GSM Global System for Mobiles 1

TOPICS GSM CONCEPTS GSM SYSTEM ARCHITECTURE IDENTITIES USED IN GSM GSM CHANNELS GSM IO LINK MOBILITY MANAGEMENT CALL MANAGEMENT RADIO RESOURCE MANAGEMENT 2

TOPICS GSM CONCEPTS GSM SYSTEM ARCHITECTURE IDENTITIES USED IN GSM GSM CHANNELS GSM IO LINK MOBILITY MANAGEMENT CALL MANAGEMENT RADIO RESOURCE MANAGEMENT 3

Telecom Basics Communication Voice and Data Analog and Digital Circuit Switched and Packet Swit ched Media - Copper Wire, Co-axial cable, Air, Optical Fibre Networks -PSTN, ISD N, PDN and Mobile Networks 4

Background to GSM 1G : Advanced Mobile Phone Service (AMPS) Analog, Circuit Switched, FDMA, FDD 2G : Digital Advanced Mobile Phone Service (D-AMPS) Digital, Circuit Switched, FDMA, FDD 2G : Global System for Mobile (GSM) Digital, Circuit Switched, FDMA and TDMA, FDD 2G : Code Division Multiple Access (CDMA) Digital, Circuit Switched, FDMA, SS, FDD 5

GSM History 6

Development of the GSM Standard 1982: Groupe Spcial Mobile (GSM) created Description of GSM features 1993: 1985: List of recommendations settled 1995: The GSM-MoU has 62 signatories in 39 count ries worldwide. Specifications of GSM phase 2 are frozen. GSM MoU joins 3GPP (UM TS) GPRS Trials begins 1992: Official commercial launch of GSM service in Europe . First Launch in Finland 1984: 1987: Initial MoU (Memorandum of Understanding) aside the drafting of technical specif ications was signed by network operators of 13 countries: Validation and trials, of the radio interface. First system trials are demonstrated at the Telecom 91 exhibition. 1999: 1988: 2000: 480M GSM subscribers Worldwide First GPRS Networks roll out 1991: End 2002: 792M GSM subscribers Worldwide 7

GSM Specifications 12 SERIES OPERATION AND MAINTENANCE 11 SERIES EQUIPMENT AND TYPE APPROVAL SPECIF ICATIONS 01 SERIES GENERAL 02 SERIES SERVICE ASPECTS 03 SERIES NETWORK ASPECTS 10 SERIES SERVICE INTERWORKING 04 SERIES MS-BSS INTERFACE AND PROTOCOLS 09 SERIES NETWORK INTERWORKING 05 SERIES PHYSICAL LAYER ON THE RADIO PATH. 06 SERIES SPEECH CODING SPECIFICATIO NS 08 SERIES BSS TO MSC INTERFACES 07 SERIES TERMINAL ADAPTERS FOR MOBILE STATIONS

Increasing GSM Data Rates UMTS E/GPRS photo report video clip video report clip video report clip video report clip vi deo report clip web photo ISDN PSTN e-mail web photo e-mail web photo GSM 0 e-mail web photo 10 sec 1 min 10 min 1 hour Transmission Time GPRS = General Packet Radio Service HSCSD = High Speed Circuit Switched Data EDG E = Enhanced Data rate for GSM Evolution UMTS = Universal Mobile Telecommunicati on System

Wireless Data Technology Options 2M 1M throughput kbps p 100 k ket ac EDGE 64 k it rcu ci HSCSD UMTS 10 k 14.4 9.6 GPRS 1k Time frame 1998 1999 2000 2001 2002 GPRS = General Packet Radio Service HSCSD = High Speed Circuit Switched Data EDG E = Enhanced Data rate for GSM Evolution UMTS = Universal Mobile Telecommunicati on System 10

Circuit-Switched or Packet-Switched Circuit mode Packet mode B C C A A F A F F D A C H F G C D A C D A G H G H F G H F C G G D D D H E H 11

Multiple Access Technique Multiple Access Achieved by dividing the available radio frequency spectrum, so that multiple users can be given access at the same time. FDMA - Frequency Divis ion Multiple Access ( eg: GSM each Frequency channel is 200KHz) TDMA - Time Divi sion Multiple Access ( eg: GSM each frequency channel is divided into 8 timeslot s) CDMA - Code Division Multiple Access (eg: IS95- Each User data is coded with a unique code) 12

Duplex Technique Duplex - How the up link and Down link of a user is separated FDD - Frequency Di vision Duplex (eg:In GSM the up link and down link of a user is separated by 45MHz ) TDD - Time Division Duplex (the up link and down link of a user will be at the same frequency but at differ ent Time ) 13

GSM Concepts Cellular Structure 2 2 7 1 6 5 3 4 6 5 7 1 Cellular Networking technology that breaks geographic ar ea into cells shaped like honey comb Cell is the radio coverage area of one base transceiver station 14

What are the types in GSM Network? GSM-900 (Channels 125 operating band 900Mhz carrier spacing 200khz spacing 45Mhz ) GSM -1800 (Channels 374 spacing 95Mhz) GSM -1900(Used in USA) 15

GSM Band Allocations (MHz) GSM systems Uplink Downlink Band Duplex Spacing Duplex channels GSM 450 GSM 480 GSM 850 GSM 900 E-GSM (900) R-GSM (900) GSM 1800 GSM 1900 450.4-457.6 478.8-486 824-849 890-915 880-915 876-880 1710-1785 1850-1910 460.4-467.6 2x7.2 488.8-496 2x7.2 869-894 935-960 925-960 921-925 1805-1880 1930-1990 2x25 2x35 2x04 2x75 2x60 2x25 10 10 45 45 45 41 95 80 35 35 124 124 174 40 374 299 Frequencies are in MHz Carrier frequency = ARFCN = Absolute Radio Frequency Chan nel Number

GSM Family Radio Band Spectrum Uplink 450.4 457.6 478.8 486 824 849 GSM 450 GSM 480 GSM 850 Downlink Uplink 876 880 460.4 467.6 488.8 496 869 894 MHz 915 915 890 915 P-GSM E-GSM GSM 1800 GSM 1900 1710 1785 1850 1910 R-GSM 921 925 935 960 960 960 1805 1880 1930 1990 Downlink MHz

Traffic/Signaling Traffic bla bla bla... Signaling RING ! riiiiing Network

MS GSM - Network Structure Um BTS BSC Abis A MSC B C GMSC E Abis A MSC E PSTN X.25 VLR X.25 OMC Server 19 F EIR H VLR HLR MS BTS AuC BSC Um BTS

GSM System specifications Frequency band Uplink Downlink Duplex Frequency Spacing Carrier separation Frequ ency Channels Time Slots /Frame(Full Rate) Voice Coder Bit Rate Modulation Air t ransmission rate Access method Speech Coder 890 - 915 MHz 935 - 960MHz 45MHz 200 KHz 124 8 13Kbps GMSK 270.833333 Kbps FDMA/TDMA RPE-LTP-LPC 20

Paired Radio Channels in GSM Case of GSM 900 Uplink 890 MHz Frequency 915 MHz 935 MHz Downlink Frequency BTS 960 MHz 0 channel # 124 Example: Channel 48 0 channel # 124 Duplex spacing = 45 MHz Frequency band spectrum = 2 x 25 MHz Channel spacing = 2 00 kHz 21

GSM Time Division Multiplex Frame and Physical Channels Time-slot TDMA frame TDMA frame TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 (frames repeat continuously) Time 0 4.615 ms 9.23 ms Physical channel # 2 = recurrence of time-slot # 2

Physical Channel BTS With FH time BTS Without FH n+1 TDMAs n TS 0 n-1 MS2 7 MS1 MS3 1 FDMA 2 // 124 ARFCN

Radio Link Aspects From Speech to RF Signal Blah... Blah... Blah... Digitizing and Source Coding Channel Coding Blah Blah Blah... Source Decoding Channel Decoding Interleaving De-interleaving Ciphering Deciphering Burst Formatting Modulating Burst De-formatting Demodulating

 Speech and user's data Idle mode Signaling Functions of the Radio Interface Communication mode BTS BTS-1 BTS-2

Access Techniques Uplink 890 MHz to 915 MHz Down Link 935 MHz to 960 MHz 25 MHz divided into 125 c hannels of 200 KHz bandwidth UP 890.0 890.2 890.4 914.8 915.0 DOWN 935.0 935.2 935.4 959.8 960.0 26

Access Techniques ... Time Division Multiple Access Each carrier frequency subdivided in time domain i nto 8 time slots Each mobile transmits data in a frequency, in its particular ti me slot - Burst period = 0.577 milli secs. 8 time slots called a TDMA frame. Per iod is .577 * 8 = 4.616 milli secs 0.577 ms 0 1 2 3 4 5 6 7 27 4.616 ms

28

Fundamentals 960 MHz 959.8MHz 124 123 . 2 1 TS: Time slot DOWNLINK 200KHz 935.2 Mhz 935 MHz 0 1 GSM utilizes two bands(TDMAMHz. 890-915 Downlink of 25 frame) = 8 TS MHz band is used for uplink while the 935960 MHz is used for downlink. The frequency bands are divided into 200 KHz wide channels called ARFCNs (Absolute Radio Frequency C hannel Numbers) i.e. Data burst = 156.25 bit periods = 576.9s there are 125 ARFCN s out of which only 124 are used. Each ARFCN supports 8 users with each user tra nsmitting / receiving on a particular time Delay 0 1 2 3 4 5 6 7 slot (TS). 2 3 4 5 6 7 915 MHz 914.8 MHz 124 123 . 2 1 45 MHz UPLINK 200KHz Uplink (TDMA frame) 890.2 MHz 890 MHz The technology Therefore 1 TDMA frame = 156.25 x 8 = 1250 bits and has a duration of 576.92s x 8 = 4.615 ms 29

GSM Delays Uplink TDMA Frames BTS side The start of the uplink TDMA is delayed of three time-slots TDMA Frame (4.615 ms) 0 R 1 R 2 R 3 R 4 R 5 R 6 R 7 R Downlink TDMA BTS T T T Down link T T T T Up link T MSs side MS1 R T MS2 R T Fixed transmit delay of three time-slots

Timing Advance 1 - Propagation Delay M2 d2 d1>>d2 M1 BTS Frame reference TS0 TS1 TS2 TS3 TS4 TS5 TS6 TS7 Propagation Delay p MSs transmit Bits Overlapping

Timing Advance 2 - Without Timing Advance: Collision TX BTS RX BTS CAN W HAT GSM HOW TA CAN yes W HEN the WHAT ms-isdn RX MS1 TX MS1 RX MS2 TX MS2 RX MS3 TX MS3 RX MS4 TX MS4 RX MS5 TX MS5 RX MS6 TX MS6 RX MS7 TX MS7 RX MS8 TX MS8 +3TS W HAT GSM yes D HOW the D ms-isdn Propagation Delay W HEN WHAT 32

Timing Advance 3 - With Timing Advance: No Collision TX BTS RX BTS CAN WHAT GSM HOW yes WHEN the WHAT ms-isdn RX MS1 TX MS1 RX MS2 TX MS2 RX MS3 TX MS3 RX MS4 TX MS4 RX MS5 TX MS5 RX MS6 TX MS6 RX MS7 TX MS7 RX MS 8 TX MS8 CAN +3TS - TA WHAT GSM yes D HOW the ms-isdn D Propagation Delay WHEN WHAT Timing Advance = 2 * Propagation Delay 33

GSM in comparison with other Standards GSM gives mobility without any loss in Audio quality Encryption techniques used gives high security in the air Interface and also use of SIM. Bit Interleaving f or high efficiency in Transmission. Variable Power (Power budgeting- extend batt ery life) Minimum Interference. Features-CCS7 Signaling SMS (Short Message Servi ces) Emergency Calls CELL Broadcast 34

TOPICS GSM CONCEPTS GSM SYSTEM ARCHITECTURE IDENTITIES USED IN GSM GSM CHANNELS GSM IO LINK MOBILITY MANAGEMENT CALL MANAGEMENT RADIO RESOURCE MANAGEMENT 35

MS GSM - Network Structure Um BTS BSC Abis A MSC B C GMSC E Abis A MSC E PSTN X.25 VLR X.25 OMC Server 36 F EIR H VLR HLR MS BTS AuC BSC Um BTS

GSM Network SS External PSTN & PDN N/W VLR AUC HLR MSC MS Mobile Station BTS Base transceive r System BSC Base Station Controller MSC Mobile Switching Center BSS BSC HLR Hom e Location Register VLR Visitor Location Register BTS EIR Equipment Identity Reg ister AUC Authentication Center MS OMC Operation And Maintenance Center EIR OMC Switching System Base Station System 37

GSM Architecture GSM Air interface B S C Abis interface VMSC SMSC A interface HLR MSC VLR EIR AUC PSTN TRAU B S C BTS BTS BTS OMCS BTS BTS BTS Network and switching subsystem OMCR A interface SS7 / speech X.25 SS7 Mobile Station Base Station System 38

Mobile Equipment(ME) Frequency and Time Synchronization Voice encoding and transmission Voice encrypt ion/decryption functions Power measurements of adjacent cells Display of short m essages International Mobile Equipment Identifier (IMEI) 39

SIM Portable Smart Card with memory (ROM-6KB to 16KB-A3/A8 algorithm, RAM- 128KB TO 256KB, EEPROM- 3KB to 8KB ) Static Information International Mobile Subscriber I dentity(IMSI) Personal Identification Number (PIN) Authentication Key (Ki) Dynam ic Information Temporary Mobile Subscriber Identity(TMSI) Location Area Identity (LAI) Phone memories, billing information Ability to store Short Messages recei ved 40

SIM-Card and GSM Mobile Equipment = Global GSM Mobility Card The Smart Card to use + GSM Contains: - IMSI SIM-Card

The SIM-Card Functions SIM-Card Credit Card Size Global GSM Mobility Card 15 mm 25 mm The Smart Card to use Permanent data: - Unique mobile subscriber identity through IMSI number and PIMSI for Packet Mod e - Authentication parameter Ki, - Authentication algorithm A3, - Generating enc ryption key Kc algorithm A8, - PIN code. GSM Microchip with stored user information Removable data: - Temporary Mobile Subscriber Number, - Location Area Identification - Routing A rea Identification (Packet mode)

Subscriber Identification IMSI Nature International Mobile Subscriber Identity Conformity with E212 Identify a PLMN worldwide Identify the subscriber of a PLMN MS - ISDN Mobile Station Integrated Services Digital Network Nb Similar to ISDN, Conformit y with E164/E213 National Significant Mobile Number Format Meaning MCC Mobile Country Code MNC Mobile Network Code H1 H2 x x x ......... x x x MSIN CC NDC M1 M2 xx xx xx xx SN Mobile Subscriber Ident. Nb H1 H2 = Identity of HLR within the home PLMN Country National Mobile Subscriber Code (where Destination (national definition) subscription Code * M1 M2 = nbr of logical HLR has been made) Nb. digits 3 2 max 10 1 to 3 2 to 4 total max 15 *This code does not identify a geographical area but an operator

Description Stored in SIM Card MCC = 208 (France) 234 (G-B) 262 (Germany) 404,405(India) Mobile Country Code 3 digits MNC = 71(APBSNL) 72(TNBSNL) 20 (Bytel) Mobile Network Code 2 digits Globa l GSM Mobility Card The Smart Card to use IMSI = 15 digits max GSM Mobile Subscriber Identification Number (MSIN) H1 H2 X X X X X X 10 digits max NMSI LAI Mobile Country Code 3 digits Mobile Network Code 2 digits Temporary Mobile Subscriber Identity 4 octets Location Area Code LAC Routing Area Code RAC RAI

Description Stored in the Network MS-ISDN (15 digits max) Country Code 3 digits max National Destination Code 2 or 3 digits Subscriber Number (SN) M1 M2 X X X X X X X X X X X X X 10 digits max MSRN Roamin g Number (RN) Must be dialed to make a call to mobile subscriber Country Code National Destination Code Is a PSTN-like number used to reach a roaming MS Country Code National Destination Code NDC = 9448(BSNL-karnataka) 9845,9880(Airtel) 9886(Hutch) = 660, 661, 618 (Bytel) HO-number Is a PSTN-like number to track the MS that hands over to another MSC during call -in-state CC = 33 (France) 091(India) 001(US) 45

Descriptor Embodied in the Mobile Equipment IMEI enables the operator to check the Mobile Equipment Identity at call setup a nd make sure that no stolen or unauthorized MS is used in the GSM network E D YP VE T O R PP A TAC Type Approval Code FAC SNR Serial NumbeR SP (SPare) Final Assembly Code

International Mobile Equipment Identity (IMEI) E D YP OVE T R PP A TAC Type Approval Code FAC SNR Serial number SP (SPare) Final Assembly Code IMEI: #06# 351475 60 926514 4 *

MS Classmark Power classes Classmark Revision level RF power Encryption algorithm Frequency Short message LoCation Se rvices MS Positioning Method 8-PSK modulation Multi-slot class Multi-band * ** T ypical value for car mounted Typical value for handheld For GMSK modulation GSM GSM GSM Class 400/850/900 1800 1900 1 1 W** 1 W** 8 W* 2 0.25 W 0.25 W 5W 3 4W 2W 2 W** 4 0.8 W 5 For 8-PSK modulation GSM GSM GSM Class 400/850/900 1800 1900 2W E1 1W 1W 0.5 W E2 0.4 W 0.4 W 0.2 W E3 0.16 W 0.16 W

Base Transceiver Station (BTS) Handles the radio interface to the mobile station. Consists of one or more radio terminals for transmission and reception Each Radio terminal represents an RF C hannel TRX and MS communicates over Um interface Received data transcoding Voice encryption/decryption Signal processing functions of the radio interface Uplink Radio channel power measurements 49

Base Station Controller (BSC) Provides all the control functions and physical links between the MSC and BTS Ex ternal Interfaces Abis interface towards the BTS A interface towards the MSC Monito s and controls several BTSs Management of channels on the radio interface Alarm Handling from the external interfaces Performs inter-cell Handover Switching fro m Abis link to the A link Interface to OMC for BSS Management 50

Mobile Switching Center (MSC) Performs call switching Interface of the cellular network to PSTN Routes calls b etween PLMN and PSTN Queries HLR when calls come from PSTN to mobile user InterBSC Handover Paging Billing 51

Home Location Register (HLR) Stores user data of all Subscribers related to the GMSC International Mobile Sub scriber Identity(IMSI) Users telephone number (MS ISDN) Subscription information and services VLR address Reference to Authentication center for key (Ki) Referr ed when call comes from public land network 52

Visitor Location Register (VLR) Database that contains Subscriber parameters and location information for all mo bile subscribers currently located in the geographical area controlled by that V LR Identity of Mobile Subscriber Copy of subscriber data from HLR Generates and allocates a Temporary Mobile Subscriber Identity(TMSI) Location Area Code Provid es necessary data when mobile originates call 53

Authentication Center (AuC) Stores Subscriber authentication data called Ki, a copy of which is also stored in in the SIM card Generates security related parameters to authorize a subscrib er (SRES-Signed RESponse) Generates unique data pattern called Cipher key (Kc) f or user data encryption Provides triplets - RAND, SRES & Kc, to the HLR on reque st. 54

EIR (Equipment Identity Register) EIR is a database that contains a list of all valid mobile station equipment wit hin the network, where each mobile station is identified by its International Mo bile Equipment Identity(IMEI). EIR has three databases., White list - For all known,good IMEIs Black list - For all bad or stolen handsets Grey list - For handsets/IMEIs that are on observation 55

Location Area Identity LAI identifies a location area which is a group of cells.. It is transmitted in the BCCH. When the MS moves into another LA (detected by monitoring LAI transmit ted on the BCCH) it must perform a LU. LAI = MCC + MNC + LAC MCC= Mobile Country Code(3 digits), identifies the country MNC= Mobile Network C ode(1-2 digits), identifies the GSMPLMN LAC= Location Area Code, identifies a lo cation area within a GSM PLMN network. The maximum length of LAC is 16 bits,enab ling 65536 different location areas to be defined in 56 one GSM PLMN.

Interfaces and Protocols Digital Networks ISUP TUP MAP Abis LAPD A BSSAP E Um LAPDm F MAP C D MAP B POTS G 57

GSM Entities and Signaling Architecture 58

GSM Protocols CM MM RR LAPDm LAPD BTSM BSSAP DTAP MAP MTP SCCP TCAP ISUP - Connec nt - Mobility Management - Radio resource - LAPD for mobile - Link Access Proced ure for D channel - BTS Management Part - BSS Application Part (BSC - MSC) - Dir ect Transfer Application Part (MS - MSC) - Mobile Application Part - Message Tra nsfer part of SS7 - Signalling Connection Control Part of SS7 - Transaction Capa bilities Application Part - ISDN User Part 59

Functional Plane of GSM MS BTS BSC MSC/VLR HLR GMSC CC MM RR Trans MS BTS BSC MSC/ VLR HLR GMSC 60

TOPICS GSM CONCEPTS GSM SYSTEM ARCHITECTURE IDENTIFIERS USED IN GSM GSM CHANNELS GSM DIO LINK MOBILITY MANAGEMENT CALL MANAGEMENT RADIO RESOURCE MANAGEMENT 61

TOPICS GSM CONCEPTS GSM SYSTEM ARCHITECTURE IDENTITIES USED IN GSM GSM CHANNELS GSM IO LINK MOBILITY MANAGEMENT CALL MANAGEMENT RADIO RESOURCE MANAGEMENT 62

Channels : differentiating between Physical and Logical channels Physical channels : The combination of an ARFCN and a time slot defines a physic al channel. Logical channels : These are channels specified by GSM which are map ped on physical channels. 63

Channel concept Physical channel: One timeslot of a TDMA-frame on one carrier is referred to as a physical channel. There are 8 physical channels per carrier in GSM,channel 0-7 (timeslot 0-7) Logical channel: A great variety of information must be transmitt ed between BTS and the MS,for e.g. user data and control signaling.Depending on the kind of information transmitted we refer to different logical channels.These logical channels are mapped on physical channel. 64

Logical Channels on Air interface LOGICAL CHANNELS COMMON CHANNELS DEDICATED CHANNELS BROADCAST CHANNELS COMMON CONTROL CHANNELS DEDICATED CONTROL CHANNELS TRAFFIC CHANNELS FCCH SCH BCCH SDCCH SACCH FACCH PCH RACH AGCH TCH/F TCH/H TCH/EFR 65

Logical channels Logical channels Control channels Traffic channels Half rate Full rate BCH CCCH DCCH FCCHSCH BCCH CBCH PCH AGCH RACH SDCCH SACCH FACCH 66

Broadcast channels BCH Broadcast Channel-BCH Alloted one ARFCN & is ON all the time in every cell. Present in TS0 and other 7 TS used by TCH. Frequency correction channel-FCCH To make sure this is the BCCH carrier. Allow the MS to synchronize to the freque ncy. Carries a 142 bit zero sequence and repeats once in every 10 frames on the BCH. Synchronization Channel-SCH This is used by the MS to synchronize to the TDMA frame structure within the par ticular cell. Listening to the SCH the MS receives the TDMA frame number and als o the BSIC ( in the coded part- 39 bits). 67 Repeats once in every 10 frames.

Broadcast channels BCH ... BCCH The last information the MS must receive in order to receive calls or make calls is some information concerning the cell. This is BCCH. This include the informa tion of Max power allowed in the cell. List of channels in use in the cell. BCCH carriers for the neighboring cells,Location Area Identity etc. BCCH occupies 4 frames (normal bursts) on BCH and repeats once every Multiframe. This is transmi tted Downlink point to multipoint. Cell Broadcast Channel - CBCH Used for the Transmission of generally accessible information like Short Message Services(SMS) 68

Common Control Channels CCCH CCCH Shares TS-0 with BCH on a Multiframe. Random access channel-RACH: Used by Mobile Station for requesting for a channel. When the mobile realizes it is paged it answers by requesting a signaling channel (SDCCH) on RACH. RACH is also used by the MS if it wants to originate a call. Initially MS doesn know the path delay (timing advance), hence uses a short burst (with a large guard perio d = 68.25 bits). MS sends normal burst only after getting the timing advance inf o on the SACCH. It is transmitted in Uplink point to point. 69

Common Control Channels CCCH .. Access Grant Channel-AGCH On request for a signaling channel by MS the network assigns a signaling channel (SDCCH) through AGCH. AGCH is transmitted on the downlink point to point. Paging Channel-PCH The information on this channel is a paging message including the MSs identity(IM SI/TMSI).This is transmitted on Downlink, point-to-multipoint. 70

Dedicated Control ChannelsDCCH Stand alone dedicated control channel(SDCCH) AGCH assigns SDCCH as signaling cha nnel on request by MS.The MS is informed about which frequency(ARFCN) & timeslot to use for traffic. Used for location update, subscriber authentication, cipher ing information, equipment validation and assignment of TCH. This is used both s ides, up and Downlink point-point. 71

Dedicated Control ChannelsDCCH Slow associated control channel-SACCH Transmission of radio link signal measurement, power control etc. Average signal strengths(RXLev) and quality of service (RXQual) of the serving base station an d of the neighboring cells is sent on SACCH (on uplink). Mobile receives informa tion like what TX power it has to transmit and the timing advance. It is associa ted with TCH or SDCCH Fast associated control channel-FACCH Used for Hand over commands and during call setup and release. FACCH data is sen t over TCH with stealing flag set 72

Traffic Channels-TCH TCH carries the voice data. Two blocks of 57 bits contain voice data in the norm al burst. One TCH is allocated for every active call. Full rate traffic channel occupies one physical channel(one TS on a carrier) and carries voice data at 13k bps Two half rate (6.5kbps) TCHs can share one physical channel. 73

GSM Channels GSM Channels Traffic Channels (TCHs) Broadcast Channels (BCHs) Full rate Half rate Control Channels Common Control Channels (CCCHs) Dedicated Control Channels (DCCHs) (down uplink) Fast Slow Downlink Downlink Uplink TCH /F TCH /H FCCH SCH BCCH PCH AGCH CBCH RACH SDCCH FACCH SACCH Traffic Multiframing Signaling Multiframing Traffic Multiframing 74

The Logical Channels on Radio Interface TS 0123456 7 BTS Frequency correction Synchronization Broadcast control Access request Subscriber paging Answer to Access request Broadcast info Dedicated Signaling Sys InFo 5, 6 + SMS Traffic (speech data) Associated Signaling FACCH MS FCCH SCH BCCH RACH PCH AGCH FCCH CBCH SDCCH SACCH SACCH SDCCH TCH FACCH Traffic (speech-data) Associated Signaling Radio Measurement + SMS Dedicated Sig naling Broadcast info CBCH SCH BCCH RACH PCH M.S. Pre-synchronization Access request Subscriber paging Answer to Access request TCH AGCH 75

Measures: Logical Channel Description SACCH MESSAGES TCH MESSAGES (1/2) Speech Data Handover Access message (uplink) - power level of the communication - quality level of the communication - level on the beacon frequency of the neighboring cells Timing Advance Power Control SMS FACCH MESSAGES Connection establishment from SDCCH to TCH SDCCH MESSAGES Request for a SDCCH assignment Request for the end of channel End validation of a SDCCH-TCH commutation Characteristics of the future used BS assignment Order of commutation from SDCCH to after handover Connection establishment to BS after TCH SMS handover Validation of an handover 76

 no message is sent (all bits 0) Logical Channel Description FCCH MESSAGES AGCH MESSAGES (2/2) SCH MESSAGES CBCH MESSAGES For dedicated channel assignment: Frame Number Base Station Identity Code (BSIC) - frequency number - slot number - frequency hopping description - Timing Advanc e (1st estimation) - MS identification BCCH MESSAGES System Information type 1, 2, 2bis, Specific information (weather, road information 2ter, 3, 4, 7, 8 (idle mode) RACH MESSAGES Service request: PCH MESSAGES messages containing a mobile identity for a call, a short message or an authentication - emergency call - answer to an incoming call - outgoing call - short message call re-establishment - inscription 77

GPRS Channels DL PBCCH PPCH PAGCH PNCH PDTCH PACCH PTCCH UL PDTCH PACCH PTCCH BSC PCUSN GPRS CORE NETWORK PRACH Packet Common Control CHannels Packet Traffic CHannels PBCCH 78 PDCH = Packet Data CHannel

Traffic and Control Multiframing Traffic channel Frame 4.615 ms TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 TS TS TS TS TS TS TS TS 0 1 2 3 4 5 6 7 TS TS TS TS TS TS TS TS 0 1 2 3 4 5 6 7 Control channel 26 traffic frames = 120 ms 0 1326 frames 0 0 1 1 2 3 2 4 3 51 x 26 traffic frame s = 6.12 s 26 x 51 control frames = 6.12 s 22 46 47 23 48 24 49 50 25 1 2 3 4 21 22 23 24 25 0 1 2 3 4 46 47 48 49 50 0 1 2 3 4 5 2042 2043 2044 2045 2046 2047 1 Hyperframe = 2,715,648 frames= 3h 28 min. 53 s 760 ms 79

80

81

Logical Channel Mapping T 1 - Traffic Channel Combination Full Rate - Downlink & Uplink 26 frames = 120 ms T T T T T T T T T T T T A T T T T T T T T T T T T time Half Rate - Downlink & Uplink 26 frames = 120 ms T0 T1 T0 T1 T0 T1 T0 T1 T0 T1 T0 T1 A0 T1 T0 T1 T0 T1 T0 T1 T0 T1 T0 T1 T0 A1 time T : TCH Ti : TCH sub-channel no. i A : SACCH Ai : SACCH sub-channel no. i : IDLE 82

Logical Channel Mapping A 2 - Dedicated Signaling Channel Combination A A A Downlink 51 frames = 235 ms D0 D0 D1 D1 D2 D2 D3 D3 D4 D4 D5 D5 D6 D6 D7 D7 A0 A4 A1 A5 A2 A6 A3 A7 time Uplink 51 frames = 235 ms A5 A1 A6 A2 A7 A3 A : SACCH D0 D0 D1 D1 D2 D2 D3 D3 D4 D4 D5 D5 : IDLE D6 D6 D7 D7 A0 A4

time D : SDCCH 83

Logical Channel Mapping Multiframe m-1 3 - Common Channel Combination Downlink C Multiframe m 51 frames = 235.38 ms Multiframe m+1 C FS B FS C C FS C C FS C C FS C C FS B time Frames repeat continuously PCH/AGCH SCH BCCH BTS Uplink Physical Channel ARFCN (n) TS (s) MS FCCH 51 frames = 235.38 ms R R R RR R R RR R R RR R R RR R R RR R R RR R R RRR R R R R RR R R RR R R RR RR RR R R R : PCH / C AGCH time F : FCCH

S : SCH B : BCCH R : RACH : IDLE 84

4 - Common Channel Combination Downlink 51 frames = 235 ms Logical Channel Mapping B B C C FS FS C C C C FS FS D0 D0 D1 D1 FS FS FS FS D2 D2 D3 D3 FS FS A0 A2 A1 A3 time Uplink 51 frames = 235 ms D3 D3 RR RR A2 A0 A3 A1 RRRRRRRRRRRRRRRRRRRRRRR RRRRRRRRRRRRRRRRRRRRRRR D0 D0 D1 D1 RR RR D2 D2 time F : FCCH S : SCH B : BCCH C /PCH : AGCH R : RACH A : SACCH D : SDCCH : IDLE 85

86

Why 26 and 51 per Multiframe? Frames 0 1 10 20 30 40 50 0 1 FS B C FS C C FS C C FS C C FS C C FS TTTTTTTTTTTTATTTTTTTTTTTT 01 12 TTTTTTTTTTTTATTTTTTTTTTTT 12 25 25 0 1 Downlink message Uplink message Mobile activity Neighboring BTS (downlink) Measurement Windows 87 Rx (n) Rx Tx Rx Rx (n) Tx Rx (n) Rx Tx

TOPICS GSM CONCEPTS GSM SYSTEM ARCHITECTURE IDENTITIES USED IN GSM GSM CHANNELS GSM IO LINK MOBILITY MANAGEMENT CALL MANAGEMENT RADIO RESOURCE MANAGEMENT 88

From Speech to Radio Transmission Step 1 Digitizing and source coding Channel coding Speech Source decoding Channel decoding Step 2 Interleaving De-interleaving Step 3 Burst formatting Burst deformatting Step 4 Ciphering Deciphering Step 5 Modulation Demodulation equalization Step 6 Transmission Diversity 89

GSM Radio Link Speech Coding -Done at Transcoder of BSC and MS The Linear Predictive Coder uses RPE-LTP(Regular Pulse Excitation- Long Term Pre diction) Converts 64kbps voice to 13kbps(260 bits every 20ms) Channel Coding - Done at BTS and MS Uses Convolution Coding and CRC (Cyclic Redundancy Check) Converts 13 kbps to 22 .8 kbps (456 bits per 20ms) 90

GSM Radio Link Bit Interleaving - Done at BTS and MS Encryption - Done at BTS and MS EX OR data with cipher block, which is generated by applying A5 Algorithm to the Ciphering Key(Kc) Multiplexing - Done at BTS Modulation - Done at BTS and MS GMSK(Gaussian filtered Minimum Shift Keying) Phase change of +90 for 0 and -90 f or 1 91

Why Digitizing and Coding the Speech? SPEECH TRANSMISSION MS BETWEEN MOBILE AND NETWORK BSS SPEECH MUST BE DIGITIZED AND CODED Better Quality Lower Rate 64 kbit/s

Speech Quality Source Coding Codec Type Mean Opinion Score (MOS) 4.25 4.2 4.2 4 3.8 3.4 Rate (kb/s) PCM A law GSM EFR CDMA 13 D-AMPS GSM FR CDMA 8 Quality Excellent Good Fair Poor Bad MOS 5 4 3 2 1 64 12.2 13 8 13 8 Listening Effort Required Complete relaxation possible, no effort. Attention nec essary, no appreciable effort. Moderate effort. Considerable effort. No meaning understood with feasible effort. 93

Speech Coding BP BAND PASS 300 Hz 3.4 kHZ A/D Every 125 s value is sampled from analog signal and quantised by 13 bit word Data rate = 13/125*10 -6 = 104 kbps SPEECH ENCODER CHANNEL CODING To modulator Every 20ms 160 samples taken Data rate = 160 * 13/20ms = 104 kbps 3 crc bits 1A 1B 2 50 132 78 Four 0 bits for codec 50 3 132 4 Conv coding rate = 1/2 delay = 4 Linear Predictive Coding & Regular Pulse Excitation Analysis 1. Generates 160 filter coeff 2. These blocks sorted in 4 sequence 1,5,9,37 / 2,6 ,10----38/ 3,7,1139/8,12,1640 3. Selects the sequence with most energy So data rat e = 104/4 = 26 kbps Long term prediction analysis 1. Previous sequences stored in memory 2. Find out the correlation between the p resent seq. And previous sequences 3. Select the highest correlation sequence 4. Find a value representing the difference between the two sequences. Reduces dat a rate = 26 kbps/2 = 13 kbps ie 260 bits in 20ms 378 coded bits 456 bits in 20 ms = 22.8 kbps 57 x 8 = 456 78 1A = Filter Coeff block ampl, LTP params 1B = RPE pointers & pulses 2 = RPE puls e & filter params CHANNEL DECODING LP D/A

SPEECH DECODER 94

Channel Processing in GSM Overview for Full Rate 20 ms Speech blocks 20 ms 20 ms A Codec dependent B Codec dependent C Codec dependent Source coding Channel coding A 456 bits B 456 bits C 8 Sub blocks of 57 bits 456 bits A A A A 5 6 7 8 Interleaving B B B B B B B B 1 2 3 4 5 6 7 8 C C C C 1 2 3 4 8 Bursts Normal burst A5 B1 A6 B2 A7 B3 A8 B4 B5 C1 B6 C2 B7 C3 B8 C4

3 57 bits 1 26 bits 1 57 bits 3 Tail Information CRL Training CRL Information Tail 95

96

Channel Processing in GSM Overview for Half Rate 20 ms Speech blocks 20 ms 20 ms A Codec dependent B Codec dependent C Codec dependent Source coding Channel coding A 228 bits B 228 bits C 4 Sub blocks of 57 bits 228 bits A A A A 1 2 3 4 Interleaving B B B B 1 2 3 4 C C C C 1 2 3 4 4 Bursts Normal burst A3 B1 A4 B2 B3 C1 B4 C2 0 1 2 3

4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 97

Interleaving: TCH Full Rate 0 1 2 3 4 5 6 7 8 ... ... 452 453 454 455 456 coded bits Divide 456 bits in 8 sub-blocks 0 8 448 1 9 449 2 10 450 3 11 451 4 12 452 5 13 453 6 14 454 7 15 455 57 Rows reordering & partitioning out 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 diagonal interleaving

bit interleaving burst b0 b1 b56 b0 b1 b56 98

Burst Formatting Normal Burst 0 1 2 1 frame: 4.615 ms 3 4 5 6 7 DATA 3 57 S 1 Training sequence 26 Burst 148 bits S 1 DATA 57 3 Guard Band 8.25 Guard 156.25 bits duration (0.577 ms) 99

Burst Formats Frequency Correction Burst (FCCH) Tail 3 bits Data 142 fixed bits (0) 156.25 bits duration (0.577 ms) Tail 3 bits Guard Period 8.25 bits Synchronization Burst (SCH) Tail Data Extended Training Sequence 64 synchronization bits 156.25 bits duratio n (0.577 ms) Data 39 bits Tail 3 bits 39 encrypted bits Guard Period 3 bits 8.25 bits 100

Burst Formats Normal Burst Tail Data 1 Training Sequence 26 bits 1 Data 57 encrypted bits Tail Guard Period 3 bits 57 encrypted bits 3 bits 8.25 bits 156.25 bits (0.577 ms) Dummy Burst Tail Dummy Sequence 3 bits 58 mixed bits Training Sequence 26 midamble bits Dumm y Sequence Tail 58 mixed bits Guard Period 3 bits 8.25 bits 156.25 bits (0.577 ms) Tail 8 bits Training Sequence Access Burst Data Tail Guard Period 68.25 bits 41 synch bits 36 encrypted bits 3 bits 156.25 bits (0.577 ms) 101

Ciphering Burst to be transmitted Data S S Data Plain data: Ciphering sequence: XOR: Ciphered data (transmitted): Ciphered seque nce: XOR: Recovered data: 0 1 1 1 0 0 1 0..... 0 0 0 1 1 0 1 0..... 0 1 1 0 1 0 0 0..... 0 0 0 1 1 0 1 0.. ... 0 1 1 1 0 0 1 0..... Received burst Data S Training S sequence Data 102

Interleaving Encoded speech blocks - Diagonal Interleaving 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 5 7 57 57 Even bits Odd bits Bn-4 Bn-3 Bn-2 Bn-1 Bn Bn+1 Bn+2 Bn+3 Encoded control channel blocks - Rectangular Interleaving 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 Even bits Odd bits Bn-4 Bn-3 Bn-2 Bn-1 Bn Bn+1 Bn+2 Bn+3 Tb 3 Coded Data 57 F Training Sequence F 1 26 1 Coded Data 57 Tb 3 Gp 8.25 103

Burst The information format transmitted during one timeslot in the TDMA frame is call ed a burst. Different Types of Bursts Normal Burst Random Access Burst Frequency Correction Burst Synchronization Burs t 104

Normal Burst 156.25 bits 0.577 ms T 3 Coded Data 57 S 1 T. Seq. 26 S 1 Coded Data 57 T 3 GP 8.25 Tail Bit(T) Coded Data Stealing Flag Training Seq. :Used as Guard Time :It is the Data part associated with the burst :This indicat es whether the burst is carrying Signaling data (FACCH) or user info (TCH). :Thi s is a fixed bit sequence known both to the BTS & the MS.This takes care of the signal deterioration. 105

156.25 bits 0.577 ms T 3 Training Sequence 41 Random Access Burst 156.25 bits 0. 577 ms T 3 Fixed Bit Sequence 142 Freq. Correc. Burst 156.25 bits 0.577 ms T 3 C oded Data 39 Training Sequence 64 Coded Data 39 T 3 GP 8.25 T 3 GP 8.25 Coded Da ta 36 T 3 GP 68.25 Synchronization Burst 106

Transmission on the radio channels A timeslot has a duration of .577 m seconds (148 Bits) 8 timeslots(8 x 0.577 = 4 .62 ms) form a TDMA frame If a mobile is assigned one TS it transmits only in th is time slot and stays idle for the other 7 with its transmitter off, called bur sting The start on the uplink is delayed from downlink by 3 TS periods One TS = duration of 156.25 bits, and its physical contents is called a burst Downlink 0 BTS > MS 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 Uplink MS > BTS 0 Offset 1 2 3 4 5 6 7 0

1 2 3 4 5 6 7 107

Timing Advance MS1 0 near MS2 0 far 1 2 3 4 5 6 7 MS1 0 near MS2 0 far 1 1 2 3 4 5 6 7 1 2 3 4 5 6 7 2 3 4 5 6 7 At BTS 0 0 1 1 2 2 3 3 4 4 5 5 6 6 7 7 At BTS 0 0 1 1 2 2 3 3 4 4 5 5 6 6 7 7 108

Frames Types On Um Interface TDMA Frame 8 Time slots (Burst Period) Length is 4.62 ms(8 * 0.577ms) 26-TDMA Multiframe 26 TDMA Frames (24 TCH, SACCH, Idle) 120 ms (26 * 4.62ms) 51-TDMA Multiframe 26 TDMA Frames (FCCH, SCH, BCCH, SDCCH, CCCH) 235.6 ms (51 * 4.62ms) 109

Frames Types On Um Interface Super Frame 51* 26 TDMA Frames 6.12 S Hyper Frame 2048 * 51* 26 TDMA Frames 3 Hours, 28 Minutes, 53 Secs and 760 ms 110

TOPICS GSM CONCEPTS GSM SYSTEM ARCHITECTURE IDENTITIES USED IN GSM GSM CHANNELS GSM IO LINK MOBILITY MANAGEMENT CALL MANAGEMENT RADIO RESOURCE MANAGEMENT 111

Mobility Management Mobility Management (MM) Location updating- normal,periodic, IMSI attach Paging Security Management Preventing unauthorized users- authentication Maintaining Privacy of users- ciph ering Providing roaming facility MM functionality mainly handled by MS, HLR, MSC/VLR. 112

Network Attachment Cell Identification MS scans complete GSM frequency band for highest power Tunes to highest powered frequency and looks for FCCH. Synchronizes in frequency domain Get training sequ ence from SCH which follows FCCH. Synchronizes in time domain. Accesses BCCH for network id, location area and frequencies of the neighboring cells. Stores a li st of 30 BCCH channels 113

Network Attachment.. PLMN Selection Get the operator information from SIM. Cell Selection Selected cell should be a cell of the selected PLMN Signal strength should be ab ove the threshold. Cell should not be barred Location Update Register with the network by means of location updation procedures. 114

MS BTS MS Location Update (registration) BSC (G)MSC VLR HLR Channel Request (RACH) Channel Assignment (AGCH) Location Update Request (SDCCH) Authentication Request (SDCCH) Authentication Response (SDCCH) Comparison of Au thentication param Accept LUP and allocTMSI (SDCCH) Ack of LUP and TMSI (SDCCH) Entry of new area and identity into VLR and HLR Channel Release (SDCCH) 115 Action TMSI + old LAI

Security - Authentication MS Ki RAND A3 SRES MS BTS AuC RAND SRES SRES Auth Result Authentication center provides RAND to Mobile AuC generates SRES using Ki of sub scriber and RAND Mobile generates SRES using Ki and RAND Mobile transmits SRES t o BTS BTS compares received SRES with one generated by AuC 116

Security - Ciphering MS Ki RAND A8 Kc MS Kc Data Um interface Network Kc Ciphered Data Data A5 A5 Data sent on air interface ciphered for security A5 and A8 algorithms used to ci pher data Ciphering Key is never transmitted on air 117

TOPICS GSM CONCEPTS GSM SYSTEM ARCHITECTURE IDENTITIES USED IN GSM GSM CHANNELS GSM IO LINK MOBILITY MANAGEMENT CALL MANAGEMENT RADIO RESOURCE MANAGEMENT 118

Communication Management (CM) Setup of calls between users on request Routing function i.e. Choice of transmis sion segments linking users Point to Point Short message services 119

GSM Actors NSS BSS BSC BTS MSC Public Switched Telephone Network VLR HLR AUC Mobile subscriber Fixed subscriber

PLMN Selection Yes Is there an up to date found PLMNs list? Yes No Creation of a found PLMN list manual mode The user selects a PLMN from the di splayed PLMNs automatic mode The MS selects the first PLMN from the preferred PL MNs list (if it is not in the forbidden PLMNs list) Cell Selection succeed? Yes End of PLMN selection No (automatic) Selection of the next preferred possible PL MN No (manual)

PLMN Selection Constitution of the "Found PLMN list" Listen to all the frequencies of the GSM spectrum: power level measurement and a verage on these measurements (124 channels in GSM 900, 374 in GSM 1800 and 299 i n GSM 1900 Select the best frequencies according to the power level Memorize the beacon fre quencies in the precedent selection (30 in GSM 900 and 40 in GSM 1800) => Create the Found PLMN list

Initial Cell Selection List of the frequencies of the selected PLMN Selection of another PLMN Eligible cell? Yes Suitable cell: Eligible cell No C1 Computation for eligible cells - cell of the selected PLMN - cell not barred - C1 > 0 Suitable cell? No Yes Look for the cell with the best C1 in the suitable cells list IMSI Attach End of Cell Selection Rejected? No Yes PLMN set in the forbidden PLMN list

Cell Selection Purpose: get synchronization with the GSM network prior establishing any communi cation. 1 BTS-5 1 1 BTS-4 1 1 H FCC 2 3 4 BTS-1 BTS-3 5 SCH CH BC BTS-2 This cell

Immediate Assignment MS 1 BTS CHANNEL REQUEST CHANNEL REQUIRED CHANNEL ACTIVATION 4 BSC MSC RACH 2 3 CHANNEL ACTIVATION ACK. IMMEDIATE ASSIGNMENT COMMAND 5 Immediate Assignment IMMEDIATE ASSIGNMENT AGCH 5 6 CM SERVICE REQUEST SDCCH or TCH LOCATION UPDAT. REQU. OR 6 SDCCH or TCH

Registration: the Very First Location Update 1 2 IMSI 4 TMSI Release 6 5 BTS BSC BSS 2 4 TMSI 6 MSC 5 2 4 TMSI 5 LAI HLR IMSI VLR id 3 VLR IMSI TMSI LAI

Intra VLR Location Update 1 2 TMSI + old LAI new TMSI BSC 3 4 BTS BSS 2 3 4 2 TMSI New TMSI 3 MSC New LAI VLR IMSI TMSI LAI IMSI not Required

Inter VLR Location Update 1 2 TMSI + old LAI newTMSI 5 7 BTS BSS 2 BSC 5 7 2 TMSI New TMSI 5 MSC New LAI Old VLR IMSI, TMSI Old LAI RAND, SRES, 4 Kc New VLR 3 IMSI,TMSI LAI RAND, SRES, Kc 6 IMSI not Required HLR 6 new VLR id subscriber data 128

IMSI Attach 1 CHANNEL REQUEST IMMEDIATE ASSIGNMENT BSS 2 BSC BTS 3 4 3 LOCATION UPDATING REQUEST (IMSI Attach) Authentication 4 Procedure MSC LOCATION UPDATING 5 ACCEPT (LAC, TMSI) 5 4 VLR 6 129

IMSI Detach 1 CHANNEL REQUEST IMMEDIATE ASSIGNMENT BSS 2 BSC BTS 4 3 IMSI DETach INDication MSC 3 IMSI DETach INDication CHANNEL RELEASE VLR 130

Outgoing Call Great Britain France Telephone network Germany BSS BSC BTS Terminating MSC Gateway MSC VLR HLR FT 131

Mobile Originating Call MS Dialing 1 CHANNEL REQUEST IMMEDIATE ASSIGNMENT 2 2 2 BSS MSC VLR PSTN CM SERVICE REQUEST 3 3 CM SERVICE REQUEST Authentication procedure Ciphering procedure 4 Sending Number 4 SETUP (basic) or EMERGENCY CALL PROCEEDING 7 7 SETUP 5 7 6 CALL PROCEEDING IAM Ring Ringing Assignment procedure ALERTING 9 CONNECT 11 ACM ANM 8 10 Ringing Path Established 11 CONNECT ACKnowledge ACM = Address Complete Message ANM = ANswer Message IAM = Initial Address Messag e 132

Mobile Terminating Call 1 - Paging Principle LA1 6 BTS11 BSC1 5 4 3 1 BTS12 6 BTS21 5 MSC/ VLR GMSC PSTN BSC2 2 BTS22 LA2 HLR BSC3 BTS23 BTS31 133

Mobile Terminating Call 2 - Detailed Procedure Visitor PLMN VLR International SS7 Provide Roaming Number (IMSI) Home PLMN HLR 4 5 9 PAGING REQUEST (TMSI) PAGE (TMSI + LA) Send info to I/C (MSRN) Roaming Number (MSRN) 6 Routing Information (MSRN) Send Routing Information (MSISDN) 1 MSISDN 8 PAGING REQUEST 10 (TMSI + LA) IAM (MSRN) 3 7 11 BSS VMSC PN GMSC IAM 2 (MSISDN) ISDN IAM MSISDN MSRN : Initial Address Message : Mobile Station Integrated Services Digital network N umber : Mobile Station Roaming Number IMSI GMSC VMSC TMSI : : : : International Mobile Subscriber Identity Gateway MSC Visitor MSC Temporary Mobil e Subscriber Identity 134

Mobile Terminating Call 3 - End to End Procedure MS BSS PAGING REQUEST (TMSI or IMSI, LA) VMSC IAM (MSRN) GMSC 2 PSTN IAM 1 (MSISDN) Dialing PAGING REQUEST 5 4 3 CHANNEL REQUEST (LAC, Cell ID) IMMEDIATE ASSIGNMENT 6 (SDCCH or TCH) 7 CM SERVICE REQUEST (Paging Response) 8 9 7 PAGING RESPONSE (TMSI or IMSI, LA) Authentication procedure Ciphering procedure Setup, Assignment, Alerting CONNECT 11 12 Ringing 10 12 Address Complete Message ANswer Message Path Established 135

Call Release 1 - Mobile Initiated MS 1 2 BSS Call in progress 2 MSC PSTN DISCONNECT DISCONNECT RELEASE RELEASE 4 3 3 RELEASE COMPLETE 5 CHANNEL RELEASE 6 7 Release RELEASE INDICATION RF Channel Release procedure 8 9 Release tone 136

Call Release 2 - PSTN Initiated 1 3 4 5 BTS BSC 4 5 BSS 1 3 1 MSC REL 6 RLC 2 PSTN 2 1 Purpose: informs the mobile then releases radio and network resources. On hook 137

Mobile Originated Call Request for Service Authentication Ciphering Equipment Validation Call Setup Ha dovers Call Release 138

Mobile Terminated Call Paging Authentication Ciphering Equipment Validation Call Setup Handovers Call elease 139

Mobile Terminated Call MS Paging Assignment CMD (=TCH) on SDCCH BTSTMSI Paged on PCH BSC HLR VLR Query for VLR info Reply (MSRN) EIR * MS Allocate tunesSDCCH Page RESP on MS Ch. REQ SDCCH * Assgn overRACH CMP ( AG CH overTMSI + LAI) BTS * Phone rings Connect traffic Ch.to trunk GMSC frees SDCCH Query VLR Page RES Page Assgn CMP f or LAC and Assign. REQ Paging TMSI the area (+TMSI) Route to MSC Alerting Networ k MSC BSC AuC PSTN BTS Land to Mobile call (MSISDN) Authentication and Ciphering procedure done as seen in Location Updation 140

TOPICS GSM CONCEPTS GSM SYSTEM ARCHITECTURE IDENTITIES USED IN GSM GSM CHANNELS GSM IO LINK MOBILITY MANAGEMENT CALL MANAGEMENT RADIO RESOURCE MANAGEMENT 141

Radio Resource Management Establish maintain and release stable connections between MS and MSC Manage Limi ted Radio and Terrestrial resources Handover process is the sole responsibility of the RR Layer Functions of RR layer are performed by MS and BSC and partly by MSC 142

Radio Resource Management Power Control Hand over Control Discontinuous Transmission Frequency Hopping 143

Power Control BTS commands MS at different distances to use different power levels so that the power arriving at the BTSs Rx is approximately the same for each TS - Reduce int erference - Longer battery life 144

Handover Means to continue a call even a mobile crosses the border of one cell to another Procedure which made the mobile station really roam Handover causes RxLev (Signal strength , uplink or downlink) RxQual (BER on data) O & M interven tion Timing Advance Traffic or Load balancing 145

Handover Types Internal Handover (Intra-BSS) Within same base station - intra cell Between diff erent base stations - inter cell External Handover (Inter-BSS) Within same MSC intra MSC Between different MSCs - inter-MSC 146

Handover Types MSC BSC GMSC BSC C-3 BSC MSC C-4 C-1 C-2 BSC 147

Intra BSC handover HO required Activate TCH(facch) with HoRef# HO performed BSC Acknowledges and alloctes TCH (facch) if 1. Check for HO passed 2. Channel avail in new BTS BTS 2 Periodic Measurement Reports (SACCH) MS tunes into new frequency and TS and send s HO message to new BTS (facch) Periodic Measurement Reports Receives new BTS data(FACCH) HO cmd with HoRef# Release TCH Cell 2 Periodic Measurement Reports (SACCH) BTS 1 Cell 1 148

Frequency plan and importance of BCCH B5 B6 B4 B3 B1 B2 B12 B9 B10 B11 F0 F1 F2 F3 F4 F5 F10 F11 F50 MS ( monitoring t he broadcast radio B1 in idle mode ) Sectored antennas BPL frequency plan: Broadcast frequencies : 15 Broadcast channels = 48-62 15 Hopping channels = 32-4 6 B8 B7 F S B B B B .. F S .. .. I F,S,B exist in time slot 0 of each frame 149

What information does Broadcast Control channel (BCCH) contain? Serves as a Beacon for the Cell Country Code (CC) and the Network Code (NC) Loca tion Area Identity (LAI) List of neighboring cells which should be monitored by MS List of frequencies used in the cell Cell identity Back 150

Location Updates Location Updates can be classified into two: Periodic Location Updates: This occurs as per the timer set by the network operator. If the MS does not per form this update the MSC marks the MS as Detached on the VLR. Location Update on a handover: This occurs if during a handover the MS is moved into a new Location Area Code ( LAC). 151

1. The MS is monitoring the BCCH and has all the decoded information stored on the SIM ( including the LAC) As soon as the mobile is on a TCH it sends the signal s trength indication on the corresponding SACCH The BSC monitors the signal streng ths and on analysis sends a handoff request on FACCH. The handoff process is compl eted on the FACCH. After the completion of call, the MS starts monitoring the BC CH again. On finding the LAC (stored on SIM) and that decoded from the BCCH to b e different , the MS requests a Location Update through SDCCH. 2. 3. 4. Back 152

Discontinuous Transmission Discontinuous Transmission(DTX) allows the radio transmitter to be switched off most of the time during speech pauses. A Silence Indicator Block is transmitted at 500bps, which generates a comfort noise Down Link interference is decreased. Up link battery is saved 153

Frequency Hopping Frequency Hopping permits the dynamic switching of radio links from one carrier frequency to another. Base Band Hopping At the BTS each the timeslot is shifted to another transceiver, which is transmitting at the hop frequency. User will be connected to different Transceivers depending on hop sequence. Synthesis Hoppin g At the BTS transceiver changes the frequencies used. The user will be connecte d to only one transceiver. Decreases the probability of interference Suppresses the effect of Rayleigh fading 154

Add-on to GSM network : rate for GSM Evolution Enhanced Data PCU; Packet EDGE is an enhancement of GPRS and CSD technologies. Segmentation/re-assembly and sched uling Radio channel accessthe current GSM technology - same TDMA frame structure , Universal Mobile Telecommunication Standards Based on control and management Tr ansmissionService Architecture retransmission.- providing the us Innovative erro r detection and : VHE Concept same bandwidth (200 kHz). Power control and feelmo dulation instead services independent of the same look 8-PSK of its personalized of GMSK. Uses Surf the Internet while on the move SGSN: GPRSRequires good propa gation conditions. network and terminal. mobility High Speed Circuit Switched Da ta Encryption Allows upto:48 kbps (EGPRS) and upto 28.8 kbps (ECSD) on every Glo bal Convergence Fixed/Mobile, Telecom/Datacom, public/private User Data Rate:14. 5kbps W@P Gateway : Charging Multimedia driven market. Mobile radio channel Adap tation SMS Use multiple timeslots (max=8), GGSN : Data:EDGE helps GSM-Only( oper ators to compete with UMTS. of the information to the mobile Interface -numeric c haracters the Wideband160 torate 2GHz Internet MHz per carrier), -max. 2Mbps bea rers - PDN, Rate : 9.6kbps band 5 hence = 115.2kbps. Compression of theUMTS data User Data max UMTS Needs a over the air interface duplexor in MS for Buffering of the information One time slot Max user data rate : 21.4 kbps simultaneous Tx and Rx Dynamic rate adaptation to suit the radio conditions at EDGE EDGE that ti me ( 9.05 kbps, 13.4 kbps, 15.6 kbps 21.4 kbps) Data Application Wireless Data GPRS GPRS HSCSD HSCSD SIM SIM Toolkit Toolkit WAP WAP Circuit Switched technology Packet Switched technology GSM GSM DATA DATA F o n e W @ P Mobile Network 98 Internet 99 2000 Technology for Applications W@P Gateway W@P Service Time 155 2001

References Wireless and Personal Communication Systems. Vijay.K.Garg and Wilkes Overview of the GSM System and Protocol Architecture, IEEE Comm. Magazine, Moe Rahnema. The GSM System for Mobile CommunicationsMichel Mouly & Marie-Bernadette Pautet Over view of the GSM Comm- John Scourias. 156

Coverage or Traffic Limitations TRAFFICLIMITED AREA (10000 subscribers per km2) COVERAGELIMITED AREA (-75 dBm at cell edge) COVERAGELIMITED AREA (-70 dBm at cell edge) 157

158

Erlang Concept Erlang is the unit of statistical resource use Average number of busy channels during the period of observation (usually, the p eak hour). Erlang B At any time, more than 1 user may request the same resource simultaneou sly. The use of such a resource is associated with a blocking rate. Erlang C Whe n more than 1 user request at the same time, instead of rejecting the extra call s, there is a queuing system. 159

Different Types of Cells EXTENDED-CELL: macro cell with system coverage extension ( 120 km) for coasts... CONCENTRIC-CELL: macro cell with system coverage limitation inside another macro MACRO-CELL: antenna radiating above roofs ---> Wide Coverage ( 35 km) High sensitivity to interference Requires "secured" Frequency reuse pattern PICO-CELL: Antenna inside building ---> Very small coverage MICRO-CELL: Antenna below the roofs ---> small coverage High isolation from interferences A few Frequencies intensively reused 160

Cell Patterns 161

Cell Sectorization TRI OMNI BI

Omnidirectional Site Antennas

Bi and Trisectorial Site Antennas

Link Budgeting Calculation of the maximum coverage range of each cell in a specific environment . Definition of planning tools parameters. Based on the path loss calculation be tween the MS and the BS in both ways. This calculation considers: RF parameters of MS and BS, system parameters (diversity gains...), propagation parameters (sh adowing), physical installation parameters (antenna height), environment classif ication.

- What is the maximum EIRP? - What are the losses in transmission and reception? - Is diversity used? - Beyond which distance the communication will cut off? - Is indoor coverage gua ranteed? - Is frequency hopping used? - What is the minimum equivalent sensitivi ty? - What is the maximum equivalent output power? - What are the body losses? EIRP:Equivalent Isotropic Radiated Power

 Overview Link Budget Parameters Standard conf. DLNA conf. Antenna Gain Rx Sensitivity Propagation Parameters: - Incar, Indoor penetration factors - Frequency 900, 180 0, 1900 MHz - Antenna Height - Environment Design Parameters: Overlapping margin Common cable Losses Rx Sensitivity Radio Link Specific Tx Cable Losses Combiner losses Tx PA Output Power Antenna Gain Rx Sens itivity Tx PA Output Power Rx Diversity Gain MS Base Station Duplexer Combiner Power Amplifier DLNA:Diversity Low Noise Amplifier Other facto rs for MS Body Losses Common cable losses

 BTS TX Power Amplifier Link Budget Parameters 2.5W PA GSM 900 S2000L 25W PA 35W PA 20W PA 30W PA S8000 Indoor S8000 Outdoor S4000 Indoor S8000 Indoor S8000 Outdoor S2000E S4000 Indoor S4000 Indoor S2000H S4000 Outdoor S2000E S2000H S4000 Outdoo r S2000E S2000H S4000 Indoor S4000 Outdoor DCS 1800 S2000L S4000 Indoor PCS 1900 S2000L S8000 Outdoor

 Combiners Link Budget Parameters H2D D 4.5 dB Loss 4.5 dB Loss D Hy/2 4.9 dB Loss 4.9 dB Loss C C C C TX TX TX TX TX TX 2-Way Hybrid Combiner with Duplexer 2-Way Hybrid Combiner with Duplexer allows S ynthesized Frequency Hopping 4-Way Cavity Combiner with 4-Way Cavity Combiner with Duplexer Duplexer allows B aseband Frequency Hopping

 Cable Losses Link Budget Parameters At the BS, for a 7/8 foam dielectric coaxial cable: 4 dB/100 m (900 MHz), 6 dB/10 0 m (1800 MHz), Common cable losses for 40 meters: 2.5 dB (900 MHz) and 3.5 dB ( 1800 MHz). Jumpers (up and down the feeder) 0.5 dB (800 MHz), 1 dB (1800 MHz).

 BTS Antenna Gain Link Budget Parameters Omnidirectional antenna Default 6.5 V with 11 dBi gain Directional antenna for tr isectorial site Default 65 H / 6.5 V with 18 dBi gain

 Mobile Station Parameters Link Budget Parameters 900 MHz TX PA Output Power RX Sensitivity 1800/1900 MHz 33 dBm (2W) -102 dBm 30 dBm (1W) -100 dBm Antenna Gain Common Cable Loss Body Loss -2 dBi for Handheld 2 dBi for Car Kit 0 dB for Handheld 2 dB for Car Kit 3 dB fo r Handheld 0 dB for Car Kit

Link Budget Presentation Parameters Antenna Gain (65 ) 18 dBi Jumper Loss 0.5 dB Feeder Loss 3 dB Sensitiv ity -110 dBm Coupling system Tx loss 4.5 dB Frequency Base Height Mobile Height Environment Penetration Factor 15 dB Body Loss 3 dB Antenna Gain -2 dB 1800 MHz 40.0 m 1.5 m Urban Outdoor Minimum Field 95%: -80 dBm Coverage Range 95%: 810 m Cable Loss 0 dB RX TX RXm RXd Output Power 30 dBm Sensitivity Max TX Output Power 44.8 dBm Base Station -100 dBm Options Rx Diversity Gain: 5 dB Overlapping Margin: 0 dB Mobile 173

Exercise 1: S8000 INDOOR: OPERATING FREQUENCY 1800 MHz BTS TX OUTPUT POWER COMBINER LOSSES RX SENSITIVITY RX SENSITIVITY + DIVERSITY COMMON CABLE LOSSES ANTENNA GAIN 30.00 W (44.8 dBm) 5.0 dB -110.0 dBm -115.0 dBm Link Budget Calculation MS 1.00 W (30.0 dBm) None -102.0 dBm None BODY LOSSES OVERLAPPING MARGIN INDOOR PENETRATION FACTOR 3.0 dB 0.0 dB 18.0 dB 3.0 dB 18.0 dBm 0.0 dB -2.0 dBm 174

Fading Example of Field Strength Variation for GSM 1800 -10 -20 -30 Measurement Free Space Zoom on Short Term Fading /2 2m Field Strength (dBm) -40 -50 -60 -70 -80 -90 0 -100 500 1000 1500 2000 2500 3000 3500 4000 4500 5000 Long Term Fading Distance (m)

Clutters

177

Mobile Station (MS) Hand portable unit Contains Mobile Equipment(ME) and Subscriber Identity Module (SIM) 178