eee 464 eee 464 wireless communications lecture 7 shahzad malik, ph.d. [email protected]

EEE 464EEE 464 Wireless

Communications

Lecture 7

Shahzad Malik, Ph.D.

[email protected]

Mobile Cellular Wireless Networks

This lecture presents system details of 2G/3G mobile cellular networks:

GSM/GPRS, CdmaOne (IS-95) and UMTS/ Cdma2000

Shahzad Malik Lecture 7

3Wireless Communications - GSM

Global System for Mobile (GSM)

GPRS

SMS

EDGE

Organization of Lecture 7Organization of Lecture 7

GSMGlobal System for

Mobile



Cellular Systems – Generation

1G 2G 3G2.5G

IS-95cdmaOne

IS-136TDMAD-AMPS

GSM

PDC

GPRS

IMT-DSUTRA FDD / W-CDMA

EDGE

IMT-TCUTRA TDD / TD-CDMA

cdma2000 1X

1X EV-DV(3X)

AMPSNMT

IMT-SCIS-136HSUWC-136

IMT-TCTD-SCDMA

CT0/1

CT2IMT-FTDECT

CD

MA

TD

MA

FD

MA

IMT-MCcdma2000 1X EV-DO



Digital PLMN systems

IMT-2000GSMGSM

CDMA 2000

CDMA 2000

IS-136IS-136

GPRSGPRS

EDGEEDGE

IS-95IS-95

UMTS:UMTS:

USA

2nd Generation (2G) 3rd Generation (3G) 4G

UTRA FDDUTRA FDD

UTRA TDDUTRA TDD

(PLMN = Public Land Mobile Network)

Packet services

More radio capacity

FDDFDD



GSM: Overview

GSM - Global System for Mobile formerly: Groupe Spéciale Mobile (founded 1982) now: Global System for Mobile Communication Pan-European standard (ETSI, European

Telecommunications Standardisation Institute) simultaneous introduction of essential services in three

phases (1991, 1994, 1996) by the European telecommunication administrations seamless roaming within Europe possible

today many providers all over the world use GSM (more than 184 countries in Asia, Africa, Europe, Australia, America)

more than 1000 million subscribers more than 70% of all digital mobile phones use GSM over 10 billion SMS per month in Germany, > 360

billion/year worldwide



GSM

Objectives:

Broad offering of speech and data services

Compatible with wireline networks, eg, ISDN

Automatic roaming and handoff

Highly efficient use of frequency spectrum

Support for different types of mobile terminal

equipment (eg, cars, portable handsets)

Digital signaling and transmission

Low cost infrastructure and terminal equipment



Performance characteristics of GSM

Communication mobile, wireless communication; support for voice and

data services Total mobility

international access, chip-card enables use of access points of different providers

Worldwide connectivity one number, the network handles localization

High capacity better frequency efficiency, smaller cells, more customers

per cell High transmission quality

high audio quality and reliability for wireless, uninterrupted phone calls at higher speeds (e.g., from cars, trains)

Security functions access control, authentication via chip-card and PIN



Architecture of the GSM system

GSM is a PLMN (Public Land Mobile Network) several providers setup mobile networks following

the GSM standard within each country components

MS (mobile station) BS (base station) MSC (mobile switching center) LR (location register)

subsystems RSS (radio subsystem): covers all radio aspects NSS (network and switching subsystem): call

forwarding, handover, switching OSS (operation subsystem): management of the

network



GSM: overview

fixed network

BSC

BSC

MSC MSC

GMSC

OMC, EIR, AUC

VLR

HLR

NSSwith OSS

RSS

VLR



GSM: elements and interfaces

NSS

MS MS

BTS

BSC

GMSC

IWF

OMC

BTS

BSC

MSC MSC

Abis

Um

EIR

HLR

VLR VLR

A

BSS

PDNISDN, PSTN

RSS

radio cell

radio cell

MS

AUCOSS

signaling

O



Um

Abis

ABSS

radiosubsystem

MS MS

BTSBSC

BTS

BTSBSC

BTS

network and switching subsystem

MSC

MSC

fixedpartner networks

IWF

ISDNPSTN

PSPDNCSPDN

SS

7

EIR

HLR

VLR

ISDNPSTN

GSM: system architecture



System architecture: radio subsystem

Components MS (Mobile Station) BSS (Base Station

Subsystem):consisting of

BTS (Base Transceiver Station):sender and receiver

BSC (Base Station Controller):controlling several transceivers

Interfaces Um : radio interface Abis : standardized, open

interface with 16 kbit/s user channels

A: standardized, open interface with 64 kbit/s user channels

Um

Abis

A

BSS

radiosubsystem

network and switchingsubsystem

MS MS

BTSBSC MSC

BTS

BTSBSC

BTSMSC



Radio subsystem

The Radio Subsystem (RSS) comprises the cellular mobile

network up to the switching centers Components

Base Station Subsystem (BSS): Base Transceiver Station (BTS): radio components

including sender, receiver, antenna - if directed

antennas are used one BTS can cover several cells Base Station Controller (BSC): switching between BTSs,

controlling BTSs, managing of network resources,

mapping of radio channels (Um) onto terrestrial

channels (A interface) BSS = BSC + sum(BTS) + interconnection

Mobile Stations (MS)



Radio subsystem - BSS Base Station Subsystem

It is the wireless point of contact of the network with users It forms Radio Access Network (RAN) It translates between the air interface and the wired

infrastructure protocolsThe two network segments need different protocols

because the difference of the nature of wireless links Unreliable, bandwidth limited, supports mobility

Speech Conversion The MS generates radio-efficient 13 kbps digitized voice packets

using speech coder. The backbone PSTN requires 64 kbps PCM digitized voice. The BSS converts 13 to 64 kbps code.

Signaling The multi-tone frequency signaling is used in POTS in the wired

backbone, whereas GSM performs several packet exchange to establish a call. The signaling conversion takes place at the BSS



Radio subsystem - BSS

Tasks of a BSS are distributed over BSC and BTS BTS comprises radio specific functions BSC is the switching center for radio channels

Functions BTS BSCManagement of radio channels XFrequency hopping (FH) X XManagement of terrestrial channels XMapping of terrestrial onto radio channels XChannel coding and decoding XRate adaptation XEncryption and decryption X XPaging X XUplink signal measurements XTraffic measurement XAuthentication XLocation registry, location update XHandover management X



Radio subsystem - Mobile station Terminal for the use of GSM services

A mobile station (MS) comprises several functional groups MT (Mobile Terminal):

offers common functions used by all services the MS offers

end-point of the radio interface (Um) TA (Terminal Adapter):

terminal adaptation, hides radio specific characteristics

TE (Terminal Equipment): peripheral device of the MS, offers services to a user does not contain GSM specific functions

SIM (Subscriber Identity Module): personalization of the mobile terminal, stores user

parameters

R SUm

TE TA MT



network and switching subsystem

Components MSC (Mobile Services Switching Center): IWF (Interworking Functions)

ISDN (Integrated Services Digital Network) PSTN (Public Switched Telephone Network) PSPDN (Packet Switched Public Data Net.) CSPDN (Circuit Switched Public Data Net.)

Databases HLR (Home Location Register) VLR (Visitor Location Register) EIR (Equipment Identity Register)

networksubsystem

MSC

MSC

fixed partnernetworks

IWF

ISDNPSTN

PSPDNCSPDN

SS

7

EIR

HLR

VLR

ISDNPSTN



Network and switching subsystem NSS is the main component of the public mobile

network GSM switching, mobility management, interconnection to

other networks, system control Components

Mobile Services Switching Center (MSC)controls all connections via a separated network to/from a mobile terminal within the domain of the MSC - several BSC can belong to a MSC

Databases (important: scalability, high capacity, low delay)

Home Location Register (HLR)central master database containing user data, permanent and semi-permanent data of all subscribers assigned to the HLR (one provider can have several HLRs)

Visitor Location Register (VLR)local database for a subset of user data, including data about all user currently in the domain of the VLR



Mobile Services Switching Center The MSC (mobile switching center) plays a central

role in GSM switching functions additional functions for mobility support management of network resources interworking functions via Gateway MSC (GMSC) integration of several databases

Functions of a MSC specific functions for paging and call forwarding termination of SS7 (signaling system no. 7) mobility specific signaling location registration and forwarding of location

information provision of new services (fax, data calls) support of short message service (SMS) generation and forwarding of accounting and billing

information



Operation subsystem The OSS (Operation Subsystem) enables

centralized operation, management, and maintenance of all GSM subsystems

Components Authentication Center (AUC)

generates user specific authentication parameters on request of a VLR

authentication parameters used for authentication of mobile terminals and encryption of user data on the air interface within the GSM system

Equipment Identity Register (EIR) registers GSM mobile stations and user rights stolen or malfunctioning mobile stations can be locked

and sometimes even localized Operation and Maintenance Center (OMC)

different control capabilities for the radio subsystem and the network subsystem



1 2 3 4 5 6 7 8

higher GSM frame structures

935-960 MHz124 channels (200 kHz)downlink

890-915 MHz124 channels (200 kHz)uplink

frequ

ency

time

GSM TDMA frame

GSM time-slot (normal burst)

4.615 ms

546.5 µs577 µs

tail user data TrainingSguardspace S user data tail

guardspace

3 bits 57 bits 26 bits 57 bits1 1 3

GSM - FDMA/TDMA



GSM FDMA

21 3 4 124…

100 KHz guard band

200 KHz Carrier Spacing

BW = 25 MHzDownlink Frequency Band: 890-915 MHzDownlink Frequency Band: 935-960 MHzBc = 200 KHzBg = 100 KHzNumber of Channels = 124Data rate for each carrier = 270.833 kbpsBit time = 3.69 sSlot time (or burst time) = 577 sNumber of bits/slot = 156.25 bitsBurst Types: 1. Normal Burst (NB) 2. Frequency Correction Burst 3. Synchronization burst 4. Random Access Burst (RAB)



GSM Physical Channels

::

Frequency 124

Frequency 2

Frequency 1 Ch 1

Timeslot 1

Ch 2 Ch 3 Ch 4 Ch 5 Ch 6 Ch 7 Ch 8

Ch 1 Ch 2 Ch 3 Ch 4 Ch 5 Ch 6 Ch 7 Ch 8

Ch 1 Ch 2 Ch 3 Ch 4 Ch 5 Ch 6 Ch 7 Ch 8

::

2 3 4 5 6 7 8

TDMA frame = 4.615 ms

ARFCN – Absolute Radio Frequency Channel Number



GSM Air Interface



GSM Logical and Physical Channels

Um interface: various logical channels are mapped to physical

channels A physical channel is a timeslot with timeslot number in a

sequence of TDMA frames on a particular ARFCN 8 physical channels mapped onto 8 timeslots within TDMA

frame per frequency carrier



GSM Frame Hierarchy

156.25 bits: Burst (0.577 ms)

8 slots: Frame (4.615 ms)

26 traffic frames: Multi frame (120 ms) 51control frames: Multi frame (235.4 ms)

51 traffic or 26 control multi frames: Super frame (6.12 s)

2048 super frames: Hyper frame (3 hr 28 min 53.76 s)



GSM hierarchy of frames

0 1 2 2045 2046 2047...

hyperframe

0 1 2 48 49 50...

0 1 24 25...

superframe

0 1 24 25...

0 1 2 48 49 50...

0 1 6 7...

multiframe

frame

burst

slot

577 µs

4.615 ms

120 ms

235.4 ms

6.12 s

3 h 28 min 53.76 s



GSM Logical Channels

3 groups of logical channels, TCH, CCH and CBCH

TCH is used to carry voice or data traffic

CCH is used for control functions

CBCH is used for broadcast functions

Logical traffic channels = full rate (TCH/F) at 22.8 kb/s or half

rate (TCH/H) at 11.4 kb/s

Physical channel = full rate traffic channel (1 timeslot) or 2

half rate traffic channels (1 timeslot in alternating frames)

Full rate channel may carry 13 kb/s speech or data at 12, 6,

or 3.6 kb/s

Half rate channel may carry 6.5 kb/s speech or data at 6 or

3.6 kb/s



GSM Logical Channel Structure

CCH

TCH/F TCH/H

BCH CCCH DCCH

FCCH SCH BCCH PCH AGCH RACH

TCH CBCH

ACCH SDCCH

FACCHSACCH



GSM Logical Channels, cont..

CCH consists of 3 groups of logical control channels, BCH,

CCCH and DCCH BCH (broadcast channel): point-to-multipoint downlink only.

Contains three sub-channels, BCCH, FCCH and SCH BCCH (broadcast control channel): send cell identities,

organization info about common control channels, cell

service available, etc FCCH (frequency correction channel): send a frequency

correction data burst containing all zeros to effect a

constant frequency shift of RF carrierSCH (synchronization channel): send TDMA frame number

and base station identity code to synchronize MSs



GSM Logical Channels, cont…

CCCH (common control channel): Consists of three sub-

channels, PCH, AGCH and RACH. This channels is used for

paging and access

PCH (paging channel): to page MSs

AGCH (access grant channel): to assign MSs to stand-

alone dedicated control channels for initial assignment

RACH (random access channel): for MS to send requests

for dedicated connections



GSM Logical Channels, cont…

DCCH (dedicated control channel): bi-directional point-to-

point -- main signaling channels. Consist of two sub-

channels, SDCCH and ACCH

SDCCH (stand-alone dedicated control channel): for

service request, subscriber authentication, equipment

validation, assignment to a traffic channel

ACCH consist of two sub-channels, SACCH and FACCH SACCH (slow associated control channel): for out-of-band

signaling associated with a traffic channel, eg, signal

strength measurements

FACCH (fast associated control channel): for preemptive

signaling on a traffic channel, eg, for handoff messages



GSM Logical Channels , cont…



GSM Packet Encoding

260 bits (20 ms)

CRC coding

½ convolutional coding

456 bits (20 ms)

260 bits 50 bits

132 bits53 bits

4 tail bits78 bits

378 bits

Speech packet (13 kbps)

Transmitted packet

192 bits (20 ms)


456 bits (20 ms)

4 tail bits48 bits signaling info

Transmitted packet

9600 bps data packet

40 parity bits


456 bits (20 ms)

4 tail bits

184 bits (20 ms)

Transmitted packet

Signaling packet



GSM Data Bursts



GSM Operation



Protocol Stack

CM

MMMM

CM

SCCP

RRMRRMRRMRRM

LAPDmLAPDm LAPD LAPD MTPMTP

Radio Radio 64kbps 64kbps 64kbps 64kbps

SCCP

Um Air Interface A-bis A

MS BTS BSC MSC

CM: Connection Management RRM: Radio Resource ManagementMM: Mobility Management MTP: Message Transfer PartSCCP: Signal Connection Control part LAPD: Link access protocol-D



GSM Protocol Layers

RF : Physical Layer LAPD: Link Layer, ISDN protocol based SCCP: Signal Connection Control Layer, part of

link layer RR: Radio Resource MM: Mobility Management CC: Call Control



GSM Network Layer

Network layer consists of 3 sublayers

Radio resource management (RR) sublayer Establishment, maintenance, and termination of

radio channel connections

Mobility management (MM) sublayer Registration, authentication, and location tracking

Call control (CC) sublayer Establishment, maintenance, and termination of

circuit-switched calls



RegistrationMS BTS BSC MSC VLR HLR

1. Channel Request2. Activation Response3. Activation ACK

4. Channel Assigned

5. Location Update Request

6. Authentication Request

7. Authentication Response

8. Authentication Check

9. Assigning TMSI

10. ACK for TMSI

11. Entry for VLR and HLR

12. Channel Release



Mobile Originated Call

PSTN GMSC

VLR

BSS

MSC

MS1

2

6 5

3 4

9

10

7 8

1, 2: connection request 3, 4: security check 5-8: check resources (free

circuit) 9-10: set up call



Mobile Terminated Call

PSTNcallingstation

GMSC

HLR VLR

BSSBSSBSS

MSC

MS

1 2

3

4

5

6

7

8 9

10

11 12

1316

10 10

11 11 11

14 15

17

1: calling a GSM subscriber2: forwarding call to GMSC3: signal call setup to HLR4, 5: request MSRN from VLR6: forward responsible

MSC to GMSC7: forward call to current MSC8, 9: get current status of MS10, 11: paging of MS12, 13: MS answers14, 15: security checks16, 17: set up connection



MTC/MOC

BTSMS

paging request

channel request

immediate assignment

paging response

authentication request

authentication response

ciphering command

ciphering complete

setup

call confirmed

assignment command

assignment complete

alerting

connect

connect acknowledge

data/speech exchange

BTSMS

channel request

immediate assignment

service request

authentication request

authentication response

ciphering command

ciphering complete

setup

call confirmed

assignment command

assignment complete

alerting

connect

connect acknowledge

data/speech exchange

MTC MOC



GSM Channel Use ExampleMS BTS BSC MSC

3. Call Establishment Request (SDCCH)

11. Traffic Channel Established (FACCH)

1. Channel Request (RACH)

6. Ciphering Command (SDCCH)

2. Channel Assigned (AGCH)

13. Call Accepted (FACCH)

4. Authentication Request (SDCCH)

5. Authentication Response (SDCCH)

7. Ciphering Ready (SDCCH)

8. Send Destination Address (SDCCH)

10. Assign Traffic Channel (SDCCH)

12. Available/Busy Signal (FACCH)

9. Routing Response (SDCCH)

14. Connection Established (FACCH)15. Information Exchange (TCH)



GSM Numbers International mobile station equipment identity (IMEI). IMEI= TAC +

FAC + SNR + SP TAC = Type Approval Code, 6 decimals FAC = Final Assembly Code, 6 decimals, assigned by manufacturer SNR = Serial Number, 6 decimals, assigned by manufacturer SP = Spare, 1 decimal place

EIR has white, black and optionally grey list. International mobile Subscriber Identity (IMSI): Stored on the SIM

(Subscriber Identity Module) card. IMSI is obtained at the time of

subscription. IMSI is not made public.

IMSI = MCC + MNC + MSIN

MCC = Mobile Country Code, 3 decimals

MNC = Mobile Network Code, 2 decimals

MSIN = Mobile Subscriber Identification Number, maximum 10 decimal

digits



GSM Numbers Mobile Station ISDN number (MSISDN), is the real phone number of the

subscriber. Stored in HLR and on SIM card MSISDN = CC + NDC + SN

CC = Country Code, up to 3 decimals NDC = National Destination Code, typically 2-3 decimals SN = Subscriber Number, maximum 10 decimals.

Mobile Station Roaming Number (MSRN), same format as MSISDN. A temporary location dependent ISDN number; assigned in two cases, at registration or at call set up.

Location Area Identity (LAI). Regularly sent on BCCH; LAI = CC + MNC + LAC,

LAC = Location Area Code, max 5 decimals (<FFFFhex). Temporary Mobile Subscriber Identity (TMSI). Stored only in the VLR and SIM

card. Consists of 4*8 bits excluding value FFFF FFFFhex

TMSI has only local meaning and can be defined according to operator’s

specifications.

LAI + TMSI uniquely identifies the user, i.e. IMSI is no longer needed for

ongoing communication



GSM Handoffs

3 types of handoffs

Intra-BSS: if old and new BTSs are attached to same

base station

MSC is not involved

Intra-MSC: if old and new BTSs are attached to

different base stations but within same MSC

Inter-MSC: if MSCs are changed



4 types of handover

MSC MSC

BSC BSCBSC

BTS BTS BTSBTS

MS MS MS MS

12 3 4



Handover procedure

HO access

BTSold BSCnew

measurementresult

BSCold

Link establishment

MSCMSmeasurementreport

HO decision

HO required

BTSnew

HO request

resource allocation

ch. activation

ch. activation ackHO request ackHO commandHO commandHO command

HO completeHO completeclear commandclear command

clear complete clear complete



HandoffMS BSS1 MSC BSS2

Measurement Report

Handoff Required

Handoff Request

Handoff Request ACK

Handoff CommandHandoff Command

Handoff Complete

Handoff Complete

Clear Command

Clear Complete

Handoff

HO Decision

Resource Allocation

Resource Release



GSM Intra-MSC Handoff

Mobile station monitors signal quality and

determines handoff is required, sends signal

measurements to serving BSS

Serving BSS sends handoff request to MSC with

ranked list of qualified target BSSs

MSC determines that best candidate BSS is under

its control (assumed here)

MSC reserves a trunk to target BSS



GSM Intra-MSC Handoff, cont..

Target BSS selects and reserves radio channels for

new connection, sends Ack to MSC

MSC notifies serving BSS to begin handoff,

including new radio channel assignment

Serving BSS forwards new radio channel

assignment to mobile station

Mobile station re-tunes to new radio channel,

notifies target BSS on new channel



GSM Intra-MSC Handoff, cont..

Target BSS notifies MSC that handoff is detected

Target BSS and mobile station exchange messages

to synchronize transmission in proper timeslot

MSC switches voice connection to target BSS,

which responds when handoff is complete

MSC notifies serving BSS to release old radio traffic

channel



GSM Inter-MSC Handoff

Mobile station monitors signal quality and

determines handoff is required, sends signal

measurements to serving BSS

Serving BSS sends handoff request to MSC with

ranked list of qualified target BSSs

Serving MSC determines that best candidate BSS is

under control of a target MSC (assumed here) and

calls target MSC through PSTN



GSM Inter-MSC Handoff, cont..

Target MSC notifies its VLR to assign a TMSI

Target VLR returns TMSI

Target MSC reserves a trunk to target BSS

Target BSS selects and reserves radio channels for

new connection, sends Ack to target MSC

Target MSC notifies serving MSC that it is ready for

handoff




Serving MSC notifies serving BSS to begin handoff,

including new radio channel assignment

Serving BSS forwards new radio channel

assignment to mobile station

Mobile station re-tunes to new radio channel,

notifies target BSS on new channel

Target BSS notifies target MSC that handoff is

detected




Target BSS and mobile station exchange messages

to synchronize transmission in proper timeslot

Voice connection is switched to target BSS, which

responds when handoff is complete

Target MSC notifies serving MSC

Old network resources are released



GSM Roaming From Another PLMN

VLR registers users roaming in its area Recognizes mobile station is from another PLMN If roaming is allowed, VLR finds the mobile’s HLR in

its home PLMN VLR constructs a global title from IMSI to allow

signaling from VLR to mobile’s HLR via public

telephone network VLR generates a mobile subscriber roaming number

(MSRN) used to route incoming calls to mobile station MSRN is sent to mobile’s HLR



GSM Roaming, cont…

VLR contains

MSRN TMSI Location area where mobile station has

registered Info for supplementary services (if any) IMSI HLR or global title Local identity for mobile station (if any)



Security in GSM Security services

access control/authentication user SIM (Subscriber Identity Module): secret PIN (personal

identification number) SIM network: challenge response method

confidentiality voice and signaling encrypted on the wireless link (after

successful authentication) anonymity

temporary identity TMSI (Temporary Mobile Subscriber Identity)

newly assigned at each new location update (LUP) encrypted transmission

3 algorithms specified in GSM A3 for authentication (“secret”, open interface) A5 for encryption (standardized) A8 for key generation (“secret”, open interface)

“secret”:• A3 and A8 available via the Internet• network providers can use stronger mechanisms



GSM - authentication

A3

RANDKi

128 bit 128 bit

SRES* 32 bit

A3

RAND Ki

128 bit 128 bit

SRES 32 bit

SRES* =? SRES SRES

RAND

SRES32 bit

mobile network SIM

AC

MSC

SIM

Ki: individual subscriber authentication key SRES: signed response



GSM - key generation and encryption

A8

RANDKi

128 bit 128 bit

Kc

64 bit

A8

RAND Ki

128 bit 128 bit

SRES

RAND

encrypteddata

mobile network (BTS) MS with SIM

AC

BSS

SIM

A5

Kc

64 bit

A5

MSdata data

cipherkey

General Packet Radio Service (GPRS)



Data services in GSM Data transmission standardized with only 9.6 kbit/s

advanced coding allows 14.4 kbit/snot enough for Internet and multimedia applications

HSCSD (High-Speed Circuit Switched Data)mainly software updatebundling of several time-slots to get higher

AIUR (Air Interface User Rate)(e.g., 57.6 kbit/s using 4 slots, 14.4 each)

advantage: ready to use, constant quality, simpledisadvantage: channels blocked for voice transmission

AIUR [kbit/s] TCH/F4.8 TCH/F9.6 TCH/F14.44.8 19.6 2 1

14.4 3 119.2 4 228.8 3 238.4 443.2 357.6 4



GPRS - Data services in GSM

GPRS is an overlay on top of the GSM physical layer and network entities; extends data capabilities of GSM

Provides connections to external packet data networks through the GSM infrastructure with short access time to the network for independent short packets (500-1000 bytes)

GPRS (General Packet Radio Service) packet switching using free slots only if data packets ready to send

(e.g., 50 kbit/s using 4 slots temporarily) standardization 1998, introduction 2001 advantage: one step towards UMTS, more flexible disadvantage: more investment needed (new

hardware/software)



GPRS Operations

GPRS uses same physical radio channels, only new

logical GPRS radio channels are defined

Active users share timeslots using TDMA; uplink and

downlink are allocated separately

Capacity allocation in GPRS is based on the “on-

demand” principle

GPRS terminals: Class A: Operates GPRS and GSM services simultaneously

Class B: Operate either GPRS or GSM service at one time

Class C: Only GPRS service

Limitations: Limited cell capacity



GPRS Network Services

Point-to-point (PTP): packet data transfer Connectionless based on IP

Connection oriented based on X.25

Point-to-multipoint (PTM-M): multicast service to all

subscriber in one area

Point-to-multipoint (PTM-G): multicast service to a

predetermined group

Multimedia messaging service (MMS)

GPRS has parameters that specify a QoS based on

service precedence, priority, reliability and required

transmission characteristics



GPRS user data rates in kbit/s

Coding scheme

1 slot 2 slots

3 slots

4 slots

5 slots

6 slots

7 slots

8 slots

CS-1 (1/2)

9.05 18.2 27.15 36.2 45.25 54.3 63.35 72.4

CS-2 (2/3)

13.4 26.8 40.2 53.6 67 80.4 93.8 107.2

CS-3 (3/4)

15.6 31.2 46.8 62.4 78 93.6 109.2 124.8

CS-4 21.4 42.8 64.2 85.6 107 128.4 149.8 171.2



Reference Architecture

Uses GSM architecture

GPRS support nodes (GSN): responsible for delivery and

routing of data packets between the MS and the external

network

Serving GPRS support node (SGSN) Controls access to MSs that are attached to a group of

BSCs (routing area (RA) of SGSN)

Gateway GPRS support node (GGSN) Logical interface to the Internet

GPRS Register (GR)Colocated with HLR and stores routing information



GPRS architecture and interfaces

MS BSS GGSNSGSN

MSC

Um

EIR

HLR/GR

VLR

PDN

Gb Gn Gi

GGSN

Gn



GPRS protocol architecture

apps.

IP/X.25

LLC

GTP

MAC

radio

MAC

radioFR

RLC BSSGP

IP/X.25

FR

Um Gb Gn

L1/L2 L1/L2

MS BSS SGSN GGSN

UDP/TCP

Gi

SNDCP

RLC BSSGP IP IP

LLC UDP/TCP

SNDCP GTP



GPRS – Channel PDCH

Time Slots used by GPRS are called PDCH Radio Block

Basic unit of transmission in PDCHFour TS in 4 consecutive TDMA Frames

Multiframe PDCH is structured in a multiframe comprising 52 TDMA

frames 240 ms

A multiframe comprises of 13 radio blocks Every 13th radio block is not used, called idle burst 12 radio blocks are used for data transmission Mean transmission time per radio block is 20ms A radio block contains 456 bits



GPRS – Radio Block



GPRS GPRS Radio

1-8 time slots of a frame can be allocated to an MS

Uplink and downlink slots can be allocated differently

Achieve data asymmetry Dedicated PDCH (Packet Data Channel) Resources for PDCH are allocated dynamically by

the BSS Some logical channels analogous to GSM are

PDTCH: Packet Data Traffic Channel PACCH: Packet Associated Control Channel PRACH: Packet Random Access Channel PAGCH: Packet Access Grant Channel PPCH: Packet Paging Channel PNCH: Packet Notification Channel



GPRS Attach

Before accessing GPRS services, the MS must register with

the GPRS network

MS performs an attachment procedure with an SGSN that

authenticates it by checking the GR

The MS is allocated a temporary logical link identity (TLLI)

A packet data protocol (PDP) context is created for the MS

for each session and is stored at the MS, SGSN, and GGSN

PDP context: PDP type, address, QoS, GGSN address

A user may have several PDP context enabled. The PDP

address may be statically or dynamically assigned

PDP context is used to route packets



GPRS attach / PDP session

GPRS attach

MS is assigned PDP (IP) addressPacket transmission can take place

Separate or combined GSM/GPRS attachMS registers with an SGSN (authentication...)Location update possible

PDP context is created

GPRS detach

PDP context terminatedAllocated IP address released

In case of dynamic address

allocation

DHCPRADIUS



PDP context

PDP context describes characteristics of GPRS session (session = “always on” connection)

PDP context information is stored in MS, SGSN and GGSN

MSMS

GGSNGGSNSGSNSGSN

::::::::::::

::::::::::::

::::::::::::

PDP type (e.g. IPv4)

PDP address = IP address of MS (e.g. 123.12.223.9)

Requested QoS (priority, delay …)

Access Point Name (GGSN address as seen from MS)

PDP type (e.g. IPv4)

PDP address = IP address of MS (e.g. 123.12.223.9)

Requested QoS (priority, delay …)

Access Point Name (GGSN address as seen from MS)

One user may have several PDP sessions active 123.12.223.9

123.12.223.0



Packet transmission

MS (client)

MS (client)

GGSNGGSN

SGSNSGSN Server (IP, WAP..)

Server (IP, WAP..)

Packet is sent to SGSN. SGSN sends packet to GGSN through GTP (GPRS Tunneling Protocol) tunnel.

Packet is tunneled through IP backbone

IP address ...IP address ... IP addressIP address IP payloadIP payload

Tunneling = encapsulation of IP packet in GTP packet

... = APN of GGSN, used for routing through tunnel



Packet transmission

MS (client)

MS (client)

GGSNGGSN


Server (IP, WAP..)

GGSN sends packet through external IP network (i.e. Internet) to IP/WAP server.

Source IP addr.Source IP addr. Dest. IP addr.Dest. IP addr. IP payloadIP payload

GGSN

Source IP address:

GGSN

Server



Packet transmission

MS (client)

MS (client)

GGSNGGSN


Server (IP, WAP..)

Server sends return packet via GGSN, GTP tunnel and SGSN to MS.

Packets from server to MS are always routed via GGSN (since this node has PDP context information).

Dest. IP address:

GGSNDest. tunnel

address: SGSN

Dest. IP address: MS



Connectivity states in GSM/GPRS

DisconnectedIdleConnected

IdleStandbyReady

MS is switched off (circuit mode)location updates on LA basishandovers, not location updates

MS is switched off (packet mode)location updates on RA basislocation updates on cell basis

GSMGSM

GPRSGPRS



GPRS connectivity state model

Idle

Ready

Standby

GPRS attach GPRS detach

Timer expired Transmission of packet

Standby timer

expired

No location management,MS not reachable

Location update when MS changes cell

Location update when MS changes routing area



MM “areas” in GSM/GPRS

Cell

Location Area (LA)

Routing Area (RA)

Location updating in GSM

Location updating in GPRS(standby state)

Location updating in GPRS(ready state)



Routing Area Updates

Route Area Update Route Area Update is performed with SGSN In case of Inter-SGSN route area update, the new SGSN retrieves

the PDP context from the old SGSN, update the HLR and the GGSN

Intra-SGSN Update The SGSN already has the user profile and PDP context

The home location register (HLR) need not be updated

A new temporary mobile subscriber identity is issued as a part of

the RA update

Inter-SGSN Update The new RA is serviced by a new SGSN

The new SGSN requests the old SGSN to send the PDP context

The SGSN informs the home GGSN, the GR, and other GGSNs

about the user’s new routing context



Handoff Management

The MS listens to the broadcast control channel (BCCH)

and decides which cell to connect using the RSS, cell

ranking, path loss, etc.

The location is updated using the routing update

procedure

The SGSN updates the GGSN of the home network with

the new SGSN and the tunneling information

Short Message Services (SMS)



Short Message Services (SMS)

Extremely popular service, similar to the peer-to-peer instant messaging services in the Internet

Allows exchange of alphanumeric messages up to 160 characters

Two types of services: Broadcast Peer to peer

Uses the same infrastructure as GSM SMS has instant delivery service as well as store-

and-forward service



Operations

SMS makes use of the GSM infrastructure,

protocols, and the physical layer to manage the

delivery of messages Each message is treated individually, and is

maintained and transmitted by the SMS center

(SMSC) Short messages (160 char mapped into 140

bytes) are transmitted through the GSM

infrastructure using SS-7 Short messages are transmitted in time slots that

are freed up in the control channels



Reference Architecture

HLR VLR

SMS-GMSCSMS-IWMSC

MSC

MS

SMSC



Cases of Short Messages

SM originating from an MS Goes to MSC for processing SMS-interworking MSC (SMS-IWMSC forwards the SM

to the SMSC Mobile terminated short message

SM is forwarded by the SMSC to the SMS-gateway MSC (SMS-GMSC)

Either the HLR or VLR is queried SM is either delivered to the BSC or forwarded to

another MSC

EDGE

Enhanced Data rates for GSM/Global Evolution

(3G)



EDGE

EDGE = Enhanced Data rates for GSM

Evolution

GSM2+ specification accepted 3G standard by

3GPP and ITU

GSM/EDGE RAN = GERAN

GERAN Rel’5: Common 3G core with same Iu-

interfaces for multi-radio GSM/EDGE/WCDMA

RAN



Enhanced Data Rates for Global Evolution (EDGE)

Provides an evolution path from existing GSM/TDMA

standards to deliver 3G services in existing spectrum bandsReuses GSM carrier bandwidth and time slot structureCan be introduced in GSM using a minimum of only one time

slot per BSReuse of existing GSM and TDMA/IS-136 infrastructureCan be deployed using as little as 600 kHz of total bandwidth384 Kbps data capability to satisfy the IMT-2000

requirements for pedestrian (microcell) and low speed

vehicular (macrocell) environments144 Kbps data capability for high speed vehicular

environment



Enhanced Data rates for GSM Evolution

Objective: Increase the bit rates (GPRS EGPRS).

Bit rates:

473 kb/s for the terminals of 100 km/h maximum.

80-130 kb/s on average.

144 kb/s for the terminals of 250 km/h maximum.

Means:

New modulation (8-PSK).

Link adaptation.

New mobiles, upgrade/replacement of TRXs and

capacity enhancement (Abis, …)



EDGE - Enhanced Data Rate for GSM Evolution

EDGE is a global radio–based high-speed mobile data

standard that can be introduced into GSM/GPRS and IS-136

[packet mode for digital advanced mobile phone system (D-

AMPS)] networks.

EDGE allows data transmission speeds up to 384 Kbps in

packet-switched mode; these throughputs are required to

support multimedia services.

This is achieved within the same GSM bandwidth and

existing 800-, 900-, 1800-, and 1900-MHz frequency bands.

EDGE is last step before UMTS. EDGE is considered in

Europe as a 2.5/2.75 generation (2.5G/2.75G) standard that

is seen as a transition from 2G to 3G (second generation

and third generation of mobile networks).



No new operator licenses are needed for EDGE. Since this feature reuses the existing spectrum, it represents a low-cost solution for operators that want to provide multimedia services on their GSM/GPRS networks.

The idea behind EDGE is to increase the data rate that can

be achieved with the 200-kHz GSM radio carrier by changing

the type of modulation used while still working with existing

GSM and GPRS network nodes.

The new modulation that is introduced is the eight-state

phase-shift keying (8-PSK).

It is built on an existing GSM/GPRS system. The basic

concept constraint was to have the smallest possible impact

on the GSM/GPRS core networks.




EGPRS is a direct evolution of GPRS. It reuses the same concepts and is based on exactly the same architecture as GPRS.

The introduction of EGPRS has no impact on the GPRS core network. The main modifications are linked to the radio interface.

The EGPRS concept aims at enabling data transmission with higher bit rates than GPRS.

Basically, EGPRS relies on a new modulation scheme and new coding schemes (CSs) for the air interface, making it possible to optimize the data throughput with respect to radio propagation conditions.

Nine modulation and coding schemes (MCSs) are proposed for enhanced packet data communications.

EGPRS - Enhanced GPRS



On top of the same services as GPRS, EGPRS provides new

ones because of higher bit rates.

It basically offers twice the capacity of a GPRS network.

Although the bit rate of the modulation is increased by a

factor 3 with the new modulation, allowing a maximum

throughput that is three times higher, the capacity of the

network is not multiplied by 3.

This is due to the carrier-to-interference ratio (C/I) variation

within the network.

Depending on the MS position, more or less channel coding

will be necessary for an optimized transmission, leading to

an average throughput lower than the maximum one.




Impact of EDGE on existing GSM/GPRS networks

Hardware upgrade to the BSS (new transceiver in each cell)

Software upgrade to the BS and BSC No change in the core networks New terminals

Terminal which provides 8PSK in the uplink and the

downlink Terminal which provides GMSK in the uplink and

8PSK in the downlink



The basic GPRS radio concepts have not been modified.

The logical channels that have been introduced for the

GPRS system are reused for EGPRS.

Data is still transferred over PDTCH, whereas signaling is

transmitted over PACCH.

The broadcast, control, and associated signaling channels

are also exactly the same.

The coding that is used over signaling channels is CS-1.

This means that during a TBF an EGPRS mobile will transfer

the signaling block over its PACCH using CS-1 and the data

will be transferred over PDTCH using MCS-1 to MCS-9.




EDGE introduction

.. < > ^ ... . . .

BTS

BTS

BSC

PCU

Gb Gs

SGSN Gr, Gd, Gf

Gn

Border Gateway

GGSN

Inter-operator

GPRS backbone

GPRS backbone

Internet PDN

Router LAN

Service plate-form

WAP, WWW, ...

SS7 Network

Gc

Gf EIR

Gr

TRAU

MSC/VLR

PSTN

HLR A

Abis

IN Plate-form



The MAC concept is also unchanged—mobiles can be

multiplexed on the same physical channel. Note that EGPRS

and GPRS mobiles can be multiplexed on the same PDCH.

The concepts of TBF, TFI, and RR management are the same.

The uplink multiplexing schemes such as dynamic allocation,

extended dynamic allocation, and fixed allocation are

unmodified.

They can be used to multiplex GPRS and EGPRS mobiles on

the same uplink PDCH.

The signaling has been slightly changed to support dedicated

EGPRS signaling during the establishment of a TBF.

The procedures that are used for power control and TA were

retained.




The RLC protocol has been slightly improved so that it

provides sufficient efficiency for the transmission of higher

throughput.

The RLC Protocol is based on the same concept of sliding

window.

The same mechanism of segmentation has been kept, and

the blocks are numbered with a BSN.

Depending on the radio conditions, the link is adapted in

such a way as to achieve the highest throughput.




Improved GSM air-interface performance

8-PSK modulation method

New modulation & coding schemes (1-9)

Incremental Redundancy (IR)

Link Adaptation (LA) Enhancements

EDGE - Enhancements



The moderate throughput of high-speed circuit-switched data and GPRS is linked to the GMSK modulation and its limited spectrum efficiency.

EDGE is based on a new modulation scheme that allows a much higher bit rate across the air interface. This modulation technique is called eight-state phase-shift keying (8-PSK).

This modulation has an eight-state constellation allowing the coding of 3 bits per symbol.

The raw bit rate is then three times higher than that for GMSK modulation.

The EGPRS transmitter adapts the modulation and CSs depending on the radio conditions; it can use GMSK or 8-PSK modulation according to the MCS used.

The receiver is not informed of the modulation that is used by the transmitter.

EDGE Modulation



EDGE Modulation Technique



EDGE Modulation Technique

Have the same symbol rate of GMSK

Each symbol is represented by 3 bits

8PSK generates same interference on adjacent

channels as GMSK.

We use the same channel structure and width

and frequency plan of GPRS

The distance between symbols is shorter using

8PSK than GMSK misinterpretation



EDGE Modulation TechniqueThe distance between two symbols in the 8-PSK constellation

is smaller than in the GMSK one for a given energy per

symbol.

This characteristic increases the probability of

misinterpretation of the symbols in the receiver, owing to the

noise and interference.

If the radio conditions are good there is no problem, and a

greater data rate can be achieved by using 8-PSK.

In the case of bad conditions, the perfor mances are

degraded with 8-PSK, and the use of GMSK may be required.

This is the reason why the two modulations are used in

EGPRS, and the adaptation of the modulation to the

propagation conditions is based on measurements

performed by the MS and BTS and controlled by the network



MS has to perform blind detection of the modulation before

being able to identify which MCS has been used.

Support of the 8-PSK modulation is mandatory for the

mobile in downlink but is optional in uplink.

On the network side, 8-PSK modulation is optional in both

uplink and downlink.

Thus, a network can support EDGE without implementing 8-

PSK.

In this case EDGE will not provide any gain in terms of

maximum throughput but only some enhancements for the

management of the radio link (RLC improvements).

The significance of this solution is very limited as there is no

gain in the maximum achievable throughput.

EDGE Modulation



EGPRS relies on a new modulation scheme and new coding schemes (CSs) for the air interface, making it possible to optimize the data throughput with respect to radio propagation conditions.

Nine modulation and coding schemes (MCSs) are proposed for enhanced packet data communications, providing raw RLC data rates ranging from 8.8 Kbps (minimum value per time slot under the worst radio propagation conditions) up to 59.2 Kbps (maximum value achievable per time slot under the best radio propagation conditions).

Data rates above 17.6 Kbps require that 8-PSK modulation be used on the air instead of the regular GMSK modulation.

EGPRS Modulation and Coding Schemes



EDGE Modulation and Coding Schemes MCS - modulation and coding schemes



EDGE modulations



EDGE performance

Modulation Method

1 TS (kbps)

4 TS’s (kbps)

8 TS’s (kbps)

MCS-1 GMSK 8,8 35,2 70,4 MCS-2 GMSK 11,2 44,8 89,6 MCS-3 GMSK 14,8 59,2 118,4 MCS-4 GMSK 17,6 70,4 140,8 MCS-5 8-PSK 22,4 89,6 179,2 MCS-6 8-PSK 29,6 118,4 236,8 MCS-7 8-PSK 44,8 179,2 358,4 MCS-8 8-PSK 54,4 217,6 435,2 MCS-9 8-PSK 59,2 236,8 473,6

In theory EDGE offers

• 3-4 x higher data bit rates for end-users than GPRS

• Improved voice capacity via

enhanced data capabilities (+ later

AMR) Average

3-4 x

0

10

20

30

40

50

60

8 10 12 14 16 18 20 22 24 26 28 30

C/I

Kbps/

TS

E-GPRSGPRS CS 1-4GPRS CS 1-2



One of the main improvements of EGPRS, compared

with GPRS, is in its link quality control (LQC).

The enhancement is made possible through the

introduction of a new ARQ scheme, incremental

redundancy (IR) and new estimators for the link quality

LQC uses a combination of 2 functionalities:

Incremental redundancy

Link adaptation

EDGE - Link Quality Control



Incremental redundancy Incremental Redundancy gives additional 2-3 dB to radio

link IR adjusts the code rate of the transmission to true

channel conditions with incremental transmissions of the redundant information until the decoding is successful

Utilises ARQ protocolLink Adaptation

Link Adaptation is used to select the best MCS for the radio link conditions

LA algorithms compare the estimated channel quality to threshold values -> optimised throughput

In EDGE LA works more effectively than in GPRS, because of IR gives better re-transmission performance

EDGE - Link Quality Control



The principle of link adaptation is to adapt the modulation and CS to the radio conditions.

When the radio conditions are poor, a MCS with a low coding rate is chosen, leading to a lower throughput. When the radio conditions are very good, a high coding rate is chosen, leading to higher through-put.

During the data transfer, the network evaluates the link quality and decides which MCS to use accordingly.

EGPRS uses a different mechanism that allows a more efficient adaptation of the link depending on the radio conditions.

The transfer of RLC data blocks in the acknowledged RLC/MAC mode can be controlled by a selective type I ARQ mechanism or by a selective type II hybrid ARQ (IR) mechanism within one TBF.

The link adaptation scheme relies on the MCS family concept.

EDGE LQC - Link Adaptation Mechanism



EDGE Link Adaptation

The ability of retransmission of packets with a more robust coding scheme

Unlike GPRS in which retransmission of packets is made with the same coding scheme



IR is an enhanced ARQ mechanism that reuses

information from the previous transmissions of an RLC

data block that was badly decoded in order to increase

the capability to decode it when it is retransmitted.

It consists of combining, at the output of the receiver

demodulator, soft bits information from N different

transmissions of the same RLC blocks.

This mechanism can be associated with link adaptation

in order to provide superior radio efficiency on the air

interface.

EDGE LQC – Incremental Redundancy



IR consists of sending n times the same block until the

block is decoded.

The soft values of the previous unsuccessful

transmissions are used.

The coding rate is decreased at each transmission,

increasing the probability of successful decoding.

IR allows the reduction of the coding rate with the

retransmission of the same block.

This mechanism is used only when the RLC Protocol

operates in acknowledged mode.

EDGE LQC – Incremental Redundancy

Mechanism



EDGE LQC – Incremental Redundancy Mechanism



The transfer of RLC data blocks in EGPRS mode reuses

exactly the same concepts as in GPRS.

The RLC data blocks are sent in sequence and the

control is performed thanks to a sliding window

mechanism.

The RLC Protocol can operate in acknowledged or

unacknowledged mode.

When operating in RLC acknowledged mode, the

acknowledgements are contained within the PACKET

UPLINK ACK/NACK message in case of uplink transfer

and in the EGPRS PACKET DOWNLINK ACK/NACK

message for a downlink transfer.

EDGE: Transmission of RLC Data Blocks



The only difference lies in the fact that two RLC data blocks can be transmitted within one single radio block every 20 ms.

This potentially leads to twice as many RLC data blocks transmissions as in GPRS.

In order to cope with the higher probability that the RLC Protocol stalls, some parts of the RLC Protocol have been enhanced.

The first improvement concerns the RLC window size. However, its modification has required some changes in the acknowledgment reporting mechanism.

These changes concern the way the reporting bitmap is handled as well as the polling mechanism.

EDGE: Transmission of RLC Data Blocks



EDGE Benefits

Short-term benefits: Capacity and performance

Easy implementation on a GSM/GPRS network

Cost effective

Increase the capacity and triples the data rate of

GPRS

Enabling new multimedia services

Long-term benefit: Harmonization with WCDMA



EDGE Evolution

Best effort IP packet data on EDGE

Voice over IP on EDGE circuit bearers

Voice over IP with statistical radio resource

multiplexing

Network based intelligent resource assignment

Smart antennas & adaptive antennas

Downlink speeds at several Mbps based on wideband

OFDM and/or multiple virtual channels



Performance Enhancements for EDGE

Link Improvement: Terminal diversity and interference suppression

Base smart antennas

Base and terminal diversity: MIMO

Transmit diversity: e.g., S-T codes

Medium Access Control:Mode 0

Time-slot management (Dynamic Packet

Assignment)



Mode 0

No transmission mode: Mode 0

Delay assigning resource to a user if its channel

quality is not good

Cutoff Threshold to delay transmissions

Features

Reduce unnecessary retransmissions

Control traffic load

Improve spectrum efficiency

eee 464 eee 464 wireless communications lecture 7 shahzad malik, ph.d. [email protected]

Documents

gsm system gsm

mobile slide

gsm cdma

gsm standard

world use gsm

overview gsm global

shahzad maliklecture

digital mobile phones