Southern Methodist University Fall 2003 EETS 8316/NTU CC745-N Wireless Networks

1. Southern Methodist University Fall 2003 EETS 8316/NTU CC745-N Wireless Networks Lecture 4: GSM Instructor: Jila Seraj email: jseraj@engr.smu.edu http://www.engr.smu.edu/~jseraj/ tel: 214-505-6303

2. Review In the last meeting we discussed • Handoff, challenges, solutions • Anchor MSC, path optimization • North American Numbering Plan • Numbers in GSM network

3. Review, Handoff • Movement into a different cell requires MTSO to automatically transfer call to another base station without interruption • Two types of handoff, hard handoff and soft handoff • BSC decides on handoff in the first generation of mobile network • BSC together with handset decides on handoff, MAHO

4. Review, Handoff, cont.. • Phases of handoff are: handoff decision, resource reservation, execution, clearing resources. • Handoff challenges are: Performing handoff before signal strength becomes too low, do not perform unnecessary handoff, resource allocation, inter-MSC/inter-system handoff, handset capabilities • Anchor MSC remains in the call

5. BS BS New Serving MSC PSTN Anchor MSC Review, Handoff, cont.. • What happens if we go back to the anchor MSC? • IS-41 has handoff back facility • What if a third MSC gets involved? • Path minimization process

6. 6 BS 7 BS BS Serving MSC PSTN Anchor MSC 4 Target MSC HANDTHIRD 1 FACDIR 2 FACDIRR 3 HANDTHIRDR 5 MSONCH 8 FACREL 9 FACRELR 10 Review, Handoff, cont..

7. BS BS BS MSC PSTN Anchor MSC New Serving MSC Call Path after path minimization process Review, Handoff, cont..

8. Review, Registration, cont.. • Registration, Power up/down, periodical, New system, Call origination • MS Service Qualification • validation information (billing) • Service profile information, features, restrictions…

9. Review, Roaming, cont.. • MS Location Update occurs at registration, deregistration, new location area, new system • Deregistration is either triggered by mobile (power down registration), by MSC for inactivity, by HLR at registration in another MSC.

10. Review, Border Case • If registration happens in several MSC, HLR decides which one is valid. • If registration happens in several BS, MSC determines which one is valid

11. Review, Paging • Paging is used when there is a terminating call to a mobile station. • A termination call is routed towards gateway MSC, Gateway MSC consults HLR, HLR request paging from visiting MSC, visiting MSC pages the handset, when page response is received HLR is informed, HLR send the visiting MSC address to gateway MSC that routes the call to visiting MSC and the terminating call is established.

12. Review, Paging, cont.. • If multiple MSC responds to the page request, HLR chooses the valid page response

13. Review, North American Numbering Plan • North American Numbering Plan consists of 10 digits, NPA-NXX-XXXX • There is no way for a switch to identify that a number belongs to a mobile subscriber, nor can it identify the network provider. • Mobile network provider “buy” a certain number series in each area for their users. • Therefore we can not bill a caller to a mobile user for the air usage. They do it in other countries!

14. Review, Primer on RF • The radio frequencies are grouped into bands. • Each set of bands are dedicated to different purposes by FCC • Each frequency is logically divided into time slots for communication between mobile station and the base station. • Some time slots are reserved for user traffic, such as voice and data and other for signaling purposes.

15. DCCH Reverse Forward SPACH RACH BCCH SCF Reserved PCH ARCH SMSCH FBCCH EBCCH SBCCH Review, Cellular DCCH Structure

16. GSM General Architecture PSTN OMC GSM Public land mobile network (PLMN) VLR MSC AUC HLR NMC A EIR BSS BSS BSC ADC Abis BTS BTS OSS Um OSS: operation subsystem BSS: base station subsystem MS: mobile station MS MS MT TE

17. GSM • Several first generation analog cellular systems in Europe but incompatible - limited roaming • 1987-1989 ETSI standards for pan-European Global System for Mobile Communications (GSM, originally Group Special Mobile) at 900 MHz • 1992 GSM is launched • 1990-1993 Standards for Digital Cellular System at 1800 MHz (DCS 1800, recently renamed GSM 1800; US version is PCS 1900)

18. GSM, cont.. • Objectives: • Broad offering of speech and data services • Compatible with wireline networks, eg, ISDN • Automatic roaming and handoff • Highly efficient use of frequency spectrum • Support for different types of mobile terminal equipment (eg, cars, portable handsets)

19. GSM, cont.. • Objectives: • Digital signaling and transmission • Low cost infrastructure and terminal equipment

20. GSM, cont.. • 13 recommendations • R.00: Preamble • R.01: General structure of recommendations, GSM overview • R.02: Service aspects: types of services • R.03: Network aspects: architecture, call routing, performance objectives • R.04: Mobile/base station interface and protocols

21. GSM, cont.. • R.05: Physical layer on radio path: multiple access, channel coding, modulation, transmission • R.06: Speech coding aspects • R.07: Terminal adaptors for mobile stations • R.08: Base station and mobile switching center (MSC) interface • R.09: Interworking with PSTN and packet data networks

22. GSM, cont.. • R.10: Service interworking, short message service • R.11: Equipment specification • R.12: Operation and maintenance, tariffs, traffic administration

23. Channel bandwidth 200 kHz Multiple access TDMA Users/carrier 8 13 kb/s Speech coding rate 22.8 kb/s FEC coded speech rate GSM, cont.. Summary of features

24. GSM, cont.. Summary of service quality requirements Speech intelligibility 90% Max one-way delay 90 ms Max handoff gap 150 ms if intercell Time to alert mobile of inbound cell 4 sec first attempt, 15 sec final attempt Release time to called network 2 sec Connect time to called network 4 sec

25. GSM General Architecture, cont.. • Mobile station (MS) communicates to base stations through radio interface Um • Mobile termination (MT) supports physical channel between MS and base station (radio transmission, channel coding, speech coding)

26. GSM General Architecture, cont.. • Terminal equipment (TE), eg, telephone set. Contains terminal/user-specific data in form of smart card (subscriber identify module or SIM card), plugs into any GSM terminal like credit card and identifies user to network for personal mobility (in addition to terminal mobility) and security

27. GSM General Architecture, cont.. • Base station Subsystem (BSS) communicates with mobile switching center through network interface A • Base Transceiver Station (BTS) handles channel allocation, signaling, frequency hopping, handover initiation, etc. • BTS communicates with BSC using Abis interface

28. GSM General Architecture, cont.. • Base station controller (BSC) manages radio channels, paging, handoff for several BTSs • BSC communicates with MSC using A interface • Mobile switching center (MSC) is gateway to PSTN and packet data networks • Performs switching, paging functions, MS location updating, handoff control, etc.

29. GSM General Architecture, cont.. • Home location register (HLR) stores subscriber info and part of MS’s location info to route incoming calls to visitor location register (VLR) where mobile is roaming • VLR registers users roaming in its area and assigns roaming numbers

30. GSM General Architecture, cont.. • Authentication center (AUC) is accessed by HLR to authenticate a user for service. It contains authentication and encryption keys for subscribers • Equipment identity register (EIR) allows stolen or fraudulent mobile stations to be identified

31. GSM General Architecture, cont.. • Operation subsystem (OSS) contains: operations and maintenance center (OMC), network management center (NMC), and administration center (ADC) . These network elements work together to monitor, control, maintain, and manage the network

32. GSM Logical and Physical Channels • Um interface: various logical channels are mapped to physical channels • A physical channel is a timeslot with timeslot number in a sequence of TDMA frames • 8 physical channels mapped onto 8 timeslots within TDMA frame per frequency carrier

33. GSM Physical Channels TDMA frame = 4.615 ms Timeslot 1 2 3 4 5 6 7 8 Frequency 1 Ch 1 Ch 2 Ch 3 Ch 4 Ch 5 Ch 6 Ch 7 Ch 8 Frequency 2 Ch 1 Ch 2 Ch 3 Ch 4 Ch 5 Ch 6 Ch 7 Ch 8 : : : : Frequency 124 Ch 1 Ch 2 Ch 3 Ch 4 Ch 5 Ch 6 Ch 7 Ch 8

34. GSM Logical Channel Structure CBCH CCH TCH TCH/F TCH/H BCH CCCH DCCH AGCH PCH FCCH SCH RACH SDCCH BCCH ACCH FACCH SACCH

35. GSM Logical Channels • 3 groups of logical channels, TCH, CCH and CBCH • TCH is used to carry voice or data traffic • CCH is used for control functions • CBCH is used for broadcast functions

36. GSM Logical Channels, cont.. • Logical traffic channels = full rate (TCH/F) at 22.8 kb/s or half rate (TCH/H) at 11.4 kb/s • Physical channel = full rate traffic channel (1 timeslot) or 2 half rate traffic channels (1 timeslot in alternating frames) • Full rate channel may carry 13 kb/s speech or data at 12, 6, or 3.6 kb/s • Half rate channel may carry 6.5 kb/s speech or data at 6 or 3.6 kb/s

37. GSM Logical Channels, cont.. • CCH consists of 3 groups of logical control channels, BCH, CCCH and DCCH • BCH (broadcast channel): point-to-multipoint downlink only. Contains three sub-channels, BCCH, FCCH and SCH • BCCH (broadcast control channel): send cell identities, organization info about common control channels, cell service available, etc

38. GSM Logical Channels • FCCH (frequency correction channel): send a frequency correction data burst containing all zeros to effect a constant frequency shift of RF carrier • SCH (synchronization channel): send TDMA frame number and base station identity code to synchronize MSs

39. GSM Logical Channels, cont… • CCCH (common control channel): Consists of three sub-channels, PCH, AGCH and RACH. This channels is used for paging and access • PCH (paging channel): to page MSs • AGCH (access grant channel): to assign MSs to stand-alone dedicated control channels for initial assignment • RACH (random access channel): for MS to send requests for dedicated connections

40. GSM Logical Channels, cont… • DCCH (dedicated control channel): bi-directional point-to-point -- main signaling channels. Consist of two sub-channels, SDCCH and ACCH • SDCCH (stand-alone dedicated control channel): for service request, subscriber authentication, equipment validation, assignment to a traffic channel

41. GSM Logical Channels, cont… • SACCH consist of two sub-channels, SACCH and FACCH • SACCH (slow associated control channel): for out-of-band signaling associated with a traffic channel, eg, signal strength measurements • FACCH (fast associated control channel): for preemptive signaling on a traffic channel, eg, for handoff messages

42. OMAP Layer 4-7 INAP MAP ISUP TCAP MUP OSI Model for SS7 SCCP Layer 3 MTP Layer 1-2 Signaling link function, Signaling link physical requirement

43. CM MM CM RRM MM RRM RRM SCCP LAPD LAPD LAPD LAPD RF RF RF RF GSM Interfaces, cont.. Air Interface Um Abis A RRM SCCP LAPD LAPD RF RF

44. GSM Protocol Layers • RF : Physical Layer • LAPD: Link Layer, ISDN protocol based • SCCP: Signal Connection Control Layer, part of link layer • RR: Radio Resource • MM: Mobility Management • CC: Call Control

45. GSM Network Layer • Network layer consists of 3 sublayers • Radio resource management (RR) sublayer • Establishment, maintenance, and termination of radio channel connections • Mobility management (MM) sublayer • Registration, authentication, and location tracking • Call control (CC) sublayer • Establishment, maintenance, and termination of circuit-switched calls

46. Switching System VLR AUC MAP MAP HLR VLR EIR MAP MAP MSC BSSAP Base Station Subsystem BSS GSM Interfaces

47. Switching System BSSAP Base Station Subsystem BSS BSC LAPD BTS MS GSM Interfaces, cont…

48. GSM Numbers • International mobile station equipment identity (IMEI). IMEI= TAC + FAC + SNR + SP • TAC = Type Approval Code, 6 decimals • FAC = Final Assembly Code, 6 decimals, assigned by manufacturer • SNR = Serial Number, 6 decimals, assigned by manufacturer • SP = Spare, 1 decimal place • EIR has while, black and optionally grey list.

49. GSM Numbers • International mobile station equipment identity (IMEI). IMEI= TAC + FAC + SNR + SP • TAC = Type Approval Code, 6 decimals • FAC = Final Assembly Code, 6 decimals, assigned by manufacturer • SNR = Serial Number, 6 decimals, assigned by manufacturer • SP = Spare, 1 decimal place • EIR has while, black and optionally grey list

50. GSM Numbers, cont… • International mobile Subscriber Identity (IMSI). Stored on the SIM (Subscriber Identity Module) card. IMSI is obtained at the time of subscription. IMSI is not made public. • IMSI = MCC + MNC + MSIN • MCC = Mobile Country Code, 3 decimals • MNC = Mobile Network Code, 2 decimals