed?
Selection of the next preferred possible PLMN
No (manual)
Listen to all the frequencies of the GSM
spectrum:power level measurement
and average on these measurements
Select the best frequencies
according to the power level
(124 channels in GSM 900, 374 in GSM 1800and 299 in GSM 1900
(30 in GSM 900 and 40 in GSM 1800)
Memorize the beacon
frequencies in the precedent selection
=> Create the Found PLMN list
PLMN Selection• Constitution of the "Found PLMN
list"
Suitable cell:
- cell of the selected PLMN- cell not barred- C1 > 0
Eligible cell
List of the frequencies of the
selected PLMN
IMSI Attach
Look for the cell with the best C1 in the suitable cells list
Eligible cell?
Yes
Selection of another PLMN
No
C1 Computation for eligible cells
Suitable cell?
YesNo
Initial Cell Selection
Rejected?
Yes
PLMN set in the forbiddenPLMN list
End of Cell Selection
No
Cell Selection
BTS-2
BTS-1
This cell
BTS-3
BTS-4
BTS-51
1
1
12
3
45
Purpose: get synchronization with the GSM network prior establishing any communication.
FCCH
SCH
BCCH
1
Immediate AssignmentMS BSC MSC
CM SERVICE REQUEST
SDCCH or TCH6
CHANNEL REQUEST
RACH1
BTS
CHANNEL REQUIRED2
CHANNEL ACTIVATION3
IMMEDIATE ASSIGNMENT
AGCH5
IMMEDIATE ASSIGNMENTCOMMAND
5
CHANNEL ACTIVATIONACK.
4
ImmediateAssignment
LOCATION UPDAT. REQU.
SDCCH or TCH6
OR
Registration: the Very First Location Update
LAI HLR
IMSIVLR id
TMSI
IMSI
TMSI
Release
VLR
IMSITMSILAI
MSC
BTS
BSS
BSC
2
4
5
2
6
1
2
4
5
6
3
4TMSI 5
Intra – VLR Location Update
VLR
IMSITMSILAI
1
2
3
4
new TMSI
TMSI + old LAI 2
3
42
3TMSI
New TMSI
New LAI
MSC
BTS
BSS
BSC
IMSI not Required
145
New LAI
newTMSI
TMSI + old LAI
TMSI New TMSI
MSC
BSS
BTS
BSC
1
2
5
7
2
5
7
2
IMSI,TMSILAI
New VLR
IMSI, TMSIOld LAI
Old VLR
RAND, SRES, Kc
HLR
new VLR id
subscriberdata
3
4
6
6
5
IMSI not Required
RAND, SRES, Kc
Inter – VLR Location Update
146
MSCBTS
BSS
BSC
VLR
3
4
5
4
6
1 CHANNELREQUEST
2IMMEDIATEASSIGNMENT
LOCATION UPDATINGREQUEST (IMSI Attach)
3
5LOCATION UPDATINGACCEPT (LAC, TMSI)
4AuthenticationProcedure
IMSI Attach
147
MSC
BTS
BSS
BSC
VLR
1 CHANNELREQUEST
2IMMEDIATEASSIGNMENT
IMSI DETach INDication
3
4CHANNELRELEASE
IMSI DETach INDication
3
IMSI Detach
149
ACM = Address Complete Message ANM = ANswer MessageIAM = Initial Address Message
MS BSS MSCCHANNEL REQUEST
1
PSTN
CM SERVICE REQUEST2 CM SERVICE REQUEST
2
CALL PROCEEDING7CALL PROCEEDING
7
Assignment procedure7
IAM6
IMMEDIATE ASSIGNMENT2
ACM8
VLR
Ring
ANM10
ALERTING 9
SETUP (basic) or
EMERGENCY4 SETUP
4
CONNECT11
CONNECT ACKnowledge11
Authentication procedure3
Ciphering procedure3
5
Dialing
Ringing
PathEstablished
Ringing
SendingNumber
Mobile Originating Call
150
PSTN
LA1
LA2
BTS11
BTS21
BTS22
BTS31
BTS12
BTS23
HLR
4
3
5
1
2
5
6
6
BSC1
BSC2
BSC3
MSC/VLR
GMSC
Mobile Terminating Call1 - Paging Principle
151
VMSCBSS
VLR
Visitor PLMN
GMSC
HLR
Home PLMN
RoutingInformation
(MSRN)
6
IAM : Initial Address MessageMSISDN : Mobile Station Integrated Services Digital
network NumberMSRN : Mobile Station Roaming Number
IMSI : International Mobile Subscriber IdentityGMSC : Gateway MSCVMSC : Visitor MSCTMSI : Temporary Mobile Subscriber Identity
PN
InternationalSS7
ISDNIAM (MSRN)
7IAM
(MSISDN)2
SendRoutingInformation(MSISDN)
3
Provide Roaming Number (IMSI)
4
PAGE(TMSI + LA)
9
Send info to I/C(MSRN)
8
Roaming Number (MSRN)
5
PAGINGREQUEST
(TMSI + LA)10
PAGINGREQUEST
(TMSI)
11
MSISDN
1
Mobile Terminating Call2 - Detailed Procedure
152
MS BSS VMSC
CHANNEL REQUEST(LAC, Cell ID)
5
PSTN
IMMEDIATE ASSIGNMENT(SDCCH or TCH)
6
PAGING REQUEST4
PAGING REQUEST
(TMSI or IMSI, LA)3
GMSC
IAM
(MSISDN)1IAM
(MSRN)2
CM SERVICE REQUEST(Paging Response)
7 PAGING RESPONSE
(TMSI or IMSI, LA)7
Authentication procedure8
Ciphering procedure9
Address Complete Message11
ANswer Message12
Setup, Assignment, Alerting10
CONNECT12
Dialing
Ringing
PathEstablished
Mobile Terminating Call3 - End to End Procedure
153
MS BSS MSC
Call in progress1
RELEASE COMPLETE4
PSTN
DISCONNECT2 DISCONNECT
2
RELEASE3RELEASE
3
RF Channel Release procedure 8
Release5
RELEASE INDICATION7
CHANNEL RELEASE 6
Releasetone
9
Call Release1 - Mobile Initiated
154
PSTN
On hook
Purpose:informs the mobilethen releases radio and network resources.
REL
RLC
MSC
BTS
BSS
BSC
11 1
12
33
4
5 5
4
6
2
Call Release2 - PSTN Initiated
155
Mobile Originated Call
• Request for Service• Authentication• Ciphering• Equipment Validation• Call Setup• Handovers• Call Release
156
Mobile Terminated Call
• Paging• Authentication• Ciphering• Equipment Validation• Call Setup• Handovers• Call Release
157
Mobile Terminated CallMS
MS
BTS
BTS
BTS
BSC
BSC
MSC
VLR
GMSC
HLR
PSTN
EIR
AuC
Land to Mobile call(MSISDN)
Query forVLR info
Reply(MSRN)
Routeto MSC
Query VLR for LAC andTMSIPaging
the area(+TMSI)
TMSI Pagedon PCH
Paging
Ch. REQover RACHAllocate SDCCHover AGCHPage RESP on SDCCH ( TMSI + LAI)
Page RES Page RES
Authentication and Ciphering procedure done as seen in Location Updation
Assign. REQ
Assignment CMD(=TCH) on SDCCH
* MS tunes* Assgn CMP* Phone rings
Connect traffic Ch.to trunkfrees SDCCHAssgn CMP
Network Alerting
158
TOPICS• GSM CONCEPTS• GSM SYSTEM ARCHITECTURE• IDENTITIES USED IN GSM• GSM CHANNELS• GSM RADIO LINK• MOBILITY MANAGEMENT• CALL MANAGEMENT• RADIO RESOURCE MANAGEMENT
159
Radio Resource Management
• Establish maintain and release stable connections between MS and MSC
• Manage Limited Radio and Terrestrial resources• Handover process is the sole responsibility of the RR
Layer• Functions of RR layer are performed by MS and BSC
and partly by MSC
160
Radio Resource Management
• Power Control• Hand over Control• Discontinuous Transmission• Frequency Hopping
161
BTS commands MS at differentdistances to use different power levelsso that the power arriving at the BTS’s Rx isapproximately the same for each TS
- Reduce interference- Longer battery life
Power Control
162
HandoverMeans to continue a call even a mobile crosses the border of one cell to anotherProcedure which made the mobile station really roamHandover causes
RxLev (Signal strength , uplink or downlink)RxQual (BER on data)O & M interventionTiming AdvanceTraffic or Load balancing
163
Handover Types
• Internal Handover (Intra-BSS)– Within same base station - intra cell– Between different base stations - inter cell
• External Handover (Inter-BSS)– Within same MSC -intra MSC– Between different MSCs - inter-MSC
164
Handover Types
BSC
BSC
BSC
BSC
MSC
MSC
GMSC
C-1 C-2
C-3
C-4
165
Periodic Measurement Reports (SACCH)
Periodic Measurement Reports
HO requiredActivate TCH(facch)with HoRef#
if 1. Check for HO passed2. Channel avail in new BTS
Acknowledges and alloctes TCH (facch)
HO cmd with HoRef#Receives new BTS data(FACCH)
MS tunes into new frequency and TS and sends HO message to new BTS (facch)
Periodic Measurement Reports (SACCH)
HO performed
Release TCH
Cell 1
Cell 2
BSC
BTS 1
BTS 2
Intra BSC handover
166
Frequency plan and importance of BCCH
B3
B2
B9
B6 B4
B1
Sectored antennas
MS ( monitoring the broadcast radio B1 in ‘idle
mode’ )
F S B B B B …..
F S …..
…..
I
F0 F50F2 F3 F4 F5 F10 F11F1
• F,S,B exist in time slot 0 of each frame
B7
B8
B5
B10
B11
B12
Example frequency plan:
Broadcast frequencies :
15 Broadcast channels = 48-62
15 Hopping channels = 32-46
167
What information does Broadcast Control channel (BCCH) contain?
Serves as a Beacon for the Cell
Country Code (CC) and the Network Code (NC)
Location Area Identity (LAI)
List of neighboring cells which should be monitored by MS
List of frequencies used in the cell
Cell identity
Back
168
Location Updates
Location Updates can be classified into two:
Periodic Location Updates:
This occurs as per the timer set by the network operator. If the MS does not perform this update the MSC marks the MS as ‘Detached’ on the VLR.
Location Update on a handover:
This occurs if during a handover the MS is moved into a new Location Area Code (LAC).
169Back
1. The MS is monitoring the BCCH and has all the decoded information stored on the SIM ( including the LAC)
2. As soon as the mobile is on a TCH it sends the signal strength indication on the corresponding SACCH
3. The BSC monitors the signal strengths and on analysis sends a ‘handoff request’ on FACCH. The handoff process is completed on the FACCH.
4. After the completion of call, the MS starts monitoring the BCCH again. On finding the LAC (stored on SIM) and that decoded from the BCCH to be different , the MS requests a ‘Location Update’ through SDCCH.
170
Discontinuous Transmission
• Discontinuous Transmission(DTX) allows the radio transmitter to be switched off most of the time during speech pauses.
• A Silence Indicator Block is transmitted at 500bps, which generates a comfort noise
• Down Link interference is decreased.• Up link battery is saved
171
Frequency Hopping• Frequency Hopping permits the dynamic
switching of radio links from one carrier frequency to another.
• Base Band Hopping– At the BTS each the timeslot is shifted to
another transceiver, which is transmitting at the hop frequency. User will be connected to different Transceivers depending on hop sequence.
• Synthesis Hopping– At the BTS transceiver changes the
frequencies used. The user will be connected to only one transceiver.
• Decreases the probability of interference• Suppresses the effect of Rayleigh fading
172
Wireless Data
98 99 2000 2001
GSMDATA
GSMDATA
HSCSDHSCSD
GPRSGPRS
EDGEEDGE
UMTSUMTS
SIMToolkit
SIMToolkit
WAPWAP
Data Application
Time
Circuit Switched technology
Packet Switched technology
Technology for Applications
SMS Data: 160 -numeric charactersUser Data Rate : 9.6kbpsOne time slot over the air interface
High Speed Circuit Switched DataUser Data Rate:14.5kbpsUse multiple timeslots (max=8), hence max rate = 115.2kbps.Needs a duplexor in MS for simultaneous Tx and Rx
Add-on to GSM network : PCU; Packet Segmentation/re-assembly and scheduling• Radio channel access control and management• Transmission error detection and retransmission.• Power controlSGSN: GPRS mobility• Encryption• Charging GGSN : Interface to the PDN, Internet
Max user data rate : 21.4 kbpsDynamic rate adaptation to suit the radio conditions at that time ( 9.05 kbps, 13.4 kbps, 15.6 kbps 21.4 kbps)
W@P Gateway W@P ServiceW@P
Fone
InternetMobile Network
Surf the Internet while on the move
W@P Gateway :• Adaptation of the information to the mobile• Compression of the data• Buffering of the information
Enhanced Data rate for GSM Evolution• EDGE is an enhancement of GPRS and CSD technologies.• Based on the current GSM technology - same TDMA frame
structure, same bandwidth (200 kHz).• Uses 8-PSK modulation instead of GMSK.• Requires good propagation conditions. • Allows upto 48 kbps (EGPRS) and upto 28.8 kbps (ECSD) on
every radio channel• EDGE helps GSM-Only operators to compete with UMTS.
Universal Mobile Telecommunication Standards • Innovative Service Architecture : VHE Concept - providing the us the same look and feel of its personalized services independent of network and terminal.• Global Convergence : Fixed/Mobile, Telecom/Datacom,
public/private• Mobile Multimedia driven market.• Wideband bearers - 2GHz band ( 5 MHz per carrier), -max. 2Mbps
173
References• Wireless and Personal Communication Systems. Vijay.K.Garg and
Wilkes • Overview of the GSM System and Protocol Architecture, IEEE Comm.
Magazine, Moe Rahnema.
• The GSM System for Mobile Communications- Michel Mouly & Marie-Bernadette Pautet
• Overview of the GSM Comm- John Scourias.
174
Coverage or Traffic LimitationsTRAFFIC-LIMITED
AREA(10000
subscribers per km2)
COVERAGE-LIMITED
AREA(-75 dBm
at cell edge)
COVERAGE- LIMITED
AREA(-70 dBm
at cell edge)
175
Average number of busy channels during the period of observation
(usually, the peak hour).
Erlang is the unit of statistical resource use
Erlang BAt any time, more than 1 user may request the same resource simultaneously. The use of such a resource is associated with a blocking rate.
Erlang CWhen more than 1 user request at the same time, instead of rejecting the extra calls, there is a queuing system.
Erlang Concept
176
Different Types of Cells
• High sensitivity to interference
• Requires "secured" Frequency reuse pattern
• High isolation from interferences
• A few Frequencies intensively reused
MACRO-CELL:antenna radiating ‘above’ roofs---> Wide Coverage ( 35 km)
MICRO-CELL:Antenna ‘below’ the roofs---> small coverage
PICO-CELL:Antenna inside building---> Very small coverage
EXTENDED-CELL:macro cell with system coverageextension ( 120 km) for coasts...
CONCENTRIC-CELL:macro cell with system coveragelimitation inside another macro
177
Cell Patterns
Cell Sectorization
TRI OMNI BI
Omnidirectional Site Antennas
Bi and Trisectorial Site Antennas
Calculation of the maximum coverage range of each cell in a specific environment.
Definition of planning tools parameters.
Based on the path loss calculation between the MS and the BS in both ways.
This calculation considers:
• RF parameters of MS and BS,• system parameters (diversity gains...),• propagation parameters (shadowing),• physical installation parameters (antenna height),• environment classification.
Link Budgeting
- What is the maximum EIRP?- What are the losses in
transmission and reception?- Is diversity used? - What is the minimum
equivalent sensitivity?- What is the maximum
equivalent output power?- What are the body losses?
- Beyond which distance the communication will cut off?
- Is indoor coverage guaranteed?
- Is frequency hopping used?
EIRP:Equivalent Isotropic Radiated Power
Duplexer
Combiner
Power Amplifier
DLNA:Diversity Low Noise Amplifier
Specific Tx Cable Losses
Tx PA OutputPower
Combiner losses
Rx Sensitivity
Rx Diversity Gain
DLNA conf.Standard conf.
Base Station
Tx PA Output Power
Other factors for MSBody LossesCommon cable losses
Propagation Parameters:- Incar, Indoor penetration factors- Frequency 900, 1800, 1900 MHz- Antenna Height- Environment
Design Parameters:Overlapping margin
Rx Sensitivity
Antenna Gain
MS
Rx Sensitivity
Common cable Losses
Antenna Gain
Radio Link
Link Budget Parameters• Overview
Link Budget Parameters• BTS TX Power Amplifier
2.5W PA 25W PA 35W PA 20W PA 30W PA
GSM 900 S2000LS2000ES4000 IndoorS4000 Outdoor
S4000 Indoor S2000HS8000 Indoor S8000 Outdoor
DCS 1800 S2000L S4000 Indoor S2000E S2000H S4000 Outdoor
S4000 IndoorS8000 Indoor S8000 Outdoor
PCS 1900 S2000L
S2000E S2000H S4000 Indoor S4000 Outdoor
S8000 Outdoor
D
H2D
Hy/2
2-Way Hybrid Combiner with Duplexer 2-Way Hybrid Combiner with Duplexer
4.5 dB Loss4.5 dB Loss
allows Synthesized Frequency Hopping
4-Way Cavity Combiner with Duplexer
4-Way Cavity Combiner with Duplexer
allows Baseband Frequency Hopping
4.9 dB Loss4.9 dB Loss
C C C C
D
Link Budget Parameters• Combiners
TX TX TX TXTXTX
At the BS, for a 7/8” foam dielectric coaxial cable:
• 4 dB/100 m (900 MHz),
• 6 dB/100 m (1800 MHz),
• Common cable losses for 40 meters: 2.5 dB (900 MHz) and 3.5 dB (1800 MHz).
Jumpers (up and down the feeder)
• 0.5 dB (800 MHz),
• 1 dB (1800 MHz).
Link Budget Parameters• Cable Losses
Omnidirectional antenna
Default 6.5° V with 11 dBi gain
Directional antenna for trisectorial site
Default 65° H / 6.5° V with 18 dBi gain
Link Budget Parameters• BTS Antenna Gain
900 MHz 1800/1900 MHz
TX PA OutputPower
33 dBm (2W) 30 dBm (1W)
RX Sensitivity -102 dBm
-2 dBi for Handheld2 dBi for Car Kit
Body Loss
Antenna Gain
Common CableLoss
-100 dBm
0 dB for Handheld2 dB for Car Kit
3 dB for Handheld0 dB for Car Kit
Link Budget Parameters• Mobile Station Parameters
189
Link Budget PresentationParameters
Frequency 1800 MHz
Base Height 40.0 m
Mobile Height 1.5 m
Environment Urban
RX TX
Mobile
Antenna Gain-2 dB
Cable Loss 0 dB
Output Power
Sensitivity
-100 dBm
30 dBm
Antenna Gain (65 °)
Jumper Loss
Feeder Loss
Sensitivity
-110 dBm
18 dBi
3 dB
Options
Rx Diversity Gain: 5 dB
Overlapping Margin: 0 dB
Penetration Factor
Body Loss 3 dB
15 dB
Outdoor Minimum Field95%: -80 dBm
Coverage Range95%: 810 m
0.5 dB
Base Station
Max TX Output Power
RXm RXd
44.8 dBm
Coupling system
Tx loss4.5 dB
190
Link Budget Calculation
BTS MS
TX OUTPUT POWER
30.00 W (44.8 dBm)
1.00 W (30.0 dBm)
COMBINER LOSSES 5.0 dB None
RX SENSITIVITY -110.0 dBm -102.0 dBm
RX SENSITIVITY + DIVERSITY -115.0 dBm None
COMMON CABLE LOSSES 3.0 dB 0.0 dB
ANTENNA GAIN 18.0 dBm -2.0 dBm
BODY LOSSES 3.0 dB
OVERLAPPING MARGIN 0.0 dB
INDOOR PENETRATIO
N FACTOR18.0
dB
Exercise 1: S8000 INDOOR: OPERATING FREQUENCY 1800 MHz
FadingExample of Field Strength Variation for GSM 1800
-100
-90
-80
-70
-60
-50
-40
-30
-20
-10
0 500 1000 1500 2000 2500 3000 3500 4000 4500 5000
Distance (m)
Fie
ld S
tre
ng
th
(dB
m)
MeasurementFree Space
Zoom onShort Term Fading
Long Term Fading
± 2 m
/2
Clutters
193
194
Mobile Station (MS)
• Hand portable unit
• Contains Mobile Equipment(ME) and Subscriber Identity Module (SIM)