Introduction To 2G/3G Mobile: "A Jump Start Training Program in Mobile Communications Theory"

Introduction to 2G/3G Mobile
A jump start training program in

mobile communications theory
Version2FlintTrainingDate:20thOctober2011
2011FlintConsultingLtd.Allrightsreserved.
Introduction to 2G/3G Mobile - Sample

Material
The course has been produced to help new to industry personnel quickly develop a basic understanding of 2nd and
3rd generation mobile communications networks. The course comprises of 4 separate modules as detailed below.
Sample training material from each of these modules is provided as reference:
Module 1
Module 2
Internet Protocol
Frame Relay
Asynchronous Transfer Mode
Multi-Protocol Label Switching
Deployment of Transport Technologies
Module 3
Fundamentals of Telecommunications
Concepts & Terminology
Network Elements
Signalling Overview
Basic Call Flows
Standards
Circuit Switched Network Overview

Circuit Switched Network Call Flows
Packet Switched Network Overview
Packet Switched Network Call Flows
Module 4
2G Radio Access Network

3G Radio Access Network

Fundamentals of
Telecommunications
Digital Exchanges
Digital
Exchange
Subscriber
Stage
Traffic
Control
O&M
Billing etc.
Digital
Switch
Trunks &
Signalling
OK weve made it to the 1970s & 80s. Glamrock, Punk and New Romantics. It was all change in the telecoms
world too. After 80 years of not very much things finally started to change.
As we can see an example of a simplified digital exchange which has many of the same components as the
old analogues exchanges. Other structures were implemented but they all have the same basic functions. All
of this runs on digital processors for the control aspects and dedicated hardware for the physical layers.
The Traffic Control is equivalent to the operator or the selector and is the function within the switch which decides
where calls go (routing) and how they are connected.
The Subscriber Stage is where the users are connected and handles all of the line signaling (off-hook, digits etc.) and
indicates the relevant bits to Traffic Control. The Subscriber Stage also converts the analogue speech information into a
digital stream.
The Digital Switch is where the connections are made between Subscriber Stages for a local call and between the
Subscriber Stage and the Trunks for a long distance call.
Trunks and Signaling handles the digital connections to other exchanges for long distance calls and also the signaling
between the exchanges.
All of this, of course needs some sort of Operation and Maintenance (O&M) function.
And then what the operators would call the most important function Billing.
Analogue to Digital Conversion & Encoding
The first step for transmission of a telephony media signal (speech) is to

convert it from analogue to digital.
The figure shows a 4-bit (16 values) linear conversion. The analogue
wave is sampled at a certain rate and at each sample a measurement is
taken and it is then represented as a digital value.
The sampling rate determines the highest frequency that the digital
stream can represent. This is called nyquist frequency and is half the
sampling frequency. For normal narrowband telephony the speech is
sampled 8000 times a second (8kHz, 125s per sample). This allows
frequencies up to 4kHz. In actual fact the transmitted band in telephony
is 300Hz-3.4kHz in order to be compatible with older analogue
equipment.
In reality 4 bits is not enough to accurately represent a waveform (e.g. CD is 16 bits). Each sample is actually 13bits in most of the world (or 14-bits in North America, Japan and a few other places). But there is another step.
The 13/14 bit values are converted to 8-bit values for transmission. This step is done in a logarithmic fashion as
it is considered the that human ear works in this way i.e. we are more sensitive to small differences at low
volumes than we are to the same differences at high volumes. The two encodings are called A-Law for the 13-bit
encoding and -Law (Mu) for the 14-bit encoding. These are defined in ITU specification G.711.
So we now have logarithmically encoded 8-bit values at a sampling rate of 8kHz. This gives 64 kilo bits per
second (kbit/s).
As we will see, there are other possible ways of encoding speech that give higher quality or lower transmission
rates but this is the basic system used in fixed line telephony and for interconnection purposes.
Things are, however, changing with the codings used in the mobile world and the shift towards IP telephony.
OSI 7 Layer Model

Application Layer
(Layer 7)
Application Layer
(Layer 7)
Network process to application
Presentation Layer
(Layer 6)
Presentation Layer
(Layer 6)
Data representation, encryption and

decryption, convert machine dependent data
to machine independent data
Session Layer
(Layer 5)
Session Layer
(Layer 5)
Transport layer
(Layer 4)
Transport layer
(Layer 4)
End-to-end connections and reliability, flow

control
Network Layer
(Layer 3)
Network Layer
(Layer 3)
Path determination and logical addressing
Data Link Layer

(Layer 2)
Data Link Layer

(Layer 2)
Physical addressing
Physical Layer
(Layer 1)
Physical Layer
(Layer 1)
Interhost communication
Media, signal and binary transmission
Logical communication between layers at equivalent point in the stack.

Physical communication moves down the stack to the physical layer, across the network,
and up through the stack at the receiving node.
Intelligent Networks
SCF
Telephony Node
Incoming leg
Telephony Node
SSF
SSF
Telephony Switching
& Control
Telephony Switching
& Control
Outgoing leg
SCF Service Control Function

Entity that contains the Intelligent Network service logic to implement Operator
Specific Service. It interfaces with the SSF
SSF Service Switching Function
Functional entity that interfaces the telephony node to the SCF. The SSF
implements actions based on triggers as instructed by the SCF.
Emergency Calls & Emergency Mode
Exchanges are required to support emergency calls (999, 112, 911 etc.). These
have specific requirements that are above and beyond normal calls:
The calls must be prioritised as soon as it is determined that the call is a priority.
This means that the call will receive preferential treatment when encountering
congested nodes/links.
The calls must not be dropped in favour of other calls.
Once connected to the emergency centre the calls must not be released even if the
subscriber hangs up as long as the operator stays on the line (last party release).
Exchanges can, in special circumstances, be set into an emergency mode. This

blocks all normal traffic and only allows pre-configured subscribers to make
calls such as the police and specified officials. This is used at times of
emergency to ensure that the most important calls are served.

Concepts & Terminology
2G System
Global System for Mobile Communications, or GSM (originally from Groupe

Spcial Mobile), is the world's most popular standard for 2G mobile telephone
systems.
GSM networks operate in a number of different carrier frequency ranges.
2G GSM networks operating in the 900 MHz or 1800 MHz bands. Others 850
MHz and 1900 MHz bands were used instead (for example in Canada and the
United States). In rare cases the 400 and 450 MHz frequency bands are
assigned in some countries because they were previously used for firstgeneration systems.
10
Base Station Identity Code (BSIC)
BSIC allows a mobile station to distinguish between different neighbouring

base stations.
BSIC = NCC + BCC
NCC = Network Colour Code (3bits = xyy). Identifies the GSM PLMN.
NCC x = operator
NCC yy = country. Only four different bit combinations exist
for country identification
Note that NCC does not uniquely identify the operator. NCC is
primarily used to distinguish between cells of operators on
each side of a border.
BCC = Base Station Colour Code (3 bits). Identifies the Base Station
BCC=0
NCC=011
BCC=2
BCC=0
BCC
BCC=2
BCC=2
BCC=3
BCC=1
BCC=2
NCC
BCC=1
BCC=1
BCC=3
BSIC
NCC=010
BCC=3
BCC=0
BCC=0
BCC=1
11

Network Elements
Version2 FlintTrainingDate:20thOctober2011
12
3G Release 4 Network
BSS
NSS
CS-MGW
Um
BTS
Abis
MS
Mc
BSC
A
Gs
IuCS
Uu
3G Ue
Iub
Base Station System

Base Transceiver Station
Base Station Controller
Mobile Station
RNS Radio Network System

RNC Radio Network Controller
Ue User Equipment
GMSC
Server
Nc
VLR
HLR
EIR
PSTN
AuC
Gf
Gr
Node B
Node B
BSS
BTS
BSC
MS
MSC
Server
Gb
RNS
PSTN
Mc
BTS
CS-MGW
Nb
RNC
SGSN
IuPS
GGSN
Gn
NSS Network Sub-System

MSC Mobile Switching Centre
VLR Visitor Location Register
HLR Home Location Register
EIR Equipment Identity Register
AuC Authentication Server
GMSC Gateway MSC
SGSN Serving GPRS Support Node
GGSN Gateway GPRS Support Node
Gi
IP
Network
Media
Signalling
13
EIR
The Equipment Identity Register is a database of IMEI's (International Mobile

Equipment Identity) which are black listed. The can be interrogated by the
network and a black listed IMEI will be denied service
One common use of the EIR is to list the IMEI numbers of stolen handsets
EIRs usually support a number of lists, and can allocated them as

black/white/grey to suit the purpose of the operator
White: Equipment legitimate. Allow usage

Grey: Equipment lost. Allow usage but track
Black: Equipment stolen. Block usage
The EIR should be periodically synchronised (at least once per day) with the
international CEIR (Central EIR) so that e.g. stolen handsets can be denied
service internationally
14
Radius-1
Remote Authentication Dial In User Service (RADIUS) is a networking protocol that provides centralized
Authentication, Authorization, and Accounting (AAA) management for hosts to connect and use a network service
RADIUS is a client/server protocol that runs in the application layer, using UDP as transport
RADIUS
Client
Authentication & Authorisation (rfc2865)
The host sends a request to access to a particular network resource using access
credentials. The Radius server checks whether the host should be given access and
returns one of three replies Access-Accept, Access-Reject or Access-Challenge. A
challenge is issued if additional information or interaction is required in order to approve
the host
RADIUS
Server
RADIUS: Access-Request
RADIUS: Accounting-Accept
RADIUS: Accounting-Reject
RADIUS: Accounting-Challenge
Accounting (rfc2866)
When an accounting session is started a RADIUS Accounting Request packet containing an

Acct-Status-Type attribute with the value "start is sent to the RADIUS server
Periodically, Interim Update records (a RADIUS Accounting Request packet containing an
Acct-Status-Type attribute with the value "interim-update") may be sent to the RADIUS
server, to update it on the status of an active session. "Interim" records typically convey
the current session duration and information on current data usage
Finally, when the accounting session ends, a RADIUS Accounting Request packet
containing an Acct-Status-Type attribute with the value "stop is sent to the RADIUS
server, providing information on the final usage in terms of time, packets transferred,
data transferred, reason for disconnect and other information related to the user's
network access
Typically, the client sends Accounting-Request packets until it receives an AccountingResponse acknowledgement, using some retry interval.
The primary purpose of this data is that the user can be billed accordingly; the data is
also commonly used for statistical purposes and for general network monitoring
RADIUS
Client
RADIUS
Server
RADIUS: Accounting-Request
[start]
RADIUS: Accounting-Response
[interim update]
[stop]
15

Signalling Overview
Version2Flint TrainingDate:20thOctober2011
16
SS7 Signalling Links

SS7
Signalling
Point 1
SS7
Signalling
Point 2
SS7 link set consisting of multiple physical links
between the SS7 signalling points.
Traditional SS7 networks allow multiple physical links in a single link set to a single end
point - multiple links between two network addresses.
SS7 also implements the protocols necessary to maintain the links ; a single end point can
initiate testing of a specific physical link and raise alarms if a single link in the set is not
fully working in both directions. In this case alarms can flag maintenance requirements
before the complete failure of the link.
17
Narrowband SS7
MAP
CAP
TCAP
SCCP
MTPL3
MTPL2
64kBits/secE1timeslot
Narrow band SS7 signalling uses

64kBits/sec TDM timeslots over
2MBit/sec E1 trunks as its physical
media. SS7/TDM has been the
traditional mechanism for SS7 links
MTP-L2 provides the data link layer for
the reliable sending of the Message
Signal Units (MSU)
MTP-L3 provides the MSU routing
capability between signalling points
NB SS7 is still widely used in 2/3G
networks usually on CN interfaces,
e.g. SGSN to HLR
18
Broad Band SS7 Activation (2)

RNS
SGSN
POLL
[N(PS) = 1, N(S) = 1]
STAT
The POLL/STAT process is repeated periodically, each peer soliciting each own 'status' independantly of the
other in alignment with the 'Timer_POLL' (typical 1 sec) and 'Timer_KEEP-ALIVE' (typical 5 sec) values.
This status response is acknowledging the request from the SGSN. Next expected SD PDU is '1'.
[N(PS) = 1, N(R) = 1]
Start MTPL-3 Signalling Link Test
SD: SLTM
The SGSN starts sending MTP-L3 signalling link test messages, the N(S) is set to 1 in the SSCOP SD PDU.
[N(S) = 1, DPC 624, OPC 648]
POLL
The RNS increments N(PS) and sends a POLL to the SGSN.
[N(PS) = 2, N(S) = 1]
STAT
The response acknowledges the status request from the RNS. Next expected SD PDU is '1'.
[N(PS) = 2, N(R) = 1]
SD: SLTM
The RNS starts sending MTP-L3 signalling link test messages, the N(S) is set to 1 in the SSCOP SD PDU.
[N(S) = 1, DPC 648, OPC 624]
SD: SLTA
[N(S) = 2, DPC 624, OPC 648]
SD: SLTA
The SGSN and RNS acknowledge the SLTM messages.
[N(S) = 2, DPC 648, OPC 624]
SD: TRA
[N(S) = 3, DPC 648, OPC 624]
Subject to implementation, other MTP-L3 messages may be sent, in the example a 'Traffic Restart Allowed'
(TRA) is shown.
The SCCP Layer can now be activated.
19

Basic Call Flows
20
Terminating SMS - 2
MS
BTS+BSC
V-MSC
HLR/AUC
G-MSC
SMS-SC
TMSI Update
DTAP:TMSIReallocationCommand
SDCCH:TMSIReallocationCommand
SDCCH:TMSIReallocationcomplete
DTAP:TMSIReallocationcomplete
SDCCH:MTDataAck
SDCCH:MTData
Terminating SMS Delivery
DTAP:mt ForwardSM
DTAP:mt ForwardSM Ack
DTAP:mt ForwardSM
DTAP:ShortMessageAck
BSSMAP:ClearCommand
SDCCH:ChannelRelease
Signaling Connection Release
L2Disconnect
BSSMAP:ClearComplete
SCCPRelease
21

Standards
22
Standards
The Mobile Network complies with

relevant standards from ITU, ETSI,
ANSI, TTC, IETF, etc.
23

Internet Protocol (IP)
24
Subnet Examples
15users
20users
25users
The company network shown has to be subnetted. The company has leased the class C address 200.1.2.0.
Which of the following network addresses and masks would be appropriate for one of the subnetworks ?
1.
200.1.2.96 255.255.255.192
2.
200.1.2.160 255.255.255.224
3.
200.1.2.80 255.255.255.224
4.
200.1.2.32 255.255.255.240
The number of host bits required is 5 as this allows 32 IP addresses and thus satisfies the number of users
per router i.e. per subnet.
This eliminates options 1 & 4 as these provide 64 and 16 hosts per subnet respectively.
Option 3 is eliminated as .80 is a host IP address as it is not a multiple of 32.
Option 2 is the correct answer as .160 is a subnet address and 255.255.255.224 gives 32 hosts per subnet.
25
Exercises - 7
Question 19
Can Router2 ping Router1's E1:_____
What is the error message for the failed pings:__________________
In Router2 add a static route to 172.16.12.0
Question 20
What new route is in Router2's routing table:
______________ via: ____________
Question 21
Now can Router2 ping Router1's E1:_____
Now can Router3 ping Router1's E1:_____
Question 22
Why do you think they invented dynamic routing protocols:
__________________________
Print the entries of the routing tables of the three routers and note them.
26

Frame Relay (FR)
27
Data Link Control Identifier (DLCI)
Frame Relay virtual circuits are identified by the Data Link Connection Identifier (DLCI).
DLCI is a 10 bit value. Values 0-15 and 992-1023 are reserved for various purposed. Values 16-991
are available for use.
8 bits
16 bits
Flags
Variable length
16 bits
8 bits
Payload
FCS
Flags
Header
Octet 1
DLCI
Octet 2
C/R EA
DLCI
FECNBECN DE
EA
Frame Relay includes congestion notification mechanisms (FECN & BECN) which report
congestion in either direction in the Frame Relay cloud. There is also the Discard
Eligible (DE) bit that can be set to allow certain packets to be discarded in preference
to others.
Use of the C/R bit is not defined by Frame Relay. A value of 0 in an EA bit indicates that
the frame's address (DLCI) continues in the next octet. Since the DLCI must occupy parts
of two octets at minimum, the first EA bit should always have a value of 0 and the
second EA bit always set to 1.
A frame must be between 5 & 8192 (1600 max recommended) octets between flags.
28

Asynchronous Transfer Mode (ATM)
29
ATM Cell Structure

8
Generic Flow Control
Virtual Path Identifier
Virtual Path Identifier
Virtual Channel Identifier
3
4

Payload Type ID
Header Error Control
Information Payload
CLP
48 Octets
Payload
53
Information Payload
GFC: Used on UNI interface. Used for extended (12 bit) VPI on NNI interface.
PTI: Bit 2 used by AAL5, Bit 3 used for congestion, Bit 4 used to indicate OAM cell.
CLP: Cell Loss Priority. Indicates the cells to discard in case of congestion.
HEC: CRC code to detect errors in the header.
30

Multiprotocol Label
Switching(MPLS)
31
Label Distribution Protocol

181.29
Use Label 5 for 181.29
0
0

Incoming Address Outgoing Outgoing

Label
Prefix Interface
Label
131.42

Label
Prefix Interface
Label
131.42
131.42
181.29
181.29

Label
Prefix Interface
Label
9
131.42
Information regarding MPLS Labels is passed via LDP and is used to populate the
MPLS distribution tables.
32

Deployment of Transport
Technologies
33
3G Release 99 Network
BSS
Um
BTS
Abis
MS
NSS
MSC
BSC
PCU
VLR
PSTN
GMSC
E
D
PSTN
BTS
Gb
RNS
Uu
3G Ue
Gf
IuCS
Node B
Iub
Node B
RNC
HLR
EIR
Gs
AuC
Gr
SGSN
IuPS
GGSN
Gn
Gi
IP
Network
TDM Media
TDM Signalling
FR Media
FR Signalling
IP Media
IP Signalling
ATM Media
ATM Signalling
34

Overview of Circuit Switched
Network Infrastructure
35
HLR Redundancy 2
Changesaremarkedtoupdateits
matedHLRwhenisupandrunning
HLR2
UpdateLocation
forsubscribersin2
STP
STP
CoreNetwork
36
PrePaid
The PrePaid system is used to validate whether a subscriber has enough

credit to use a CS or PS service
The user is validated at call setup and periodically once a service has been
established
There are various mechanisms used for PrePaid services
In the network the PrePaid platform communicates to the MSC-S and SGSN
via SS7 signalling
CAMEL Ph2 is used CS prepaid services
CAMEL Ph3 is used for SMS & PS prepaid services
37

Circuit Switched Call Flows
38
Mobile Originated CS call (1)

UE/MS
NodeB
RNC
VLR/MSC
PSTN
RRCconnectionrequest
RadioLinksetup
Callconnectionsetup
Authenticationandciphering
RRC = Radio Resource Control

The signalling shown assumes that the UE/MS is already registered in the VLR.
Authentication and ciphering is optional and requested by the network; authentication confirms the
information in the VLR, ciphering is between the RNC and UE/MS.
39
MSC-S/MGW Interfaces
BICC
RANAP Iu-C (CS)
MSCS
BSSAP
ISUP
SIP/SIP-I
GCP ATM or SIGTRAN

(GPS)
Synch
O&M
IP Iu-UP, RTP
Iu-UP(CS) IP
Iu-UP(CS) ATM
MGW
ATM Iu-UP, AAL2

TDM
A interface TDM
40

Overview of Packet Switched
Network Infrastructure
41
UE to SGSN UTRAN Control Plane Interface
42

Packet Switched Call Flows
43
PDP Context Activation (1)

MS
RNS
SGSN
GGSN
User activates data 'session' on MS
The MS initiates the data session setup procedure by sending an

Activate PDP Context Request message to the SGSN.
Activate PDP Context Request
The Activate PDP Context Request message will include the

requested PDP address type (IPv4 or IPv6), the requested QoS
and APN.
[LLC SAPI, NSAPI, TI, Req. PDP address, Req. QoS, Req
APN]
Service Request
The Service Request message is sent by the MS to establish

logical association between the MS and the network. It will contain
the P-TMSI to indentify the MS and the status of each the NSAPI
values 5 - 15 indicating whether there is a PDP context active.
[P-TMSI, PDP Context Status]
Activate PDP Context Request
A Transaction Identifier will be assigned for the context along with

the allocated Network Services Access Point identifier. (A NSAPI
value = 5 will be assigned to the 'Primary' PDP Context).
[LLC SAPI, NASPI, TI, Req. PDP address type, Req. QoS,
Req. APN]
SGSN performs subscription check on requested APN
APN-DNS
Resolve GGSN address
[<APN Name>]
The SGSN will contact the APN DNS to resolve the APN name to
GGSN GTP-C IP Address.
GGSN address resolution

[GGSN Address]
The SGSN will send a Create PDP Context Request to the GGSN
to set up a session from the MS to the required APN.
Create PDP Context Request
[IMSI, MSISDN, Selection Mode, TEID-C, TEID-U, SGSN CU
Addresses, NSAPI, Charging Char., APN, QoS]
44

Introduction to 2G RAN - GSM
45
BTS Transmission and Reception

The slots for transmission and reception for a given mobile are offset in time so
that the mobile does not transmit and receive at the same time
Transmit Frame
0
Base Station Transmit

Slot Numbers
Corresponding Receive Frame
5
Base Station Receive

Time
46

Introduction to 3G RAN WCDMA
47
Use of Channelisation Codes
In the Downlink Channelisation Codes are used to distinguish between data channels
from the same Base Station
In the Uplink Channelisation Codes are used to distinguish between data channels from
the same mobile
Downlink
CC1&CC2
CC3,CC4&CC5
Uplink
CC1,CC2&CC3
CC1&CC2
48
Scrambling and Channelisation Codes
Common channels in the cell (CC's are known by all users). Downlink channels (different CC for each
channel)
Common channels will be broadcasted to everyone in the cell. Each user in the cell must know the
channelisation codes for these channels, i.e CCp and CCb.
All the CCs are unique in the downlink
In the uplink they must only be unique within each users set of channels.
The code CC1 is used twice in the uplink, but for two different users, which is allowed. In this case
SC2 and SC4 separate out the users
PilotBroadcastchannel
SC1+CCp+CCb
PN1+CC1+CC2
SC2+CC1+CC2
PN1+CC3
SC4+CC1
49
HSPA Data Speeds with 3GPP releases
50

Introduction To 2G/3G Mobile: "A Jump Start Training Program in Mobile Communications Theory"

Încărcat de

Informații document

Titlu original

Drepturi de autor

Formate disponibile

Partajați acest document

Partajați sau inserați document

Opțiuni de partajare

Vi se pare util acest document?

Este necorespunzător acest conținut?

Drepturi de autor:

Formate disponibile

Introduction To 2G/3G Mobile: "A Jump Start Training Program in Mobile Communications Theory"

Încărcat de

Drepturi de autor:

Formate disponibile

Introduction to 2G/3G Mobile

A jump start training program in

Introduction to 2G/3G Mobile - Sample

Circuit Switched Network Overview

2G Radio Access Network