RFID

GSM History7What are the types in GSM Network?GSM-900 (Channels 125 operating band 900Mhz carrier spacing 200khz spacing 45Mhz)

GSM -1800 (Channels 374 spacing 95Mhz)

GSM -1900(Used in USA)

GSM ChannelsControl ChannelsTraffic Channels(TCHs)FullrateHalfrateDedicated ControlChannels(DCCHs)SlowFastDownlinkBroadcastChannels(BCHs)Common ControlChannels(CCCHs)DownlinkUplinkTCH /FTCH /HFCCHSCHBCCHPCHCBCHRACHAGCHSDCCHSACCHFACCHTraffic MultiframingSignaling MultiframingTraffic Multiframing(down uplink)GSM Channels 40Control channels are intended to carry signaling or synchronization data. Three are defined: Broadcast Channels (BCHs), Common Control Channels (CCCHs), Dedicated Control Channels (DCCHs).Broadcast channels are point-to-multipoint unidirectional (downlink) control channels from the fixed subsystem to the mobile station. First, BCHs include a Frequency Correction Channel (FCCH) that allows an MS to accurately tune to a Base Transceiver Station (BTS).Then BCHs contain the Synchronization Channel (SCH), which provide TDMA frame-oriented synchronization data to an MS.Last, BCHs include the Broadcast Control Channel (BCCH) intended to broadcast a variety of information to MSs, including cues necessary for the MS to register in the network.FACCH MESSAGESConnection establishment from SDCCH to TCHEnd validation of a SDCCH-TCH commutationCharacteristics of the future used BS after handoverConnection establishment to BS after handoverValidation of an handoverSACCH MESSAGESMeasures:power level of the communicationquality level of the communicationlevel on the beacon frequency of the neighboring cells Timing AdvancePower ControlSMSTCH MESSAGESSpeechDataHandover Access message (uplink)SDCCH MESSAGESRequest for a SDCCH assignmentRequest for the end of channel assignmentOrder of commutation from SDCCH to TCHSMSLogical Channel Description (1/2)41Slow Associated Control CHannel (SACCH)SACCH is a dedicated signaling channel associated with SDCCH or TCH. It is used to carry:on the uplink path: radio measurements, Layer 1 Header and Short Messages (SMS),on the downlink path: System Information type 5, 5bis, 5ter and 6, Layer 1 Header and Short Messages (SMS).These messages give information about quality of the communication (UL), Location Area Identity (DL), Cell Identity (DL), Neighboring Cells Beacon Frequencies in dedicated mode (DL), NCC permitted (DL), Cell Options (DL), Power Control (Layer 1 Header- UL/DL), Timing Advance (UL/DL).Standalone Dedicated Control CHannel (SDCCH)SDCCH is a dedicated and consequently a duplex channel. This channel transmits signaling messages for link establishment, location update, SMS, authentication of the subscriber, ciphering command and answer, and all kinds of supplementary services.Telecom BasicsCommunicationVoice and DataAnalog and DigitalCircuit Switched and Packet SwitchedMedia - Copper Wire, Co-axial cable, Air, Optical FibreNetworks -PSTN, ISDN, PDN and Mobile NetworksBackground to GSM1G : Advanced Mobile Phone Service (AMPS)Analog, Circuit Switched, FDMA, FDD2G : Digital Advanced Mobile Phone Service (D-AMPS)Digital, Circuit Switched, FDMA, FDD2G : Global System for Mobile (GSM)Digital, Circuit Switched, FDMA and TDMA, FDD2G : Code Division Multiple Access (CDMA)Digital, Circuit Switched, FDMA, SS, FDD01234212223242501234464748495026 traffic frames = 120 ms1 Hyperframe = 2,715,648 frames= 3h 28 min. 53 s 760 ms0123520422043204420452046204741326 frames012346474849500134222232524TS0TS1TS2TS3TS5TS6TS7TS0TS1TS2TS3TS4TS5TS6TS7TS0TS1TS2TS3TS4TS5TS6TS7TS4TS0TS1TS2TS3TS4TS5TS6TS7TS0TS1TS2TS3TS4TS5TS6TS7Frame4.615 msControl channelTraffic channel51 x 26 traffic frames = 6.12 s26 x 51 control frames = 6.12 sTraffic and Control Multiframing44Higher order frames, called traffic multiframes, consist of 26 TDMA frames and have a duration of 120 ms (26 x 4.615 ms). This 26 DTMA multiframe carries Traffic Channels (TCHs), Slow Associated Control Channel (SACCH), and Fast Associated Control Channel (FACCH). Similarly, a 51-frame multiframe, called a control multiframe, has a duration of 235.365 ms (51 x 4.615 ms) and supports Common Control Channels (CCCHs), Broadcast Channels (BCHs) and Stand Alone Control Channels (SDCCHs).One Superframe consists of 51 traffic multiframes or 26 control multiframes, in other words contains 51 x 26 TDMA frames with a total duration of 6.12 seconds (51 x 120 ms).The highest order frame is called a hyperframe and consists of 2,048 superframes, or 2,715,648 frames (2048 x 51 x 21). The time duration of the hyperframe is 3 hrs, 28 min., and 52.76 sec (2,715,648 x 4.615 ms). This long period of hyperframe is called the GSM time.Full Rate - Downlink & UplinkT: TCHA: SACCH: IDLETi: TCH sub-channel no. iAi: SACCH sub-channel no. itime 26 frames = 120 ms T0A0T0T0T0T0T0T0T0T0T0T0T0T1T1T1T1T1T1T1T1T1T1T1T1A1timeHalf Rate - Downlink & UplinkTATTTTTTTTTTTTTTTTTTTTTTTT 26 frames = 120 ms Logical Channel Mapping1 - Traffic Channel Combination47Full rate speech transmissionWhen a Mobile Station is in communication mode, speech is coded every 20 ms in blocks. These blocks are coded in 8 half-bursts, whose information quantity is equivalent to 4 entire bursts. Then, one burst has to be delivered every 4.615 ms.So, in 26 frames lasting 120 ms, 24 bursts are used for speech transmission. One burst is used for an SACCH. The last one in the sequence is an idle burst. During this burst, the mobile is not idle, but it uses this time to monitor the neighboring cell frequencies.Half rate speech transmissionWhen the half rate speech transmission is in use, the 26 frames of a given time slot can be separated between two users, since only 12 coded speech bursts are used per user.So, in 26 frames lasting 120 ms, the odd burst numbers are restricted to one user, and the other numbers are for the other user. SACCH bursts are in the 13th and 26th positions. In this case, the monitoring is more frequent.Full rate speech: 13 kbpsHalf rate speech: 5.6 kbpsA: SACCHD: SDCCH: IDLE 51 frames = 235 ms A1A2A3A0D7D6D5D4D3D2D1D0A5A6A7A4D7D6D5D4D3D2D1D0timeDownlink 51 frames = 235 ms A5A6A7A0A4D7D6D5D4D3D2D1D0D7D6D5D4D3D2D1D0A1A2A3timeUplinkAAAALogical Channel Mapping2 - Dedicated Signaling Channel Combination48The dedicated channels are combined into two multiframes of 51 frames. In the uplink and the downlink directions, the configuration is almost the same one, only shifted by 15 frames.The dedicated channels combination broadcasts a group of 8 SDCCH frames (2 groups of 4 consecutive SDCCH frames), each of them is associated to 4 consecutive SACCH frames. Each different group is used by a different dedicated communication. The multiframe configuration is shown on the above figure.So 8 users can use the same physical channel simultaneously, and the different communications associated to their SACCH signaling are spread on a cycle of 102 frames (2 51-multiframes). In such a multiplexing cycle, 6 frames are unused (idle TS). 51 frames = 235.38 ms Downlinktime 51 frames = 235.38 ms RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRUplinktimeB: BCCHS: SCH F: FCCH: IDLE: PCH /AGCHCR: RACHBTSMSPhysical ChannelARFCN (n) TS (s) FCCHSCHBCCHPCH/AGCHFrames repeat continuouslyMultiframe m+1Multiframe m-1Multiframe mCCFSCCFSCCFSCCCBFSFSBFSCLogical Channel Mapping3 - Common Channel Combination49Downlink wayThe downlink channel is used to combine FCCH, SCH, BCCH, PCH and AGCH:FCCH and SCH are always transmitted consecutively (an SCH always follows an FCCH). Over 51 frames, the pairs are located at the 0-1, 10-11, 20-21, 30-31 and 40-41 positions.BCCH uses 4 frames per multiframe (Frame Number 2 to 5) and sometimes 4 other frames (6 to 9) for BCCH extension.PCH and AGCH form the CCCH blocks (9 groups of 4 frames). They can have different configurations, depending on the cell capacity and are dynamically defined in SI (System Information) message Type 3 (management of these channels). The 51th frame is unused.Uplink wayThe uplink direction is reserved for RACH. The configuration is simple: all the 51 frames broadcast RACH messages. So all the mobile station can request a dedicated resource to access the network on each TS 0 of a specific TDMA frame in the cell.** Nortel BTSs use TS 0 of the lowest frequency of the frequencies allocated to a BTS for their beacons. Thus, the corresponding uplink TS can contain RACHs.A3A2A1D3D2D3D2D1D1D0D0 FS FS FSCCC FSB FS FS FS FSCCC FSB FS 51 frames = 235 ms A0timeDownlinkRRRRD2D2D1D1D0D0A1A3A0A2RRRRD3D3 51 frames = 235 ms timeUplinkRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRA: SACCHD: SDCCH: IDLEB: BCCHS: SCH F: FCCH: AGCH/PCHCR: RACHLogical Channel Mapping4 - Common Channel Combination50In the case of a low capacity cell, it is possible to combine some dedicated channels with some common control channels on the same physical channel.Their configuration is done on 2 x 51 frames and is indicated in the SI type 3.This combination contains all the channels of dedicated and common combinations: FCCH, SCH, BCCH, PCH, AGCH, SDCCH, SACCH and RACH.Downlink wayFrom a common control combination, FCCH, SCH and BCCH keep their configuration (FCCH+SCH: 0, 10, 20, 30 and 40; BCCH: 2 to 5) for both multiframes.PCH and AGCH are still dynamically configured but only on the bursts: 6-9 (except when extended BCCH are used), 12-15 and 16-19, for both multiframes.On the bursts left, 4 blocks of 4 SDCCH TSs, each of them associated with a SACCH block of 4 TSs, and one idle TS at the end of each multiframe. Each different group is used by a different sub-channel.Uplink way On 102 frames, 27 RACH frames are reserved and the other ones are replaced by 4 blocks of 4 SDCCH TSs, each of them associated with a block of 4 SACCH TSs.Downlink messageUplink messageNeighboring BTS(downlink) Measurement WindowsCCFSCCFSCCFSCCCBFSFSFS 0 1 12 25 0 1 12 250 1 10 20 30 40 50 0 1TATTTTTTTTTTTTTTTTTTTTTTTTATTTTTTTTTTTTTTTTTTTTTTTMobile activity Rx Rx Tx Rx Rx Tx Rx Rx Tx (n) (n) (n)Why 26 and 51 Frames per Multiframe?52During a communication, the Mobile Station has to listen to the beacon frequency of the neighboring cells (which list is provided to the MS through a SACCH) in order to know synchronization values with the neighboring sites. This pre-synchronization is useful for an eventual handover, so that the mobile station can access the assigned channel. The MS can decode beacon frequency information only during the idle window of the TCH multiframe. Indeed, during data exchanges, the mobile has not enough time to decode information between reception, transmission (3 TSs later), and the next reception (5 TSs later), since it has to change frequencies and process some data. However, between transmission and reception (4 TSs), the MS has sufficient time to perform a level measurement on a neighboring cell.However, the MS must find time to decode the synchronization information broadcast on the SCH of the neighboring cells and read and decode BCCH information for new cells. For this, the MS uses the idle TS (TS 26 on the traffic multiframe) that provides a larger observation window and processing time. Since 26 and 51 have no common divider and 26*2=51+1, the idle slot of the TCH multiframe shifts forward a frame in the 51-multiframe: 0, 26, 1, 27, 2,... We are sure that the MS has been able to pre-synchronize with a neighboring site (FCCH+SCH decoding) after at most 11 successive decoding phases at the idle TS level.SpeechSourcedecodingChanneldecodingDe-interleavingBurst deformattingDecipheringDemodulationequalizationDigitizing andsource codingChannelcodingModulationCipheringBurst formattingInterleavingStep 1Step 2Step 3Step 4TransmissionStep 5Step 6DiversityFrom Speech to Radio Transmission53From a speech signal to a radio signal, several operations are performed. The reverse mechanisms are performed on the receiver side. Main operations are the following:Digitizing: Speech blocks are first digitized: one sample is coded on 8 bits and the sampling frequency is 8 kHz. This leads to a raw bit rate of 64 kbps (G.703/G.704 A or -law). On the NSS side, it is the format of the speech on the A interface (E1 or T1).Source coding uses a low bit-rate code for the air interface. Input: 20 ms of digitized speech (160 speech samples of 8 bits each rate is 64 kbps). Output: depends on speech vocoder. As an example, for full rate speech vocoder, the rate of the coded speech is 13 kbps.Channel coding uses codes enabling detection and correction of signal errors. The result is a flow of code words (456 bits long).Interleaving and burst formatting spread the bits of several code words to expand data of the same block in different bursts. The results is a succession of blocks, one block for each channel burst.Ciphering modifies the contents of these blocks through a "secret code" known only by the mobile telephone and the Base Transceiver Station, thus protecting data from eavesdropping.Codec Type Mean Opinion ScoreRate (kb/s)(MOS)

PCM A law4.2564GSM EFR4.212.2CDMA 134.213D-AMPS48GSM FR3.813CDMA 83.48 QualityMOS Listening Effort Required

Excellent5 Complete relaxation possible, no effort. Good4 Attention necessary, no appreciable effort. Fair3 Moderate effort. Poor2 Considerable effort. Bad1 No meaning understood with feasible effort.Speech Quality Source Coding57Since each telecommunication system has its own intrinsic characteristics and limitations, specific voice CODECs have been designed for each system with the objective of achieving the best trade-off between voice quality, robustness to errors and network capacity. As a result, the voice quality differ from one system to another.The advent of new speech compression codecs for wireless systems has provoked intense interest in comparisons of subjective voice quality over these codecs. Estimates of subjective quality are typically given as Mean Opinion Scores (MOS) obtained from listening tests. Voice quality is a subjective parameter. By asking a group of normal telephone listeners to rate the quality of telephone speech samples, we can obtain an estimate of the quality that would be achieved on various types of connections. In particular, we use subjective listening tests to characterize the voice quality of speech compression codecs used in wireless and other systems where bandwidth efficiency is at a premium, because there are no objective measures that can estimate voice quality effectively.C20 ms20 msAA8A7A6A5B4B3B2B1B8B7B6B5C4C3C2C157 bitsInformation11CRLCRL33TailTail26 bitsTraining8 Bursts8 Sub blocksof 57 bits Source codingChannel codingInterleavingNormalburst20 msB456 bitsA456 bitsB456 bitsC57 bitsInformationA8B4A7B3A6B2A5B1B8C4B7C3B6C2B5C1Speech blocksCodec dependentCodec dependentCodec dependentChannel Processing in GSMOverview for Full Rate59After having transformed speech blocks (20 ms) into digital blocks, channel coding adds redundancy.The purpose of channel coding is to improve poor transmission quality due to disturbances such as noise, interference, or multipath propagation (resulting from the reflections of the transmitted signal from buildings, etc.).Channel coding consist in adding redundant information to the source data calculated from this source information:Convolutional codes and block codes: for correction purposes.Fire code: detection and correction of bursty errors.Parity code: error detection.Each channel has its own coding and interleaving scheme.A common structure of 456 (for full rate) or 228 (for half rate) coded bit is interleaved and mapped onto bursts.The blocks are interleaved and spread into segments which are combined with flags and a training sequence to build up the burst. Ciphering is applied to the bursts, and the resulting data is used to modulate the carriers.C20 ms20 msAA4A3A2A1B2B1B4B3C4C3C2C14 Bursts4 Sub blocksof 57 bits Source codingChannel codingInterleaving20 msB228 bitsA228 bitsB228 bitsCA4B2A3B1B4C2B3C1Speech blocksCodec dependentCodec dependentCodec dependentNormalburst012345670123456701234567Channel Processing in GSMOverview for Half Rate61For half rate, 20 ms of speech generate 112 bits of information (rate=5.6 kbits/s), that are coded into 228 bits (channel coding).Interleaving of these 228 bits is done on the same principle as per Full Rate but on four bursts instead of eight.0 1 2 3 4 5 6 7 8 ......452 453 454 45501234567 8 9101112131415 44844945045145245345445557 RowsDivide 456 bits in 8 sub-blocks7654321076540123reordering&partitioningoutdiagonalinterleaving456coded bitsburstb0b1b56b1b56b0bitinterleavingInterleaving: TCH Full Rate62After channel coding, speech coded information (TCH Full rate) are classified into 456 bits blocks. They are then spread into bursts.These 456 bits are reordered into a 8 x 57 array, line by line. The initially close bits are separated. The array is split into 8 columns of 57 bits. In this way, each 57 bits block contains bits which were all distant each other.Each 57 bits block shall be grouped with another one in order to create a burst which contains 114 information bits. Each of the 4 first blocks is grouped with each of the 4 last blocks of the previous segment. In the same way, each of the 4 last blocks is grouped with each of the 4 first blocks of the next segment.In a burst, containing 2 x 57 bits blocks, it is possible to increase bit spreading. The first block uses the even positions and the second one uses the odd positions inside the burst. The proximity of initially successive bits are now destroyed.Each speech block of 456 bits (20 ms) is so spread over 8 bursts.1 frame:4.615 ms01234567Guard15712657DATA156.25 bits duration(0.577 ms)Trainingsequence33DATA8.25SSGuardBandBurst148 bitsBurst FormattingNormal Burst63A basic unit of measure in transmission on a radio path is a burst, a series of 114 modulated bits of information. Bursts have a finite duration and occupy a finite part of the radio spectrum. Bursts are sent in time and frequency windows called slots.The normal burst shown in this slide is made of:Tail bits: three "0" bits at the beginning and end to help avoid loss of synchronization.Information: speech, data, and signaling.A training sequence: a list of bits known by the receiver allowing it to demodulate the burst.Stealing flags (S): indicate if information is either user's data (includes speech) or signaling data whenever the TCH has been stolen.A guard band: bits where nothing is transmitted to allow for overlap due to the variable distance from the mobile telephone to the Base Transceiver Station. This is necessary if the timing advance is not exactly right.Normal Burst bears traffic channels, its associated channel (slow and fast), Stand Alone, and the broadcast Control Channels (BCCHs).Synchronization Burst(SCH)TailDataExtended Training SequenceDataTail156.25 bits duration(0.577 ms)3 bits39 encrypted bits64 synchronization bits39 bits3 bits8.25 bitsGuard PeriodFrequency Correction Burst(FCCH)TailDataTail156.25 bits duration(0.577 ms)3 bits142 fixed bits (0)3 bits8.25 bitsGuard PeriodBurst Formats64Frequency correction burstThis burst is used for the frequency synchronization of a mobile station. The repeated transmission of Frequency Bursts is also called Frequency Correction Channel (FCCH). Tail bits as well as data bits are all set to 0. This corresponds to the broadcasting of an unmodulated carrier with a frequency shift of 1625/24 kHz above the nominal carrier frequency. This signal is periodically transmitted by the base station on the BCCH carrier frequency. Depending on the stability of its own reference clock, the mobile can periodically resynchronize with the base station using the FCCH.

Synchronization BurstThis burst is used to transmit information which allows the mobile station to synchronize time-wise with the BTS. Besides a long midamble, this burst contains the running number of the TDMA frame number. Repeated broadcasting of synchronization bursts is considered as the synchronization channel.Access BurstTailTrainingSequenceGuard PeriodTail156.25 bits (0.577 ms)8 bits36 encrypted bits68.25 bits3 bits41 synch bitsDataDummy BurstTailDummy SequenceTraining SequenceDummy SequenceTail3 bits58 mixed bits26 midamble bits58 mixed bits3 bits8.25 bitsGuard Period156.25 bits (0.577 ms)156.25 bits (0.577 ms)13 bits57 encrypted bits126 bits57 encrypted bits3 bits8.25 bitsTailDataTraining SequenceDataTailGuard PeriodNormal BurstBurst Formats65Normal burstA normal burst contains 26 bits for the training sequence, plus 2 x 58 bits for information. More precisely, there are twice x 57 information bits and two stealing flags, which indicate if information is traffic or signaling. There are also three tail bits, and 8.25 bits for the guard period.Dummy burstThe dummy burst structure is the same as for the normal burst. However, information bits are replaced by mixed bits: this burst is used to replace data if there is nothing to transmit. This is the case for BCCH and TCH filling when they are transmitted on the beacon frequency.Access burstAn access burst contains 41 bits for the training sequence, 36 bits for the information, 8 and 3 tail bits at respectively the beginning and the end of the burst. The guard period is of 68.25 bits. This burst is used for random access to the RACH without reservation. It has a guard period significantly longer then the other bursts. This reduces the probability of collisions, since the mobiles competing for the RACH are not (yet) synchronized.Plain data:0 1 1 1 0 0 1 0.....Ciphering sequence:0 0 0 1 1 0 1 0.....XOR:Ciphered data (transmitted):0 1 1 0 1 0 0 0.....Ciphered sequence: 0 0 0 1 1 0 1 0..... XOR: Recovered data:0 1 1 1 0 0 1 0.....DataSSDataBurst to betransmittedDataSSTrainingsequenceDataReceived burstCiphering66Ciphering, or encryption, is a procedure that provides additional security for the subscriber. Ciphering is not channel coding. It is performed after the encoding and interleaving of different channel and is done independently of whether the channel is a signaling channel or a traffic channel. Ciphering is only done on the two data segments.Ciphering is achieved by performing an exclusive OR (XOR) operation between a pseudo-random bit sequence (which was computed through the A5 algorithm by the ciphering key allocated to the user for a call and the burst number) and the 114 useful bits of a normal burst.Deciphering, in turn, applies exactly the same operation, since XOR twice with the same data leads back to the original value.Last, it is worth noting that the whole specification of the encryption algorithm (A5) is distributed under conditions by the Association of European Operators which have signed the GSM Memorandum of Understanding (MoU). GSM uses seven A5 types of algorithm:Encryption algorithm A5-1 which contains European and United States technical software that cannot directly or indirectly be exported to any embargoed or restricted country.Encryption algorithm A5-2 which contains software that does not require a license or approval.Encryption algorithms A5-3 to A5-7 not supported by Nortel.Home Location Register (HLR)Stores user data of all Subscribers related to the GMSCInternational Mobile Subscriber Identity(IMSI)Users telephone number (MS ISDN)Subscription information and servicesVLR addressReference to Authentication center for key (Ki)Referred when call comes from public land network

Visitor Location Register (VLR)Database that contains Subscriber parameters and location information for all mobile subscribers currently located in the geographical area controlled by that VLR Identity of Mobile SubscriberCopy of subscriber data from HLRGenerates and allocates a Temporary Mobile Subscriber Identity(TMSI)Location Area CodeProvides necessary data when mobile originates call

Authentication Center (AuC)Stores Subscriber authentication data called Ki, a copy of which is also stored in in the SIM cardGenerates security related parameters to authorize a subscriber (SRES-Signed RESponse)Generates unique data pattern called Cipher key (Kc) for user data encryptionProvides triplets - RAND, SRES & Kc, to the HLR on request.

EIR (Equipment Identity Register)EIR is a database that contains a list of all valid mobile station equipment within the network, where each mobile station is identified by its International Mobile Equipment Identity(IMEI).EIR has three databases.,White list - For all known,good IMEIsBlack list - For all bad or stolen handsetsGrey list - For handsets/IMEIs that are on observationLocation Area IdentityLAI identifies a location area which is a group of cells.. It is transmitted in the BCCH. When the MS moves into another LA (detected by monitoring LAI transmitted on the BCCH) it must perform a LU. LAI = MCC + MNC + LAC MCC= Mobile Country Code(3 digits), identifies the countryMNC= Mobile Network Code(1-2 digits), identifies the GSM-PLMNLAC= Location Area Code, identifies a location area within a GSM PLMN network. The maximum length of LAC is 16 bits,enabling 65536 different location areas to be defined in one GSM PLMN.

Interfaces and Protocols

UmAbisACBEDFDigital NetworksPOTSTUPISUPMAPMAPMAPBSSAPLAPDLAPDmGGSM ProtocolsCM - Connection ManagementMM- Mobility ManagementRR - Radio resource LAPDm - LAPD for mobileLAPD - Link Access Procedure for D channelBTSM- BTS Management PartBSSAP - BSS Application Part (BSC - MSC)DTAP - Direct Transfer Application Part (MS - MSC)MAP - Mobile Application PartMTP - Message Transfer part of SS7SCCP - Signalling Connection Control Part of SS7TCAP - Transaction Capabilities Application PartISUP- ISDN User PartChannels : differentiating between Physical and Logical channelsPhysical channels : The combination of an ARFCN and a time slot defines a physical channel.

Logical channels : These are channels specified by GSM which are mapped on physical channels.Physical channel:One timeslot of a TDMA-frame on one carrier is referred to as a physical channel. There are 8 physical channels per carrier in GSM,channel 0-7(timeslot 0-7)

Logical channel:A great variety of information must be transmitted between BTS and the MS,for e.g. user data and control signaling.Depending on the kind of information transmitted we refer to different logical channels.These logical channels are mapped on physical channel.Channel conceptLogical Channels on Air interfaceLOGICALCHANNELSCOMMONCHANNELSDEDICATED CHANNELSBROADCAST CHANNELSCOMMONCONTROLCHANNELSDEDICATED CONTROL CHANNELS TRAFFIC CHANNELSFCCHBCCHSCHSDCCHSACCHFACCHPCHAGCHRACHTCH/FTCH/EFRTCH/HFCCHLogical channelsLogical channelsControl channelsTraffic channels BCHCCCHDCCHHalf rateFullrateSCHBCCHPCHAGCHRACHSDCCHSACCHFACCHCBCHBroadcast channels BCH Broadcast Channel-BCH Alloted one ARFCN & is ON all the time in every cell. Present in TS0 and other 7 TS used by TCH.Frequency correction channel-FCCH To make sure this is the BCCH carrier.Allow the MS to synchronize to the frequency.Carries a 142 bit zero sequence and repeats once in every 10 frames on the BCH.Synchronization Channel-SCHThis is used by the MS to synchronize to the TDMA frame structure within the particular cell.Listening to the SCH the MS receives the TDMA frame number and also the BSIC ( in the coded part- 39 bits).Repeats once in every 10 frames.Broadcast channels BCH ...BCCHThe last information the MS must receive in order to receive calls or make calls is some information concerning the cell. This is BCCH.This include the information of Max power allowed in the cell.List of channels in use in the cell.BCCH carriers for the neighboring cells,Location Area Identity etc.BCCH occupies 4 frames (normal bursts) on BCH and repeats once every Multiframe.This is transmitted Downlink point to multipoint.Cell Broadcast Channel - CBCHUsed for the Transmission of generally accessible information like Short Message Services(SMS)

Common Control Channels CCCHCCCH- Shares TS-0 with BCH on a Multiframe.Random access channel-RACH:Used by Mobile Station for requesting for a channel. When the mobile realizes it is paged it answers by requesting a signaling channel (SDCCH) on RACH. RACH is also used by the MS if it wants to originate a call.Initially MS doesnt know the path delay (timing advance), hence uses a short burst (with a large guard period = 68.25 bits).MS sends normal burst only after getting the timing advance info on the SACCH.It is transmitted in Uplink point to point.Common Control Channels CCCH ..Access Grant Channel-AGCHOn request for a signaling channel by MS the network assigns a signaling channel(SDCCH) through AGCH. AGCH is transmitted on the downlink point to point.Paging Channel-PCHThe information on this channel is a paging message including the MSs identity(IMSI/TMSI).This is transmitted on Downlink, point-to-multipoint.

Dedicated Control Channels-DCCHStand alone dedicated control channel(SDCCH)AGCH assigns SDCCH as signaling channel on request by MS.The MS is informed about which frequency(ARFCN) & timeslot to use for traffic. Used for location update, subscriber authentication, ciphering information, equipment validation and assignment of TCH.This is used both sides, up and Downlink point-point.

Dedicated Control Channels-DCCHSlow associated control channel-SACCHTransmission of radio link signal measurement, power control etc.Average signal strengths(RXLev) and quality of service (RXQual) of the serving base station and of the neighboring cells is sent on SACCH (on uplink).Mobile receives information like what TX power it has to transmit and the timing advance. It is associated with TCH or SDCCHFast associated control channel-FACCHUsed for Hand over commands and during call setup and release. FACCH data is sent over TCH with stealing flag setTraffic Channels-TCHTCH carries the voice data.Two blocks of 57 bits contain voice data in the normal burst.One TCH is allocated for every active call.Full rate traffic channel occupies one physical channel(one TS on a carrier) and carries voice data at 13kbpsTwo half rate (6.5kbps) TCHs can share one physical channel.

GSM Radio LinkSpeech Coding -Done at Transcoder of BSC and MSThe Linear Predictive Coder uses RPE-LTP(Regular Pulse Excitation- Long Term Prediction)Converts 64kbps voice to 13kbps(260 bits every 20ms)Channel Coding - Done at BTS and MSUses Convolution Coding and CRC (Cyclic Redundancy Check)Converts 13 kbps to 22.8 kbps (456 bits per 20ms)GSM Radio LinkBit Interleaving - Done at BTS and MSEncryption - Done at BTS and MS EX OR data with cipher block, which is generated by applying A5 Algorithm to the Ciphering Key(Kc)Multiplexing - Done at BTS Modulation - Done at BTS and MS GMSK(Gaussian filtered Minimum Shift Keying)Phase change of +90 for 0 and -90 for 1 SPEECHTRANSMISSIONBETWEEN MOBILEAND NETWORKBSSMSSPEECH MUST BE DIGITIZED AND CODED64 kbit/sBetter QualityLower RateWhy Digitizing and Coding the Speech?

56Speech is the most important feature that the mobile must process. The transmission path has to provide the highest speech quality possible for the user.In wireless communication, the best way to detect and correct errors introduced by the transmission path is to process a digital signal. Then, by threshold comparisons, we can recover the binary information with an acceptable quality, compared to an analog transmission.Telephony bandwidth is from 300 to 3400 Hz. The sampling frequency is 8 kHz.The perceived speech quality after coding in a GSM network shall remain as close as possible to the one perceived in the classical fixed telephony network (PSTN).Speech CodingBPA/DSPEECHENCODERCHANNEL CODINGLPD/ASPEECHDECODERCHANNEL DECODINGBAND PASS300 Hz - 3.4 kHZEvery 125 s value issampled from analog signal and quantised by 13 bit wordData rate = 13/125*10 -6 = 104 kbpsEvery 20ms 160 samples takenData rate = 160 * 13/20ms = 104 kbpsLinear Predictive Coding & Regular Pulse Excitation Analysis1. Generates 160 filter coeff2. These blocks sorted in 4 sequence 1,5,9,37 / 2,6,10----38/ 3,7,1139/8,12,16403. Selects the sequence with most energy

So data rate = 104/4 = 26 kbpsLong term prediction analysis1. Previous sequences stored in memory2. Find out the correlation between the present seq. And previous sequences3. Select the highest correlation sequence4. Find a value representing the differencebetween the two sequences.

Reduces data rate = 26 kbps/2 = 13 kbpsie 260 bits in 20ms50132781A1B21A = Filter Coeff block ampl, LTP params1B = RPE pointers &pulses2 = RPE pulse & filterparams50313243 crc bitsFour 0 bits for codec378 coded bitsConv coding rate = 1/2 delay = 478456 bits in 20 ms = 22.8 kbps57 x 8 = 456To modulator

Interleaving5757575757575757575757575757575757575757575757575757575757575757575757575757575757575757575757575757575757575757Encoded speech blocks - Diagonal InterleavingEven bitsOdd bitsTb 3Coded Data 57F 1Training Sequence26F 1Coded Data 57Tb 3Gp8.25Bn-4 Bn-3 Bn-2 Bn-1 Bn Bn+1 Bn+2 Bn+3 575757575757575757575757575757575757575757575757575757575757575757575757575757575757575757575757Encoded control channel blocks - Rectangular InterleavingEven bitsOdd bitsBn-4 Bn-3 Bn-2 Bn-1 Bn Bn+1 Bn+2 Bn+3

BurstThe information format transmitted during one timeslot in the TDMA frame is called a burst.Different Types of BurstsNormal BurstRandom Access BurstFrequency Correction BurstSynchronization Burst

Normal BurstT3Coded Data57S1T. Seq.26S1Coded Data57T3GP8.25Tail Bit(T):Used as Guard TimeCoded Data :It is the Data part associated with the burstStealing Flag:This indicates whether the burst is carrying Signaling data (FACCH) or user info (TCH).Training Seq.:This is a fixed bit sequence known both to the BTS & the MS.This takes care of the signal deterioration.

156.25 bits 0.577 msT3Training Sequence41Coded Data36T3GP68.25Random Access BurstT3Fixed Bit Sequence142T3GP8.25T3Coded Data39 Training Sequence64CodedData 39T3GP8.25Freq. Correc. BurstSynchronization Burst156.25 bits 0.577 ms156.25 bits 0.577 ms156.25 bits 0.577 msTransmission on the radio channels A timeslot has a duration of .577 m seconds (148 Bits) 8 timeslots(8 x 0.577 = 4.62 ms) form a TDMA frame If a mobile is assigned one TS it transmits only in this time slot and stays idle for the other 7 with its transmitter off, called bursting The start on the uplink is delayed from downlink by 3 TS periods One TS = duration of 156.25 bits, and its physical contents is called a burst 01234567012345670123456701234567DownlinkBTS > MSUplinkMS > BTSOffset0123456701234567MS1 nearMS2far0123456701234567AtBTS01234567MS1 near01234567MS2far0123456701234567AtBTSTiming AdvanceFrames Types On Um InterfaceTDMA Frame 8 Time slots (Burst Period)Length is 4.62 ms(8 * 0.577ms) 26-TDMA Multiframe26 TDMA Frames (24 TCH, SACCH, Idle)120 ms (26 * 4.62ms)51-TDMA Multiframe26 TDMA Frames (FCCH, SCH, BCCH, SDCCH, CCCH)235.6 ms (51 * 4.62ms)Frames Types On Um InterfaceSuper Frame51* 26 TDMA Frames6.12 SHyper Frame2048 * 51* 26 TDMA Frames3 Hours, 28 Minutes, 53 Secs and 760 msTOPICSGSM CONCEPTSGSM SYSTEM ARCHITECTUREGSM CHANNELSGSM RADIO LINKMOBILITY MANAGEMENTCALL MANAGEMENTRADIO RESOURCE MANAGEMENTMobility ManagementMobility Management (MM)Location updating- normal,periodic, IMSI attachPagingSecurity ManagementPreventing unauthorized users- authenticationMaintaining Privacy of users- cipheringProviding roaming facilityMM functionality mainly handled by MS, HLR, MSC/VLR.

Network AttachmentCell IdentificationMS scans complete GSM frequency band for highest powerTunes to highest powered frequency and looks for FCCH. Synchronizes in frequency domainGet training sequence from SCH which follows FCCH. Synchronizes in time domain.Accesses BCCH for network id, location area and frequencies of the neighboring cells. Stores a list of 30 BCCH channels

Network Attachment..PLMN SelectionGet the operator information from SIM.Cell SelectionSelected cell should be a cell of the selected PLMNSignal strength should be above the threshold.Cell should not be barredLocation UpdateRegister with the network by means of location updation procedures.

MS BTS BSC (G)MSC VLR HLR ActionChannel Request (RACH)

Channel Assignment (AGCH)Authentication Request (SDCCH)Authentication Response (SDCCH)Comparison of Authentication paramsAccept LUP and allocTMSI (SDCCH)Ack of LUP and TMSI (SDCCH)Entry of new area and identity into VLR and HLRChannel Release (SDCCH)MS Location Update (registration) Location Update Request (SDCCH)TMSI + old LAISecurity - AuthenticationAuthentication center provides RAND to MobileAuC generates SRES using Ki of subscriber and RANDMobile generates SRES using Ki and RANDMobile transmits SRES to BTSBTS compares received SRES with one generated by AuCMSKiRANDA3SRES

RANDSRESSRESAuth ResultAuCBTSMSSecurity - CipheringData sent on air interface ciphered for security A5 and A8 algorithms used to cipher dataCiphering Key is never transmitted on airMSKiRANDA8KcMSNetworkUm interfaceA5A5KcKcDataDataCipheredDataCommunication Management (CM)Setup of calls between users on requestRouting function i.e. Choice of transmission segments linking usersPoint to Point Short message services

GSM ActorsPublicSwitchedTelephoneNetwork

BTSBSSBSCFixed subscriberMobile subscriberAUCHLRVLR

MSCNSS

83The above slides show the GSM actors that are involved in the following procedures.

PLMN SelectionNoautomatic modeThe MS selects the first PLMN from the preferred PLMNs list (if it is not in the forbidden PLMNs list)The user selects a PLMN from the displayed PLMNsmanual modeYesYesCreation of a found PLMN listIs there an up to date found PLMNs list?End of PLMN selectionYesNo (automatic)Cell Selection succeed?Selection of the next preferred possible PLMNNo (manual)84Generally, a user remains in his home PLMN (HPLMN). When the MS is switched on, the selected PLMN is the nominal PLMN and the first beacon frequency found belongs to this PLMN. There is no PLMN selection procedure.When the user roams, the MS checks the beacon frequencies of the previous existing. This check fails because the detected beacon frequencies do not belong to the selected PLMN (HPLMN). The MS must select a new PLMN. This operation consists in finding the existing PLMNs. The MS does a normal selection on all the GSM frequencies, checks the beacon frequencies, and reads the PLMN number on the BCCH channel. If the MS has already done this check, the MS can try first the registered PLMN before. There are two ways to select a network in the found PLMN list:automatic mode: a list of networks classified by priority order (the preferred PLMN list) is stored in the SIM card. The list allows the MS to select the available network with the highest priority,manual mode: the MS displays the list of available networks (found PLMN list) so that a PLMN may be selected by the user.Listen to all the frequencies of the GSM spectrum:power level measurement and average on these measurementsSelect the best frequencies according to the power level(124 channels in GSM 900, 374 in GSM 1800and 299 in GSM 1900(30 in GSM 900 and 40 in GSM 1800)Memorize the beacon frequencies in the precedent selection => Create the Found PLMN listPLMN SelectionConstitution of the "Found PLMN list"85When switched on, a MS must be available as soon as possible. Therefore, the selection of a PLMN and a cell is really optimized because, during this time, the user can not use his MS. When there is no existing beacon frequencies list stored in the SIM card (neither a list of the latest neighboring cells, nor a list of found PLMNs), the MS:checks all the frequencies of the GSM spectrum (124 frequencies in GSM 900, 374 in GSM 1800, 299 in GSM 1900),measures their level (averaging done at least on 5 measurements during at least 3 seconds [GSM 05.08]),selects the 30 frequencies (in GSM 900, 40 in GSM 1800) with the highest level,selects the frequencies corresponding to a beacon frequency (FCCH and SCH channels),creates the found PLMN list (PLMN name corresponding to the beacon frequencies).Suitable cell:

- cell of the selected PLMN- cell not barred- C1 > 0Eligible cellList of the frequencies of the selected PLMNIMSI AttachLook for the cell with the best C1 in the suitable cells listEligible cell?YesSelection of another PLMNNoC1 Computation for eligible cellsSuitable cell?YesNoInitial Cell SelectionRejected?YesPLMN set in the forbiddenPLMN listEnd of Cell SelectionNo86Phase 1 MSThe MS searches a suitable cell in the previous list. The first beacon frequency studied is the first frequency of the list i.e. the frequency with the best level.A suitable cell is a cell:of the selected PLMN,not barred,complying with the C1 criterion (C1 > 0).When a suitable cell is found, an IMSI attach is performed if necessary.

Phase 2 MS2 lists of cells are created, according to the priority level for selection (normal/low). In both lists, the cells are classified from the best to the worst C1 received. The MS first scans the normal priority list, and if no cell is suitable, the MS considers the second list (low priority).Since a dual band MS is at least a phase 2 MS, this procedure is also used by dual band MS in dual band networks, and the MS selects the best suitable cell independently of the band.The principle applied to each list is the same as described for phase 1 MS.Cell SelectionBTS-2BTS-1This cellBTS-3BTS-4BTS-511112345Purpose: get synchronization with the GSM network prior establishing any communication.FCCHSCHBCCH1

871-Provided a SIM card is present, immediately after tuning on power, the MS starts the search of BCCH carriers. Normally, the MS has a stored list of 32 carriers of the current network. Signal level measurements (RXLEV) are done on each of these frequencies. If no list is available, all GSM frequencies have to be measured to find potential BCCH carriers.2-After having found potential candidates based on the received signal level, each carrier is investigated for the presence of FCCH signal, beginning with the strongest signal. In the above slide, the strongest signal comes from BTS1.3-The synchronization burst of the SCH in the TDMA frame immediately following the FCCH burst has a long training sequence of 64 bits which is used for fine tuning of the frequency correction and time synchronization. This way the MS is able to read and decode the BSIC and the RFN.4-The MS can now reads data from broadcast channel (BCCH).5-The MS camps on this BCCH if it is suitable for the MS; otherwise it tries to select the next strongest beacon carrier.Immediate AssignmentMSBSCMSC CM SERVICE REQUESTSDCCH or TCH6CHANNEL REQUESTRACH1BTSCHANNEL REQUIRED2CHANNEL ACTIVATION3IMMEDIATE ASSIGNMENTAGCH5IMMEDIATE ASSIGNMENTCOMMAND5CHANNEL ACTIVATIONACK.4ImmediateAssignmentLOCATION UPDAT. REQU.SDCCH or TCH6OR

88The Immediate Assignment procedure is always initiated by the MS and may be triggered by a Paging Request or by a Mobile Originating Service request.Procedure1- The MS sends a CHANNEL REQUEST message (RACH).2- The BTS decodes this message and indicates it to BSC through CHANNEL REQUIRED message.3- The BSC asks the BTS to activate a dedicated channel: SDCCH or TCH (if no SDCCH available).4- Acknowledgement by the BTS5- The BSC sends an IMMEDIATE ASSIGNMENT COMMAND message to the MS (via the BTS); the MS has to seize the indicated dedicated channel including these values: initial Timing Advance and initial maximum transmission power.6- Then the MS can request a service on the dedicated channel through: LOCATION UPDATING REQUEST message for location.SERVICE REQUEST message including the access reason (call setup, paging etc.),Etc..Registration: the Very First Location UpdateLAIHLRIMSIVLR idTMSIIMSITMSIReleaseVLRIMSITMSILAIMSCBTSBSSBSC245261245634TMSI5

891- Channel allocation (Connection request procedure):the MS sends (on RACH) a CHANNEL REQUEST message,the network responds with IMMEDIATE ASSIGNMENT (assigns a dedicated channel).2- The MS sends a LOCATION UPDATING REQUEST message to the BSS, with the IMSI.3- The VLR stores the LAI of the MS and informs the HLR which:stores the VLR identity, downloads the subscriber profile, if the MS is allowed to roam.4- The VLR triggers and monitors the Authentication procedure and can also activate Ciphering procedure.5- The VLR may assign a TMSI and sends it to the MS in the LOCATION UPDATING ACCEPT message.6- The MSC releases the connection.Intra VLR Location UpdateVLRIMSITMSILAI1234 new TMSITMSI + old LAI23423TMSINew TMSINew LAIMSCBTSBSSBSCIMSI not Required

901-Channel allocation (Connection request procedure).2-The MS sends a LOCATION UPDATING REQUEST message to the BSS (with the TMSI and the old LAI), relayed to the VLR through the MSC.3-The VLR stores the new Location Area Identity, then if require, assigns a new TMSI and responds to the MS with a LOCATION UPDATING ACCEPT message.4-The MSC releases the connection.New LAI newTMSITMSI + old LAITMSINew TMSIMSCBSSBTSBSC12572572IMSI,TMSILAINew VLRIMSI, TMSIOld LAIOld VLRRAND, SRES, KcHLRnew VLR idsubscriberdata34665IMSI not RequiredRAND, SRES, Kc

Inter VLR Location Update911-Channel allocation (connection request procedure).2-The MS sends a LOCATION UPDATING REQUEST message to BSS, (with the TMSI + old LAI) relayed to the VLR through MSC.3-The new VLR asks the old VLR for the MS identity and ciphering items.4-The old VLR backs new VLR IMSI, RAND, SRES, Kc.5-The new VLR assigns a TMSI and sends it to the MS over a LOCATION UPDATING ACCEPT message (with cipher mode if required).6-The new VLR informs the HLR which sends subscriber data and asks the old VLR to erase the previous MS data.7-The MSC releases connection.MSCBTSBSSBSCVLR

345461CHANNELREQUEST2IMMEDIATEASSIGNMENTLOCATION UPDATINGREQUEST (IMSI Attach)35LOCATION UPDATINGACCEPT (LAC, TMSI)4AuthenticationProcedure

IMSI Attach92The IMSI attach procedure is used (if required by the network), to indicate the IMSI as active in the network and is performed by using the Location updating procedure.Procedure1- MS requests (on a RACH) a dedicated channel with CHANNEL REQUEST message using a random number.2- BSS assigns a dedicated channel (on a AGCH) with IMMEDIATE ASSIGNMENT message using this random number.3- MS sends (over this dedicated channel) a LOCATION UPDATING REQUEST message including its identity and the IMSI Attach cause.4- Authentication procedure (if required by the network).5- The MSC responds by sending a LOCATION UPDATING ACCEPT message.6- In the VLR, a flag is set to indicate that the subscriber is active.

This procedure is used only if the update status is updated and if the stored LAI is the same as the one which is actually broadcast on the BCCH of the current serving cell.MSCBTSBSSBSCVLR

1CHANNELREQUEST2IMMEDIATEASSIGNMENTIMSI DETach INDication34CHANNELRELEASEIMSI DETach INDication3

IMSI Detach93The IMSI detach procedure may be invoked by a MS:if the MS is switched off,if the SIM card is detached. Procedure1- The MS requests (on a RACH) a dedicated channel with CHANNEL REQUEST message.2- The BSS assigns a dedicated channel (on a AGCH) with an IMMEDIATE ASSIGNMENT message.3- The MS sends an IMSI DETach INDication message to the VLR.4- The VLR sets a flag to indicate that this MS is no longer available; no paging will be done to that MS until an IMSI ATTach occurs.FTGreat BritainFranceGermanyTelephonenetworkTerminatingMSCBSCBTSBSSVLR

GatewayMSC

HLR

Outgoing Call94A France Telecom mobile subscriber, registered in the French HLR, is currently roaming in Great Britain. He wants to call a friend in Germany on the fixed line: how is the communication established?ACM = Address Complete Message ANM = ANswer MessageIAM = Initial Address MessageMSBSSMSCCHANNEL REQUEST1PSTNCM SERVICE REQUEST2CM SERVICE REQUEST2CALL PROCEEDING7CALL PROCEEDING7Assignment procedure7IAM6

IMMEDIATE ASSIGNMENT2ACM8VLRRingANM10ALERTING9SETUP (basic) orEMERGENCY4SETUP4CONNECT11CONNECT ACKnowledge11Authentication procedure3Ciphering procedure35DialingRingingPathEstablishedRingingSendingNumberMobile Originating Call951-The MS originates the call by sending a CHANNEL REQUEST message (on RACH).2-Immediate assignment: channel allocation with TCH / FACCH or SDCCH.3-The VLR launches authentication (if required) and completes ciphering.4-The MS initiates call establishment by sending a SETUP message (called party number) to the MSC.5-The MSC in turn checks mobile subscriber capabilities with VLR for desired service.6-If it agrees, the MSC relays the called number over an ISUP Initial Address Message.7-The MSC also sends a CALL PROCEEDING message to the MS (assigning TCH / FACCH EA in case of Early Assignment).8-Recipient PSTN switch rings the land telephone and returns an ISUP Address Complete Message to the MSC.9-Upon receiving this message, the MSC alerts the MS with an ALERTING message.10-The Called party goes off hook, and the PSTN sends an ISUP ANswer Message to the MSC. The MSC then connects the MS (assigning a TCH in case of OACSU).11-The call is accepted (CONNECT/CONNECT ACK) and the conversation starts.In case of Emergency MO Call, the SETUP message (basic call) is replaced by the EMERGENCY one.PSTNLA1LA2BTS11BTS21BTS22BTS31BTS12BTS23HLR43512566BSC1BSC2BSC3MSC/VLRGMSCMobile Terminating Call1 - Paging Principle96The main difference with an MO Call procedure is the Paging of the Mobile Station.When the MS is in Idle mode, the network does not know the cell, but only the Location Area where the MS is located.Since RR sessions are only established at the request of the MS, the role of the Paging procedure is to trigger that operation.Principle1-A call from the fixed network (PSTN) is switched to the Gateway MSC (GMSC).2-The GMSC retrieves from the HLR, the identity of the MSC/VLR (or Visitor MSC) handling the Location Area of the Mobile Station.3-The GMSC routes the call to the VMSC.4-The VMSC reads the LA where the MS is located into its VLR.5-The VMSC sends instructions to one or several BSC (BSC1 and BSC2) to page the MS in the different cells of LA1.6-BSC1 and BSC2 page the MS in the BTSs of the Location Area LA1. (BTS11, BTS12, BTS21).GMSC and VMSC are software functions.Use of MSRN = the only case in GSM where a circuit is established before the call is answered.VMSCBSSVLR

Visitor PLMNGMSCHLRHome PLMNRoutingInformation(MSRN)6IAM:Initial Address MessageMSISDN:Mobile Station Integrated Services Digital network NumberMSRN:Mobile Station Roaming NumberIMSI:International Mobile Subscriber IdentityGMSC:Gateway MSCVMSC:Visitor MSCTMSI:Temporary Mobile Subscriber IdentityPNInternationalSS7ISDNIAM (MSRN)7IAM(MSISDN)2SendRoutingInformation(MSISDN)3Provide Roaming Number (IMSI)4PAGE(TMSI + LA)9Send info to I/C(MSRN)8Roaming Number (MSRN)5PAGINGREQUEST(TMSI + LA)10PAGINGREQUEST(TMSI)11MSISDN1

Mobile Terminating Call2 - Detailed Procedure97Procedure1-The calling subscriber accesses the ISDN by dialing an MS-ISDN number.2-Transmission of the MS-ISDN number to the GMSC through IAM (Initial Address Message).3-Transmission of the MS-ISDN number to the HLR through SRI (Send Routing Information).4-The HLR interrogates the VLR (Visitor MSC) that is currently serving the user.5-The VLR returns a routing number (MSRN) to the HLR, which passes it back to the GMSC.6-The MSRN is transmitted to the GMSC (address of appropriate VMSC).7-The GMSC calls the VMSC through an IAM (with MSRN).8-The MSC asks the VLR to establish where the called party is located.9-The VLR gives location information (LA) to the MSC with a PAGE message.10-The VMSC alerts all BSCs in charge of cells belonging to this LA,with a PAGING REQUEST message.11-All the BTSs page the MS over a PCH; depending upon the paging type message, up to fourdifferent TMSI may be contained in the page command.MSBSSVMSCCHANNEL REQUEST(LAC, Cell ID)5PSTNIMMEDIATE ASSIGNMENT(SDCCH or TCH)6PAGING REQUEST4PAGING REQUEST (TMSI or IMSI, LA)3GMSCIAM(MSISDN)1IAM(MSRN)2CM SERVICE REQUEST(Paging Response)7PAGING RESPONSE (TMSI or IMSI, LA)7Authentication procedure8Ciphering procedure9Address Complete Message11ANswer Message12Setup, Assignment, Alerting10CONNECT12DialingRingingPathEstablishedMobile Terminating Call3 - End to End Procedure98Procedure1-PSTN sends an IAM (with the MSISDN) to the GMSC.2-GMSC sends an IAM (with the MSRN) to the VMSC.3-The VMSC sends a PAGING REQUEST MM message to the BSS.4-The BSS sends a PAGING REQUEST (with IMSI or TMSI) to the MS. 5-The MS must request a channel (CHANNEL REQUEST message with paging cause) over the RACH, within 0.5 second. 6-The BSS complies and assigns a dedicated channel (on AGCH) to the MS with IMMEDIATE ASSIGNMENT message.7-The MS sends a PAGING RESPONSE to the VMSC via the BSS.8/9-Authentication and Ciphering procedures (if required).10-Setup, Assignment, Alerting procedures (see MS Originating Call).11-Alerting is sent to the PSTN with an ACM (ISUP message).12-CONNECT and ANM messages are sent to the PSTN. The call is completed.MSBSSMSCCall in progress1RELEASE COMPLETE4PSTNDISCONNECT2DISCONNECT2RELEASE3RELEASE3RF Channel Release procedure8Release5

RELEASE INDICATION7CHANNEL RELEASE6Releasetone9Call Release1 - Mobile Initiated99Call release can be initiated by either the PSTN user or the mobile user. The BSC is responsible for BSS resources, and the MSC is responsible for the NSS and PSTN connection.Procedure1- The call is currently in progress.2- The MS initiates the release of a call by sending a DISCONNECT message to the MSC.3- The MSC returns a RELEASE message to the MS.4- The MS acknowledges with a RELEASE COMPLETE message.5- The MSC can send the Release message to the PSTN without waiting for the RELEASE COMPLETE MM message from the MS.6- The BSC requests the MS to return to Idle mode with CHANNEL RELEASE message.7- The BTS informs the BSC with RELEASE INDICATION that the signaling link is disconnected.8- BSC requests the BTS to de-activate the RF Channel (TCH): Channel Release.9- The PSTN informs the land terminal with the appropriate tone.Abnormal termination is monitored by a set of timers (operator configurable) to ensure that resources are not unused/unavailable.PSTNOn hookPurpose:informs the mobilethen releases radio and network resources.RELRLCMSCBTSBSSBSC1111233455462

Call Release2 - PSTN Initiated100Procedure1-The call is in progress.2-The release process starts with an ISUP Release message from the land network.3-Upon receiving this message, the MSC initiates the release of the call by sending a DISCONNECT message to the MS.4-The MS replies by sending a RELEASE CHANNEL message to the MSC.5/6-The MSC in turn, sends a RELEASE COMPLETE message back to the MS and sends a Release Complete message to the PSTN.Mobile Originated CallRequest for ServiceAuthenticationCipheringEquipment ValidationCall SetupHandoversCall Release

Mobile Terminated CallPagingAuthenticationCipheringEquipment ValidationCall SetupHandoversCall Release

Mobile Terminated Call

MSMS

BTSBTSBTSBSCBSCMSCVLRGMSCHLRPSTNEIRAuCLand to Mobile call(MSISDN)Query forVLR infoReply(MSRN)Routeto MSC

Query VLR for LAC andTMSIPagingthe area(+TMSI)TMSI Pagedon PCHPagingCh. REQover RACHAllocate SDCCHover AGCHPage RESP on SDCCH ( TMSI + LAI)Page RES Page RESAuthentication and Ciphering procedure done as seen in Location UpdationAssign. REQ

Assignment CMD(=TCH) on SDCCH* MS tunes* Assgn CMP* Phone ringsConnect traffic Ch.to trunkfrees SDCCHAssgn CMP

Network AlertingTOPICSGSM CONCEPTSGSM SYSTEM ARCHITECTUREGSM CHANNELSGSM RADIO LINKMOBILITY MANAGEMENTCALL MANAGEMENTRADIO RESOURCE MANAGEMENTRadio Resource ManagementEstablish maintain and release stable connections between MS and MSCManage Limited Radio and Terrestrial resourcesHandover process is the sole responsibility of the RR LayerFunctions of RR layer are performed by MS and BSC and partly by MSCRadio Resource ManagementPower ControlHand over ControlDiscontinuous TransmissionFrequency Hopping

BTS commands MS at differentdistances to use different power levelsso that the power arriving at the BTSs Rx isapproximately the same for each TS

- Reduce interference- Longer battery life

Power ControlHandoverMeans to continue a call even a mobile crosses the border of one cell to another Procedure which made the mobile station really roamHandover causesRxLev (Signal strength , uplink or downlink)RxQual (BER on data)O & M interventionTiming AdvanceTraffic or Load balancingHandover TypesInternal Handover (Intra-BSS)Within same base station - intra cellBetween different base stations - inter cellExternal Handover (Inter-BSS)Within same MSC -intra MSCBetween different MSCs - inter-MSCHandover TypesBSCBSCBSCBSCMSCMSCGMSCC-1C-2C-3C-4

Periodic Measurement Reports (SACCH)Periodic Measurement ReportsHO requiredActivate TCH(facch)with HoRef#

if 1. Check for HO passed2. Channel avail in new BTSAcknowledges and alloctes TCH (facch)

HO cmd with HoRef#Receives new BTS data(FACCH)

MS tunes into new frequency and TS and sends HO message to new BTS (facch)Periodic Measurement Reports (SACCH) HO performedRelease TCHCell 1Cell 2BSCBTS 1BTS 2Intra BSC handoverFrequency plan and importance of BCCH B3B2B9B6B4B1Sectored antennasMS ( monitoring the broadcast radio B1 in idle mode )FSBBBB..FS....IF0F50F2F3F4F5F10F11F1F,S,B exist in time slot 0 of each frame

B7B8B5B10B11B12BPL frequency plan:Broadcast frequencies : 15 Broadcast channels = 48-62 15 Hopping channels = 32-46

What information does Broadcast Control channel (BCCH) contain? Serves as a Beacon for the Cell Country Code (CC) and the Network Code (NC) Location Area Identity (LAI) List of neighboring cells which should be monitored by MS List of frequencies used in the cell Cell identityBackLocation UpdatesLocation Updates can be classified into two:

Periodic Location Updates:This occurs as per the timer set by the network operator. If the MS does not perform this update the MSC marks the MS as Detached on the VLR.

Location Update on a handover:This occurs if during a handover the MS is moved into a new Location Area Code (LAC).

BackThe MS is monitoring the BCCH and has all the decoded information stored on the SIM ( including the LAC) As soon as the mobile is on a TCH it sends the signal strength indication on the corresponding SACCH The BSC monitors the signal strengths and on analysis sends a handoff request on FACCH. The handoff process is completed on the FACCH. After the completion of call, the MS starts monitoring the BCCH again. On finding the LAC (stored on SIM) and that decoded from the BCCH to be different , the MS requests a Location Update through SDCCH. Discontinuous Transmission Discontinuous Transmission(DTX) allows the radio transmitter to be switched off most of the time during speech pauses.A Silence Indicator Block is transmitted at 500bps, which generates a comfort noiseDown Link interference is decreased.Up link battery is savedFrequency HoppingFrequency Hopping permits the dynamic switching of radio links from one carrier frequency to another.Base Band HoppingAt the BTS each the timeslot is shifted to another transceiver, which is transmitting at the hop frequency. User will be connected to different Transceivers depending on hop sequence.Synthesis HoppingAt the BTS transceiver changes the frequencies used. The user will be connected to only one transceiver.Decreases the probability of interferenceSuppresses the effect of Rayleigh fadingWireless Data989920002001GSMDATAHSCSDGPRSEDGEUMTSSIMToolkitWAPData ApplicationTimeCircuit Switched technologyPacket Switched technologyTechnology for ApplicationsSMS Data: 160 -numeric charactersUser Data Rate : 9.6kbpsOne time slot over the air interfaceHigh Speed Circuit Switched DataUser Data Rate:14.5kbpsUse multiple timeslots (max=8), hence max rate = 115.2kbps.Needs a duplexor in MS for simultaneous Tx and Rx

Add-on to GSM network : PCU; Packet Segmentation/re-assembly and scheduling Radio channel access control and management Transmission error detection and retransmission. Power controlSGSN: GPRS mobility Encryption Charging GGSN : Interface to the PDN, Internet

Max user data rate : 21.4 kbpsDynamic rate adaptation to suit the radio conditions at that time ( 9.05 kbps, 13.4 kbps, 15.6 kbps 21.4 kbps)W@P GatewayW@P ServiceW@P

FoneInternetMobile NetworkSurf the Internet while on the move

W@P Gateway : Adaptation of the information to the mobile Compression of the data Buffering of the informationEnhanced Data rate for GSM Evolution EDGE is an enhancement of GPRS and CSD technologies. Based on the current GSM technology - same TDMA frame structure, same bandwidth (200 kHz). Uses 8-PSK modulation instead of GMSK. Requires good propagation conditions. Allows upto 48 kbps (EGPRS) and upto 28.8 kbps (ECSD) on every radio channel EDGE helps GSM-Only operators to compete with UMTS.Universal Mobile Telecommunication Standards Innovative Service Architecture : VHE Concept - providing the us the same look and feel of its personalized services independent of network and terminal. Global Convergence : Fixed/Mobile, Telecom/Datacom, public/private Mobile Multimedia driven market. Wideband bearers - 2GHz band ( 5 MHz per carrier), -max. 2MbpsCoverage or Traffic LimitationsTRAFFIC-LIMITEDAREA(10000 subscribers per km2)COVERAGE-LIMITEDAREA(-75 dBm at cell edge)COVERAGE- LIMITEDAREA(-70 dBm at cell edge)119At the beginning of GSM, there were relatively few subscribers and radio resources available in each cell were sufficient to cope with the call requests. As subscriber numbers grew, some dense urban cells became congested, and the need for extra radio resources appeared. The solution was to add extra sites to provide extra channels even if the radio coverage was good enough. This is called cell splitting.For radio coverage, the use of a link budget calculation sheet is necessary. The size of the cell is determined in this case by the signal strength necessary at the edge of the cell.For capacity-limited areas, the BTS manages a given maximum number of subscribers. To determine the number of sites necessary to provide the service is simply to divide the number of subscribers located in the area by the number of subscribers managed by one site.Average number of busy channels during the period of observation (usually, the peak hour).

Erlang is the unit of statistical resource useErlang BAt any time, more than 1 user may request the same resource simultaneously. The use of such a resource is associated with a blocking rate.

Erlang CWhen more than 1 user request at the same time, instead of rejecting the extra calls, there is a queuing system.

Erlang Concept 120An Erlang, in the simplest sense, is the percentage of time a subscriber uses its phone. A subscriber using a resource fully, 60 minutes per hour, is requesting 1 Erlang of traffic.This is for a single user. If more users need the same resource, then the concept Erlang B, with a blocking rate, Br comes into play. The approximation follows the Poisson Distribution and is computed as follows.

The Erlang B formula used to compute the resource number is quite complicated. A good approximation can be obtained by using the following formula:N = A + kA1/2 where:N is the number of resources needed to provide A Erlangs with the Br,Blocking Rate expressed in 10 to the power -k: Br = 10-kFor Erlang C, the concept of blocking rate is no longer used. The calls, instead of being rejected when no resource is available, are held for a given time, and a queuing principle is used. That is to say, the user has a probability of waiting more than a given time before getting the line.

Different Types of CellsHigh sensitivity to interferenceRequires "secured" Frequency reuse pattern High isolation from interferencesA few Frequencies intensively reusedMACRO-CELL:antenna radiating above roofs---> Wide Coverage ( 35 km)MICRO-CELL:Antenna below the roofs---> small coveragePICO-CELL:Antenna inside building---> Very small coverage

EXTENDED-CELL:macro cell with system coverageextension ( 120 km) for coasts...CONCENTRIC-CELL:macro cell with system coveragelimitation inside another macro121As capacity increases, various solutions have to be implemented to provide extra local capacity.Macro cells are relatively large cells for remote and sparsely populated areas. These cells can have a radius as large as 3 to 35 km. Micro cells are used for densely populated areas. By splitting the existing areas into smaller cells, the number of channels and the capacity of the cells are increased. The power levels of the transmitters used in these cells are then decreased, reducing the possibility of interference between neighboring cells. Some of the micro cells may be small as 0.1 to 1 km depending on the need.Pico cells are generally used in buildings, shopping malls, conference halls and is a smaller version of a micro-cell. The distances covered with a pico cell are approximately 0.01 to 1 km. They are used in buildings for close in calling, part of a Private Branch Exchange (PBX) or a wireless Local Area Network (LAN) application today.Concentric cells allow provisioning of extra capacity close to the site by adding TRXs with system limitations reducing their coverage range.Extended cells have a radius of maximum 120 km. They are mainly used for coastal regions where an extended version of macro cells is needed. The capacity of a TRX is reduced to half if extended cells are implemented.Cell PatternsCell Sectorization

TRIOMNIBI123There are two main types of cellsOmnidirectional cell: This type of cell has a single transmitter in the center of the cell and transmits in all directions. It is very simple to implement and covers a large area. However, it is not intended to be used in areas requiring a large amount of radio capacity. Since there is transmission in all directions, this will cause more interference and will cause a lower frequency reuse pattern. Sectored Cell: This is more complicated to implement because it divide the cells in smaller areas. Instead of one transmitter in the center of the cell transmitting in all directions, it uses a number of smaller directional transmitters pointed in different directions. This limits interference in one direction so that the frequency could be reused in a closer cell in the opposite direction. Two types of sectored cell are shown, on the same bi and tri-directional.Omnidirectional Site Antennas

124These pictures show one omni antenna as well as an omni site with space diversity.The vertical radiation patterns with no electrical tilt (top) and with electrical tilt (bottom) are printed on the right.Mechanical tilt is not used for omni antennas.Bi and Trisectorial Site Antennas

125These two pictures illustrate bi- and tri-sector sites with space diversity.Calculation of the maximum coverage range of each cell in a specific environment.

Definition of planning tools parameters.

Based on the path loss calculation between the MS and the BS in both ways.

This calculation considers:RF parameters of MS and BS,system parameters (diversity gains...),propagation parameters (shadowing),physical installation parameters (antenna height),environment classification.Link Budgeting126-What is the maximum EIRP?-What are the losses in transmission and reception?-Is diversity used?-What is the minimum equivalent sensitivity?-What is the maximum equivalent output power?-What are the body losses?-Beyond which distance the communication will cut off? -Is indoor coverage guaranteed?-Is frequency hopping used?

EIRP:Equivalent Isotropic Radiated Power127DuplexerCombinerPower AmplifierDLNA:Diversity Low Noise AmplifierSpecific Tx Cable LossesTx PA OutputPowerCombiner lossesRx SensitivityRx Diversity GainDLNA conf.Standard conf.Base StationTx PA Output PowerOther factors for MSBody LossesCommon cable lossesPropagation Parameters:- Incar, Indoor penetration factors- Frequency 900, 1800, 1900 MHz- Antenna Height- Environment

Design Parameters:Overlapping marginRx SensitivityAntenna GainMSRx SensitivityCommon cable LossesAntenna GainRadio LinkLink Budget ParametersOverview128Link Budget ParametersBTS TX Power Amplifier2.5W PA25W PA35W PA20W PA30W PAGSM 900S2000LS2000ES4000 IndoorS4000 OutdoorS4000 IndoorS2000HS8000 Indoor S8000 OutdoorDCS 1800S2000LS4000 Indoor S2000E S2000H S4000 Outdoor S4000 IndoorS8000 Indoor S8000 Outdoor PCS 1900S2000LS2000E S2000H S4000 Indoor S4000 Outdoor S8000 Outdoor129DH2DHy/22-Way Hybrid Combiner with Duplexer 4.5 dB Lossallows Synthesized Frequency Hopping4-Way Cavity Combiner with Duplexer allows Baseband Frequency Hopping4.9 dB LossCCCCDLink Budget ParametersCombinersTXTXTXTXTXTX130At the BS, for a 7/8 foam dielectric coaxial cable:4 dB/100 m (900 MHz),

6 dB/100 m (1800 MHz),

Common cable losses for 40 meters: 2.5 dB (900 MHz) and 3.5 dB (1800 MHz).

Jumpers (up and down the feeder)

0.5 dB (800 MHz),

1 dB (1800 MHz).Link Budget ParametersCable Losses131Omnidirectional antenna

Default 6.5 V with 11 dBi gain

Directional antenna for trisectorial site

Default 65 H / 6.5 V with 18 dBi gainLink Budget ParametersBTS Antenna Gain132900 MHz1800/1900 MHzTX PA OutputPower33 dBm (2W)30 dBm (1W)RX Sensitivity-102 dBm-2 dBi for Handheld2 dBi for Car KitBody LossAntenna GainCommon CableLoss-100 dBm0 dB for Handheld2 dB for Car Kit3 dB for Handheld0 dB for Car KitLink Budget ParametersMobile Station Parameters133Link Budget PresentationParameters

Frequency1800 MHzBase Height40.0 mMobile Height1.5 mEnvironmentUrbanRXTXMobileAntenna Gain-2 dB Cable Loss 0 dBOutput PowerSensitivity -100 dBm30 dBmAntenna Gain (65 ) Jumper LossFeeder Loss Sensitivity -110 dBm18 dBi3 dBOptions Rx Diversity Gain: 5 dB Overlapping Margin: 0 dB Penetration FactorBody Loss3 dB15 dBOutdoor Minimum Field95%: -80 dBmCoverage Range95%: 810 m0.5 dBBase StationMax TX Output PowerRXm RXd 44.8 dBmCoupling systemTx loss4.5 dB134The purpose of a link budget calculation is to determine the range/size of the cell with given equipment and quality of service in a specific environment.First of all the technical characteristics of the BTS and the MS are taken into account: output power and input sensitivity as well as feeder losses and antenna gain on the BTS side and body losses and antenna gain on the MS side.Secondly, the quality of service is specified using various elements: percentage of area covered inside the cell (ex: 95%), indoor penetration losses (ex: 18 dB), overlapping margin (ex: 3 dB).Thirdly, the environment is specified (ex: urban) with antennae height, for both BTS and MS.Radio wave propagation losses are dependent on frequency (GSM 900, GSM 1800 or GSM 1900), and environment. This is taken into account in the link budget.The above diagram illustrates all the elements used in the link budget for determining the maximum path loss for the radio waves, from the BTS to the MS (downlink) and from the MS to the BTS (uplink).The worst case or lowest path loss allowed will be used to calculate the cell range in the specified conditions.Link Budget CalculationBTSMSTX OUTPUT POWER30.00 W (44.8 dBm)1.00 W (30.0 dBm)COMBINER LOSSES5.0 dBNoneRX SENSITIVITY-110.0 dBm-102.0 dBmRX SENSITIVITY + DIVERSITY-115.0 dBmNoneCOMMON CABLE LOSSES3.0 dB0.0 dBANTENNA GAIN18.0 dBm-2.0 dBmBODY LOSSES3.0 dBOVERLAPPING MARGIN0.0 dBINDOOR PENETRATION FACTOR18.0 dBExercise 1: S8000 INDOOR: OPERATING FREQUENCY 1800 MHz 135From the above values, calculate:The total Downlink BudgetThe total Uplink BudgetDetermine the Budget to be used in order to determine the size of the cell.FadingExample of Field Strength Variation for GSM 1800 -100-90-80-70-60-50-40-30-20-100500100015002000250030003500400045005000Distance (m)Field Strength (dBm)MeasurementFree SpaceZoom onShort Term FadingLong Term Fading 2 m /2136Information exchanged between the MS and the BTS is transported by means of radio waves which are attenuated, reflected or diffracted, along their paths.The received signal is the sum of different signals resulting from these effects, sometimes constructive, sometimes destructive.Free-space loss is calculated using the following formula: Loss (dB) = 32.4 + 20*log(d) + 20*log(f) where d is the distance between the BTS and the MS, expressed in km, and f is the frequency expressed in MHz.In practice, the radio waves are not in free-space propagation conditions and the term depending on distance can vary from 20*log(d) for free space to 40*log(d) for very dense urban, depending on the environment.Practical expressions of path loss are given here, depending on frequency and environment. They come from several measurements, are statistical and represent the mean variation to which short term and long term fading values have to be added:Rural (BTS antenna at 100 m)Urban (BTS antenna at 50 m)GSM 90090.7 + 31.8log(d)123.3 + 33.7log(d)Rural (BTS antenna at 60 m)Urban (BTS antenna at 50 m)GSM 1800100.1 + 33.3log(d)133.2 + 33.8log(d)Clutters

137Radio waves behave differently depending on the environment, and the radio range can vary from a few hundred meters to several kilometers. It is important to classify the different types of environment included in the area to be provided with GSM service.As an example, the map presented above shows a city and its surroundings, classified into fourteen types of environment or clutters.A link budget is established for each clutter, defining a specific cell size.Example of Dense Urban clutterAreas within an urban perimeter. This includes dense urban areas with dense development where built-up features do not appear distinct from each other. It also includes built-up features of the downtown district with heights below 40 m.

Example of Mean Urban clutterAreas with an urban perimeter. The mean urban clutter should have mean street density with no pattern, the major streets are visible, the built-up features appear distinct from each other. Some small vegetation could be included. Average height is below 40 m.

Thank you