2 - 2 GSM

GSM, GPRS, and EDGE
Prof. Kwang-Cheng Chen Institute of Communications Engineering National Taiwan University FAX: (02) 2368 3824 email: chenkc@cc.ee.ntu.edu.tw
NTUEE Mobile Communications KC Chen 1
Outlines
Introductory System Construction GSM Architecture and Principles Physical Layer Data Link Layer Network Layer Testing
NTUEE Mobile Communications
KC Chen
GSM Phase 1 Services Category Services Comments Teleservices Telephony Full-rate 13 kbps Emergency calls Short-message: point-toAlphanumerical point and cell broadcastinformation Telefax Group 3 Asynchronous data 300-9.6 kbps Bearer Synchronous data services Asynchronous PAD access (packet switched) Alternate speech/data Supplement- Call forwarding ary services Call barring
GSM Phase 2 Services Category Services Comments Teleservices Telephony Half-rate 6.5 kbps Short-message services Synchronous dedicated 2.4-9.6 kbps Bearer packet data access services Supplement- Calling/connected line ary services identity presentation Calling/connection line identity restriction Call waiting Call hold Multiparty comm. Conference call Closed user group Advice of charge On-line information Operator barringChen NTUEE Mobile Communications KC 4
GSM
GSM stands for Global System for Mobile. GSM (group special mobile) was first developed by the CEPT. GSM services follow ISDN and are classified as teleservices and data services. Subscriber Identity Module (SIM) is a memory device storing ID, networks or countries for services, privacy keys, etc.
KC Chen
Further Standardization (I)

New bearer services and data-related improvements
HSCSD (high-speed circuit-switched data) 14.4 kbps (single-slot) data GPRS (general packet radio service) EDGE (enhanced data rates for global evolution)
Speech-related
EFR (enhanced full-rate) speech codec AMR (adaptive multi-rate) codec TFO (tandem free operation)
Further Standardization (II)

Mobile station (MS) positioning related
Cell identity Uplink time of arrival (TOA) and enhanced observed time difference (E-OTD) GPS and A-GPS
Frequency band-related
GSM-400/700/850
Supplementary, billing, related Service platforms

SIM application toolkit Customized applications for mobile network enhanced logic (CAMEL)
GSM System Architecture

Abis BTS BSC BTS Air A BTS BSC BTS Base Station Subsystem
HLR
VLR
AUC
SS7 MSC
PSTN ISDN Data net.
OMC Network Switching Subsystem

KC Chen 8
Registration
When a mobile station is on, a scanning algorithm scans the whole GSM frequency band. If a network is detected, mobile station reads system information from (forward) base channel. If current location is not the same as it was when the mobile station off, registration procedure starts.
Registration in Network MS BTS BSC (G)MSC VLR HLR
KC Chen
Action channel request channel activation activation knowledge channel assignment location update authetication request authetication response comparison of authet. assignment of new area and TMSI ack. of area and TMSI entry area & ID into VLR & HLR channel release 10
MS
BTS
Mobile Action Originated channel request Call Establishment channel assignment call establishment request authentication request authentication response ciphering command ciphering complete and in function setup message call proceeding assignment of a traffic channel assignment complete & all messages on chann alerting (ringing) connect (call party accepted the call) connect ack. (two-way call) speech data
KC Chen 11
MS
BTS
Mobile Action paging mobile station Terminated Call channel request Establishment channel assignment answer to paging & on the assigned channel authentication request authentication response request to transmit in the ciphered mode ack. of ciphered mode setup msg. for the incoming call confirmation assignment of a traffic channel ack. of traffic channel alerting (caller getting ringing sound) connect when mobile off-hook acceptance of connected msg. exchange of speech data
KC Chen 12
Handoff in Analog Systems

Base station monitor the quality of link between a mobile station and itself. If the quality degraded, it requests adjancent cells to report power level for the mobile. Network decides the frequency to use in the new cell and eventually command change. Mobile station is passive and cell sites are equipped with measuring receiver.
Handover in GSM
The mobile station monitors the perceived power levels of neighboring cells that are provided by the base station. Measurement report is periodically sent back to the base station that might conduct measurements too. In case necessity of a handover, it can be performed without delay. GSM distinguished different types of handovers.
Types of GSM Handover

In case a handover is performed within the area of a BSC, BSC handles this simple handover and MSC is just informed. In case a mobile crossing boundary of a BSC, MSC has to control the handover. For a handover between 2 MSCs, the first MSC still has to maintain control of call managment, though 2nd MSC will handle evantually.
GSM Authentication
KEY (in SIM) authentication algorithm SRES RAND (generated random number) (SRES) =?
Um Network Mobile Station Interface A set of (RAND,SRES) are stored in the HLR & VLR for the use of authentication center.
Ciphering
The ciphering algorithms are usually based on certain one-way function. If a ciphering algorithm A5 is used to encipher a data stream in GSM system, the same algorithm is used to decipher. In current system, only A5/1 algorithm is used. But for non-COCOM countries, a simpler A5/2 is used. Both algorithms can coexist in western European countries.
Dynamic Ciphering
MS Ki A8 Um Network RAND Ciphering Command
Kc DATA Ciphered Data

KC Chen
A5
A5
DATA
18
Temporary Mobile Subscriber Identity (TMSI)
To prevent an intruder from identifying a GSM user IMSI, TMSI is assigned to each subscriber using the network during the location updating and is used for reporting, calling, paging as long as remaining active. The assignment, administration, updating of TMSI is performed by the VLR. When MS off, it is stored on the SIM card.
KC Chen 19
Handset HW
Power/Battery Management SIM Baseband Processor Multimedia Co-Processor IrDA Bluetooth WLAN WiMAX UWB FM DVB/DAB-T DVB-H DSC SD/MS MP3 MPEG, H.264 LCD Driver LCD Controller
RF
PA
Memory
Antenna
NTUEE Mobile Communications KC Chen
20
Handset SW
Power/Battery Management SIM Baseband Layer 1/2/3 Processor MMI, drivers, Multimedia Middleware, Co-Processor Appl. SW IrDA Bluetooth WLAN WiMAX UWB FM DVB/DAB-T DVB-H DSC SD/MS MP3 LCD Driver LCD Controller
RF
PA
Memory
Antenna
21
Physical Layer - Layer 1
KC Chen
22
GSM Frame Structure

Superframe 6.12 sec 120 msec ... 51 Multiframe
...
26 Frames
4.615 msec 0.57692 msec 3 156.25 bits Tail Bit

8 Time Slots
Coded Data Midamble 57 1 26 1 57 3 8.25 Guard Period

23
Stealing Flag
KC Chen
GSM Radio Subsystem

GSM uses a combination of TDMA and FHMA, and FDD. 200 kHz wide channels called ARFCNs (absolute radio frequency channel numbers) Each ARFCN pair is separated by exactly 45 MHz with 3 time slots spacing. channel data rate 270.833 kbps using BT=0.3 GMSK.
GSM Traffic CHannels (TCH)

full rate speech at 13 kbps with channel coding added to 22.8 kbps full rate data for 9600/4800/2400 bps. With FEC, data is sent at 22.8 kbps. half-rate speech at 6.5 kbps and can carry up to 11.4 kbps half-rate data at 4800/2400 bps.
GSM Control Channels (CCH)

Braodcast Channels (BCH): broadcast control channel (BCCH), frequency correction channel (FCCH), syncrhonization channel (SCH). Common Control Channels (CCCH): paging channel (PCH), random access channel (RACH), access grant channel (AGCH).
CCH
Dedicated Control Channel (DCCH): stand-alone dedicated control channel (SDCCH), slow associated control channel (SACCH), fast associated control channel (FACCH). bidirectional with the same format and function on both forward and reverse links.
Frequencies: Primary GSM

Mobile station transmits in 890-915 MHz. Base station transmits in 935-960 MHz. 125 channels are numbered from 0 to 124. Within the system, only the absolute radio frequency channel number (ARFCN) is used (from 1 to 124). Channel 0 is used as the guard band for GSM and other applications.
KC Chen
28
Frequencies: E-GSM
Additional 10 MHz bandwidth has been added to the bottom end of the duplex bands. It results in 50 more channels with numbers from 974 to 1023. Channel number 0 is returned for use in extended GSM and channel 974 serves as the guard band.
DCS-1800 or PCN
Same signaling and messaging techniques as GSM. 1710-1785 MHz for uplink and 18051880 MHz for downlink. Duplex spacing is 95 MHz with 374 channels. Channel numbers are 512 to 885.
KC Chen
30
PCS-1900/DCS-1900
Same DCS-1800 system for North America PCS. Lower frequency starts from 1850 MHz with 80 MHz duplex spacing. Channel numbers range from 512 to 810.
KC Chen
31
Power Levels in GSM

Power Class 1 2 3 4 5 6 7 8 Max. Power of a Mobile Station (dBm) 20W(43) 8W(39) 5W(37) 2W(33) 0.8W(29) Max. Power of a Base Station (dBm) 320W(55) 160W(52) 80W(49) 40W(46) 20W(43) 10W(40) 5W(37) 2.5W(34)
KC Chen 32
Power Levels in DCS-1800 and Phase II GSM

Max. Power Max. Power Max. Power Max. Power Power of DCS-1800of DCS-1900 of DCS-1800 of DCS-1900 Class MS (dBm) MS (dBm) BTS (dBm) BTS (dBm) 1 2 3 4 1W(30) 0.25W(24) 1W(30) 0.25W(24) 2W(33) 20W(43) 10W(40) 5W(37) 2.5W(34) 20-40W 10-20W 5-10W 2.5-5W
KC Chen
33
Macro-cell and Micro-cell

bad coverage
hot spot
Macro-cell and Micro-cell

bad coverage
hot spot
Power Levels for Micro-BTS

Power Class M1 M2 M3 Max. Power of GSM Micro-BTS 0.25W 0.08W 0.03W Max. Power of DCS-1800 Micro-BTS 1.6W 0.5W 0.16W Max. Power of PCS-1900 Micro-BTS 0.5-1.6W 0.16-0.5W 0.05-0.16W
KC Chen
36
Time Division Duplex (TDD) in GSM

BTS transmits 0 1 2 3 4 5 6 7 0 1 2 3
0 1
3 4
MS transmts TDMA Frame 4.615ms around 216.6 Hz effect

TDD
no need for a dedicated duplex stage (duplexer); only requiring fast-switching synthesizer, RF filter paths, fast antenna switching increased battery life or lighter battery better quality and lower cost
KC Chen
38
Normal Burst
Training S Coded Data T GP T Coded Data S 3 57 1 Sequence 26 1 57 3 8.25 148 bits = 0.54612 msec
KC Chen
39
Pulse Power Profile

dB +4 +1 -1 -6 -30
-70 10us 10us 147 bits 8us 0.5428 msec NTUEE Mobile Communications KC Chen
40
Tail Bits (T)

used as guard time to cover the uncertainty during power ramping up and ramping down. The tail bits are always set to be zero, while the demodulation process requires initial zero bits.
KC Chen
41
Stealing Flag (S)

These two bits are an indication to the receiver whether the incoming burst is carrying signaling data (to maintain the link) or user data (traffic). Indicating flag is needed since signaling data are very important and go to different places.
KC Chen
42
Training Sequence
Let radios synchronize their receivers with burst, e.g. equalizer for multipath fading. 8 sequences ae defined in GSM. All radios in a particular cell share the same training sequence. An equalizer in GSM can compensate up to 16 micro-sec path delay.
Guard Period (GP)

No data is transmitted and is just considered as guard time, to avoid possible overlap of radiation power of two bursts.
KC Chen
44
Random Access Burst

T SynchronizationCoded Data T Guard Period 8 Sequence 41 36 3 68.25 88 bits = 0.32472 msec 68.25 bits = 0.252 msec which is equivalent to 75.5 km propagation delay. That is, the max. allowed distance between mobile station and BTS is 37.75 km. Based on other system parameters, the max. cell size is 35 km in GSM.
Frequency-Correction Burst
T 3 fixed bit sequence 142 148 bits = 0.54612 ms An all zeros sequence can meet the purpose of frequency correction due to the nature of GMSK. T 3 GP 8.25
KC Chen
46
Synchroniation Burst
T Coded Data 3 39 Synchronization Seq. 64 Coded Data T GP 39 3 8.25
148 bits At beginning of mobile communicating to network, it only detects the frequency of base channel and needs to know the training seq. and system parameters. This is done by the synchronization burst. In this kind of burst, in addition to a longer synchronization seq., coded data contains the BSIC (base station information code) including BCC (BS color code) and NCC (national color code), and shortened TDMA frame number.
Logical Channels
A logical channel carries signaling data or user data. It can be mapped into any physical channel (frequency and time slot). Once a physical channel is assigned to carry the content of a logical channel, the assignment shall not change. 7 combinations of logical channels. GSM distinguishes between traffic channels and control channels.
KC Chen
48
Traffic Channels
TCH/FS (traffic channel/full-rate speech): 13 kbps net speech rate. TCH/HS (traffic channel/half-rate speech): future application without speech quality degradation. TCH/F9.6/4.8/2.4: data transmission at rates of 9.6/4.8/2.4 kbps. TCH/H4.8/2.4:
Control Channels
braodcast channels common control channels dedicated control channels associated control channels
KC Chen
50
Broadcast Channels (BCH)

BCHs are only transmitted by the base station and provide information for MSs to synchronize with the network. Three types of BCH: broadcast control channel (BCCH) frequency-correction channel (FCCH) synchronization channel (SCH)
CCCH support the establishment of a dedicated link between a mobile and a BTS. CCCH provides tools for call setups and can originate from the network or mobiles. Three types of CCCH.
Common Control Channels (CCCH)
KC Chen
52
Common Control Channels (CCCH): continued

random access channel (RACH): to request a dedicated channel and only used by mobiles. paging channel (PCH): BTS calls individual MSs within its cell. access grant channel (AGCH): where MS gets information from BTS on which dedicated channel for its immediate needs.
KC Chen
53
Dedicated Control Channels (DCCH)

used for message transfers between network and MS, not for traffic, and also used for lowlevel signaling messages among radios. standalone dedicated control channel (SDCCH) slow associated control channel (SACCH): carrying control and measurement parameters/routine data to maintain a link.
In downlink, a BTS transmits a reduced set of system parameters to keep mobile up to date on the latest changes in the system. In uplink, MS reports the measurement results. FACCH can carry the same information as SDCCH but FACCH replaces all/part of a traffic channel.
Fast Associated Control Channel (FACCH)
Logical Channels and Directions

Logical Channel TCH FACCH BCCH FCCH SCH RACH PCH AGCH SDCCH SACCH
MS BTS <-----> <-----> <----<---------> -----> <----<----<-----> <----->

56
Channel Combinations
1. 2. 3. 4. 5. 6. 7. TCH/FS+FACCH/FS+SACCH/FS TCH/HS(0,1)+FACCH/HS(0,1) +SACCH/HS(0,1) TCH/HS(0)+FACCH/HS(0)+SACCH/HS(0) +TCH/HS(1)+FACCH/HS(1)+SACCH/HS(1) FCCH+SCH+CCCH+BCCH FCCH+SCH+CCCH+BCCH+SDCCH/4 +SACCH/4 CCCH+BCCH SDCCH/8+SACCH/8
KC Chen 57
Multiframe Structure
Each channel combination requires one single physical channel. Multiframe structure made of a fied number of TDMA fames allows logial channels to be ordered into time slots. 26-multiframe structure is used for the traffic channel combinations and 51-multiframe structure is used for signaling combinations.
KC Chen
58
For combination I (TCH/FS), the first 12 fames for traffic data (speech & data), 13rd frame for SACCH, another 12 frames for traffic, and the last frame idle for MS to measure etc. 120 ms totally.
Traffic Channel Frame Structure (26-Multiframe)
KC Chen
59
Traffic Channel Frame Structure (26-Multiframe): continued

For combination II or III (TCH/HS), 2 half-rate speech channels are packed onto one 26multiframe structure. One logical channel uses every other TDMA frame. Frame 13 for SACCH1 and 26 for SACCH2. Combination II for one half-rate channel and III for two half-rate channels. FACCH may take a position of traffic channel if necessary.
not carrying any user data. more complex as incorporating 4 different channel combinations and structures.
Signaling Frame Structure (51 Multiframe)
KC Chen
61
Combination IV (downlink): FCCH+SCH+CCCH+BCCCH

235.38 ms F SBCCHCCCH 0 1 2-5 6-9 FCCH SCH idle CCCH includes PCH and AGCH
CCCH 12-19
CCCH 22-29
CCCH 32-39 CCCH I 42-49 50
Combination IV (uplink): FCCH+SCH+CCCH+BCCCH

R RBCCHCCCH 0 1 2-5 6-9 RACH CCCH 12-19 CCCH 22-29 CCCH 32-39 CCCH R 42-49 50
This combination is normally used for cells with several carriers and a large amount of traffic on CCCH. It can be transmitted on any frequency available in time slot 0. The frequency here is a reference for neighboring cells.
Combinations V VI VII
Combination V is the minimum for smaller cells with only one or two transceivers. It may assign up to 4 DCCHs. Combination VI is similar to IV but without FCCHs and SCHs for cases with a huge number of transceivers. Combination VII is to provide routine signaling. 8 DCCHs may be used to servce 8 parallel signaling links on one physical channel.
Cell Broadcast Channel (CBCH)

CBCH supports a part of the group of short message services (point-toomnipoint). An operator is thus able to transmit messages to its subscribers. CBCH is always mapped on the 2nd subslot of SDCCH independently for channel combination V and VII. CBCH only in downlink and no ack.
Block and Convolutional Coding of Full-Rate Speech

block coding Class Ia of clas Ia bits 50 bits with 3 CRC bits Class Ib 132 bits Class II 78 bits adding 4 bits of zeros to reset codec
convolutional code r=1/2 K=5 378 coded bits

78 bits
66
9.6 kbps coding in terminal equipment => 240 bits a frame (at 12 kbps) By adding 0000, 244 bits. By r=1/2 K=5 convolutional code, 488 coded bits. Puncturing 32 coded bits, 456 coded bits.
Coding for 9.6 kbps Data Transmission
KC Chen
67
Coding for 2.4 kbps Data

2.4 kbps at terminal equipment => 72 bits (at 3.6 kbps) By adding 0000, 76 bits By r=1/6 K=5 convolutional code, 456 coded bits.
KC Chen
68
Coding for Signaling Channel

signaling information 184 bits Fire Code parity 40 bits convolutional code r=1/2 K=5 456 coded bits
0000
Speech Coding for Mobile Communications
KC Chen
70
Speech Coders Waveform Coders Time Domain Nondifferential PCM Source Coders LPC Vocoders
Frequency Domain SBC ATC
Differential DELTA CVSDM ADPCM APC
KC Chen
71
ADPCM for CT-2

input + + analog waveform 4-bit adaptive quantizer adaptive scaling factor generator inverse adaptive quantizer adaptive predictor
output
Channel Vocoder: Speech Generation Model

speech Anaylzer Transmission
secondary source Noise Source Pulse Source

Vocal Tract Filter
speech output
KC Chen
73
Linear Predictive Coders (LPC)

The LPC system models the vocal tract as an all-pole linear filter with transfer function
H ( z ) = G / (1 + bk z k )
k =1 M
KC Chen
74
LPC Coding System

LPC Filter Buffer Encoder C H A N N E L Decoder S Y N T H E S I Z E R
75
Voiced/ Unvoiced Encoder Decision Pitch Analysis Encoder
Decoder
Decoder
Excitation
Code-Excited LPC (CELP)

Coder and decoder have a predetermined code book of stochastic (zero-meam white Gaussian) excitation signals. Transmitter searches its codebook for best perceptual match and the corresponding index is transmitted. The receiver uses the index for synthesizer. CELP coders are extremely complicated.
KC Chen
76
Speech Coders Used in Various Mobile Radio Systems Standards GSM CD-900 IS-54 IS-95 IS-95 PCS PDC CT-2 DECT PHS DCS-1800 PACS Service Speech Coder Bit Rate (kbps) 13 16 8 8 14.4 4.5/6.7/11.2 32 32 32 13 32
77
cellular RPE-LTP cellular SBC cellular VSELP cellular CELP PCS CELP cellular VSELP cordless ADPCM cordless ADPCM cordless/PCSADPCM PCS RPE-LTP PCS ADPCM
KC Chen
GSM Codec
regular pulse excited long term prediction (RPE-LTP) combination of RELP (France) and MPE-LTP (Germany) 13 kbps complicated and power hungry
KC Chen
78
GSM Speech Encoder

Hamming Window Segmentation Pre-emphasis LPC Inverse Filter STP Analysis Filter + LPF Grid Selection M U X
LTP Analysis Filter
Pre-processing
STP
LTP
KC Chen
RPE
79
GSM Speech Decoder

D E M U X Grid Position/ RPE Decoding LTP Synthesis Filter STP Synthesis Filter output PostProcessing
KC Chen
80
Transmission
Speech coder issues 260 bits every 20 msec. 50 bits out of 260 bits describe filter coef., block amplitude, LTP parameters and are class Ia under channel coding protection. 132 bits describe RPE pointers, RPE pulses, some LTP parameters and are class Ib. 78 bits contain RPE pulse and filter parameters and are class II.
KC Chen
81
Discontinuous Transmission (DTX)

When a pause is detected by speech transcoder, we discontinue/suspend radio tx. for the duration of pause, 50% duty cycle. Voice activitiy detection (VAD) determines the presence/absence of speech, even under strong background noise. Every 480 ms, a silence descriptor (SID) frame is transmitted to yield presence.
Adaptive Multi-rate Codec (AMR)

1999, ETSI approved AMR codec by Ericsson, Nokia, Siemens.
3GPP adopted AMR later AMR contains a set of fixed-rate speech, channel codecs, fast in-band signaling, link adaptation.
Operating at full-rate (22.8K bps) and half-rate (11.4K bps) Ability to adapt to radio channel and traffic load conditions, to select optimal channel mode (HR/FR) and codec mode Tradeoff between speech and channel coding to deliver best possible combination of speech quality and system capacity
AMR Speech & Channel Coding

AMR (and EFR) utilizes algebraic code excitation linear prediction (ACELP) A combination of 8 speech codecs
12.2, 10.2, 7.95, 7.4, 6.7, 5.9, 5.15, 4.75 kbps
All for full-rate codec Lower 6 rates for half-rate codec
AMR NB (narrow band) with GMSK in rel98 Error correction is based on recursive systematic convolutional (RSC) coding with puncturing 6-bit CRC is used for detecting bad frames
AMR In-band Signaling & Link Adaptation

Both MS and BS perform channel quality measurement
Codec mode command (up link) or codec mode request (down link) is sent over radio interface in in-band messages
The receiving end uses information to select the best codec mode for prevailing channel condition
Codec mode indicator is sent over radio Codec mode might be different in up/down links but the channel mode (FR/HR) must be the same Network controls codec/channel mode, and MS follows AMR contains voice activity detection (VAD) and DTX
KC Chen
85
AMR Codec System

S- Speech QI- quality indicator MC- codec mode command (inband signaling) MR- codec mode request (inband signaling) MI- codec mode indicator (inband signaling) Mobile station (MS) Speech in Multirate Speech Encoder Multirate Channel Encoder
MRd
U=Uplink D=Downlink
Base transceiver station (MS) Multirate Channel Decoder

MRd
Transcoder (TC) Multirate Speech speech out decoder
MIu S
MIu S MRd
Radio Channel (uplink)
MIu S MRd
MIu S
Abis/ter
MIu S
Mode Request Generator

QIu
MCd
Uplink Quality Meas.

QIu
Downlink mode control Uplink mode control

MCu S MId
MCd
MCu
Downlink Quality Meas.
Link adaptation MultiMCu rate S KC Channel MId Chen Encoder
MultiMultiRadio MCu rate rate Channel Speech S Speech Channel MIu out NTUEE Mobile Communications(downlink) Decoder Decoder
Abis/ter
S MId
Multirate speech Speech 86 in encoder
Bit Allocation of AMR Codec

(Kbps) 12.2 10.2 7.95 7.4 6.7 5.9 5.15 4.75 1.75 LPC 38 26 27 26 26 26 23 23 29 LTP 30 26 28 26 24 24 20 20 0 FCB 140 124 68 68 56 44 36 36 0
KC Chen
Gains 36 28 36 28 28 24 24 16 6
Total 244 204 159 148 134 118 103 95 35

87
FCB: fixed codebook ACB: adaptive codebook

Data Link Layer - Layer 2
KC Chen
88
Layer 2 GSM Signaling

Protocol used for signaling transfer between a MS and a BTS is link access procedure for the Dm-channel (LAPDm). It is adapted from link access protocol data (LAPD) in ISDN networks. LAPD is used in GSM on Abis interface between BTS and BSC.
Tasks of Data Link Layer

The data link layer is responsible for the correct and complete transfer of information blocks between layer 3 entities over GSM air interface. The protocol have the following functions: organization of layer 3 information into frames peer-to-peer transmission of signaling data in defined formats recognition of frame formats establishment, maintainance/supervision, termination of one or parallel data links on signaling channels acknowledgement of transmission and reception of numbered information frames (I-frames) unacknowledged transmission and reception of unnumbered infromation frames (UI-frames)
Frame Format A
address field control length indicator field field fill bits
1 octet variable length
KC Chen
91
Frame Format B
address field control length indicator information field field field & fill bits
1 octet variable length
KC Chen
92
Frame Formats A & B

Frame format A is used when no signaling but wanting to keep the signaling channel. When signaling is ready for transmission, frame format B is used, which contains an information field. Such a frame is called an Iframe. When numbered I-frames are transmitted, it is referred as the acknowledged mode and the procedure called multi-frame operation.
KC Chen
93
Frame Formats Abis and Bbis

Abis Length Indicator Field Length Indicator Field Fill Bits
Bbis
Information Field & Fill Bits
Formats Abis and Bbis are equivalent to formats A and B but they are only used in the unacknowledged mode of signaling data transfer.
Address Field
In GSM control channels, the address field is fixed at one octet. It is primarily used to addressed the service access point (SAP), a defined interaface which provides services to a layer 3 entity. GSM provides two SAPs on radio interface: for signaling and for short message.
KC Chen
95
Address Field: continued

8 X 7 6 5 4 SAPI 3 2 1 LPD C/RE/A
LPD=00 for link protocol discriminator SAPI=000 for layer 3 signaling 011 for short messages C/R=0 for mobile sending a command 1 for mobile sending a response E/A=0 for next octet is a part of address E/A=1 for GSM control channels
Control Field
It consists of only one octet and is only in frame formats A & B. 3 types: I-frame: numbered and carrying numbered layer 3 information S-frame: control functions like I-frame ack., requests for repartitions, intermittent suspension of numbered inform. transfers. U-frame: unnumbered type frames offering additional data link functions.
KC Chen
97
Control Field: continued

I-frame 8 7 N(R) 8 7 N(R) 8 U
6 5 4 P 6 5 4 P/F S 6 5 4 U P/F U
KC Chen
3 N(S) 3 S 3 U
1 0
S-frame
0 1 2 1 1 1
98
U-frame
7 U
I-frame: This type of frames are numbered and carry numbered Layer 3 information. S-frame: Supervisor frames are control function like (a) I-frame ack. with fill frame (Format A) (b) request for repetitors (c) intermittent suspension of numbered information transfers U-frame: The unnumbered frames offer additional data link functions for Layer 2 and allow for the transfer of unnumbered and unack. information frames on control channels.
Control Field Parameters

N(S) Transmitter Send Sequence Number: modulo-8 counter N(R) Transmitter Receive Sequence Number: also a modulo-8 counter Poll/Final Bit: Poll bit is set when a response is requested; final bit is set when a response to a command is sent back.
KC Chen
100
Control Field Parameters: Supervisor and Unnumbered Bits

Receive Ready RR frame, SS=00, has 3 functions: a data link entity is ready to receive an I frame; ack. reception up to N(R)-1 frames; reset Layer 2 in case not ready Receive Not Ready, RNR frame, SS=01: can not receive I-frame Reject, REJ frame, SS=10: reception of one or more frames is required.
Control Field: U Frame

SABM Command, UUUUU=00111: Set asynchronous balanced mode starts the modulo-8counted I-frame transmissions. DISC Command, UUUUU=01000: Disconnect ends a multi-frame operation session. UA Response, UUUUU=01100: Unnumbered ack. is set to ack. an SABM or DISC. UI Command, UUUUU=00000: transmission of unnumbered information within the frame. DM Response, UUUUU=00011: sent from a data link layer entity when multiframe operation is not allowed.
KC Chen
102
Length Indicator Field

8 7 6 L 5 4 3 2 1 M EL
One octet is sufficient for GSM signaling. L stands for the length of Information Field in the remainder of the frame. M=0 either an entire layer 3 message included or the last part of segmented message M=1 another part of message following EL=1 the last octet in the length indicator field EL=0 not the last octet
Network Layer - Layer 3
KC Chen
104
Layer 3
The network layer of GSM, also referred as signaling layer, uses a protocol to establish, maintain, terminate mobile connections. Three sublayer defined for Layer 3 (network layer): radio resource management (RR), mobility management (MM), connection management (CM).
RR Sublayer
responsible for management of frequency spectrum, system reaction to radio environment changes, maintaining of a clear channel between PLMN and MS. including channel assignment, power control, time alignment, handover, etc.
KC Chen
106
RR Sublayer Procedures
channel assignment procedure channel release channel change and handover procedures change of frequencies, hopping sequences or algorithms, frequency tables measurement report from mobiles power control and timing advance modification of channel modes cipher mode setting
MM Sublayer
support of user mobility, registration, management of mobile data checking user & equipment identity checking allowed services for users support of confidentiality (e.g. TMSI) user security provision of MM connection, based on RR, to CM
MM Sublayer Procedures
location update periodic updating authentication IMSI attach IMSI detach TMSI reallocation indentification
CM Sublayer
managing all functions necessary for circuit switching call control in GSM PLMN call control responsibilities, which are amost identical to a fixed ISDN network, call control entity in GSM establishing, maintaining,and releasing call connection for communication links.
KC Chen
110
CM Sublayer Procedures
mobile-originated call establishment mobile-terminated call establishment changes of transmission mode during an ongoing call call re-establishment after interruption of an MM connection dual-tone multi-frequency (DTMF) control for DTMF transmissions
Structure of Layer 3 Message

8 7 6 TI TI flag 0 5 4 3 2 1 Protocol Discriminator
Message Type Information Elements mandatory Information Elements optional
KC Chen
112
Transaction Identifier
TI is a pointer to distinguish multiple parallel CM connections and various simultaneous transactions. For RR & MM, TI is not relevant, TI=0000. TI flag indicates originator of a CM connection. It is set 0 by the originator and 1 when sent back.
KC Chen
113
Protocol Discriminator
PD links Layer 3 protocol to the addressed entity and identifies 6 protocols: radio resource management (0110), mobility management (0101), call control (0011), short message services (1001), supplementary service (1011), test procedure (1111).
KC Chen
114
Information Elements
Mandatory IEs have a reserved place in structure of message; optional IEs carry information element identifier (IEI) telling receiver the purpose of information contained. 4 possible IE types: mandatory fixed length (MF), mandatory variable length (MV), optional fixed length (OF), optional variable length (OV).
KC Chen
115
Testing GSM
KC Chen
116
First Generation GSM Radio Test

Personal Computer SC ENC HWC DEC BDM
RF/SYNTH MOD O-att I-att DEMOD RF-out RF-in
117
Transmitter Measurements
RF power frequency error and phase error special transmitter power measurements: peak power, power-time template, burst timing measurements in spectrum: due to modulation, due to switching transients, spurious emissions, intermodulation attenuation
KC Chen
118
BER, residual BER, frame erasure rate sensitivity cochannel rejection adjacent channel rejection intermodulation rejection blocking & spurious response rejection
Measurements on Digital Receivers
KC Chen
119
Test of Layer 1
synchronization and timing power control radio channel management
KC Chen
120
Fading Environments
rural area (RA) hilly terrain (HT) typical urban (TU) equalizer (EQ)
KC Chen
121
Test of Layer 2
establishment of an acknowledged data link error control during data link establishment seq. counting during ack. block transfer segmentation and concatenation loss of I-frame reaction to erroneous C/R in address field reaction to erroneous values in control field reaction to invalid frames
Block Diagram of Mobile Station

receiving circuits antenna combiner A/D equalizer demodulator demultiplexer channel codec speech codec A/D D/A
control VCO & synthesizer signaling unit
transmitting D/A burst building unit circuits multiplexer telephone modulator

Additional RF Tests on a MS
bad-frame indication performance intermodulation rejection transceiver test for spurious emission measurement in active & idle states.
KC Chen
124
Signaling Test of Layer 1

downlink power control correction of burst timing report of actual timing advance & power levels (uplink SACCH) measurement report
KC Chen
125
Block Diagram of Base Station

receiving circuits A/D equalizer demodulator demultiplexer speech codec 64 kbps A-law 13 kbps 64 kbps channel signaling codec
control VCO & synthesizer signaling unit
16 kbps transmitting D/A burst building unit speech circuits multiplexer codec modulator
64 kbps
BTS BSC 3 kbps in-band signaling Abis

Iridium: Satellite Mobile Using GSM
KC Chen
127
Briefing
66 LEO (low-earth-orbit) satellites in 6 polar orbital planes which 780 km above seasurface. Each has 48 L band beams for subscriber coverage. Constellation of satellites is controlled by the system control segment (SCS). SCS also decides frequency planning and routing information. It is a packet switching network.
KC Chen
128
Iridium System Overview

K-band L-band Gateway International switching center PSTN
L-band
K-band
ISU
System Control Segment
Iridium Gateway
MOC HLR VLR EIR M S C GMS
ETC
International Switch & PSTN

MOC: message origination controller GMS: gateway management system ETC: earth station controller EIR: equipment identity register
KC Chen 130
INMARSAT
The only commercial satellite mobile communication system
3 geo-stationary satellites over Pacific, Indian, Atlantic oceans Supporting speech, data, video traffic Small VSAT and portable terminals Originally for marine-time applications
KC Chen
131
General Packet Radio Services: GPRS
KC Chen
132
What Is GPRS?
Conventional Way: Circuit Switched Data
PSTN HLR
CIRCUIT SWITCHED
MSC/ VLR
A
BSC
Data over Voice

GSM BTS
KC Chen
133
What Is GPRS?
Packet Switched Technology on GSM
PSTN HLR MSC/ VLR GGSN PSDN Internet
A
BSC
Gb Packet Data
SGSN
GGSN: Gateway GPRS Support Node SGSN: Serving GPRS Support Node
KC Chen 134
GSM BTS
PACKET SWITCHED
What Is GPRS?
GPRS VS Circuit Switched Data
Time Circuit Switched Data
TS1 TS2 TS3
GPRS
TS1
KC Chen
135
GPRS Multi-slot Capabilities

Downlink 1-slot Uplink Monitor 0 5 1 6 2 7 3 0 4 1 5 2 6 3 7 4 0 5 1 6
Downlink 2-slot Uplink Monitor
0 5
1 6
2 7
3 0
4 1
5 2
6 3
7 4
0 5
1 6
Downlink 3-8-slot Uplink Monitor
0 5
1 6
2 7
3 0
4 1
5 2
6 3
7 4
0 5
1 6
KC Chen
136
3 slots:
4th slot:
5th slot:
What Is GPRS?
GPRS Network Seen by IP Network
Host 155.222.33.55
Subnetwork 191.200.44.xxx
Source: Nokia
KC Chen
137
Why GPRS?
Operators View
First attractive data service for GSM. Optimal support for packet switched traffic. First step to the 3rd generation. The possibility to offer new services. Better network efficiency. Higher revenue.
KC Chen
138
Why GPRS?
Users View
A global and wireless access to the Internet ! All existing TCP/IP applications can be used. New and attractive services. Users stay on the line long but only pay for the capacity used. Data rate from 9.05 kbps up to 171.2 kbps.
9.05 kbps per channel by CS-1 (Channel Coding Scheme 1). 13.4 kbps by CS-2, 15.6 kbps by CS-3, and 21.4 kbps by CS4. Maximum date rate: 21.4 x 8 = 171.2 kbps.
Services on GPRS
GPRS is only a bearer!
E-mail File transfer Shopping and ticket sales Banking and finance management News Web Traffic information Stock prices And many others...
GPRS Logical Architecture

SGSN: Serving GPRS Support Node GGSN: Gateway GPRS Support Node
SGSN
GGSN
SGSN
New Interface ( IP ) New Interface ( IP/X.25 ) New Interface ( FR ) New Interface ( SS7 )
New Elements for GPRS

SGSN
Same level as the MSC/VLR. Connected to the BSS with Frame Relay. Detects new GPRS MSs in its service area. Records location of MSs in its service area. Sends/Receives data packets to/from the MSs.
GGSN
Provides interworking with the PDN (e.g., the Internet). Looks like a router, when seen by the Internet. Connected to the SGSN via an IP-based backbone.
Enhanced Elements for GPRS

HLR
Enhanced with GPRS subscriber data and routing information.
MSC/VLR
Enhanced for co-ordination of GPRS and Circuit Switched services (e.g., combined location update, paging for circuit-switched calls via the SGSN ).
BSS
Supports flexible radio channel allocation, and supports a new interface to the SGSN.
SMS-GMSC and SMS-IWMSC

Supports SMS transmission via the SGSN.
Illustration - GPRS Attach

Internet HLR GGSN GGSN IP based backbone SGSN SGSN
Attach
BSS BSS
KC Chen
144
Illustration - Activate an IP
Address
Activate
BSS BSS
KC Chen
145
Illustration
- Intra SGSN Routing Area (RA) Update
BSS BSS
RA Up da te
KC Chen 146
Illustration - Inter SGSN RA

Update
BSS BSS
RA
Up
da te
147
KC Chen
Illustration
- Data Routing from the Internet to the MS
BSS BSS
KC Chen
148
Illustration
- Data Routing from the MS to the Internet
BSS BSS
KC Chen
149
Illustration
- MS to MS Routing via the same GGSN
BSS BSS
KC Chen
150
Illustration
- MS to MS Routing via the same GGSN
BSS BSS
KC Chen
151
Illustration
- MS to MS Routing via Different GGSNs
BSS BSS
KC Chen
152
Illustration
- Data Routing for Roaming MS
HLR Internet GGSN GGSN Operator 1 backbone SGSN SGSN Operator 2 backbone BG Inter-operator backbone BG
BSS
KC Chen
153
Transmission plane
Transmission plane ( continued )

GTP: GPRS Tunneling Protocol IP: Internet Protocol UDP: User Data Protocol TCP: Transmission Control Protocol SNDCP: Subnetwork Dependent Convergence Protocol LLC: Logical Link Control BSSGP: BSS GPRS Protocol NS: Network Service RLC: Radio Link Control function MAC: Medium Access Protocol

GPRS Tunneling Protocol
By GTP, many packet data protocol ( e.g., IP, X.25 ) can be supported, even if the protocol is not supported by all SGSNs. GTP header contains an IMSI (International Mobile Subscriber Identifier) and an NSAPI (Network Service Access Point Identifier) . Below GTP, IP ( V4 or V6 ) is used as a backbone network protocol. Ethernet, ISDN, or ATM may be used below IP. TCP carries GTP protocol data unit for X.25, UDP carries GTP protocol data unit for IP.

Subnetwork Dependent Convergence Protocol
Multilplexing, segmentation, and compression.
TLLI: Temporary Logical Link Identifier


RLC/MAC
KC Chen
158

RLC/MAC (uplink)
The access to the uplink uses a Slotted-Aloha based reservation protocol.
KC Chen
159

RLC/MAC (uplink)
A selective ARQ protocol that provides retransmission of erroneous RLC data blocks.
KC Chen
160

RLC/MAC (downlink)
The network initiates packet to an MS that is in Standby state by sending a Packet Paging Request.
KC Chen
161

RLC/MAC (downlink)
KC Chen
162

LLC
Provides a reliable logical link between the MS and its SGSN. Acknowledged mode for Packet Data Unit. Unacknowledged mode for signaling and SMS.
BSS GPRS Protocol

Conveys routing information between SGSN and BSS.
Network Service
Frame Relay.
Signaling plane: MS-SGSN
GMM: GPRS Mobility Management SM: Session Management

Signaling plane: SGSN-HLR
MAP: with enhancement for GPRS
KC Chen
165
Signaling plane: SGSNMSC/VLR
BSSAP+: A subset of Base Station System Application Part ( BSSAP ) . It supports signaling for Mobility Management Functionality ( e.g. combined
RA/LA update )
Signaling plane: GSN-GSN
GTP: GPRS Tunneling Protocol UDP: User Datagram Protocol
KC Chen
167
Signaling plane: GGSN-HLR

-based on MAP
MAP: Supports signaling for Network-Requested PDP ( Packet Data Protocol ) Context Activation Procedure
Signaling plane: GGSN-HLR

-based on GTP and MAP
Interworking: between GTP and MAP

References
CHT Labs. Presentation GSM 03.60 Version 6.3.2 ( 1999-07 ) GSM 03.64 Version 6.2.0 ( 1999-05 ) Nokias White Paper on GPRS http://www.nokia.com http://www.ericsson.com http://www.motorola.com http://www.alcatel.com http://www.nortelnetworks.com
EDGE
KC Chen
171
Modulation Coding
8-PSK
270.833 kbps (as GMSK) 3 bits/symbol Payload per burst: 342 bits (vs 114 bits) Gross rate per time slot: 68.4 kbps (vs 22.8 kbps)
KC Chen
172
Logical architecture
KC Chen
173
Transmission Plane
KC Chen
174
Network architecture for supporting HSCSD
KC Chen
175
Multiplexing of network protocols

Signaling SMS Pocket data protocol N-PDU NSAPI SNDCP SNDC header NSAPI + control SAPI LCC LCC header TLLI control
NTUEE Mobile Communications RLC or BSSGP KC Chen
Data
LCC information Data

176
EGPRS coding and puncturing example

(MCS-9: uncoded 8-PSK, two RLC blocks per 20ms)
3 bits USF 45 bits RLC/MAC HCS E Hdr. 612 bits FBI Data=592 bits BCS TB E Rate 1/3 convolutional coding 36 bits 135 bits Puncturing SB=8 36 bits 124 bits 612 bits P1 1836 bits Puncturing 612 bits P2 612 bits P3 612 bits P1 612 bits FBI Data=592 bits BCS TB Rate 1/3 convolutional coding 1836 bits Puncturing 612 bits P2 612 bits P3
KC Chen 1392 bits
177
Network architecture
(a) 57.6 kbps non-transparent service
NTUEE Mobile Communications (b)
KC Chen 56.0 / 64.0 kbps transparent service
178

2 - 2 GSM

Încărcat de

Informații document

Descriere originală:

Titlu original

Drepturi de autor

Formate disponibile

Partajați acest document

Partajați sau inserați document

Opțiuni de partajare

Vi se pare util acest document?

Este necorespunzător acest conținut?

Drepturi de autor:

Formate disponibile

2 - 2 GSM

Încărcat de

Drepturi de autor:

Formate disponibile

GSM, GPRS, and EDGE

NTUEE Mobile Communications

NTUEE Mobile Communications

Further Standardization (I)

Further Standardization (II)

Supplementary, billing, related Service platforms

GSM System Architecture

PSTN ISDN Data net.

OMC Network Switching Subsystem

Registration in Network MS BTS BSC (G)MSC VLR HLR

NTUEE Mobile Communications

NTUEE Mobile Communications

NTUEE Mobile Communications

Handoff in Analog Systems

Types of GSM Handover

Kc DATA Ciphered Data

NTUEE Mobile Communications

Temporary Mobile Subscriber Identity (TMSI)

NTUEE Mobile Communications

Physical Layer - Layer 1

NTUEE Mobile Communications

GSM Frame Structure

4.615 msec 0.57692 msec 3 156.25 bits Tail Bit

Coded Data Midamble 57 1 26 1 57 3 8.25 Guard Period

GSM Radio Subsystem

GSM Traffic CHannels (TCH)

GSM Control Channels (CCH)

Frequencies: Primary GSM

NTUEE Mobile Communications

NTUEE Mobile Communications

NTUEE Mobile Communications

Power Levels in GSM

NTUEE Mobile Communications

Power Levels in DCS-1800 and Phase II GSM

NTUEE Mobile Communications

Macro-cell and Micro-cell

Macro-cell and Micro-cell

Power Levels for Micro-BTS

NTUEE Mobile Communications

Time Division Duplex (TDD) in GSM

MS transmts TDMA Frame 4.615ms around 216.6 Hz effect

NTUEE Mobile Communications

NTUEE Mobile Communications

Pulse Power Profile

Tail Bits (T)

NTUEE Mobile Communications

Stealing Flag (S)

NTUEE Mobile Communications

Guard Period (GP)

NTUEE Mobile Communications

Random Access Burst

NTUEE Mobile Communications

NTUEE Mobile Communications

NTUEE Mobile Communications

Broadcast Channels (BCH)

Common Control Channels (CCCH)

NTUEE Mobile Communications

Common Control Channels (CCCH): continued

NTUEE Mobile Communications

Dedicated Control Channels (DCCH)

Fast Associated Control Channel (FACCH)

Logical Channels and Directions