WMAN IEEE 802.

16

An introduction to 802.16
The IEEE 802.16 Working Group on Broadband Wireless Access Standards develops standards for broadband Wireless Metropolitan Area Networks. IEEE 802.16 is a part of the IEEE 802 LAN/MAN Standards Committee, the international forum for wireless networks standardization.

An introduction to 802.16
The IEEE 802.16 Task Group d developed, with the reference IEEE PAR 802.16-REVd, a revision of IEEE 802.16 ("Air Interface for Fixed Broadband Wireless Access Systems") as modified by IEEE 802.16a e 802.16c. The complete standard has been approved on 24th June 2004 and then published as IEEE Standard 802.16-2004, replacing 802.162001, 802.16c-2002, and 802.16a-2003.

An introduction to 802.16
The base components of a WiMAX system ( WiMAX is the commercial name adopted by the WiMAX Forum, a consortium of device manufacturers and network providers that supports the development of the IEEE 802.16 standards family) are:
 

subscriber station (SS) base station (BS)

An introduction to 802.16


A BS and one or more SS compose a cell with a point-multipoint structure (P2MP). The BS controls the access to the transmissive medium, allocating resources to the SS, respecting QoS restraints and regulating network access with dedicated security mechanisms.

An introduction to 802.16


An 802.16 system often uses a fixed antenna at the SS site ; that antenna is typically installed on a roof. The standard optionally supports adaptive antenna systems (AAS) and subchannel techniques to improve the link quality, e.g. for indoor installations. The 802.16e subcommittee, apart from studying mobility extensions, has the purpose of handling power control for battery operated terminals. A BS uses a sectorized and/or directional antenna or an omnidirectional one. The fixed SS typically use directive antennas, while mobile or portable ones have omni antennas.

An introduction to 802.16
 

A group of BS can be configured to build a wireless cellular network. Using OFDM we can have a cell radius up to 45 km, but of course that requires a favourable radio environment, free from interferences, and we can obtain only the lowest speeds ; typical cell dimensions have a cell radius of less then 7 km. The 802.16 standard can manage P2P or mesh geometries, using couples of directive antennas. That can be used to extend network reach beyond that obtainable with P2MP.

An introduction to 802.16


WiMAX supports TDD and FDD modes, as well as various channel bandwidths. The OFDM PHY ( also called WirelessMAN-OFDM) is used for frequencies between 2 and 11 GHz. 802.16 MAC has many interesting characteristics that allow for an efficient control of BS and SS access ; the timing is based on frames divided into slots ; the size of frames and slots is changing every frame , under control of the allocation logic of the BS, that insures that the QoS of active links is always respected.

An introduction to 802.16


1. 2. 3. 4.

The MAC level delivers a connection oriented service to higher stack levels; every connection has its QoS that is guaranteed and controlled over time by the MAC itself. Each SS can anyway ask the BS to dynamically change the QoS without dropping the connection. MAC level QoS service can have 4 variations: Constant data rate real time polling non real time polling best effort

An introduction to 802.16
 

A media access control packet data unit (MPDU) is transmitted in PHY level slots. An MPDU encapsulates media access control service data units (MSDU); those are the packets exchanged between MAC level and higher level ones. MPDUs are exchanged between MAC level and lower levels (PHY); an MSDU can be fragmented in more MPDUs, or many MSDU can be aggregated in a single MPDU, as well as some MSDU fragments can be packed in an MPDU. ARQ can be used to ask for retransmission of unfragmented MSDUs or for MSDU fragments.

An introduction to 802.16


The MAC has a privacy sublevel that runs authentication, key exchange and MPDU ciphering. 802.16 protocol levels are shown in the picture.

An introduction to 802.16


Using various coding options and a very flexible PHY level modulation, added to slot and frame allocations dynamically adjustable, with powerful QoS mechanisms, it is possible with 802.16 to deliver voice and broadband data services in cells with a huge choice of size, propagation environment and users type. Various convergence sublevels, layered over the MAC level, implement in a transparent way Ethernet,ATM,TDM and IP services.

An introduction to 802.16

WiMAX defines a set of interoperable system profiles for the most common radio frequencies, both licensed and unlicensed ; this permits 802.16 compatible device to be used in various radio world configurations. System profiles are built out of one of the MAC base profiles (P2MP or mesh) combined with one out of the 6 PHY profiles shown in the table above. Essentially we have 3 channel widths (1,75 3,5 and 7 MHz) in the 3,5 GHz ETSI band, 2 channel widths (3 and 5,5 MHz) for MMDS and a channel width of 10 MHz for unlicensed bands.

An introduction to 802.16

In the picture we can see the transmission chain for 802.16 WirelessMAN OFDM ; this solution has been selected over single-carrier (SC) and CDMA because it has better characteristics in NLOS applications, drastically simplifying the equalizator needed for operation in environments that show relevant multipath propagation fenomena.

An introduction to 802.16

Reed-Solomon and convolutional coding are FEC techniques that are used in the WirelessMAN OFDM PHY. In the table we show the code rate obtained by applying both codes according to the modulation type.

An introduction to 802.16

In WirelessMAN OFDM FFT size has been fixed to 256; in such a block 55 subcarriers ( 28 low and 27 high ones) are reserved for guard band and 8 are reserved for pilot. Having 192 useful subcarriers, the system nevertheless uses various oversampling ratios, 8/7 and 7/6, to maximize efficiency even if it remains within the spectral masks required by the various national norms. The guard time interval is quite wide compared to the duration of an OFDM symbol; we can have a maximum of 25% and a minimum of 3% in favourable conditions.

An introduction to 802.16

In the table we displayed RMS delay spead values for an omni antenna in the various 802.16a channel models. The cell radius has been set to 7 km. It is important to note the 4 terrain types: Terrain type A: maximum path loss, hilly area with density of trees medium to high Terrain type B: path loss intermediate Terrain type C: low loss, land mostly flat with low density of trees The worst case, 5,24 microseconds, can be tolerated with the guard time option when using 10 MHz channels; in a mobile environment with omni antennas in the SS a 10 microseconds delay spread can be compensated with guard time for a 5 MHz bandwidth.

1. 2.

3. 

An introduction to 802.16

In the table we notice various data rates obtainable using the allowed combinations of bandwidth and modulation type and code rate, using a 1/32 guard time; we also considered PHY overhead but not MAC and preamble ones. Optionally we can also use uplink subchanneling; this is quite useful for limited power transmitters ( e.g.: a notebook) in indoor or mobile environments. With a subchanneling factor of 1/16 we can have a link gain of 12 dB. We define therefore 16 sets of 12 subcarriers that can be wholly assigned or in 1,2,4,8 subsets to an SS uplink.

An introduction to 802.16


To handle variations over time of channel characteristics, 802.16 allows an optional more frequent rate of preambles; in the uplink path we can insert with programmable frequency some short preambles,that are called midambles for this special usage. The available options are: Only preamble Mid-amble every L=8 symbols Mid-amble every L=16 symbols Mid-amble every L=32 symbols In the downlink optionally we can have a short preamble at the start of every frame. The BS scheduler must in fact guarantee a maximum mandatory interval before sending the informations needed for a channel estimation. A maxumum SS speed of 150 km/h can be managed with L better that 10, if we use appropriate interpolation schemas for channel characteristics estimation.

1. 2. 3. 4. 

An introduction to 802.16


In 802.16 the PHY is in charge of radio channel framing, of shared media access and of slot allocation. The MAC assigns MSDU into MPDU; this is slightly higher than what happens commonly. The radio transmission time is divided into frames; in an FDD system we have uplink frames( from SS to BS ) e downlink frames( from BS to SS ) that are temporally aligned over separate channels. In a TDD system every frame is split in a downlink and an uplink subframe. In both TDD ed FDD modes the frame length can be varied under BS scheduler control in each frame; in TDD mode the splitting point between uplink and downlink changes too, and the time can be allocated asymmetrically between the two directions.

An introduction to 802.16


The downlink frame includes a preamble, a DL_MAP, an UL_MAP and a downlink slots set. The DL_MAP is a map of the slots in the downlink subframe. The UL_MAP is a map of the slots in the uplink subframe. With those 2 frame descriptors the BS allocates channel access both for down and uplink. The SS uses the DL_MAP to identify MPDUs within the frame and gets them sequentially, receiving only those whose connection ID is owned by the SS.

  

An introduction to 802.16


The uplink frames structure is more complex because for the best effort service and for the initial network connection we need a contention based multiple access , to allow for multiple SS that want to access at the same time. According to connections QoS, each connection can have a guaranteed slot, can have a polled slot, or must be contending for a TDMA slot. This last type happens only in slots reserved for this type of operation, divided among initial connection slots and bandwidth request slots. Those slots are then divided into minislots. The contending SS use an exponential truncated binary backoff algorithmto decide which minislot they should use.

An introduction to 802.16


The initial ranging contention slot is used as part of the network access procedure. An SS send a ranging request (RNG-REQ) in such a slot. This packet has a long preamble, because the BS must find the exact timings used by the SS. When the BS receives an RNG-REQ, it answers with a RNG-RSP ranging response that sends back to the SS the timing and power control informations. The SS can then set its own timings according to the transit time and to the path loss; in this way its transmissions can reach the BS with the same alignment and level of the other SS.

An introduction to 802.16
  

SS to decide who can use the channel. The bandwidth requests are sent in this slot.. Evey time a request has been authorized by the BS, the SS can transmit in the slots that the BS allocated on purpose. The BS decides the length of the contended slots too; the optimal length is varied according to the number of SS, number and QoS type of connections, current network activity and so on.

The bandwith request contention slot is used by the

An introduction to 802.16


In a 802.16 system MAC communicates using MAC protocol data unit (MPDU) transported by PHY. The MAC generic header (MGH) contains MPDU details, mainly formed by: Connection ID (CID) that identified the connection that owns the MPDU Frame length various bit that qualify CRC presence, subheaders, if the payload has been ciphered using which key and so on Optionally the frame can have a CCITT 32 bit CRC if needed.

1.

2. 3.

An introduction to 802.16
 

The payload can host both management and user data. Some connection can have only management purposes and therefore can carry only management messages ; all the other channels are transport channels that carry only user data. The payload in a transport connection may contain a whole MSDU, MSDU fragments, MSDU aggregates, MSDU fragment aggregates, bandwidth requests or ARQ requests according to MAC rules for bandwidth requests, fragmentation, packing and ARQ.

An introduction to 802.16

Above you can see the frame formats for 802.16a

An introduction to 802.16


To request variations to the guaranteed specifications of a connection we send a 6 byte bandwidth request header instead of the GMH It is characterized by an header type bit (HT) set at 1 and by the encryption type bit (ET) set to 0. The 6 bit Type field can be 0 to indicate an incremental request or 1 to indicate and aggregate request. The CID contains the connection identifier of the connection that has to be modified; it must not be the same one of the GMH, but it can be any one that belongs to the SS. The BR field is the number of requested uplink bytes. The HCS is an 8 bit CRC for the previous 5 bytes.

 

An introduction to 802.16


The generic MPDU have both transport and management informations, according to the connection CID of their header. In fact every generic MPDU starts with a GMH, whose structure is shown in the picture. A GHM is identified by HT bit set to zero. The EC bit specifies if the frame is cpihered, while the CI bit specifies if at the end of the MPDU there is an optional CRC. The encryption key sequence (EKS) bits identify the key that has been used to encrypt the frame; the privacy sublevel allows the contemporary use of more than one key, so the stream can go on undisturbed during the key changeover procedure; EKS distinguishes between old and new keys.

 

An introduction to 802.16


The 11 bit long LEN field specifies the number of bits of the MPDU including header and CRC, limiting the maximum frame length to 2047 byte. The CID indicates the connection of the GMH; the HCS is an 8 bit CRC of the previous bytes. The Type fields indicates in 6 bits what is embedded in the payload: bit 0=1 if there is a grant management subheader bit 1=1 if there is a packing subheader bit 2=1 if there is a fragmentation subheader bit 3=1 if the 2 previous subheader have an extended length bit 4=1 if there is an ARQ feedback bit 5=1 if there is a mesh subheader

1. 2. 3. 4.

5. 6.

An introduction to 802.16

The grant management subheader is a fast way to ask for uplink bandwidth without sending a full MPDU. Every connessione, identified by a 16 bit CID, has its own QoS class, that we will define later on. If the GMH CID indicates an unsolicited grant service (UGS) channel the subheader format is the one described in the picture above. The slip indicator (SI) is set by the SS when the uplink buffer of a certain stream is full, due to a small slip between uplink and arrival speeds ; it requires therefore a small increase in uplink capability. The poll me (PI) asks the BS to send a bandwidth poll.

An introduction to 802.16

If the CID in the GMH indicates a channel that is using other scheduling services (rtPS, nrtPS, BE) the subheader format is the one in the above picture. The piggyback request is a 16 bit number that represents the number of uplink bytes needed ; it explicitely asks for bandwidth to the BS. The previous format is used only in UGS because in this case the bandwidth grants are regular and implicit ; the data flow in both direction is quasi synchronous and the 2 flow bits are enough to maintain the synchronization.

An introduction to 802.16
  

An MSDU can be divided into fragments that are indipendently transmitted, using a fragment subheader (FSH) like in the picture above. The FSH describes an MSDU fragment. The fragment control bits (FC) indicates (10) if it is the first fragment, the last one (01) or another in the middle (11) ; the 00 combination indicates a non fragmented MSDU. The fragment sequence number (FSN) increments by 1 for each fragment so we can know the correct order for receiver reassembly.

An introduction to 802.16

    

Many MSDU or many MSDU fragments can be aggregated in a single MPDU; this is the MAC-level packet aggregation. A bit in the GMH indicates the presence of the packing subheader, that is shown in the picture above. An MPDU can have more than a packing subheader, that may delimit an MSDU or an MSDU fragment. An MSDU can therefore be split into fragments or packed into packed frames ; this allows the BS to better use the available slots. We can notice that the packing and fragmentation subheaders are very similar, this explains the FC value of 00.

An introduction to 802.16
The ARQ is the tool the allow both link sides to ask for MSDU ritransmission, usually due to a bad reception. We define a system block size and we consider the MSDU as built out from a set of such blocks, apart from the last one that can have a smaller size. When an 802.16 system has ARQ support, the FSH is replaced by an extended FSH an the PSH by an extended PSH, as shown in the picture above. We replace the FSN with a block sequence number BSN, to allow ARQ operation. When we send an ARQ request, the blocks that have to be resent are identified with their BSN. In an extended FSH the BSN indicates the first block of the fragment; the fragments must have an integral number of blocks to correctly align them.

 

An introduction to 802.16


Similarly to FSH, the PSH is extended so as to use a block number BSN with 11 bits instead of the 3 bits long FSN. To ask a block retransmission (NACK) or when we have a correct reception (ACK) we include in the payload an ARQ feedback. The ACK maps are a bitmap of succesfully received blocks.

An introduction to 802.16
 

The 802.16 MAC is connection oriented. Each connection has QoS parameters, is handled by one out of 4 scheduler services, can have its own security association, can be a management or transport connection. It is identified by an unique CID; the connections are unidirectionali, therefore in a bidirectional connection we have 2 different CIDs. Some CID are reserved for special purposes, like initial ranging and multicast polling and broadcast. Every SS, when it joins an active networks, allocates a base connection, a primary connetion and a secondary management connection. The BS reserves an m number of CID for the base,primary and secondary connections that it has been setup to handle. When all the management connections have been setup, an SS can then create the transport connections. The service streams associated to the transport connections can join multicast groups and listen the multicast polling channels that have been associated to those groups.

 

An introduction to 802.16

In the picture there is a list of 802.16 connection IDs.

An introduction to 802.16
 

A device that wants to join a network must run a series of tasks. First it has to look for a downlink signal from a BS and synchronize to it. Once is is capable of receiving the downlink, it can use the descriptor of the channel uplink (UCD) to identify the transmission parameters and the timing of the initial ranging uplink contended slot. The SS can then perform the initial ranging, that warns the BS of the presence of the SS and provides the SS with the basic and primary management connections. Using management messages on the primary connection the basic features of the system are negotiated. Registration takes place which leads to the activation of the secondary management link. Before being allowed to continue the SS must obtain permission to access the system and a security association for their secondary management connection, to do this it is used the privacy and key management (PKM) protocol. On completion of this phase, as an example an IP connection can be enabled via the secondary management channel, for example by using TFTP to finish the configuration of the various parts.

An introduction to 802.16
 

When a connection has been setup, it must be refreshed with a periodic ranging. The ranging operation is used in the control loops that synchronize the timings and power levels of BS and SS. When the channel conditions vary, or the distance between SS and BS changes ( even if this is more a task for 802.16e) we must quickly adjust the operating parameters. We use the same messages of initial ranging, but we use in the RNG-REQ the base connection CID instead of 0.

An introduction to 802.16


The 802.16 security techniques are derived from the Docsis ones. The MPDU encryption in transport connections and in the secondary management one is done with cipher block chaining (CBC) DES. The PKM protocol, based on certificates, authorizes SS and transfers the keys between BS and SS. Since the encryption is done on the payload of the MPDU, it hides all the details of fragmentation, packaging, authorization requests and ARQ.

An introduction to 802.16
      

The PKM protocol uses RSA asymmetrical key protocols and methods to authenticate an SS to a BS. The SS delivers its X.509 certificate to the BS, showing its identity and public key. The BS sends back to the SS an authorization key encrypted with SS public keys, that decrypts it with its own private key. The autorization key is then derived to have the key enciphering keys (KEK). The authorization key is known both to BS and SS, and the two parties compute the same KEK. A temporal ciphering key (TEK) is sent from the BS to the SS, after ciphering it with EDE DES using a KEK. The TEK is then used in DES-CBC mode to encrypt MPDU data.

An introduction to 802.16


The convergence sublevels (CS) map 802.16 MAC services that are connection oriented into a standard network interface. The 2 specified levels are the l'ATM CS and the Packet CS. The ATM sublayer transports ATM connections. The Packet sublayer is composed by 3 base modes: IP Specific, transports IP native frames and supports IPv4, IPv6 ed IP mobile IEEE Std 802.3, transports Ethernet 802.3 frames IEEE Std 802.1Q-1998, transports VLAN according to 802.1Q

   1. 2. 3.

An introduction to 802.16


The task group 802.16e has been working to add mobile support to 802.16 ; the amendment has been approved as IEEE Std 802.16e-2005 An 802.16e MSS is able to use broadband services, doing handovers, using an omni antenna with power saving techniques. The 802.16e specification add further security specifications, like AES-CCM encryption and EAP authentication.