GSMFDMA/TDMA
Cell structure, reuse factor
Logical channelsBursts
Multiframes
Modern Mobile Networks
Dr. Dóra Maros
GSM
GSM900 :Uplink: 890~915MHz
Downlink: 935~960MHzDuplex distance: 45MHz
Bandwidth: 25MHzChannel bandwidth: 200KHz
124 duplex carriersChannel numbering: 1-124
GSM1800 :Uplink: 1710-1785MHz
Downlink: 1805-1880MHzDuplex distance : 95MHz
Bandwidth: 75MHzChannel Bandwidth: 200KHz
374 duplex carriersChannel numbering: 512-885
EGSM900 :Uplink: 880~890MHz
Downlink: 925~935MHzDuplex distance: 45MHz
Bandwidth: 10MHzChannel bandwidth:
200KHz
GSM1900MHz:Uplink:1850~1910MHz
Downlink:1930~1990MHzDuplex distance: 80MHz
Bandwidth: 60MHzChannel bandwidth:
200KHz
GSM Frequency Bands
GSM
Physical channel:
One carrier, one timeslot - fxTy
0 1 765432
1 TDMA frame = 8 timeslots
time
TS0-TS7DL and UL timing
BTS
GSM Radio Interface
GSM
Omni-directional antenna
360° radiation
Directional antenna(sector antenna)
120°, 60° radiation
GSM Antennas
GSM
R
R R
Omni antennas
On the green line
we can measure
same signal strength
Hexagonal Cell Pattern
GSM
Cells using same carrier frequencies, reuse factor:7
Using the same carriers is not allowed in the
adjacent cells!
We apply omni antennas!
Theory of Frequency Reuse
GSM
A3
C2B1
B3
A2C1
C3
B2A1
A3
C2B1
B3
A2C1
B3
A1C1
A1
A3A2
C3
B2A1
A3A3
C3
C1
B2A1B2A1
A2C1
B3
We apply 120° sector antennas
Reuse factor = 9
3/9 Cluster
GSM
A3
D2B1
C3
B2D1
D3
A2C1
B3
C2A1
B3
C2A1
A3
A1B1
D1
D3D2
C3
B2A1
C3D2
C3
C1
D2B1C2A1
A2C1
D3
Reuse factor = 12
4/12 Cluster
We apply 120° sector antennas
GSM
200 KHz
200 KHz
Overlapping causes adjacent
channel interference
No overlapping between two
frequency bands
f
f
Adjacent Channel Interference
GSM
C/ICarrrier f1/ carrier f1
interference
C/A Carrier f1/ adjacent carrier f2
interference
C/I and C/A
GSM
TCH
CCH
Voice CH
Data CH
FR (Full Rate, 13Kbit/s))
HR (Half Rate, 6.5 Kbit/s)
4.8Kbit/s HR TCH (TCH/H4.8)
9.6Kbit/s FR TCH4.8Kbit/s FR TCH
BCHFCCH (DL): Frequency Correction CH.SCH (DL): Synchronization CH.BCCH (DL): Broadcast Control CH.
CCCHRACH (UL): Random Access CH.AGCH (DL): Access Grant CH. PCH (DL): Paging CH.
DCCHSDCCH: Stand-alone Dedicated CCH.FACCH: Fast Associated CCH.SACCH: Slow Associated CCH.
14.4Kbit/s FR TCH
Traffic Channels
Control Channels
GSM Logical Channels
GSM
Broadcast Channels (BCH): Downlink channels. Responsible for sychronization, frequency correction, the BTS broadcasts general information about cell and network. Point to multipoint connection, all MS in the cell receives the information on BCH.
Broadcast Control Channel (BCCH): BTS sends general information around the cell (eg. Cell identity, Location Area Code, Network Code, maximum MS output power, etc.).
Frequency Correction Channel (FCCH): MS can find the BCCH carrier in the cell by FCCH. The channel sends an unmodulated sine signal (it sends only zeros), so the MS can tune to BCCH carrier frequency. FCCH also helps to find a new BCCH carrier in the new cell after power on.
Synchronization Channel (SCH): BTS sends a synchronization sequence for all MS for time synchronization. Base Station Identity Code (BSIC) and TDMA Frame Number (TFN) is also sent on this channel. TDMA frame number plays an important role in cryptografical algorithm (ciphering) on the radio channel.
Broadcast Channels
GSM
Common Control Channels (CCCH): Common physical cannel, but the messages is addressed only for one MS. Directional (uplink or downlink)
Paging Channel (PCH): Downlink channel. If MS has an incoming call, network sends a paging (searching) message in the cells inside Location Area. IMSI or TMSI is also sent in the paging message.
Access Grant Channel (AGCH): Downlink channel. This channel grants (offers) an SDCCH (numbered 0-7) in the cell for the MS point to point signalling.
Random Access Channel (RACH): Uplink channel. MS uses when it initiates a connection to the network in case of power on, outgoing (MS originated) call, or location update procedure, etc.
Common Control Channels
GSM
Dedicated Control Channels (DCCH): Dedicated means that the channel is unique for one MS (point to point connection). These channels are used for connection establishment procedures, for signalling information in case of handover and other control information (power and timing control). DCCHs are bidirectional.
Stand-alone Dedicated Control Channel (SDCCH): There are 8 SDCCHs in a cell (0-7). Used for connection establishment (authentication, ciphering, IMEI checking, and TCH assignment). When a TCH is assigned for MS, the mobile tunes to another channel.
Slow Associated Control Channel (SACCH): Uplink: MS sends measurement report to BTS.Downlink: power regulation of MS, time alignment (accurate timing) of MS. Associates to TCH and SDCCH-hoz.
Fast Associated Control Channel (FACCH): Used when handover procedure is needed. Downlink: a handover command (new channel and timeslot) is sent on TCH when Stealing Flags (F) bits are not zero.Uplink: handover acknowledge, power regulation, timing. Associates to TCH.
Dedicated Control Channels
GSM
Types of GSM Bursts
Information Information
Information Information
Information
Sychronization bits
Training bits
Training bits
Sychronization bits
Dummy bits Dummy bits
All „0”
GSM
FC, S and A Burst
G
T
Guard perriod: no information transmitted
Tail bits:000
0,577 ms, 156,25 bit
148 bits
86 bits
FCCH
SCH
RACH
InformationInformation
InformationSychronization bits
Sychronization bits
GSM
N and D burst
F Stealing Flag
0,577 ms, 156,25 bit
TCH, BCCH, PCH, AGCH, SDCCH, SACCH, FACCH
IDLE: no user info, predefined bit sequence
Dummy bits Dummy bitsTraining bits
Training bitsInformation Information
GSM
Burst contents
Guard period
Guard Period
GSM
TCH Multiframe
GSM
Repetition time: 51 frame
Multiframe on BCCH Carrier TS0
Downlink
Uplink
RACH
F:FCCHS:SCHC:Common
TDMA frames DL
TDMA frames DL
GSM
Dowlink multiframe structure is the same, but it is shifted in time!
Multiframe on BCCH Carrier TS1
GSM
Frame Structure
GSMRadio propagation
Path lossShadowing
Multipath fading, ISIFrequency hopping
Interleaving
Modern Mobile Networks
Dr. Dóra Maros
GSM
The wavelength is inversly proportional to the frequency of elektromagnetic wave :
λ = c/f, where
λ - wavelength (m)c - velocity of electromagnetic wave (in vacuum and in the air about 3*108 m/s, accurate value: 299792458 m/s)f - frequency (Hz)
Example: 1. f=900 MHz (9*108 Hz) λ =? 3*108 / 9*108 = 3/9 [m] ~ 0,33 [m] 2. f=2,6 GHz (2,6*109)
3*108 / 2,6*109 = 1,154 * 10-1 ~ 0,1154 [m]
Radio propagation I. Frequency and wavelength
GSM
RSL Received
Signal Level (dB)
d (distance from antenna)
Free space attenuation:
a0 = 20 log (4Πd/λ)
a0 = 20 log (df) + 28,14
Radio propagation II. Path loss
GSM
Makrocell propagation models:Relative small traffic (rural, road), high speed of movement (>100 km/h)
Hata, COST231
Mikrocell propagation models:High traffic (urban, suburban), smaller speed of movement (30-80 km/h)Walfish-Ikegami modell, COST 231
Indoor propagation models:Mootley-Keenan (félempirikus)Ray-tracing
Radio Propagation III. Propagation Models
GSM
RSL (dB)
Mean value
Slow fading caused by shadowing
Radio Propagation IV. Shadowing
d (distance from antenna)
Base Station
Mobile Equipment
GSM
Fast fading caused by reflections
Radio Propagation V. Multipath Fading
Base Station Mobile Equipment
GSM
Consecutive bursts are transmitted on different carriers
Number of hopping: 217/s
4 frequencies Different wavelengths
Fading dips shift!
Radio Propagation VI. Frequency Hopping
GSM
If delay of received bit is > 1 bit duration, it may cause Inter Symbol Interference (ISI) in the receiver. Two consecutive bits interfere each other.
1 or 0?
Bit error in the
receiver!
Radio Propagation VII. Inter Symbol Interference (ISI)
Base Station Mobile Equipment
GSM
Burst contents on radio channel
(received)
Modified training sequence (noisy
channel)
Training sequence pattern in the
receiver
Correlator
Modified channel model
Viterbi Decode
r
Reconstructed bitsRadio
channel
Radio Propagation VIII. VITERBI Demodulator and Decoder
GSM
• Original sequence is segmented into blocks• Consecutive blocks are sent in different
bursts (different timeslots and frames )
Original sequence
Interleaved sequence
Packet loss
Reconstructed sequence
Radio Propagation IX. Interleaving
GSM
57 bits
Segmentation456 bits (20 ms
speech) are divided
into 8 blocks (57 bits each)
I. Level interleaving
Radio Propagation X. Interleaving on GSM Speech Channel (example)
II. Level interleaving
GSMSecurity functions
AuthenticatonCiphering
Location updateCell selection
Handover
Modern Mobile Networks
Dr. Dóra Maros
GSM
The network elements which take part in security functions : Mobile Station (MS) Base Station (BTS) Mobile Switching Center (MSC or MSS) Autentication Center (AUC) Home Location Register (HLR) Visitor Location Register(VLR).
GSM Security Functions I.
GSM
SIM card unlock: PIN = Personal Identity Number (4 digits)
PIN unlock key: PUK code
Authentication: A procedure of verification of IMSI validity on SIM card.
Ciphering: This is an encyption procedure in BTS and MS for protection of user information (speech or data) on radio interface.
IMEI checking: This procedure checks the ME IMEI number. • If IMEI is on the black list of EIR, the connection
establishment is denied! • If IMEI is on the white list, MS can connect to the
network. • When IMEI is on the grey list , mobile has some
restrictions in communication, but attach is allowed.
GSM Security Functions II.
GSM
Random number
generator
IMSI1 – Ki1
IMSI2 - Ki2
IMSI3 – Ki3
RAND
Ki
AUC
A8 algorith
m
A3 algorith
m
SRES
Kc
RAND
Ki
RAND
Signed Response
Ciphering Key
Random Number
AUC and TRIPLETs
Kc: Ciphering Key Ki: Subscriber Identity Key
GSM
A3
Ki RAND
SRES
MS
A3
RAND
SRESegyezik?
network
SIM
Authentication procedure
SRESSIM = SRESAUC
?
GSM
A8
Ki RAND
Kc
MS
RAND
Kc
network
A8
SIM
Kc Generation
Kc: Ciphering Key Ki: Subscriber Identity Key
GSM
frame number22 bits
MS BTS
A5
Kc64 bits
S1114 bits
S2114 bits
ciphering
deciphering
frame number22 bits
A5
Kc64 bits
S1114 bits
S2114 bits
deciphering
ciphering
In Mobile Equipment (ME)
Ciphering Procedure
GSM
BCCH carrier
1
BCCH carrier 3
BCCH carrier 2
Serving BTS
RSL carrier1 > RSL carrier2 > RSL carrier 3
Cell Selection (IDLE mode)
Mobile tunes to the strongest BCCH carrier in
its IDLE mode
GSM
Power On: IMSI attached (1)
Power Off: IMSI detached (0)
VLR
IMSI record
1
0
SDCCH
IMSI Attach/Detach, az IMSI flag
IMSI flag
GSM
Location Area 1 (LAC1)
Location Area 2 (LAC2)
Location Area 3 (LAC3)
MSC/MSS
Location Area and LAC
GSM
Paging message is sent in all cells inside LA!
Location Area in Paging Procedure
Serving cell, where the connection is established
GSM
Location Area 1 (LAC1)
Location Area 2 (LAC2)
VLRLAC1 LAC2
IMSI record
On BCCH LAC (Location Area Code) is transmitted
Location Update procedure updates LAC in VLR IMSI record!
Location Update Procedure
GSM
LA2
LA1
BSC1
VLR
MSC
BSC2
(1) new LAI
(2) Channel Req. IMSI (RACH)
(3) Channel required
IMSI: LA1 LA2
(6)
(7)Loc. Upd. Accept.
(7) Loc. Upd. Accept. (SDCCH)
(4) Immediate Assign. (AGCH)
(5) Loc. Upd, Req. (SDCCH)
Location Update Procedure inside MSC/MSS Service Area
GSM
(8) Loc. Upd. Ack
(SDCCH)
(4) Suscribe
r Informat
ion Request
VLR
MSC2
IMSI: VLR1 VLR2
BSC2
VLR
MSC1
(5)
LA2
LA1
BSC1
(1) new LAI
(2) Loc. Upd. Req. (SDCCH)
(2) Loc. Upd. Request
(6) Loc. Upd. Acknowledge
HLR
IMSI MGT(3)
(6) Subscriber Information
(7) Location Cancellation
Location Update Procedure Between MSC/MSS Service Areas
GSM
Rescue handover:• System rescues the connection if the
received signal is too weak or noisy (caused by path loss or shadowing)
• BSC sends a handover command to the MS and BTS if measurement report evaluation results indicate weak connection quality
Traffic handover:Handover because of high traffic in the serving cell. (eg. traffic is increasing suddenly in the cell, and probability of congestion is very high)
Confinement handover:S/N optimization, TRX power minimalization
Types of Handover (Handoff)
GSM
TCH multiframe
24. 25. IDLE Downlink 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3
Uplink 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 024. 25. IDLE
At the end of TCH multiframe we have 12 timeslots duration for checking BSIC on the adjacent cell’s
SCH!
Measurements on the Adjacents Cells
GSM
TCH BCCH carrier2
BCCH carrier1
Serving BTS
On TCH (serving cell):
RXLEV
RXQUAL
DISTANCE
On BCCH carrier (adjacent cells)
RXLEV
Measurement report
on
SACCH
MR from MS nad BTS
BSC
Adjacent cells
Measurement Report
On TCH:
RXLEV
RXQUAL
DISTANCE
GSM
a bc
Jelerősség (SS)
Jelerősség (SS)
BTSA
BTSB
SS MIN.
(A) SS MIN.
(B)
HO. MARGIN (B)
Handover Margin
GSM
Forrás: Alien Coders: Basics of GSM in depth
Handover CasesI. Intracell Handover
GSM
Handover Cases II. Intercell handover
Source: Alien Coders: Basics of GSM in depth
GSM
Handover Cases II. Inter BSC Handover
Source: Alien Coders: Basics of GSM in depth
GSM
Handover Cases III. Inter MSC handover
Source: Alien Coders: Basics of GSM in depth
Top Related