Mobile Protocol

Network Protocols and The Motivation (continued)
Architectures of Mobile Radio “GSM with its enhancements (GPRS,HSCSD,WAP,

Systems CAMEL etc.) is the biggest technical system ever
designed by mankind” (source GSM world conference
2000).
An introductory lecture for pre- and
postgraduate students of Electrical In terms of :
• Mobiles produced per year: about 400 Mio. devices, more
Engineering. items than watch industry.
• Technological complexity: more R&D hours than Apollo, ISS, ..
• Size/Investment: in terms of € invested in infrastructure.
GSM, WAP, GPRS, UMTS
4/2/2003 U.A.Hermann: GSM 4/2/2003 U.A.Hermann: GSM

1 3
The Motivation The Motivation (continued)

The GSM Association’s membership Nice to know:
consists of more than 690 second (400+ )
• In war thorn countries (like Afghanistan, Yugoslavia) GSM was
and third generation wireless network the first telecom infrastructure readily and publicly available
operators and key manufacturers and within 6 months. (biggest problems: theft of BTSs, charging).
suppliers to the wireless industry. Its • It is today cheaper to set up a wireless communication system
members provide digital wireless from the scratch, than a wire-line system.
services to more than 777.5 million • Wireless systems have been instrumental for the deregulation
customers (end November 2002) in over of telecom markets: Easy to establish competition between
operators, leading to massive price reductions…
191 countries today – approximately
71% of the total digital wireless market • Speed of innovation (features, size of terminals, prices etc.)
are unprecedented in history. And it continues …
today. (source www.gsmworld.org)
2 4
1
1.1. Introduction
1.Global System for

Mobile • Quality of service and security
Communications
– From the subscriber’s point of view, the quality for voice
telephony in the GSM system shall be at least as good as that
achieved by the first generation of 900 MHz analogue systems
(GSM)
over the range of practical operating conditions.
– The system shall be capable of offering encryption of user

information but any such facility should not have a significant
influence on the costs of those parts of the system used by
[Mouly, Pautet – 1992] mobile subscribers who do not require such facility.

5 7
1.1. Introduction 1.1. Introduction

Basic Requirements (as defined by CCITT in 1985)
• Services • Radio frequency utilisation
– The system shall be designed such that the mobile stations can – The system concept to be chosen shall permit a high level of
be used in all participating countries. spectrum efficiency and state-of-the-art subscriber facilities at a
– In addition to telephone traffic, the system must allow maximum reasonable cost, taking into account both urban and rural areas
flexibility for other types of services, e.g. ISDN related services.
and also development of new services.
– The services and facilities offered in PSTN/ISDN and other
public networks should as far as possible be available in the – The system shall allow for operation in the entire frequency
mobile system. The system shall also offer additional facilities, band 890 – 915 MHz and 935- 960 MHz.
taking into account the special nature of mobile – The 900 MHz CEPT mobile communications system must co-
communications. exist with earlier systems in the same frequency band.
– It should be possible for mobile stations belonging to the system
to be used on board ships, as an extension to the land mobile
service. Aeronautical use of GSM mobile stations should be • Cost aspects
prohibited. – The system parameters shall be chosen with a view to limit the
– In addition to vehicle-mounted stations, the system shall be costs of the complete system, in particular the mobile units.
capable of providing service for handheld stations and other
categories of mobile stations.
6 8
2
1.1. Introduction 1.2.-1 Two dimensional view of a network
• Network aspects Physical grouping
– The identification plan shall be based on the relevant CCITT (machine)
Increasing Distributed
Recommendations. level of functional plane
– The numbering plan shall be based on the relevant CCITT abstraction
Recommendations. (field of co-
– The system design must permit different charging structures and operation)
rates to be used in different networks.
– For the interconnection of the mobile switching centres and
location registers, an internationally standardised signalling
system shall be used.
– No significant modification of the fixed public network must b
required.
– The GSM system shall enable implementation of common Spatial distribution
coverage PLMNs
– Protection of signalling information and network control Physical groupings (machines or entities) are represented by vertical blocks, whereas
information must be provided for in the system. co-operating functions are grouped in horizontal layers, each one corresponding to a
U.A.Hermann: GSM
functional domain U.A.Hermann: GSM
4/2/2003 9 4/2/2003 11
1.2. Architecture 1.2. Architecture

1.2.1. Overview • Dynamic view :
1.2.1.1. “The three description axis” – Describes the interworking of the system elements, based on events
and the way they trigger other events.
• Static view (figure 1.2.-1.) :
– … describes functions, which are fulfilled through the co-
• Systematic of description in this lecture (Figure 1.2.-2.) :
operation of several machines. “A function is something to fulfil 1. Description of the GSM system in terms of machines.
an activity” 2. Description of the functional planes in detail. Role of each machine
– Machine (here ) = an assembly of interconnected system in each plane,
components, physically close to each other, working together to 3. Description of event sequences (dynamic view)
perform identifiable tasks. Additionally a stepwise , top down process of splitting the system into
– “Function” in technical literature often refers to some abstract subsystem is used
machine. So here its is used closer to the original meaning of the
word.
• Architecture of GSM:
– “Canonical architecture” is described in the ETSI Recommendations
(the Standard)
– Real architecture: depends on implementational aspects. Design
freedom for manufacturers is intentional !
10 12
3
1.2.-2. The three axes of description 1.2. Architecture
Static functional view Static equipment view Dynamic view • 1.2.1.2. The borders of GSM (figure 1.2.-3.)
– BSS= Base Station Subsystem,
In charge of providing and managing transmission paths between the mobile
stations and NSS machines (primarily MSC), including management of
radio interface.
– NSS= Network and Switching Subsystem
In charge of managing the communications and connecting the mobile
station to the relevant networks or other mobiles. NSS is only indirectly
via BSS in contact with the mobiles.
– OSS = Operation and maintenance sub-system
In charge of managing the GSM network.
– A interface = Interface between BSS and NSS
GSM functions can be described along several axes, each one from a different
and complementary viewpoint
13 15
1.2. Architecture Figure 1.2.-3 GSM subsystem organisation

• Systematic of the Standard:
– To describe the behaviour of the system at the interfaces
– Leave the internals of machines open to design decisions of the Operator
manufacturers.
– The standard even describes interfaces between layers (even so they
are inside one machine) in order to avoid ambiguity . This does OSS
however not constrain implementation
GSM
es
Ex twork
Mo S
NS
bil
Ne
BS
er s
ter
S
nal s
Us
Following logically the three borders of the GSM domain, GSM can be defined
as composed of subsystems which interact between themselves and with the
outside world along with the black border lines shown
14 16
4
1.2.2. Subsystems 1.2.2.2. Base Station Subsystem (= BSS, figure 1.2.-5.)

1.2.2.1. Mobile station (= MS or mobile, figure 1.2.-4.)
• BTS= Base transceiver station:
• Main Functions: – Radio reception and transmission, incl. antenna, signal processing, etc.
– Terminal equipment: out functions specific to the service, e.g. a fax – A-bis interface to BSC
– Mobile termination: all functions related to radio interface – TRAU (= transcoder/rate adapter unit): data compression, part of BTS
but typically situated remotely at BSC of MSC.
– Terminal adapter: in between, e.g. modem interface.
• SIM (Subscriber Identity Module) • BSC (= base station controller) :
– All radio interface management through remote command to BTS and
– There is no personalisation need for the mobile equipment !
MS.
• MS = Mobile Equipment + SIM – Management of radio channels and handover.
– Switching functionality
• Abis interface not standardised for O&M functionality
17 19
1.2.-4. Mobile station functional architecture 1.2.-5. BSS components and interfaces
BSS
BTS
BSC OSS
(q3-if)
terminal terminal mobile

equipment adapter termination A if
Abis if
NSS
The mobile station may be a standalone equipment for certain services Radio if
Or support the connection of external terminals, either directly or The base station sub-system consists of BTSs, situated on the antenna
through relevant adaptation functions sites, and of BSCs, each one in control of several BTSs
18 20
5
1.2. Architecture 1.2.-6. Internal structure of the NSS
Control flow
1.2.2.3. Network and switching sub-system (NSS, figure 1.2.-6.) User data flow
• Main task= manage communications between GSM users and other telecom SS7
SS7
network users. backbone
backbone
• MSC (Mobile services switching centre)= coordinate setting-up of calls
from and to GSM users. MSC interface to other nets may require a gateway HLR AUC
for adaptation (interworking functions or IWF)
• One MSC controls several BSCs, with a traffic capacity of 1 … 10 Mio
subscribers.
• HLR (Home Location Register)= database containing subscriber data.
GMSC
AUC (Authentication Centre ) is a functional subdivision of the HLR.
• VLR= (visitors location register), linked to one or more MSCs, temporarily PSTN, PSPDN,
ISDN
MSC/VLR
storing subscriber data for mobile currently located in the MSC area
Here the VLR is integrated into the MSC. The fixed network between GMSC and
MSC/VLR as well as the SS7 net may or may not be part of the GSM network
21 23
1.2.2.3. Network and switching sub-system (continued) 1.2.2.4. Operation Sub-System (figure 1.2.-7.)
OSS is typically very vendor dependent, as it is equipment dependent.
• GMSC (Gateway MSC)= a call is always first routed to the next GMSC. • Cost sensitivity for operators: remote and automatic control of thousands of
This fetches routing information from the HLR and routes the call to the BTSs plus BSCs and MSCs. (BTSs are processed via BSCs). The better the
visited MSC. GMSC needs not to be a MSC, but could be a general O&M system is, the less and less qualified personnel is needed for
interconnection point . operation!
• SS7 network as “glue” between the MSCs. STPs (Signalling transfer • TMN (Telecommunication Management Network) concept: all OMCs
points” are the connectors between MSC and external SS7 networks. compose a network which as a whole is connected to all traffic handling
• Transit exchanges (TE) may be used in order to route the outgoing calls as machines.
close as possible to the destination • OMC-R= Radio OMC=> functions: CM (configuration management),
FM (fault management), PM (performance management). One OMC-R
is in charge of several BSCs.
• Different OMCs are for NSS, Voice Mail, SMS, transmission network etc.

22 24
6
1.2. Architecture 1.3. Functional Planes
1.2.2.4. Operation Sub-System (continued) 1.3.1. Overview of GSM protocol architecture

• Subscription Management= subscriber data management and charging.
Picture 1.3.-1 shows how the different machines of a GSM network
• Subscriber data management involves the HLR (= repository for subscriber
data) and the AUC (for security related data) plus distributed terminals at interact interact through the 4 planes of the respective protocols:
points of sales. SIM initialisation and personalisation is done in this system.
• Call charging: CDRs (Charge data records ) are produced in all switches. Transmission: physical layer, digital signal processing, coding and
Typically collection is done in a billing system close to HLR. modulation.
Radio Resource Management: management of transmission resources, coping with
• EIR (= equipment identity register) = database managing mobile equipment
physical aspects of the movement of the user.
(= ME) data, like IMEI (= international mobile equipment identity) for
Mobility Management: Managing subscriber location data, confidentiality,
tracking stolen mobiles and “misbehaving” mobiles.
authentication .
Communication Management: consists of different, independent components
depending on the type of service
OAM: Operation, Administration and Maintenance:

25 27
1.2.-7. OSS Organisation 1.3. -1 General Protocol Architecture
Network
Subscription operation and
management maintenance
and charging BSC MSC/VLR HLR GMSC
CM
Communication
Management
SIM
MM
Mobility
Management
Mobile equipment
management RR Radio
Resource Man.
The three main parts of OSS are: Trans

Network operation and management of telecommunications machines. Subscription mission
management, charging and billing. Mobile equipment management OAM MS BTS BSC MSC/VLR HLR GMSC
26 28
7
1.3. Functional Planes 1.3. Functional Planes
1.3.2. Overview of Transmission

Tasks provided: 1.3.5. Overview of Communication Management
•Carry user information Consists of subdomains
•Carry signalling information
•Call Control
•Included are: •Involves MSC/VLR, GMSC, IWF, HLR
•Modulation, Demodulation •Management of circuit oriented services
•En- / De- Coding, •Establishing, maintaining, releasing calls
•Multiplexing, Demultiplexing •Choice of routing path between users through switching network
•Formatting of data
•Sequencing •Supplementary Services Management
•Error correction through repetition •Enables to configure services independently of call.
•Routing information
•Short Message Services

29 31
1.3. Functional Planes 1.4. Overview of Interfaces and Protocols

Protocol Stack on the Radio Interface:
1.3.3. Overview of Radio Resource Management
Tasks provided: •RIL3-RR: Management of Radio Resources – “Radio Interface Layer 3”
•RIL3-MM: Signalling exchange between MS and NSS entities transparently for the
•Establish and release stable connections BTS and BSC.
•Cater for mobile movement •RSM : Radio Subsystem Management.
•Cope with limited radio resources. Radio resource sharing.
Inside NSS:
1.3.4. Overview of Mobility Management •MTP: Massage Transfer Part are the protocols used for signalling in SS7.
•TUP, ISUP, …: call related signalling between MSCs and external networks.
Involved machines: •MAP: “Mobile Application Part”, group of non call related signalling of
•SIM inside mobile station different protocols between different entities.
•HLR •TCAP: “Transaction Capabilities Application Part” of SS7.
•MSC/VLR •SCCP: “Signalling Connection Control Part” of SS7
•For security: AuC inside the HLR.
30 32
8
1.4.-1. Overview of GSM Signalling Architecture 1.5. Transmission
Anchor
MS BTS BSC Relay MSC MSC/VLR HLR 1.5.1. Basic Aspects of Transmission
CM RIL3-CC
MAP/D
MM RIL3-MM •To provide means of transmission between users: “Connecting People”
•This means adaptation to different optimisation schemes on the successive
RR RIL3-RR BSSMAP MAP/E
RSM segments along the transmission way.
•This requires translation functions between different transmission segments which
increases complexity.
TCAP
•GSM is a multi-service network, so it requires interconnection with various kinds
Layer 2 SCCP SCCP SCCP of external networks in order to provide consistent end-to-end services.
LAPDm LAPD MTP MTP MTP

33 35
1.4.-2. Different MAP/x protocols between entities 1.5. Transmission
MAP/F 1.5.2. An End-To-End view of Data Transmission

MSC EIR
MAP/D •“Bearer Capabilities” between the terminals are described.
MAP/I •Important: boundary between GSM network and the external network.
VLR MAP/D HLR •External networks may be:
•ISDN or broadband ISDN (DSL)
MAP/E MAP/G MAP/C
•PSTN (Public Switched Telephony Network)
•PSPDN (Packet Switched Data Network)
MAP/C
MAP/H= for short message transfer GMSC •CSPDN (Circuit Switched Public Data Network)
VLR
MAP/I= MS to HLR protocol •GSM use two generic functions for interworking:
for Supplementary Services MAP/D SMS •“Network Interworking Function” or IWF at the boundary of the GSM
MSC MAP/H Gateway network to the external network.
•“Terminal Adaptation Function” of TAF performs adaptation between mobile
station and external terminal Equipment (TE), like a PC.
34 36
9
1.5.-1. Schematic of Data Transmission Planes 1.5. Transmission
End-to-end
1.5.2.1 The PSTN Case (continued)
communication
Plane 1: end-to-end trans-
mission between •Similar interworking problems as between ISDN and PTSN arose:
terminals
• Difference between the user bit rate (e.g. 9600 bit/sec) and the carrying bit
rate (e.g. 12000 bit/sec.): between a Modem and the TE there are typically not
only 2 wires for data transmission (one in each direction), but also for clock and
modem control. Additionally multiplexing and demultiplexing of these control
GSM signals is needed.
Plane 2: TAF-IWF plane inside
TAF IWF External Network •Asynchronous transmission: but GSM is basically synchronous, so an
GSM
adaptation between the data flows is needed.
•Synchronous transmission: clock adaptation between the different clocking
systems is needed.
Plane 3: generic GSM transmission
plane MSC/VLR

37 39
1.5. Transmission 1.5.-2. Schematic Interconnection with PSTN

User User
1.5.2.1 The PSTN Case PSTN
3,1 kHz
Audio Audio line
•Analogue audio MODEM needed on the network side, so only certain types are Audio
Modem Modem
supported by the Standard: Digital/ Analogue Analogue/Digital
a: PSTN user to PSTN User

Modem Type Rate Mode of transmission
User GSM PSTN User
V.21 300 bit/sec Asynchronous
transmission
V.22 1200 bit/sec Asynchronous, synchronous 3,1 kHz
V.22bis 2400 bit/sec Synchronous Audio Audio line
Audio
V.23 1200 / 75 bit/sec Asynchronous Modem Modem
Digital/ Analogue
Analogue/Digital
V.26ter 2400 bit/sec Synchronous
V.32 4800, 9600 bit/sec Synchronous
b) GSM user to PSTN user
38 40
10
1.5. Transmission 1.5. Transmission
1.5.2.2 The ISDN Case 1.5.2.3 The PSPDN Case

•Two cases are implemented in GSM : “dedicated PAD access” and “dedicated
•When the GSM core standard was developed in the late eighties, no one imagined packet access” (see next picture). (PAD= Packet Assembler Disassembler)
the success of internet, so the requirement of higher data rates in GSM was •A single number is needed from the user in order to address the receiver.
prioritised lower, than the need for cost reductions in the infrastructure. •No specific subscription with the PSPDN is required for the GSM user.
•From the PSPDN perspective, the subscriber is the GSM network, which again has
•Basically ISDN offers with 64 kbit/sec a higher bit rate than GSM with only to dispatch the and recover the charges from the GSM subscribers.
9,6 kbit/sec. •GSM interworks directly with PSPDN
•Transmission between GSM and PSPDN does not necessarily make use of audio
•So the GSM “Rate Adaptation” function uses a “trick” to simulate logically an modems (depending on operators)
analogue terminal in a PSTN in order to facilitate the CCITT V.110 specified •The GSM IWF is aware, that it is a PSPDN access, and it interferes with the
capability of an ISDN modem to communicate with a slower analogue modem in transmission protocol, mainly to add the required identification of the PDPDN (not
the PSTN (see next picture) the subscriber).
•X.32 is a modification of X.25 allowing to transport the subscriber identification
41 43
1.5.-3. Schematic Interconnection with ISDN 1.5.-4. Schematic Interconnection with PSPDN
GSM User
User PSTN User User PSPDN
ISDN
3,1 kHz 64 kbit/sec
Circuit
Audio Audio line +V.110 Modem Modem PAD
Audio RA RA
Modem analogue Modem
Digital/ Analogue
a) Dedicated PAD access to PSPDN from GSM

a: PSTN user to ISDN User
User GSM
User User GSM User
ISDN PSPDN
transmission
64 kbit/sec
X.32 packet service
Circuit
RA +V.110 RA Modem Modem PH
Analogue/Digital
b) GSM user to ISDN user b) Dedicated direct access to PSPDN from GSM
42 44
11
1.5.4. Transmission inside GSM 1.5.4.2. Transcoder Rate Adaptation Unit (TRAU), continued
1.5.4.1. Speech
•Time alignment: in the downlink direction, transmission on the radio path can
•GSM full rate uses a 13 kbit/sec coding scheme by RPE-LTP (= Regular Pulse
start only, when a whole 20 msec block is received from the MSC. So there is an
Excitation – Long Term Prediction) Codec.
optimum time relationship between the moment of the beginning of a block
•Speech is transmitted in groups of 260 bit every 20 msec. transmission on the radio path and the end of the reception of a block on the 16
•Discontinuous Transmission (= DTX) and Voice Activity Detection (= VAD) kbit/sec link. Otherwise an additional 20 msec delay would result.
•DTX aims at increasing the efficiency of the radio interface by decreasing •Speech/Data and Full/Half Rate discrimination: inband information is needed
the cochannel interference, by suppressing transmission in case no in order to control the TRAU.
information is transmitted. •Reception Quality: receiver (demodulator and decoder) in the BTS signals,
•VAD is created by the speech codec and indicates when silence is when the reception was under a quality threshold. “Bad” frames are ignored by
transmitted. the speech transcoder.
•Comfort noise is injected on the receiver site in order to improve the
subjective speech impression. Only one 20 msec frame is transmitted every
480 msec.
45 47
1.5. Transmission 1.5.-5 Positions of the TRAU

1.5.4.2. Transcoder Rate Adaptation Unit (TRAU)
TRAU
•Speech data rate compression: TRAU compresses the 64 kbit/sec data rate of BSC MSC/VLR
ISDN to the 13 kbit/sec of GSM FR (Full Rate)
•Functionally the TRAU is part of the BTS.
TRAU
•Practically most vendors situate it at the MSC in order to save transmission
capacity (see picture 1.5.-5.). MSC/VLR
BSC
•This creates some additional overhead for inband signalling between BTS and TRAU
TRAU:
MSC/VLR
BSC
•Synchronisation: the speech encoded data stream does not contain
synchronisation information. This must be gained separately. On the air 16 kbit/sec transmission
interface this is provided by the general synchronisation . On the 2Mbit/sec 16 kbit/sec transmission physical site
terrestrial line this is achieved by additional synchronisation bits.

46 48
12
1.5.4.3. Data 1.5.4.3.1. Connection Types (continued)
1.5.4.3.1. Connection Types
•“NT” (Non Transparent Connections):
•Particular problem for radio transmission (as opposed to wire line •additional “Error/Repeat” scheme is used in case of bad reception.
communication):high bit error rates, e.g. over 10-3. •The transmission on the GSM circuit connection is considered as a packet
•GSM (like all transmission systems) had to find a compromise between data flow.
transmission quality, throughput and delay. •The throughput varies with the quality of basic transmission (the higher
•In GSM different compromise solutions had been developed in order to cater for the the BER, the lower the throughput), as well as the delay.
different sorts of applications. •Basic rates are 12000 bit/sec and 6000 bit/sec for 9600 kbit/sec (FR) and
4,8 kbit/sec (HR)
•Two categories: •Bits are grouped in successive frames of 240 bit incl. redundancy bits to
•“T” (Transparent) connections: FEC (Forward Error Correcting Code) allow the receiver to detect errors and start the repeat protocol called RLP
supplied by the radio interface. Derived from ISDN V.110. Path between (Radio Link Protocol)
TAF and IWF is seen as a synchronous circle. User data rates between 600 •RLP is operated between TAF and IWF.
bit/sec and 9600 bit/sec. Better protection for slower data rate.User data •Problem of data rate: if the T mode already leads to a user rate of 9600
rates below 2400 bit/sec are grouped into one category. bit/sec with a 12000 bit/sec connection, where does so the additional bits
for the RLP protocol come from ?
49 51

1.5.4.3.1. Connection Types (continued) 1.5.4.3.1. Connection Types (continued)
Performance versus rate in T mode: •“NT” (Non Transparent Connections):

•Solution: “bit steeling” from e.g. start/stop protocol of the user or from the
User rate Intermediate Rate Channel Type Residual Error Rate low level protocol of the application, like the LAPB in case of an X.25
9600 bit/sec 12 kbit/sec Full rate (FR) 0,3% connection.
The main function of these protocols are framing, error correction by
4800 bit/sec 6 kbit/sec Full rate 0,01 % retransmission and flow control, all functions as well fulfilled by RLP!
Half rate 0,3% •In both cases (Start/stop and LAPB) the idea is to replace them on the
≤ 2400 bit/sec 3,6 kbit/sec Full rate 0,001% GSM segment of the connection by the RLP and thereby apply more
efficient schemes for the radio connection instead of the “stolen” bits.
Half rate 0,01 %
•Consequence: RLP only works in some specific configurations, for which
GSM knows which low layer protocol is used.
The figures for residual error rates consider typical urban radio conditions with
frequency hopping •So in total GSM offers several compromise solutions for the data transmission
depending on the parameters:
Delay / Quality of Service / Radio Spectrum Efficiency
50 52
13
1.5.4.3.1. Connection Types (continued) •The RA1 Function (continued):
Name Quality of service Delay (two-way, TAF-IWF) •For this synchronisation is required between multiplexer and demultiplexer.
TCH/F9.6, T Low 330 ms •Bit rates lower than 4800 bit/sec are increased by by repeating each bit so
many times, till the required 4800 bit/sec are achieved.
TCH/F9.6, NT High > 330 ms
•The RA2 Function :
TCH/F4.8, (T) Medium 330 ms
•… rate adapts the intermediate rate to 64 kbit/sec, by simply adding 6 or 7
TCH/F2.4, (T) Medium 200 ms bits to each 1 bit in an octet.
TCH/H4.8, T Low 600 ms
TCH/H4.8, NT High > 600 ms Asynchronous raw rate, synchronous
e.g. 300 or 9600 bit /sec Intermediate rate
TCH/H2.4(T) Medium 600 ms RA1 (8 or 16 kbit/sec)
RA0
TCH/F = “full rate” channel , 23 kbit/sec raw bit rate. RA2
The quality indications are only indicative in a statistical sense, as they depend sampling sync 64 kbit/sec
on the specific radio conditions. fill fill
“plug”
53 55

1.5.4.3.2. Basics of Rate Adaptation (Repetition of ISDN V110) 1.5.4.3.3. GSM T Connections
•The RA0 Function: • The transmission path between the TAF at the mobile site and the IWF at the
•An asynchronous data flow is a succession of characters, each typically Infrastructure site are equivalent to before sketched V.110 functionality (see next
preceded by a start bit and terminated by a stop bit. On such a flow it is not picture)
required that the bit edges fall with the regular clock. •Differences on the radio interface:
•In ISDN and GSM data transmission is however only synchronous, so RA0 •… to limit as much as possible the information to be transmitted so that
has to transfer the asynchronous into an synchronous data flow, by delaying the maximum part of the raw throughput can be devoted to optimised
bits till they are aligned with the clock . redundancy, in order to maximise the transmission quality.
•In case of higher incoming than outgoing data rate stop bits may be skipped •Synchronisation bits are removed, as GSM has its own synchronisation at
at the sender and reinserted at the receiver. the radio interface which can be used to derive the V.110 synch.
•The RA1 Function: •Bits E1, E2, E3 indicating the transmitted data speed can be removed, as
•… provides a bit flow at the intermediate rate of 8 kbit/sec or 16 kbit/sec, this is part of GSM signalling
according to the nominal rate to transport. •Resulting “intermediate rates” at GSM after the RA1’ are 12 kbit/sec,
•… multiplexes between the auxiliary information (Modem control plus other 6 kbit/sec and 3,6 kbit/sec (= 2,4 kbit/sec data plus 1,2 kbit/sec auxiliary
signals) and the main data flow. data)
54 56
14
1.5. Transmission 1.6. The Radio Interface
1.6.1. The requirements

Intermediate data rate 1.6.1.1. User Data Transmission
Asynchronous raw rate, (3,6 , 6 or 12 kbit/sec) Intermediate data rate
e.g. 300 or 9600 bit /sec (8 or 16 kbit/sec)
synchronous •Most of the user services offered by GSM rely on 4 different transmission modes:
•Speech, with 13 kbit/sec
•Data with 12 , 6 or 3,6 kbit/sec raw data rate.
RA0
•SMS uses a different package oriented service, which is derived from from
methods used for transfer of signalling.
RA1’/RA1
sampling
RA1’ sync RA2
64 kbit/sec
“plug” fill •“Traffic Channels”
fill
TAF BTS+TRAU •THC/F (F= Full Rate) for 13 kbit/sec speech and 12, 6 or 3,6 kbit/sec data.
•TCH/H (H= Half Rate) fro 7 kbit/sec speech and 6 or 3,6 kbit/sec data.
Adaptation functions RA0 (for asynchronous data only) and part of RA1
(called RA1’) are performed in the TAF (inside the mobile station), whereas the
Complement of RA1 and RA2 are performed in the BTS/TRAU
57 59
1.6. The Radio Interface 1.6. The Radio Interface

1.6.1.2. Signalling
• This chapter is deliberately kept rather brief and intend to give rather an overview
of the aspects of channel coding, as these typically are dealt with in different •Is need for e.g. call set up, call release, handover, authentication, etc.
lectures.
•Signalling in Connection with a Call is done by 2 different methods in parallel to
•The radio interface has been the most important one, at least from the time and the user data stream:
effort of development, due to following reasons: •SACCH= Slow Associated Control Channel:
•Compatibility requirement at the radio interface. •Bidirectional channel carrying about 2 messages per second
•Spectral efficiency (Number of synchronous calls which fit into a given radio •Transmission delay= about half a second.
spectrum) •Used for non urgent procedures, like transmission of radio measurement
•Resistance to interference, which determines the frequency reuse factor. data needed for preparing handover.
•No user data is lost, as the data/speech is “compressed into the other time
•Multiple access scheme will be described and the signal processing from bits to slots of the TCH”
radio waves. •FACCH= Fast Associated Control Channel:
•GSM uses a mixture of FDMA and TDMA, with FH (=Frequency Hopping) •For urgent/fast procedures like authentication or handover.
•Medium Bandwidth = 200 kHz. •Is not an extra channel, but a particular use of the TCH: “channel steeling”
•TDMA factor = number of calls on 200 kHz band is 8 (or 16 for Half Rate) •So user data is lost during a call, not at call set up or call termination.
•GMSK is the (classical) modulation scheme used. •Receiver can identify both uses by reading the “stealing flag”.
58 60
15
1.6.1.2. Signalling (continued) 1.6.1.3. Idle Mode (continued)
•Signalling outside a Call is done if a connection between MS and network is Cell Broadcast Messages
established only for signalling purposes, like SMS, location update etc.
•SDCCH= Stand alone Dedicated Control Channel or FCH/8 (eighth of a TCH/F) •CBCH= Cell Broadcast Channel
•Similar characteristic as a TCH, however lower rate. •… has half the capacity of a TCH/8
•TCH/8 also has an SDCCH, so it perfectly looks as a TCH and could •Constraints: it must be possible for a MS to listen to the CBCH in parallel to the
theoretically be used as such for user data … BCCH and PCH.
1.6.1.3. Idle Mode Terminology : “What is a Channel”
•Idle Mode as opposed to Dedicated Mode is the phase, when the mobile is switched •CCITT: “a channel is an identified portion of an interface”
on. But no radio communication is ongoing (hence none of the precious radio resource •GSM: confusion is created by using the term channel in two different ways:
is being used. •Sometimes a specific resource , like TCH
•During idle the MS still has to listen to the BTS for “Paging”, measurement of radio •Sometimes a specific usage of a resource, like FACCH
environment in order to choose the most suitable BTS to “camp on”, listen to the Cell
Broadcast (CB) SMS. U.A.Hermann: GSM U.A.Hermann: GSM
4/2/2003 61 4/2/2003 63

1.6.1.3. Idle Mode (continued)
Access Support 1.6.2. The Multiple Access Scheme
•Downlink, unidirectional channels: •Burst= finite duration and major part of energy is in a finite part of the radio
•FCCH = Frequency Correction Channel: transmitted by the BTS for the mobiles spectrum
to synchronize their internal clock frequency. •Slots= the central frequencies of the slots are positioned every 200 kHz
•SCH= Synchronisation Channel transmitted by the BTS for the MS to (FDMA aspect) and they recur every 15/26 msec (TDMA aspect).All slot time
synchronize its internal Clock (time synchronisation) limits are simultaneous in a given cell.
•BCCH= Broadcast Control Channel= transmitted by the BTS to e.g. identify the •Bidirectional channels are separated by a frequency gap (45 MHz for GSM-
network to which a given cell belongs. 900 and 75 MHz for DCS-1800) and a time shift depending on the channel
•PAGCH= Paging and Access Grant Channel= PCH (Paging Channel) and type.
AGCH (Access Grant Channel). The partition between PCH and AGCH varies in
time.
•Uplink, unidirectional channel:

•RACH= Random Access Channel: used fro the first access request of a MS. The
timing of this burst is chosen randomly, so there may be “clashes” between
mobiles…
62 64
16
1.6.2.1. The Time Axis 1.6.2.1.1. Dedicated Channel (continued)
•Organisation of the time axis is always cyclic, but the length of cycles as well as •Coding follows cycles based on grouping 4 successive bursts. For the TCH/F a
number of slots in a cycle varies according to the type of channel. cycle contains 6 times 4 bursts. However for the SACCH, the full cycle, taking into
•Each time slot has a number ( which is cyclic) account this grouping 4*4, lasts 4* 26* 8= 104* 8 BP= 480 msec.
Relationship between Uplink and Downlink:

•From BTS point of view: Uplink time slot number is delayed by 3 BP against
1.6.2.1.1. Dedicated Channel Downlink.
•This relationship is fixed, so Up- and Downlink channels have the same TN.
•TCH/F always goes together with its SACCH (sometimes called TACH/F ). •Due to this shift, the MS does not need a splitter between Transmitter and
•TACH/F consists of one slot every 8 BP (Burst Period)= 4,615 msec= 60/13 msec. Receiver.
•Time Slot Number (TN) = 0 … 7 allocated to different traffic channels Transmission
•Cycle time of SACCH is one for 26 time slots
120 msec Reception
(26)
0 1 2 3 4 5 6 7
01234567 8 BP = 4,615 msec
0 1 2 3 4 5 6 7
BP 15/26 msec
65 67

1.6.2.1.1. Dedicated Channel (continued) 1.6.2.1.1. Dedicated Channel (continued)
•120 msec period was chosen as a multiple of 20 msec (GSM Speech frame) and TCH/8
fixed network frame (ISDN) to obtain synchronism. •From the perspective of the time organisation many different kinds of TACH/8
exist:
•So a burst period = 120 msec/ 26* 8 slots = 15/26 msec •Some a grouped by 8 in order to form the equivalent of TACH/F = SDCCH/8
•Others are grouped by 4 and combined with common channels to form
•TACH/F 26 slot cycle includes 24 slots in which TCH/F bursts are sent , 1 slot on together the equivalent of TACH/F= SDCCH/4
which a SACCH burst is sent and one slot with no transmission (See next picture).
•Common properties of all TACH/8:
•In order to spread the arrival of SACCH messages at the base station, the cycles of •All follow a cycle of 102* 8 BPs, where 8 slots are used for TCH/8 and 4 slots
two TACHs using successive slots are separated by 97 BP (= 12* 8 + 1 slot) are used for SACCH
•Period 102 is different from period 104. This is because the Common
7 T T T T T T T T T T T T T T T T T T T T T T T T S Channels follow a period of 51* 8 BPs.
0 T T T T T T T T T T T T S T T T T T T T T T T T T •The TACCH/8 vary in their phase relations between the TCH slots and the
1 T T T T T T T T T T T T T T T T T T T T T T T T S SACCH ones, as well between UL and DL
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25
•Considering the measurement reporting period as well, there are 12 different
schedulings for the TACH/8
66 68
17
1.6.-1 Time organisation of TACH/8 1.6. The Radio Interface
1.6.2.1.2. Common Channel (continued)
T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T S S S S S S S S S S S S S S S S
0 4 8 12 16 20 24 28 32 36 40 48 50 BCCH and PAGCH
T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T S S S S S S S S S S S S S S S S •Both are DL channels.

•A BCCH/F uses 40 slots:
51 55 59 63 67 71 75 79 83 87 91 95 99 101
Grouping by 8 (each TACH/8 is marked with the same colour). During this cycle, BCCH PAGCH
2 blocks of 4 slots are used for the TCH/8 and 1 block of 4 slots for the SACCH
0 2 6 12 22 32 42
T T T T T T T T T T T T T T T T S S S S S S S S
•A BCCH/T (T for third) uses 16 slots per 51* 8 BP, all with the same TN
0 22 26 29 32 36 39 42 46 50
BCCH PAGCH
T T T T T T T T T T T T T T T T S S S S S S S S
51 73 77 80 83 87 90 93 97 101 0 2 6 12
Grouping by 4
69 71

1.6.2.1.2. Common Channel 1.6.2.1.2. Common Channel (continued)
General Organisation
•All Common Channels are designed to be grouped together on the same RACH
(“Beacon”) frequency in a few combinations
•Their time definitions are therefore all based on the same cycle= 51* 8 BPs •RACH is a DL channel.
•This cycle and the cycle for the traffic channel (= 104* 8 BPs) were deliberately •The time organisation of a RACH/F is similar to a TACH/F in UL direction.
chosen without a common divider! •The RACH/H uses 23 time slots in a 51* 8 cycleand its capacity is therefore more
•The intention is that a MS in dedicated mode during its idle time slot (no.= 52) than half of a RACH/F.
shall listen to the beacon frequencies of neighbouring base stations in order to
RACH
prepare a potential hand over.
•So the SCH and FCCH of neighbouring BTSs “slide” along the listening window
of the MS.
0 4 14 36 45
•This synchronisation to the neighbouring BTSs is called “presynchronisation”
•The TN= 0 of the FCCH is by definition! Common Channel Combinations
FCCH SCH •Every cell broadcasts FCCH and SCH
•Every cell supporting mobile access has BCCH, PAGCH and RACH. E.g. a micro-
cell under an umbrella cell might not support access, but only be reachable via
0 10 20 30 40
handover.
70 72
18
1.6.2.1.2. Common Channel (continued) 1.6.2.1.2. Common Channel (continued)
•In order to save spectrum, the common channels are always grouped together. •For big capacity sites more capacity for paging and access grant might be used, so
•3 possible combinations are used, depending on traffic capacity of a given cell that additional extension sets of PAGCH/F and RACH/F are used.
•Downlink channel structure for normal capacity cells: •Each such extension set has an additional BCCH, but no FCH and SCCH, as they
must be unique in a cell.
FCH SCH BCCH PAGCH/F •The extension sets are for TN=2, 4 and 6, due to following reasons:
•All common channels of one cell must use the same frequency.
•Cells of very large radius may allow RACH bursts to overflow into th enext
0 1 2 6 10 12 20 21 30 32 40 42 time slot. This would not be possible, if this slot is allocated.
•The number of possible combinations should be limited in order to simplify
• … and the related uplink channel structure implementation.
RACH CBCH
•CBCH cycle = 8* 51* 8 BP (lasting about 2 sec), where 4* 4 time slots are used.
•Allowed poitions in the 51* 8 BPs cycle and allowed TNs are limited, so that the
MS can listen to BCCH and PAGCH.
•2 different cases can be distinguished:
73 75

1.6.2.1.2. Common Channel (continued) 1.6.2.1.2. Common Channel (continued)
•For small capacity sites less capacity for paging and access grant might be used, so 1. If the common channel is a small one with a PAGCH/T and a RACH/H, the
that instead TACH/8 for additional signalling is combined: CBCH can use the same TN=0 and frequency as the the common channel.
2. For all common channel configurations: CBCH I son TN=0 (not for beacon
frequency), 1, 2 or 3 . The CBCH must than again be on a specific position in
FCH SCH BCCH PAGCH/T TACH/8 (used for signalling) the 51* 8 BP cycle, which would otherwise belong to a TCH/8. In this case the
MS in idle mode has to listen to the bursts of different TNs. This increases
scheduling complexity and is the only case where an idle MS has to listen to 2
0 1 2 6 10 12 20 21 30 32 40 42
time slots!
• When a CBCH is used, the first block of the PAGCH in the 51* 8 cycle cannot
• … and the related uplink channel structure be used fro paging.
• Inside the 8* 51* 8 BP cycle, the CBCH can be seen as a half downlink TCH/8,
RACH using for out of eight 4-burst blocks.
• The 4 other blocks, i.e. the slots else used by the SACCH, and the uplink
corresponding slots are not used by the CBCH and cannot be used for anything
0 4 14 36 45
else. In case of congestion CBCH can be stopped and used for TACH/8

74 76
19
1.6.2.1.3. Channel Organisation in a Cell 1.6.2.1.5. Frames (GSM Standard definitions)
• “TDMA Frame” consists of 8 time slots, FN= TDMA Frame Number
• In a cell one or more TRX (= Transmitter / Receiver) may be combined into • “26 or 51Multiframe“= 26 or 51 TDMA frames”= 26 or 51* 8 BPs
one BTS. • Superframe= 51* 26 TDMA frames = ca. 6,12 sec. This is the shortest period
• The combinations of logical channels on the frequencies is optimised for the for which the organisation of all channels is repeated.
traffic capacity needed in a given cell • “Hyperframe”= 2048* 51* 26* 8 BP = 12533,760 sec.= 3 h, 28 min. 53,760 sec
• … and optimized to use all available time slots. is a multiple of all cycles and the shortest period for freq.hopping and ciphering
• Typical small capacity cell with only 1 TRX:
• TN= FCCH, SCH, BCCH, PAGCH/T, RACH/H, 4 TACH/8
• TN1 …7= 1 TACH/F each. Hyperframe= 2048 superframes= 3 h 28 min 53,760 sec.
• Medium Capacity Cell with e.g. 4 TRX:
• One TN0 group: FCCH, SCH, BCCH, PAGCH/F, RACH/F
• Twice 8 TACH/8 Superframe = 26* 51 multiframes= 6,12 sec
• 29 TACH/F
• Large Capacity Cell with 12 TRX:
• One TN0 group: FCH, SCH, BCCH, PAGCH/F, RACH/F
0 1 2 24 25 0 1 2 3 48 49 50
• TN= 2, 4 and 6 groups: BCCH, PAGCH/F, RACH/F
26 multiframes= 51 multiframes= 235 msec
• 5 times 8 TACH/8 120 msec 0 7
• 87 TACH/F TDMA Frame= 4,615 msec
77 79

1.6.2.1.4. Synchronisation Acquisition 1.6.2.2. The Frequency Axis
1.6.2.2.1. Available frequencies
• Synchronisation is generally a key issue for all radio systems … • GSM900= 890- 915 MHz (uplink) and 935- 960 MHz (downlink)
• Steps of initial synchronisation: • DCS1800= 1710- 1785 MHz (UL) and 1805- 1880 MHz (DL)
1. MS listens after a predefined strategy for a BCCH carrier frequency (called beacon • Extension Bands= 8 MHz directly under the original bands.
frequency). Strategy may e.g. be to start listening for the last beacon frequency, • 200 kHz carrier spacing between two channels.
than for all beacon frequencies used by the home mobile operator and than for all
GSM frequencies. As the beacon frequency is not power controlled, but always 1.6.2.2.2. Frequency Hopping (FH)
transmitted at full power, it should be easy to find … • GSM uses slow FH as opposed to fast FH in military systems.
2. MS looks for a FCCH: as it is a pure sine wave, it is easy to detect. The • GSM hopping period = burst period.
information derived is used to tune the synthesizer frequency and to roughly adjust • Fast FH= quicker than modulation rate.
the clock to the TN0 boundaries. • FH was introduced due to 2 reasons:
3. As the SCH slots always come after the FCCH slot, they are easy to find and 1. Compensate for Rayleigh fading in case of stationary or slowly moving mobiles: in
decode. Inside the SCH the MS finds exact information about its slot number in the case of a “fading hole” at a certain place and frequency, there might not be a such a
8* 26* 51* 2049 BP clock hole at another, decoupled frequency. Typically decoupling is achieved at more
4. The MS reads the BCCH in order to obtain information about the BTS, the operator than 1 MHz frequency difference. FH gain is about 6,5 dB.
etc. 2. Interferer diversity: Interference by e.g. a nearby mobile is statistically distributed.
The system capacity is best for a given C/I, if the spread around the mean value is
as small as possible.
78 80
20
1.6.2.2.3. Hopping Sequences 1.6.2.2.5. The Case of Common Channels
• GSM uses slow FH as opposed to fast FH in e.g. military systems. • Common Channels (FCCH, SCH, BCCH, PAGCH, RACH) never hop, in order to ease
• GSM hopping period = burst period. initial synchronisation.
• Fast FH= quicker than modulation rate. • Extension sets of common channels are as well forbidden to hop.
• Common Channels must always transmit at full power in order to allow MSs the
• FH was introduced due to 2 reasons: “neighbour station monitoring” of field strength. This again is needed by the mobiles in
1. Compensate for Rayleigh fading in case of stationary or slowly moving order to prepare handover, I.e. measure field strength in order to find the best candidate
mobiles: in case of a “fading hole” at a certain place and frequency, there for a potential HO.
• So if no information is to be transmitted, “fill frames” with predefined content are
might not be a such a hole at another, decoupled frequency. Typically
transmitted.
decoupling is achieved at more than 1 MHz frequency difference. FH gain • This is why the BCCH frequency also is called beacon frequency.
is about 6,5 dB. • Interesting case: in small cells (minimum would be only one TRX) still FH might be
2. Interferer diversity: Interference by e.g. a nearby mobile is statistically required by the operator in order to gain on frequency and interferer diversity:
distributed. The system capacity is best for a given C/I, if the spread • But TN= 0 with the common channels must not hop!
around the mean value is as small as possible. • The other time slots should hop at least over 4, better 8 different frequencies in
order to gain the desired effects.
• So the beacon frequency must be filled up with “fill frames” on each TN≠ 0 which
has just “hopped off” to another frequency.

81 83

1.6.2.2.4. Hopping Sequences 1.6.3. From Source Data to Radio Waves
• In GSM 64 different FH sequences are foreseen. They are pseudo random with • The intention of this chapter is not explain channel coding and modulation, as these are
exception of the first sequence (number= 0), which is one frequency after the other. topics covered by other text books and lectures, but rather how these technologies had
• The FH sequences have each a “Hopping Sequence Number” (HSN) = 0… 63. been applied on. (for more on these subjects, see e.g. [Sklar- 1988]
• For a set of n available frequencies in a given cell, GSM allows 64* n different hopping • The operations described here are standard for all transmission systems on the
sequences to be build, depending on which frequency of the given set is defined as the transmitter side (and inversely on the receiver side):
starting frequency for the hopping sequence. • Channel Coding: introduction of redundancy in order to enable error detection and
• MAIO (Mobile Allocation Index Offset)= starting number of frequency in a set. correction. In GSM e.g. a code word for full rate speech is 456 bits long
• Properties: • Interleaving: mixing up bits which are “close” to each other over several code
• 2 channels with identical HSN, but different MAIO never use the same frequency words. Since the error probability of successive bits in the modulated data stream is
on the same burst. highly correlated and channel coding performs better with decorrelated errors,
• 2 channels with identical frequency lists, same TN but different HSNs interfere for interleaving aims at decorrelating errors. After interleafing the block structure is
1/n of the bursts, as if the sequences were random. created: one block for one burst.
• Ciphering: creates data confidentiality by applying a ciphering code, which is only
• Inside one cell, typically identical HSN, but different MAIOs are used in order to avoid known by the BTS and the MS.
interference between mobiles. • Burst Formatting: Adds some binary information (midamble) to the blocks in order
• In distant cells using the same frequency set, different HSNs should be used in order to to help synchronisation and equalisation.
gain from interferer diversity. • Modulation: transforms the binary signal into an analogue signal of the right
frequency.
82 84
21
1.6.-2. Sequence of operations from Speech to Radio Waves and back 1.6.-3 The Normal Burst
Level (dB)
correlation
+4
+1
-1
-6
Digitizing and Source 16
Source Coding Decoding
-30
Channel Channel 147 bits
Coding Decoding
Interleaving De-Interleaving
-70
or
Burst Formatting Burst Formatting -36
dBm 7056 / 13 T (µsec)
10 10 10 10 -5 5
8 1 burst period (7500/13 µsec.) 8
Ciphering Deciphering
Figure 1.6.-3.a: time mask of a normal burst Figure 1.6.-3b. Autocorrelation
Power level during guard time mustbe below function of a GSM training
Modulation Demodulation
-70 dB or –36 dBm, whichever is higher. sequence

85 87

1.6.3.1. The Bursts 1.6.3.1.2. The Access Burst
Transmission time window = (576 + 12/13) µsec.= ( 156+ ¼) bit
Tail Training Sequence Information Tail
7 41 36 3
1.6.3.1.1. The Normal Burst
Tail Information Training Information Tail
Sequence • The access burst is the only short burst in GSM.
3 58 26 58 3 • Objective: to fit into the reception window of a BTS despite the signal delay
between MS and BTS due to speed of light.
• Guard time is determined by the signal envelope (see next figure): period during which
the signal is below –70 dB is about 30 µsec. • Propagation delay is twice the signal way between BTS and MS. Only a MS more
• In Uplink this guard time is used for MS tolerances and compensation of multipath than 35 km away from the BTS would miss the time window of the BTS. But this
echo. is not allowed by the standard any way (exception: extended cells).
• Training period in the middle is sometimes called midamble: minimum distance to • Longer training sequence and tail bits in the beginning in order to increase
useful bits. Used for channel estimation, demodulation and equalisation. demodulation and detection success probability: the BTS receiver does neither
• 8 different training sequences (TS) are defined. Different TS are used by BTS which use know whether nor when and with which reception level and frequency error the
same frequencies and are close enough to create interference. signal arrives!
• The TS have been chosen for a sharp autocorrelation function with a high peak and a • Only one training sequence is specified, despite the fact that multiple sequences
low correlation with the other midambles. would increase detection probability. Reason: keep its simple… !
• The bits closest to the TS are the “Stealing” flags (=1 means stealing), indicating to the
decoder that a different decoding shal be used, as a FCCH is transmitted. In other
channels than TCH, these bits are ofU.A.Hermann:
no use. GSM U.A.Hermann: GSM
4/2/2003 86 4/2/2003 88
22
1.6.-4 The Access Burst 1.6. The Radio Interface
Level (dB)
+1
+4 Total Delay 1.6.3.2. Interleaving and Channel Coding
-6
-1
1.6.3.2.1 General principles of Interleaving
BTS • Interleaving is meant to decorrelate the relative position of bits respectively in the code
-30 word and in the modulated radio bursts. (better performance of decoding is achieved, if
87 bits
errors are randomised and not appearing burst wise)
MS • b bits of a code word are spread into n bursts. The larger n, the better the transmission
performance but the longer the transmission delay.
• Different compromises were found in GSM, depending on the channel usage.
-70
or
-36
DL delay UL delay time 1.6.3.2.2 General principles of Channel Coding
dBm 4176 / 13 T (µsec)
10 10 10 10 • Channel coding intends to improve transmission quality, so it compensates for different
8 1 burst period (7500/13 µsec.) 8 disturbances (noise at low reception level, interference, multipath propagation, Doppler
shift, …)
Figure 1.6.-4.a: An access burst has the Figure 1.6.-3b. Autocorrelation • In GSM several codes are concatenated:
same ramping specification as a normal burst, function of a GSM training • Block convolution codes: used with likelihood estimation data from demodulator. Good
results for error correction.
but the useful duration is much shorter sequence
• Fire code: used after convolutional decoder in order to cope with “bursty”, residual errors.
• Simple parity code for error detection.
89 91

1.6.3.1.3. The SCH Burst
Tail Information Training Information Tail
1.6.3.2.3 Convolutional and Block Codes
Sequence
3 39 64 39 3 • Maximum degree of generator polynomial used by GSM is 4 .
• In GSM such a simple code has been chosen (despite the fact, that
• The SCH burst is the first burst received by a MS. convolutional codes of larger degree are better), because the performance gain
• Therefore its training sequence is longer (in order to ease demodulation). is is limited by the interleaving depth.
• Only one TS is used (the MS would not have a chance to know which one was • “span” of a code = length of sequence of coded bits, which must be
used, as it is not yet synchronised on the BTS). analysed to decode one information bit.
• Little gain is obtained if span is greater than interleaving depth.
• E.g. for 9,6 kbit/sec a span of 22 is optimum in GSM.
1.6.3.1.4. The FCCH Burst (or “Pure Sine Wave Burst”)
1.6.3.2.4. Fire Code
• All its bits are set to 0.
• With the modulation technique this results in a pure sine wave, with frequency
• In GSM a shortened cyclic code is used.
1625/24 kHz higher than the carrier central frequency
• Generator polynomial : (X23 + 1) ( x17 + X3 +1)
• So the degree of the polynomial is 40 (= number of redundancy bits)
• Errors of up to 11 bits can be corrected.
90 92
23
1.6.3.2.5 Parity Codes 1.6.3.2.7 Example TCH/FS transmission mode (continued)
• Parity codes are linear block codes , derived (like the Fire code) from cyclic codes. • Interleaving:
• 3 different codes are used: • Full rate speech blocks are interleaved on 8 bursts: 456 bits of one block are split in 8
• For speech: a 3-bit redundancy code, enables detection of most important bits groups of 57 bits, each transmitted on a different burst. So each block carries
of speech codec. Only one-error patterns can be detected, two or more errors contributions from 2 successive speech blocks.
can not be detected.
• For RACH: 6-bit redundancy code, used for error detection • So 1 burst contains 116 bits of coded data:
• 57 bits from block B
X6 + X5 + X3 + X2 + X + 1 = (X + 1) (X5 + X2 + 1)
• 1 “stealing” bit indicating whether this half burst is speech or FACCH
• For SCH: 10-bit cyclic redundancy code, used for error detection • 57 bits from block B+1
X10 + X8 + X6 + X5 + X4 + X2 + 1 = (X4 + X3 + X2 + X + 1) (X3 + X + 1) (X3 + X2 + 1)= • 1 “stealing” bit indicating whether this half burst is speech or FACCH
= (X5 + 1) (X7 + 1)
(X +1)(X +1 )
1.6.3.2.6. Decoding
• GSM does (like most modern standards) not describe reception, but just transmission.
• Only minimum performance criteria are given fro receivers. Typically they are fulfilled by
maximum likelihood decoder (Viterbi) using soft decision input from the demodulator.
93 95

1.6.3.2.7 Example TCH/FS transmission mode 1.6.3.3. Ciphering
• Input rate= 13 kbit/ sec at full rate, 20 msec blocks with 260 bits. • Ciphering is one of the main advantages of digital transmission as compared to
• Some bits are more sensitive to errors and therefore additionally protected: analogue.
• 78 bits unprotected • In GSM several ciphering algorithms are used with different strengths, depending
• 182 bits : protected by a convolutional block code on export regulations to particular countries.
• 50 bits (category 1a) of the 182 are additionally protected by 3 additional redundancy • All ciphering algorithms must by such, that they can be intercepted and decoded
bits. The remaining 132 bits are category 1b. on line by police or other state authorities.
• Using a public key algorithm makes the system hard against “normal”
• Coding:
eavesdropping.
• Category 1a bits are protected by a detection code with polynomial X3 + X + 1. If any
of these bits would be disturbed, only loud noise would be heard instead of speech. So • The ciphering itself is very simple: EXOR operation with a pseudo random
in case such errors are detected, the receiver speech codec either produces comfort sequence and the 114 useful bits of a normal burst (I.e. without stealing flag)
noise or a repetition of the last block. • Sampling is applied to all normal bursts (speech, data , signalling).
• Convolutional code: two convolutions without puncturing: D4 + D3 + 1 and • Ciphering I sonly used on the air interface, so it ends in the BTS.
D4 + D3 + D +1, so 185 bits plus 4 tail bits add up to 378 bits. This plus 78 unprotected
bits adds up to 456 bit

94 96
24
1.6.3.4. Modulation 1.6.3.4. Modulation (continued)
• In GSM a GMSK (Gaussian Minimum Shift Key) with BT= 0,3 and a modulation • Properties of GMSK modulation in case the modulating bits di are constant ( all 0
rate of 270 5/6 kbaud is used. or 1): πt
• Demodulation is typically done by a Viterbi or a linear relaxation algorithm.
ϕ (t ) =ϕ 0 + ∑ Φ(t − iT ) =ϕ 0 +
i 2T
• Formula: This is a sine wave of frequency
• Electrical field generated: E(t) = a(t) cos (ω0t + φ(t)) ω0 1
f1 =( + )
a(t) follows a ramping curve in order to avoid spurious emissions due to sharp 2π 4T
changes between emission and silence. Additionally a(t) is subject to power
Control. • Properties of GMSK modulation in case di is alternating ( 0, 1, 0 , 1, 0, …):
ω0 is the respective centre frequency. πt
ϕ (t ) =ϕ 0 − ∑ Φ (t − iT ) =ϕ 0 −
2T
• φ(t) = φ0 + Σ ki Ф(t- iT) with infinite bit stream …, di-1 , di, di+1,… i
This is a sine wave of frequency
ki = 1 if di = di-1,
ki = -1 if di ≠ di-1 ω0 1
Ф(xT)= ½π (G(x + ½) – G(x- ½))
f1 =( − )
2π 4T
97 99

1.6.3.4. Modulation (continued) Φ(t) 1.6.3.5. Modulator , Demodulator
π/2 • Most modulators have been implemented with an intermediate frequency at e.g.
T =48 /13µσ
72 MHz.
ln(2)
σ= =0.441684
2π 0.3 • Demodulator is generally much more complex than modulator, due to
t2 t2 • Variable attenuation, e.g. through shadowing
x
1 − σ − t
G ( x) =x ∫ e 2σ 2
+ e 2σ 2 • Multipath propagation (receptions of multiple copies of the original signal
−∞ 2πσ 2π shifted in time)
-2T -T 0 T 2T
• Noise and spurious signals, e.g. from other GSM emitter using the same or an
adjacent channel (= co-channel or adjacent channel interference)
•Basically Φ(t) is a smoothed π/2 step in order to gain a more narrow spectrum. • The GSM Standard does not specify which demodulator implementation is to be
•GMSK is a compromise between spectrum efficiency (about 1 bit /Herz) and used, but requires certain minimum performance constraints. E.g. capability to
demodulation complexity. cope with two multipaths of equal power received at an interval of up to 16 µsec.,
•The considerable spectral overlap considering the channel separation of 200 kHz i.e. almost 4 bit periods.
leads to the necessity of frequency planning, in order to separate geographically • To achieve this an equalizer is needed. Typically Viterbi maximum likelihood
Adjacent frequencies. estimation is implemented.
98 100
25
1.7. Signalling Transfer 1.7. Signalling Transfer
1.7.1. Basics (continued)
•Most functions in GSM are involving distant machines, which have to
communicate with each other •Relaying: messages between distant nodes are transported via “relay nodes”
•This chapter describes how these messages (or signalling information) are between distant machines.
transported from one machine to another. •Relay nodes :
•The next chapter will describe, what these messages do, what they trigger etc. • … sometimes adapt messages (format , encoding etc.) to the interface
•Message sending is triggered by an event and message reception triggers again requirements,
other events. •… route messages to the correct output directions,
•A typical message consists of: •But handle the data in a “transparent way”. “Transparent” data or message in
•Message type= indication what reaction the message will trigger this context means: the relay node does not read or interprete the message (“it
•Qualifying information= mandatory or optional parameters. does not need to understand it”)
•Tasks pf transmission protocols (link layer functions):
•Delimitation of bit streams. •Slightly more complex case:
•Error protection… •Intermediate node is triggered by the reception of a messages from node A to
•Organisation of message flows and … transmit a message to node B, containing part of the information carried by the
•… their routing. original message.
•This is called “Protocol Interworking”
101 103

1.7.2. Linking
1.7.1. Basics
•The 3 different protocols on link level have very similar functionality.
•LAPD (= Link Access Protocol for ISDN “D” channel):
•In GSM each segment of the transmission path bears its own protocol. Whey so
•Adapted from ISDN
many different ones, if they all serve the same basic needs …?
•Between BTS and BSC
•Optimisation, especially on the radio path.
•LAPDm
•Reuse of existing protocols, especially CCITT Signalling System 7.
•GSM specific, optimised for air interface
•History: different interfaces were developed by different standardisation
•Between MS- BTS
groups…
•Using FACCH or SACCH
•MTP 2
•Messages may be exchanged between contiguous entities like:
•Level 2 of SS7 protocol
BTS- BSC, BSC – MSC, SIM – ME (Mobile Equipment)
•Between BSC-MSC, MSC/VLR/HLR-SS7 network
•Exchange between NSS entities (MSC/VLR, GMSC, HLR/AuC, EIR) are typically
handled over intermediary nodes which are part of the worldwide SS7 network.
•Physical lines between all NSS nodes would be excessive, expensive and not
necessary.
102 104
26
1.7.2.1. Structuring in Frames
1.7.2.2. Segmentation and Re-Assembly (continued)
•In signalling the “atomic” unit is the “frame”.
•In MTP2 and LAPD a frame is (like in HDLC, from which both protocols are •The maximum frame length at the air interface is too short (21 or 23 octets).
derived) start and end with a “flag”. •Therefore segmentation and message reassembly is defined for LAPDm.
•“More” bit is signalling that further frames are coming.
Flag
Flag
(frame start)
(frame end) Header and trailer of
Upper layer message each link frame
01111110 Frame Content 01111110
1 Segmentation Fill bits
•To prevent false starts and ends, a mechanism (“0 bit insertion” after 5
1
consecutive 1 is introduced in order to disguise the flag pattern, if it appears inside
1
data. 1 time
•Advantage of flag mechanism: frame content may have different length.
1 1 1 1
•Difference on the air interface: for LAPDm the flag was not needed, as each frame
fits in one physical block of 23 octets length in case of TCH (FCCH signalling). Re-assembly
•In case of SACCH, 21 octets are used, as 2 octets are needed for timing advance Upper layer message
and transmission power control)
105 107
1.7.2.1. Structuring in Frames(continued) 1.7.2.3. Error Detection and Correction
•The effective information may be smaller, than 23 or 21 octets, •Error Detection:

•… so a length indicator is introduced in each frame •LAPD and MTP2 use the HDLC scheme,
•…and unused octets are filled with “00101011” (this was chosen in order to •consisting in adding 16 redundancy bits, called Frame Check Sequence (= FCS)
avoid similarity with FCCH). •Generator polynomial= x16 + x12 + x5 + 1
•LAPDm on the radio path does not need additional error detection, as this already
is part of the physical layer.
1.7.2.2. Segmentation and Re-Assembly
•The maximum length of frames is generally limited to ease the dimensioning of
•Purposes of error detection:
buffers in the system. •Information on the likelihood of residual errors in a frame, in order to ask for the
•When the maximum length of a signalling message is exceeding the frame length, repetition of the the frame
than the message must be segmented and transmitted over several frames. •Link quality monitoring in order to trigger alarms, if certain thresholds are
•No segmentation needed on exceeded.
•A interface: maximum length of frames is limited to 272 information octets (plus 6
octets for frame control, excluding flags). So all messages have to fit into this size ! •Link Quality monitoring in SS7 :
•Abis : message limitation to 264 octets (excluding flags), which corresponds to •SS7 links are never inactive. Special fill frames are send, if there is no information.
260 octets of upper layer information. •Link is declared out of order, if error rate exceeds e.g. 4* 10-3
106 108
27
1.7.2.3. Error Detection and Correction (continued)
•Window size (see next figure):
•Link Quality monitoring on the GSM radio path: •Size K of a sending window = number of frames which can at any given time be sent and not
•SACCH channel is used for quality monitoring. yet acknowledged.
•A counter is incremented and decremented according to the validity of a block. •Window size K must be high enough to allow a sender to transmit messages without waiting
•Link failure is reported, when the counter reaches Zero. for the acknowledgment delay.
•The initial value of the counter RADIO_LINK_TIMEOUT is set by operator. •The frames of the sending window have to be stored at sender side till they are acknowledged.
•Numbering Cycle
•Frame acknowledge and repetition function: •of LAPD and MTP2 = 128
•LAPD, LAPDm and MTP2 use backward error correction as HDLC: •of LAPDm = 8, in order to reduce the size of the frame header.
•Non-acknowledged mode: frames are transmitted once, whatever the outcome
at the receiver side. •Window size of LAPDm = 1,
•Acknowledged mode, ensuring correction of erroneous frames by repetition. •in order to simplify the protocol.
•The non-acknowledged mode is e.g. more adequate for recurrent measurement •Window size 1 corresponds to a simple send-and-wait protocol.
messages send by mobiles, as a lost message does not harm and a repetition of an •In case of TCH/8 used for signalling, performance does not suffer from this
old measurement value would not render the latest information. simplification, because this channel is of basically alternating nature.
•In case of the other channels, transmission of signalling messages will be additionally
delayed when several frames are send in a row, due to window size = 1
109 111
1.7. Signalling Transfer 1.7.-1 Window mechanism for acknowledgement

1.7.2.3. Error Detection and Correction (continued) Sender Receiver
0 7 0
6
•Acknowledgement and repetition is based on a cyclic frame numbering: 1
•In LAPD and LAPDm the acknowledgment is done by the receiver transmitting 1 lost 5
the number of the expected next frame to the sender in the indicator N(R).
4 3 2
•In MTP2 the number of the last frame correctly received is transmitted back to the 6
7 0
2 7 0 Frame 2 has been successful-
Ack.0 6
sender. 5 1 1 ly received, but the time win-
5 dow can not be changed, as
•In any cases the sender repeats non acknowledged frames. 4 3 2 1 4 3 2 frame 1 is still missing.
•The total number of repetitions is limited in order to avoid endless loops.
•Repetition is triggered by the 6 7 0
sender, if 5 1
Sender Receiver When the ack. for frame 2 7 0
•it receives an acknow-
0 is received, the send window 6 4 3 2
ledgement for a frame Supervision 0 acknowledged
is shifted from 1 to 3 5 1 Ack.2
which is not the last timer 1 1 expected
lost
4 3 2
one send or
2
•when it doesn’t receive 0 acknowledged
Timer 1 expected Windows (here red figures) represent a sliding set of contiguous frames, which can be either:
an acknowledgement Expiry (1) 1 •sent and not yet acknowledged (sending window) , or
after a certain time Timer 2
2 acknowledged
Expiry (1)
3 expected •accepted for reception (receiving window) at a given moment

110 112
28
SABM 1.7.2.4. Multiplexing (continued)
•Acknowledge mode setting procedure:
Initialisation/resetting of context on both UA •The only case on the air interface, where real independent message flows are transmitted
sides of an interface in acknowledged mode. simultaneously with acknowledgment and repetition (see table): TCH/8
SABM = Set Asynchronous Balanced Mode 0 •TCH/F was reserved for speech and data connections, no pre-emption for SMS …
UA = Unnumbered Acknowledge. 1 Numbered frame •In consequence transmission of SMS is slow: 80 octets/sec or 600 bit/sec.
transmission
2
•Multiplexing on Abis interface:
“SAPI” Type of flow
•In LAPD exchange of upper layer information can only start after such an exchange. •Additional to the radio signalling
•In LAPDm : SABM carries a “piggyback” message which is repeated in UA answer. Procedures, the Abis interface also carries 0 Radio signalling
A flow dedicated to the operation and 62 Operation and maintenance
•Acknowledge mode release procedure: Maintenance of the BTS 63 Layer 2 management
•Normal release of a link Numbered frame •… and Layer 2 management flow.
•No piggybacking is allowed transmission
•At any time an unacknowledged frame of info.
may be send. DISC
When no frame is pending: “fill frames” are send
UA
consisting of UI frames (“Unnumbered Information”)
U.A.Hermann: GSM U.A.Hermann: GSM
4/2/2003 0 113 4/2/2003 115

1.7.2.4. Multiplexing
•The link layer offers the possibility of multiplexing independent message flows on the same
channels: 1.7.2.5. Flow Control
•Problem: ordering of frames between them is not guaranteed and
• …window mechanism applies to each flow in a separate manner. •Processing and buffering capacities of implementations are typically sufficient to cope with
•Solution: each frame contains an address in order to separate the flows. the maximum throughput of a given link.
•On LAPD this multiplexing is e.g. used for point-to-multipoint installations. •However in case of resource sharing: the available resources are typically smaller than the
sum of the maximum capacities for each flow.
•LAPDm: on the TACHs this multiplexing is provided as well, even so they are only Point-
to-Point connections: •Flow control has to prevent, that the overall system capacity crashes to 0 due to an overload.
•On the air interface two independent message flows can exist independently:
Transfer of signalling (SAPI= 0) and SMS (SAPI= 1). •So flow control along the transmission line is need:
•Both are distinguished by SAPI (= Service Access Point Identifier), which are the link •“stop-and-go” control using 2 commands
identifiers transmitted in the protocol. •Provided by LAPD, MTP2 , not LAPDm
•Not all channels are suitable for all combinations of the 2 SAPIs:
TCH/F TCH/8 SACCH
Signalling (SAPI0) Ack.mode Ack. mode Non-ack.mode
SMS (SAPI3) - Ack.mode Ack. mode
114 116
29
1.7.2.6. Summary: LAPD and LAPDm Frames 1.7.3. Networking
•Link protocols described before enable exchange between 2 entities, which are directly,
Frame Frame Type Meaning Role
physically connected.
SABM Unnumbered frames Set Asynch.Balanced Mode 1st frame to set-up acknowledged mode •In many cases however application protocols involve entities, which are not directly
DISC Disconnect first frame to release ack. Mode interconnected.
UA Unnumbered Ackn. Ack to e.g. the above 2 frames
DM Disconnect Mode Response indicating disconnected mode •For this purpose different mechanisms are available:
•“Elementary links”: are single links on the route between start and destination of a
UI Unnumbered Information Information frame (non-ack.mode)
message.
I Info. transfer frames Information Information Frame (ack.mode) •An elementary link may be used for a number of different network connections
RR supervisory frames Receive Ready “you may go on” (flow control) between potentially different start and end points.
Also used for acknowledgement
•Routing is done by 2 different mechanisms:
RNR Receive not ready “you should stop” (flow control) •“Datagram”: each message is analysed on its arrival
REJ Reject Negative acknowledgement •“Virtual Circuit”: the route is established by the first message and the following
FRMR FRaMe Reject Error back-reporting messages follow the same route.
RNR and FRMR are not used in LAPDm •Multiple parallel connections between the same entities are generally possible.
•Tags with addresses are used to discriminate between the different message flows
117 119

1.7.2.6. Summary: LAPD and LAPDm Frames (continued) 1.7.3.1 Networking in the BSS
1.7.3.1.1. The Mobile Station Point of View
•TEI = Address for destination Terminal, because LAPD is point to multipoint •The MS addresses different network entities in its protocols, depending on the application
•The addresses are used by the network for routing.
•N(S) = number of frame (sending side)
•Several parallel user communications may be established in parallel between the MS and
•N(R) = number of expected frame (receiving side) for numbered information MSC (e.g. indication of incoming call in case a call already is established).
carrying frames. •.Protocol Discriminator (= PD) is used in GSM to indicates the application protocol and
thereby to address to which destination a message is send on the infrastructure side.
LAPD
PD Function Origin/destination
Start End
Flag address control information FCS Flag CC, SS Call control management and MS from/to MSC (and
Supplementary services management HLR)
TEI = Address for destination Terminal
N(S) N(R) MM Location and security management MS from/to MSC/VLR
SAPI TEI
RR Radio resource management MS from/to BSC
LAPDm Addr. Contr. information •The BTS is not in this table, as it does not terminate MS protocols.
•PD is inserted by the originator as part of the application protocol and used by the receiver
SAPI N(S) N(R) (e.g. MSC or MS) to distribute the message to the right SW module.
118 120
30
1.7.3.1.1. The Mobile Station Point of View (continued) 1.7.3.1.2. Abis Interface (continued)
• Discrimination between CC and SS messages of different user communications: •Messages on the Abis interface, for which the BTS acts as a transparent relay, are put into
• Done by TI= Transaction Identifier an “envelope” of additional messages.
• Each transaction belongs to a communication. •These messages are of the following types:
• TI is inserted by the originator (MSC or MS)
• TI is used by receiver to relate a message to the right context. From BSC to BTS From BTS to BSC Use
ESTABLISH REQUEST ESTABLISH INDICATION link establishment
ESTABLISH CONFIRM
1.7.3.1.2. Abis Interface
DATA REQUEST DATA INDICATION acknowledged info. transfer
• In principle the BTS can be considered as a remote radio link entity of the BSC. UNIT DATA REQUEST UNIT DATA INDICATION Non acknowledged
• Many different messages flow over the Abis IF, belonging to information transfer
• BTS – BSC communication, RELEASE REQUEST RELEASE INDICATION Link release
• Communication of MS with BSC, MSC, HLR etc. RELEASE CONFIRM
• Communication with TRXs (Transmitter/Receiver Unit) inside the BTS.
ERROR INDICATION Link error notification
• In order to reach different message destinations, each message on the Abis inteface
carries a “message discriminator” with complementary data. (see next table).
• So there are 4 different message groups transmitted via the Abis interface
121 123

1.7.3.1.2. Abis Interface (continued) 1.7.3.1.3. A Interface between BSC and MSC
Message discriminator + Communication Use •DTAP (Direct Transfer Application Part) = message flow to MSC.
complementary data end nodes •BSSMAP ( BSS Management Part)= message flow to BSC.
•SCCP (Signalling Connection Control Part) is an SS7 protocol, used to route messages to
Radio Link Layer Mngmt. + MS- BSC or Relay of radio path messages particular MS or to BSC.
Channel reference + beyond transparently through the BTS
Radio link reference BSSMAP DTAP
Dedicated Channel Mngmt. + BTS- BSC Interworking for a given TACH
Channel reference
Distribution layer
Common Channel Mngmt. + BTS- BSC Interworking for a given BCCH
Channel reference or PAGCH/RACH SCCP
TRX management BTS- BSC Control of TRX status BSC MSC/VLR
MTP 3
•The “channel reference” determines the MS to be addressed and contains additionally the MTP 2
type of channel (TACH/F, TACH/8, BCCH, etc.) and time slot number.
MTP 1
•“radio link reference” indicates the LAPDm link on which the message is to be send or
received. It discriminates between SAPI 0 and 3 and between TCH and SACCH .
122 124
31
1.7.3.1.3. A Interface between BSC and MSC (continued) 1.7.3.1.4. Networking on MAP/E (continued)
MTP3 features/aspects: •The information fields of these messages contain the information exchanged between MS and
•Management of SS7 network ( traffic, channels and routers) anchor MSC:
•Routing of messages in an SS7 network. In GSM it is only used to route between BSC – MSC •same information as on A interface when transported by a DTAP message or
•Redundancy: a “linkset” of redundant lines may be established for safety reasons. •…on Abis when transported as a Radio Link Layer message or
•“Load sharing”: between different lines of a linkset. •… on the radio interface
SCCP features/aspects:
In GSM only 2 out of several classes of services are used:
PROCESS ACCESS
SIGNALLING
Message
•Basic connectionless mode (class 0): (message from MS) From MS
•Related to system management tasks, like reset or overload indication Anchor Relay
BSS
•Connection oriented mode (class 2): MSC MSC
•Enables separate independent connections to be set up. This is used on A interface to
FORWARD ACCESS
SIGNALLING
Message
distinguish transactions with different MS. (message to MS) To MS
•Connection are only set up when needed and released when not needed any longer, e.g.
for handover, call set-up or location update. •As the MAP protocol is used, the relay MSC has to use TCAP in order to address the different
•BSC and MSC have to store a context per connection in order to be able to map MS. Therefore the relay MSC has to maintain a context for each connection with a MS in order
•messages from/to BTS and the right radio channel to translate between SCCP references (towards BSC) and TCAP references (to anchor MSC)
•from/to MSC using a certain SCCP connection.
125 127

1.7.3.1.3. A Interface between BSC and MSC (continued) 1.7.3.1.5. Summary: Connections in the BSS
DTAP / BSSMAP Discrimination • Structure of protocole used between MS and Anchor MSC for transport of signalling
•The distribution function on top of SCCP adds a small header to the application message messages:
before transferring it to a given SCCP connection. Relay Anchor
•So all messages on the A interface bear a discrimination flag , indicating whether the message MSC MSC
is a BSSMAP or a DTAP message.
BSC
•So the BSC acts as a transit node for DTAP messages between MS and MSC. MAP/E
•BSSMAP messages start or terminate in BSC.
BTS
distribution TCAP
1.7.3.1.4. Networking on MAP/E Mobile “08.58”
SCCP SCCP
Station
•Inter-MSC handover: jf a handover transfers a MS from one MSC1 to a cell of another MSC2,
MTP 3 MTP 3
the original MSC1 stays as the “anchor MSC” in the connection.
•The transport of messages between the 2 MSCs is done via MAP/E, which is part of the MAP. LAPDm LAPD MTP 2 MTP 2
•In this case however the handling is very different, as the relay MSC acts as a transparent Radio
channels
64 kbit/sec ch. MTP 1 MTP 1
router between MS and anchor MSC.
•Only 2 MAP/E messages are needed (see next picture) PROCESS ACCESS SIGNALLING Radio Abis A E
and FORWARD ACCESS SIGNALLING. interface interface interface interface
126 128
32
1.7.3.1.5. Summary: Connections in the BSS (continued) 1.7.3.2. Networking in the NSS
•SS7 standards are used .
• The next picture shows the hierarchical organisation of message flows from MS to MSC: •Routing and addressing schemes are important, as roaming leads to messages exchanged
•Different links, transactions, connections, … between
•Their identifiers, discriminators, addresses, references, … • different networks,
• operated by different companies,
• The hierarchies are shown as nested boxes. • in different countries.
• 4 different MS are having ongoing calls in parellel in this example. 1.7.3.2.1 The SS7 Network Protocols
•2 network levels in SS7:
•For MSa all levels of detail are shown for •Lower level to build national networks: based on MTP3
• the 2 different calls in progress: TI= and b on PD= CC, on SAPI=0 •Higher level for interconnecting all national nets to a global net: SCCP
•… and 1 SMS transaction (TI= a on SAPI=3) Reason: it is much easier to manage routing tables covering one network (addressing of
entities owned by one company), than many foreign networks.
•MSa and MSb use the same TRX, but different SCCP connections on the A interface •2 levels of addressing correspond to these 2 network levels:
•SPC (= Signalling Point Code) is used in MTP on national level: each message contains
•2 different TRXs are used in the BTS for the different calls. the SPC of the destination.
•“Global Title”= higher addressing scheme for identifying any SS7 point worldwide.
In GSM it is used in SCCP for addressing of MAP messages between NSS entities.
129 131
1.7.-1 Connection Identifiers in the BTS

MS BTS BSC Relay MSC Anchor MSC 1.7. Signalling Transfer
BSS MAP 1.7.3.2.1 The SS7 Network Protocols (continued)
PD= RR
2 different addressing schemes in SCCP:
PD= MM
•If bound for a destination in the same national network: MTP addressing information is
TI= a sufficient. The SPC is included as the address at the SCCP level.
TI= b
•If bound for a destination in another national network: “Global Title” must be used:
MS a PD=CC
DLCI: SAPI= 0 •Global Title may be any number without relation to SS7 (e.g. PSTN number (E.164), data
Link: SAPI= 0
number (X.121), GSM subscriber number (IMSI, E.212), etc.)
Link: SAPI= 0
•It contains no routing information,
TI= a
Link: SAPI= 3 DLCI: SAPI= 3 •…therefore at least at network border SCCP translation to derive the relevant MTP addr.
Channel Id= N1 DTAP
Channel= C1 SCCP Ref: R1 TCAP reference: T1
national network country A international SS7 network national network country B
MS b Channel= C2 Channel Id= N2 SCCP Ref: R2 TCAP reference: T2
A GA GB
TRX: TEI= T1 B
MS c Signalling
Channel= C3 Channel Id= N1 SCCP Ref: R3 TCAP reference: T3 Point
Signal Transfer
Point (STP)
MS d Gateway SCCP Global title (for B)
Channel= C4 Channel Id= N2 SCCP Ref: R4 TCAP reference: T4
TRX: TEI= T2
Function
A derives GA derives GB derives
Radio Interface A Interface E Interface SPC(GA) SPC(GA) SPC(GA)
Abis Interface
130 132
33
1.7.3.2.1 The SS7 Network Protocols (continued) 1.7.3.2.2. TCAP (continued)
•In GSM the SCCP address (whether global title or an SPC) includes a sub-address (= sub- •Many cases in MAP where important data are only sent once in a dialogue:
system number), which identifies the type of target entity (= HLR, VLR, MSC, or EIR) •This information is than implicit for the rest of the dialogue.
•The context is than created by
•Gateway function : to establish the interworking between the two levels. •TCAP primitive: TC-Begin
•Gateway is part of the national network and the global SS7 network. •TC-Continue
•SCCP function in gateway node receives a message bound for an international destination •TC-End
⇒SCCP function determines from the global title the appropriate international node &
⇒ … forwards message to this node, using international SPC as the MTP address •Correlation of individual commands and responses in a dialogue is managed in “Component”
•This scenario is repeated each time a gateway is passed, till the destination is reached. sub-layer:
•Correlation between a request and answer issued by a MAP entity is not managed by
•SCCP is a “datagram networking protocol”: each message contains an SCCP address. MAP, but by TCAP.
•Consequence: MAP often does not specify a message name as an answer to a request.
•SPC addresses consist of : •This answer is simply contained in the “Return Result” or “Return Error” messages
•Geographical zone indicator linked by TCAP to the “Invoke” component containing the initial message.
•Network indicator within the zone •This linking is done by the transaction indicator contained in each message.
•Point indicator within the network. •E.g.: “Radio Channel Acknowledgement” is an answer to “PerformHandover” message.
•In NSS the capability of SCCP to manage independent connections (as on A interface) is not “Radio Channel Acknowledgement” is carried in the “Return Result” component of the
used TCAP “PerformHandover” operation.
133 135

1.7.3.2.2. TCAP 1.7.3.2.2. TCAP (continued)
•On top of SCCP: MAP uses TCAP (= Transaction Capabilities Application Part”) •Grouping in TCAP:
•TCAP is considered as an application protocol not transmission protocol. •Several operations belonging to the same dialogue can be grouped inside a TCAP
•TCAP provides means to distinguish different message flows. message.
•TCAP in GSM can be modelled in 2 sublayers: invoke •E.g.result of one operation (e.g. acknowledgment of a subscriber authentication) while
•“Transaction” sublayer return result invoking another one (e.g. start of ciphering)
•“Component” sublayer on top component return error
sub-layer reject •TCAP syntax is ASN.1 (“Abstract Syntax Notation 1”)
•Transaction sublayer manages transactions (= dialogues)
end-to-end. transaction
This is an example for virtual machine approach to sub-layer
distinguish several independent flows in parallel on the Begin, continue,end
Abort, unit-data
same transmission means:
•TCAP adds a transaction indicator to each message
•This indicator relates all messages to their contexts.
•So MAP does not need to consider how to link different exchanges concerning the same
context (e.g.. handover). This is done by TCAP.

134 136
34
1.7.3.3. Networking for Supplementary Services (= SS) Management 1.7.3.4. Networking for Point-To-Point SMS
•SS messages are transferred between MS and HLR. •For SMS GSM may interwork with external networks
•The management of SS is performed by HLR, even though the service is normally fulfilled by •SMS are transported between MS and SM-SC (=Short Message - Service Centre)
MSC/VLR HLR was chosen as the single point of control to ensure consistency of data
throughout the network. •SM-SC:
•Not specified in GAM standard,
•SS communication between MS and HLR consists of two “legs” •Possibly even outside a given GSM network.
•BSS (carried as stand alone messages or as part of Call Control) •SM-SC is connected to one or several MSCs, which act as gateways between GSM and
•NSS using MTP, SCCP, TCAP SM-SC, called
•MSC/VLR acts as a relay between MS and HLR: e.g. analysing whether messages from •SMS-GMSC: in case of mobile terminating SMS
HLR must be transmitted to the MS or not. •SMS-IWMSC (InterWorking MSC) : in case of mobile originating SMS.
•MAP/I (see next picture ) is the application protocol between MS and HLR: •Transportation specification:
•Between MS and MSC : its messages are carried encapsulated either inside CC messages •Gateway to SM-SC : complete stack is not part of GSM standard.
or inside messages using SS protocol discriminator. •MS to Gateway is part part of the GSM standard.
•Between MSC and HLR: SS7 stack is used (messages are distinguished from other •SM-TP (“Short Message transport Protocol”) between MS and SM-SC is an end-to-end
messages by message type). protocol incl. features of an application protocol (see next picture)

137 139

1.7.3.3. Networking for SS Management 1.7.-2. Protocol architecture for the transport of short messages in GSM
•Messages belonging to different MS are distin-
guished on: SM-SC
MSC/VLR HLR
•MAP leg: by use of TCAP,
•A-Interface: by SCCP connection, SM-TP
•Air interface: by the radio channel. MAP/I
SM-RP MAP/H
•Several SS management transactions may exist in RIL3- CC
parallel. They are distinguished on: . TCAP SM-CP TCAP
•MAP leg: by use of TCAP, .
. SCCP SCCP
•BSS leg: different TIs .
MSC/VLR has to translate between both . MTP •In the next chapters the BSS- MTP
and the NSS- leg will be analysed.
•As mobile originating (= MO) and

MSC/VLR SMS-gateway
Mobile Terminating (MT) SMS use the
same mechanisms, but in opposite directions, only MO SMS is described.

138 140
35
1.7.3.4.1 BSS leg 1.7.3.4.2 NSS leg
•The lower layers for message transfer have been described in chapter about linking: •Between MSC and GMSC the short messages are transported like signalling messages:
•Radio path: acknowledged-mode SAPI 3 on TCH/8 or SACCH •Using SS7 stack supporting MAP (MTP, SCCP, TCAP)
•Relay protocol on Abis interface between BSC and MSC •On top of this the MAP/H: providing the same functions as SM-RP in the BSS leg.
•DTAP on A interface •The three messages of MAP/H can be directly mapped on SM-RP (see picture).
•SM-CP (= Short Message Control Protocol) is a very small and simple protocol:
•Command/answer procedure with 3 message types.
MSC VLR SMS-gateway
•No reference to correlate messages, as operation is “send and wait”.
•CP-Data message contains higher level information, like SMS itself, upper layer RP-Data Forward Short Message
acknowledgment or error report. message ref (TCAP component reference)
Originator sm-RP-OA
TP-message sm-RP-UI
CP-Data RP-ACK Forwarding Acknowledgement

SMS-gateway [RP-message] message ref. (TCAP component reference)
or or
CP-ACK
RP-Error Forwarding Error
CP-Error or message ref. (TCAP component reference)
(cause) cause error type
SMS-gateway
141 143
1.7. Signalling Transfer 1.8. Radio Resource Management

1.7.3.4.1 BSS leg (continued)
Major difference between a radio mobile telecommunication network and a network
with fixed links:
•SM-RP (= Short Message Relay Protocol) is managing references and addressing. Three
messages are defined: •Management of access resources:
•In fixed systems a dedicated communication medium (“wire”) between
•RP-Data: carrying the message itself.
•RP-ACK: transporting the acknowledgment terminal and infrastructure.
•RP-Error: error indication. •In radio systems: communication medium (i.e. radio spectrum) is precious, so
•Messages are correlated to each other by a 1 octet message reference: so it is possible to only allocated for a call.
send parallel messages on this level. •In ISDN e.g. a signalling channel is always ready for use by a terminal. In
•Addressing: GSM however the paging and the random access channels are the only “lines”
to the infrastructure in idle mode.
•For MO SMS: in SM-RP RP-Data message the destination address is included.
•For MT SMS: in SM-RP RP-Data message the origin address is included. •Handover:
In each case it is the SM-SC address.
•Problem does not exist in fixed networks.
•In radio systems: Complex measurements and decision procedures are required
to keep the quality of communication.

142 144
36
1.8. Radio Resource Management 1.8. Radio Resource Management
Basic concept of GSM: Anchor MSC 1.8.1.1. Concept of RR Sessions

•If a handover transfers a MS from one MSC to another, the original MSC stays in
•For location updating, SMS transfer, SS management: an RR session consists of minimum:
control of the call.
•Means to transmit signalling between MS and anchor-MSC.
•Big advantage: single point of control for all aspects of the call, like e.g. charging. •Incl. a dedicated radio channel.
•Relay MSC: MSC next to BSC (even if there is only 1 MSC active) •References to manage the session on the BTS-BSC and BSC-MSC interface.
•BSS resources to monitor radio connection and to take handover decisions.
•Canonical architecture for each call:
•For circuit type user data, additionally
•a complete circuit connection between MS and anchor-MSC…
Relay-MSC Anchor-MSC
•…additionally to the signalling connection.
SAPI 0 LAPD BSC SCCP Relay-MSC

link connection connection
BSC MSC VLR MSC VLR
MS Worldwide
BTS telecom net MS
GSM BTS MSC VLR
Terrestrial Channel TRAU Terrestrial Channel
Radio Channel (16 kbit/sec.) (64 kbit/sec.)

145 147

1.8.1.1. Concept of RR Sessions (continued)
1.8.1. RR Functions
•Different characteristics of an RR-session, which may change during a session:
•3 different, standard dedicated channels exist: TACH/8, TACH/H and TACH/F.
Items for analysis in this chapter:
•For data: different transmission modes.
•Different ciphering algorithms.
•Requirements of Radio resource Management
•Distribution of tasks between involved machines •Definition: An RR session is the period of time when a MS is in dedicated mode between 2
•Properties of the transmission chain between MS and MSC. periods of idle mode.
•Handover: Measurement and HO decision. •An RR session can be used for several calls (so called CM –transactions)
•Management of transmission power, •Begin and end of CM-transactions relate to usage of transmission, but are independent
•Management of timing advance. of an RR session, which relates to the movement of the MS (handovers).
CM transactions
•Management of the radio channels on the radio interface.
Anchor MSC RR-session

Relay MSC
BSC RR-connection
BTS
Intra-BSC inter-BTS handover or change Inter-MSC handover
of channel on same BTS Inter-BSC handover
146 148
37
1.8. Radio Resource Management
1.8.1.2. Initialisation (continued)
1.8.1.1. Concept of RR Sessions (continued) 1.8.1.2.2 . Paging and Discontinuous Reception
•Context changes: •Paging procedure:

•during an RR session the RR contexts in the MS and the anchor MSC are permanently •Paging is triggered by an incoming call.
kept. •MSC/VLR requests BSS to page in certain cells (location area).
•The contexts in the BTS, BSC and relay MSC are erased and crated new again, each •MSC provides identity of the subscriber.
time there is an handover to a •BSC is managing the PAGCH: grouping and scheduling the paging messages,
•New radio channel inside the same BTS. repeating unanswered messages and sending initial assignment messages.
•A new BTS
•New BSC, •Paging channel may be subdivided into sub-channels :
•New relay-MSC •In order to save battery capacity of MS: only to listen partially to a paging channel, not
So the anchor-MSC is the only stable element in the network during an RR session. all the time.
•Trade off: slightly longer response times.
•This is called DRX (= Discontinuous Reception), has nothing to do with DTX!
•The PAGCH configuration is send on the BCCH (2 parameters):
•there may be 4 to 81 sub-channels
•The MS knows to which channel to listen, as the channels are by definition
mapped to the last 3 digits of the IMSI.

149 151

1.8.1.2. Initialisation 1.8.1.3. Transmission Management
•Definition: Access = The transition of a MS from idle mode to dedicated mode. •In this chapter : details of management of the characteristics of an RR-session.
•Characteristics depend on the chosen service:
•Access is part of the initialisation process. •Decision on characteristics by anchor MSC.
•Access is the same, regardless, whether it is MO or MT. In MT case first a paging of the MS •Transitions are coordinated by BSC. (e.g. according to type of data)
by the BSS happens. •BSS manages cipher mode and DTX.
1.8.1.3.1. Transmission Mode Management

1.8.1.2.1. Access •The set of possible transmission modes differs depending on the type of channel used on the
•Random Access of a MS: radio interface:
•Only 8 bit message content.
•No MS ID in RACCH burst TACH/8 TACH/F TACH/H
•No reason for access is signalled to BTS. Signalling only Signalling only Signalling only
•2 MS might independently send an RACH burst at the same time => BTS may be Speech Speech
unable to decode and answer.
Data 3.6 kbit/s Data 3.6 kbit/s
•Access of an MS ends with an initial channel assignment (called immediate assignment in
GSM): radio channel is allocated to be used by MS. Data 6 kbit/s Data 6 kbit/s transparent
•Access = initialisation of an RR session. Data 12 kbit/s transparent Data 6 kbit/s non-transparent
Data 12 kbit/s non-transparent
150 152
38
1.8.1.3. Transmission Management 1.8.1.3. Transmission Management
1.8.1.3.1. Transmission Mode Management (continued) 1.8.1.3.2. Terrestrial Channel Management
•“Signalling only” mode used for e.g.: •BSC: is setting up and controlling terrestrial circuit from BTS to BSC.
•At the beginning of a call, •Relay-MSC: is allocating terrestrial circuit from BSC or TRAU to Relay-MSC. MSC
•SMS signals the channel choice to BSC, so that BSC can set the right connection in its switching
•Location updating matrix.
•Anchor-MSC to Relay-MSC: initiated by Anchor-MSC using ISDN procedures for call
•Setting up of transmission mode: establishment.
•… mode is chosen by MSC depending on end-to-end service. •TRAU: if the TRAU is on the MSC side of the BSC:
•First the RR-session is established as a “signalling only” connection. The channel of 1. MSC chooses a circuit towards TRAU
this connection is chosen by the BSC, typically an TACH/8 2. Signalling between BSC and MSC
•… than after the transmission needs are clear, the MSC intervenes and changes the 3. BSC BSC controls set up of circuits between BTS and TRAU.
channel type and transmission mode according to user requirements.
•Task distribution between BSC and MSC: Relay-MSC

•MSC commands to BSS the channel type and transmission mode. BSC 2
•BSC chooses the exact channel and coordinates BTS and MS.
•MSC selects the terrestrial circuits : between BSC or TRAU and MSC. BTS MSC VLR
3 1
TRAU
153 155

1.8.1.3. Transmission Management 1.8.1.3. Transmission Management
1.8.1.3.1. Transmission Mode Management (continued) 1.8.1.3.3. Cipher Mode Management
•Procedure for transmission mode management: •Ciphering criteria are determined by the operator (and by export regulations different
•Typically the initial TACH/8 channel for signalling has to be changed to the user ciphering are used in different countries)
required channel (to TACH/F or TACH/H).
•This is “subsequent assignment”: to change a radio channel used by an RR-session •Ciphering is independent from type of transported data.
without changing the cell.
•“mode modification” procedure: if the type of channel is OK, but not the transmission •RR-session is always “clear text”= unciphered, as the network does not yet know the user
mode. identity.
•Handover: above changes may happen in the context of an handover.
•Sometimes subsequent assignment is confusingly called intra-cell handover. GSM •Transition from clear text to ciphered mode
convention however is to use the phrase handover in the context of actions due to •MSC is deciding:
quality or load requirements (why is it done?) •Provides ciphering parameters (mode and user ciphering key Kc)
•Commands change of mode from un-ciphered to ciphered.
•BSC coordinates the change:
•Synchronisation is important: if one entity would e.g. still send un-ciphered and
the other one expects ciphered data, an unrecoverable loss of connection happens,
•BTS and MS are impacted.

154 156
39
1.8.1.3. Transmission Management 1.8.1.4. Handover Preparation
1.8.1.3.4. Discontinuous Transmission (=DTX)
•Handover has 3 phases:
•During DTX radio communication is reduced to a minimum in order to reduce radio •Preparation: important/complex process with heavy impact on QoS & spectral efficiency
interference in the network. •Decision:
•DTX is optional, so it must be managed. •Execution.
•DTX is independently applied for both directions DL and UL.
•DTX only in some transmission modes: 1.8.1.4.1. Handover Purposes
•Speech and non-transparent data: •“Rescue Handover”:
•Not for transparent data: impossible to assess when a user doesn’t need radio connection. •Definition: Call would be lost, if cell is not changed.
•DTX is commanded by the MSC and managed/configured by the BSC. •So QoS is determining element
•Operator can/must optimize DTX behaviour by parameters (e.g. not for MS to MS calls due to •Call reestablishment: extreme form of rescue handover, where communication is lost and
“double clipping” effect). MS attempts to recover with the serving cell.
•BTS derives its behaviour dynamically: •Confinement HO”:
•From MS (UL) •Definition: a HO with the objective to minimize the global interference.
•From TRAU or MSC/IWF in DL. •From interference point of view there is a “best” cell, particularly, if power control is used
•Change of DTX: •“Traffic HO”:
•In UL the MSC can at any moment force MS to use or stop DTX. •Definition: a HO with the objective to unload an overloaded cell.
•In DL changes only possible, when transmission mode changes. •Used e.g. in case of a local “hot spot” cell, e.g. serving a football stadium.
•Traffic HO increases interference and contradicts confinement HO!
157 159
Figure 1.8.-1 Procedure for setting of DTX 1.8. Radio Resource Management
Downlink DTX 1.8.1.4. Handover Preparation
BSC 1.8.1.4.2. Handover Criteria
DTX
decision
•Criteria for rescue HO:
•Measurements from BTS and MS.
BTS MSC VLR •Transmission quality : Bit error Rate (= BER)
MS
DTX settings •Signal level: RxLev.
TRAU
•Propagation delay: timing advance
Uplink DTX •Criteria for confinement HO:

BSC •Theoretically the UL and DL transmission quality between the MS and each neighbouring
cell should be known.
DTX •Practically: downlink path loss (RxLev) as measured by the MS is used typically.
settings DTX
BTS decision
MS MSC VLR •Criteria for traffic HO:
TRAU
•MSC and BSC know load information of BTS
•MSC dictates number of MS to be handed over.
The basic setting, whether or not DTX is to be used, needs only be notified to •BSC first selects those which are soon to be handed over to other reasons (e.g. rescue).
the transmitting end. The receiving unit doesn’t need to know beforehand.
•The HO algorithms are up to manufacturers and operators. Not specified in the standard.
158 160
40
1.8.1.4. Handover Preparation 1.8.1.4. Handover Preparation
1.8.1.4.2. Handover Criteria (continued) 1.8.1.4.3. Measurements (continued)
•Parameters for the HO decision process: • length of monitoring time:

•Static data, like e.g. maximum transmission power of •From end of reception to start of transmission:
•MS 26 intervals of (2 BP – ε), BP (= Burst Period)= 577 µs, ε= timing advance,
•Serving BTS these intervals are too short
•BTSs of neighbour cells •From end transmission of to start of reception :
•Real time measurements performed by MS: 24 small intervals of (4 BP + ε), and one “long” interval of (12 BP + ε),
•DL transmission quality (raw BER) This interval is due to the unused slot in the 26 slot cycle.
•DL reception level on current channel.
•DL reception level from neighbour cells. •MS requirement : either switch synthesizer to new monitoring frequency in less than 1 ms or
•Real time measurements performed by BTS: use 2 frequency synthesizers
•UL transmission quality (raw BER) •BTS requirement: “beacon carrier” must be transmitted all time on full power, even if no
•UL reception level on current channel. user data are transmitted! => MS is able to find, synchronise on and measure BCCH carrier of
•Timing advance. neighbour cells:
•Traffic considerations, cell capacity and load •MS receives a list of beacon frequencies to be monitored from BTS.
•MS pre-synchronizes on the FCCH and SCH of these beacon frequencies.
•GSM requirement for easing HO: MS must constantly be pre-synchronized on all
neighbour BTS.
161 163

1.8.1.4.3. Measurements 1.8.1.4.3. Measurements (continued)
•Measurement reporting: • Mechanisms of pre-synchronisation:

•Minimum reporting rate in GSM = once per second. •Once every 26 slot cycles (= every 120 ms) on a TACH/F an “idle slot” (= long interval =
•MS reports for serving cell and up to 6 neighbour cells. about 6 ms) gives a time window for the MS to perform neighbour station monitoring
•Measurement reporting of MS = 130 bit /s (more often with TACH/8): MS looks for FCCH and subsequent SCH.
•Reports are carried on SACCH, which has 260 bit/s capacity.
•So reporting frequency can be doubled, if no other signalling is ongoing on SACCH. •FCCH and TACH are “sliding” against each other, as they have different periods:
•Even during DTX the measurement reports are transmitted. •FCCH period of BTS= 51* 8 BP
•TACH period of MS = 26* 2* 8 BP
•Neighbour cells measurements: •So the FCCH cycle is shifted 8 BPs relatively to the TACH/F cycle between 2
•Neighbour cell monitoring happens in MS between transmission of UL bursts and successive idle slots.
reception of DL bursts.
•The length of these measurement periods depends on the channel type. They are shortest •The typical distance of 2 successive FCCH bursts is 80 BP, max. 88 BP.
for TACH/F (see figure):
transmit … •A “long interval” lasts about 12 BP (reception is possible for 9 BPs, rest is used for
“free” intervals during which the
MS neither receives nor transmits About About About frequency stabilisation/setting) Î 11 successive long intervals (11* 26 slot cycles = about
1 ms 2 ms 6 ms 1.2 s) are sufficient for the MS to find an FCCH on a beacon carrier. After each 26 slot
Time available for measurements
receive …
at MS cycle the “idle” window of the MS is shifted 1 slot relatively to the 51 slot cycle of the
4/2/2003 U.A.Hermann: GSM
162
BTS
164
41
1.8.1.4. Handover Preparation
1.8.1.4. Handover Preparation 1.8.1.4.3. Measurements (continued)
1.8.1.4.3. Measurements (continued)
•“PLMN permitted” indication in the BCCH: a screening indicator telling the MS, for
•TACH/8 case: which cells to report measurement results. It is an 8 bit indicator with one bit for each of
•Problem: TACH/8 and FCCH have both 51 * 8 BP cycle time the 8 patterns of NCCs. By this reporting on the cells of a neighbour PLMN can be
•Phasing between TACH/8 and FACCH can be anything. blocked.
•Solution: due to the structure of TACH/8, there are big gaps between the reception of
TACH/8 bursts, which may be used by the MS to listen to neighbour stations, so regardless •The measurement period:
of the phasing, there will always be moments, when 1 of the FCCH bursts can be listened
to. •Measurements are averaged over a measurement period, as single measurements are of
little value due to noise: raw BER are averaged and logarithm of reception levels.
•BSIC (=Base Station Identity Code):
•Measurement period = period of message transmission on SACCH.
•Problem : it might happen, that a MS receives more than one beacon channel using a
given frequency (e.g. in boundary areas to neighbour countries or in case cell planning is •Uplink and downlink periods are simultaneous.
done with very few frequencies.
•Solution: BSIC is transmitted in the SCH as
a “colour code” (like the colouring of maps), 1 23 1 2 •Measurement results of MS may be delayed up to half a second due to transmission delay.
3 In order to report UL and DL measurements synchronously to BSC, BTS buffers its own
so that BTS with same beacon frequency use 2
13 12 measurements.
different BSICs. 3
165 167

1.8.1.4.3. Measurements (continued) 1.8.1.4.3. Measurements (continued)
•BSIC is used for many cases, when distinction between cells is required: •Interaction with DTX:
•MS gets from the BTS a list of beacon frequencies to be monitored. •Under DTX, only a minimum of speech blocks are send in order to minimize interference.
In measurement report MS reports BSIC of the monitored cells.
•Screening: network may indicate a subset of BSICs for which no reporting shall be •In order to have some blocks to perform measurements on, it is required, that 12 bursts are
done, because the cells are blocked for handover. send in each reporting period:
•Prevention of spurious reception of RACH bursts by the BTS: it might happen, •4 SACCH bursts (forming a coding block)
that 2 cells receive the RACH burst of the MS. To prevent this , the RACH burst is •8 bursts of TCH containing the SID (= SIlence Descriptor) frame in order to refresh
“exclusive-ored” with the BSIC, so only the right cell decodes the burst comfort noise.
successfully. •(on TCH/8 only 8 bursts per measurement period are send Î DTX is not applicable )
•In idle mode the MS reads the BSIC to make sure, that it is still monitoring the same
cell. •2 sets of measurements are done by MS and BTS on TACH/F:
•Full set of all 100 bursts (better due to longer averaging).
•Between operators inside a given country there are no problems of undue overlapping of •Subset of 12 bursts (available in case of DTX ).
beacon frequencies, as they have per definition disjoint frequency allocations. •For each measurement MS and BTS report whether DTX was used, so that the BSC
can discard the full measurement in this case.
•Between operators of different countries with common borders, a NCC (= National
Colour Code or “PLMN colour code”) is proposed, which are the first 3 bits of the BSIC
166 168
42
1.8.1.4. Handover Preparation 1.8.1.5. Power Control and Timing Advance
1.8.1.4.3. Measurements (continued) 1.8.1.5.1. Power Control (continued)
•The PWRC Indication: •Algorithm and functional split of power control:

•Manufacturer options: implementation in BTS or BSC.
•Complication: •BSS is in control and computes power levels based on own and MS measurements.
•A frequency hopping TACH may use time slots (not TN= 0) on the beacon frequency •Strategy of control algorithm: minimise power till RxLev and RxQual are just acceptable.
as one of the frequencies of the hopping sequence.
•The beacon frequency must be transmitted with constant (full) transmission power. •Initial values:
•ÎResult: power control is only applied to a subset of the used bursts. Î This means •Power level for random access= power for first transmission on dedicated channel= fixed
inaccurate reception level measurements. per cell and communicated to the MS in a cell via BCCH.
•If MS max power is below, than MS transmits with full power.
•Solution:
•PWRC (PoWeR Control indicator) is send on connection level by the BTS. •Power control speed:
•Effect: MS discards reception level measurements on beacon frequency, … •Max. 2 dB each 60 ms
•… in case the following conditions are met: •… so a big jump will not be completed before the next command arrives.
•Channel hops on at least 2 different frequencies.
•1 of those frequencies = beacon frequency.
•DL power control is used.

169 171

1.8.1.5. Power Control and Timing Advance 1.8.1.5. Power Control and Timing Advance
1.8.1.5.1. Power Control (continued)
Power Control and timing advance are strongly interrelated with the RR management
functions. •Procedures:
•MS transmits measurement results to BSC, maybe with pre-processing in BTS.
1.8.1.5.1. Power Control •BSC commands transmission power to MS and BTS.
•BSC indicates to MS power level for initial assignment and channel transition .
•BSC indicates to BTS the initial power level when channel connection is initialised.
•Objective of Power Control (like DTX) is to decrease interference (and to a smaller degree to
save battery power)
•UL and DL power control can be applied independently from each other and for each MS. BSC
•UL power control: change of values
BSC
•Range: 20 – 30 dB, (depending on MS class)
•Step: 2 dB initial
values
•Minimum: 13 dBm (= 20 mW)
•DL power control (manufacturer dependant): BTS
•Range: about 30 dB, (manufacturer dependant) BTS
•Step: 2 dB
•Minimum: 13 dBm (= 20 mW) MS
•Power control= network option, but mandatory for MS ! measurements
•Power control = managed by BSS
170 172
43
1.8.1.5. Power Control and Timing Advance 1.8.1.5. Power Control and Timing Advance
1.8.1.5.2. Timing Advance (= TA) 1.8.1.5.2. Timing Advance (= TA) (continued)
•The Problem: • Arrival time offset at MS = transmission time offset between the two BTS -
•TDMA scheme of GSM does have very small guard bands between subsequent bursts ( propagation time 1 – propagation time 2 ) (see green area in picture before)
received by BTS. • Transmission time offset between 2 BTS = 0 by definition for synchronised BTSs
•Far away MS would therefore transmit into the subsequent reception time slot. • So MS can compute the new TA2 = TA1 – 2( prop1 – prop2)
• BTS cannot do this calculation: it does not know (prop1 – prop2) .
•Solution: MS advances its transmission time (which at the first instance was derived from its • … so MS starts transmitting with TA= 0 before switching to normal transmission
reception of bursts), by a time as commanded by BSS. with TA2. This enables BTS to assess the propagation times.
•After dedicated connection has been established: BTS measures time offset of received bursts 3. Neither MS nor BSS can calculate TA beforehand:
and feeds TA via SACCH back to MS. • Happens at HO or initial assignment (= IA) between 2 non-synchronised cells.
• So in both cases ( HO & IA) MS is not allowed to send normal bursts
•TA varies from 0 to 233 µs, corresponding to max. 35 km cell radius, coding 0 … 63 immediately as in synchronised case. MS must first go through random access
•Guard time for access bursts limits delay to 220 µs. sequence in order to allow BTS to calculate and signal TA.
•Guard time between Tx and Rx for implementation of MS with only 1 synthesizer is limited… • So MS sends RACH burst with TA=0. BSS measures ∆T (= 2 * prop.time)
• Disadvantage: this procedure lengthens the HO process and the communication
•Extended Cells (coastal areas)= more than 580 µs guard time by only using channels with even interruption.
TN. TN= 0 must be used for BCCH !

173 175

1.8.1.5. Power Control and Timing Advance 1.8.1.6. Radio Channel Management
1.8.1.5.2. Timing Advance (= TA)
Two aspects of managing the set of channels in a given cell:
• Different cases, depending on whether MS and BTS know the new TA up front: • Long term: determining and configuring the channel set up Îpart of cell planning.
1. MS and BSS know TA up front: • Short term: dedicated channel allocation management Î part of the dynamic control
• Happens e.g. at subsequent assignment. processes.
• MS just uses the old TA value.
• BTS receives old TA value as the new one from BSC (BTS does not know, that Task allocation:
the old and new connection are to the same MS!) • MSC just indicates channel type
2. Only MS, not BSS can assess new TA beforehand: • BSC controls radio channel management
• Happens if HO is done between synchronized BTSs. • BTS executes commands of BSC
• MS measures difference between arrival times of bursts from the two BTS (part
of pre-synchronisation). 1.8.1.6.1. Cell Channel Configuration
BTS 2
n Tx BTS2
• Traffic management mechanisms allow operators to change channel configurations without
BTS 1 Tx BTS1 n disturbing ongoing traffic.
prop2 = time difference Configuration of access channels:

as measured by MS
prop1 prop1
prop2 • Depending on the radio spectrum allocated to a cell, capacity requirements for access
= time offset
between 2 BTS
channels vary (RACH, PAGCH)
174 176
44
1.8.1.6. Radio Channel Management 1.8.1.6. Radio Channel Management
1.8.1.6.1. Cell Channel Configuration (continued) 1.8.1.6.1. Cell Channel Configuration (continued)
• 5 different access channel configurations: Changes in the Frequency Configuration
• The MSs are distributed CCCH Number of RACH burst PAGCH message • Frequencies allocated to a cell may change dynamically in time Î frequency redefinition
on the up to 4 different capacity MS groups Rate (bursts per rate procedure
carriers in 4 different (equiv. in TACH/F) second) (messages per second) • Changes in frequency allocation are even possible for FH. Specific mechanisms have been
(other half only for
groups depending on 1/2 4 TACH/8 usable 1 114.7 12.7 developed:
the channel structure • Precisely synchronised change of frequency parameters to MS and BTS for all
(see column 2). 1 1 216.7 38.2 connections
2 2 433.4 76.5 • Precisely timed channel assignment: initial assignment or subsequent assignment for
• MS finds this info on 3 3 650 114.7 HO.
the BCCH • MS view of frequency change: just a normal channel change.
4 4 866.7 152.9 • BSS view: several MS and BTS have to be closely synchronised:
• This access channel structure may change in time, problem : MSs listening to a given 1. OSS informs BSC about required modification of frequency organisation.
channel 2. BSC determines time for transition instant and makes sure all affected MS have time
to receive the related command.
In case of allocation of channels before the actual transition: MS are informed to
perform transition at the commanded time.

177 179

1.8.1.6.1. Cell Channel Configuration (continued) 1.8.1.6.2. Dedicated Channel Allocation
Organisation of PAGCH • Infrastructure chooses a given radio channel out of a pool of idle channels in 3 different
cases:
• PAGCH is organised in 2 parts on a CCCH: • Initial assignment: MS is in idle mode and e.g. user wants a call or location update
• Several paging sub-channels, each one allocated to a certain sub-population of MS. happens.
Initial Assignment messages can be send as well on these sub-channels. • Subsequent assignment: when a different channel is required due to change of
• Possible sub-channel reserved exclusively for assignment messages. communication needs, e.g. from TACH/8 to TACH/F.
• Handover.
• PAGCH configuration is broadcast on BCCH to MS. So they know where to listen for calls.
Allocation Strategies
• PAGCH config. May change dynamically, without MS to loose calls.
• MS view is simple: channel assignments are just orders to start transmission & reception.
Traffic Channel configuration • BSS view: first choice of channel by BSC, than transition.
• Optimised algorithms for allocation:
• Set of traffic channels may be changed dynamically in order to meet traffic demand. • E.g. whilst the telephone is ringing, a TACH/8 is sufficient, TACH/F can be allocated
• E.g. one TACH/F may be changed to 8 TACH/8. when call is put through. So several strategies are possible…
• This is controlled by O&M or under BSC control. • Very early assignment (VEA): allocate TACH/F at initial assignment, if usage of this
• Choice is open for manufacturer or/and operator channel is probable.

178 180
45
1.8.1.6. Radio Channel Management
1.8.1.6.2. Dedicated Channel Allocation 1.8.1.6. Radio Channel Management
1.8.1.6.2. Dedicated Channel Allocation (continued)
• Early assignment (EA): allocate TACH/8 first, than TACH/F as soon as need for this
channel is clear.
Interference based channel allocation
• Off Air Call Set Up (OACSU): TACH/8, till called party answers call, than switch to
TACH/F. Disadvantage: lower user comfort as time without contact is noticeable.
• BTS measures UL interference of idle channels Î noise level is known by BSS
• Î BSS selects best channels first for allocation in order to minimise interference.
• Trade offs:
TACH/F • Congestion due to interference:
• VEA is fastest due to
TACH/8 • Problem: traffic in one cell is interference in neighbour cell.
highest bandwidth TACH/F
• Î In case all channels in one cell are occupied, many channels in neighbour cell
• OACSU is most economic TACH/8
TACH/F might be unusable due to interference
spectrum utilisation. Time
• So BSC must not take additional channels into usage, when allowed interference level
• VEA is “overkill” for Access Full Call Called party is reached.
location update. request information answers • This mechanism is used as “dynamic channel allocation”: one cell has more channels
than meaningful in terms of frequency planning, so that high interference with
• Measures in case of overload:
neighbour cells is possible. That means in case of overload, that this cell is “stealing”
• Queuing (user gets voice message from operator)
frequencies from neighbour cells.
• Rejection (occupied tone).

181 183

1.8.1.6.2. Dedicated Channel Allocation (continued) 1.8.1.6.2. Dedicated Channel Allocation (continued)
Queuing Radio Channel Description
• Queuing strategies are left open to manufacturer and operator. GSM standard just provides • For frequency hopping the BSS needs to tell the MS which hopping sequence to use.
means (e.g. indications to be exchanged between entities). • Problem: with 124 frequencies in GSM and 374 in DCS, there are almost an infinite
• Queuing depends on the conditions in which its is applied: number of possible frequency combinations. Encoding of all these possible frequencies
• At initial assignment (IA) : queuing is not applicable, as there is a repetition algorithm would consume too many bits on the air interface.
in IA, so a not answered request would be repeated. • Solution:
• Subsequent assignment: • MAIO (= Mobile Allocation Index Offset) describes the starting point for the hopping
• Disadvantage: user perceives delay in call set up. recurring function.
• Advantage: user would otherwise be rejected. • HSN (= Hopping sequence Number), 64 bit, describes which of a predefined set of
• Handover: complicated strategy, as in case of e.g. rescue HO, queuing might lead to a hopping frequencies to use.
connection break down. • Cell allocation: two step mechanism:
• Forceful termination of calls: pre-emption • 16 octets in GSM 900 transmitted on BCCH indicate which frequencies are used
in the respective cell.
• When BSC send a channel allocation message to a MS, only a subset of these
frequencies is allocated for FH (coded with 64 bit for 64 frequencies)
182 184
46
1.8.2. Architecture and Protocols 1.8.2. Architecture and Protocols (continued)

•Procedure:
•The BTS is the “main performer” of radio transmission. Its radio resource
•BSC decision: outgoing (inter-BSC) HO is necessary.
functions are mainly controlled by the BSC.
•BSC indicates several potential target cells to Relay-MSC (maybe managed by
different BSCs and MSCs)
• The anchor MSC
•“Rescue HO”: indicate several potential target cells, “Confinement HO” only 1.
•…decides, which properties of the transmission chain are to be used to fulfil a
•In case of several targets, the Relay-MSC may try one after the other or decide
given service.
based on its own traffic data.
•…performs subsequent inter-MSC handovers.
•For a cell controlled by another MSC: only 1 target cell at a time is proposed by
the “old” Relay-MSC to the Anchor-MSC.
•The relay MSC :
•Traffic HO:
•… is in charge of subsequent inter-BSC handovers and
•MSC may “force” a BSC to handover a portion of its traffic to another cell.
•…the circuits between itself and its BSC.
•BSC than selects the connections to be handed over and the target cell
•For all other functions the Relay MSC just is relaying messages.
(“candidate enquiry procedure”)
•So in GSM there is a basic conflict between confinement and traffic criteria for HO
decision, as the related data are under control of different nodes.
185 187
1.8.2. Architecture and Protocols (continued) 1.8.2. Architecture and Protocols (continued)
Special aspects of handover: •Functional split inside the BSS. Two basic concepts:
•Central processing of all handover relevant data in the BSC:
•Information needed for handover decision come from: •Advantage: Speed of HO decision, single point of control
•BTS: measurement values (as reported from MS and own measurements). •Disadvantage: High processing load in BSC, high signalling load on Abis.
•BSC: frequency planning and cell layout data. •Pre-processing in the BTS:
•BSC and MSC: traffic information •Advantage: distribution of processing load, lower signalling load on Abis.
•Disadvantage: complex, distributed algorithms for HO control
•Basic split of tasks for HO decision: •Solution: BTS/BSC split of HO architecture is not specified by GSM, but up to
•BSS is managing radio resources and deciding to perform handover on a given the manufacturers. The GSM standard just foresees the mechanisms for both
RR session. solutions.
•MSC may however intervene on this HO decision based on radio criteria, if
there are traffic criteria. •Protocols (see next picture):
•BSC-BTS protocol: BSC configures the transmission path and BTS reports
measurements to the BSC. (specified in GSM Rec. 08.58 and therefore called
08.58 protocol or RSM (Radio Subsystem Management)
186 188
47
1.8.2. Architecture and Protocols (continued) 1.8.3. RR Procedures
•Protocol from BSC to Relay-MSC:
•Is called BSSMAP (= BSS Management Application Part) 1.8.3.1. Initial Procedures: Access and initial assignment
•Used to carry requests for initial connection establishment and …
•… any change in connection attributes as commanded by higher layers. •Purpose of initial Procedures: transition of MS from idle to dedicated mode.
•HO handling between Relay-MSC and BSC
•Protocol between 2 adjacent MSCs: is part of MAP and called MAP/E •Initial assignment is always triggered by request from MS for 1 out of 3 reasons:
•Location updating
Relay-MSC Anchor-MSC •Answering of paging
•Reaction on user request (e.g. outgoing call, SS or SMS)
MS BTS BSC MSC VLR MSC VLR •Access procedure is always the same:
•MS -> BSS: RIL3-RR “channel request” message send on RACH
•BSS -> MS: RIL3-RR “immediate assignment (extended)” message on PAGCH with
RIL3-RR MAP/E the channel allocated to the MS.
RSM BSSMAP
•MS -> BSS: MS establishes the link layer for the signalling transfer on the newly
TCAP allocated channel. MS sends initial message with subscribers identity and reason
SCCP SCCP connection request.
LAPDm LAPD MTP MTP

189 191

1.8.3. RR Procedures 1.8.3.1.1 Random Access
•In this chapter temporal procedures and the dynamic processes between the different tasks •Problem : Access of MSs can not be scheduled Î random collisions of access bursts happen.
needed for RR management are described.
•In case of collisions only some or none of the random access bursts might be possible to be
•Following procedures will be analysed: decoded correctly by BSS.
•Creating an RR session. •Collisions increase with traffic .
•Paging procedure •GSM uses “slotted Aloha”.
•RR session, e.g. changing channel characteristics (type of channel, ciphering mode)
•Handover execution, incl. call reestablishment. •Access repetition in case of collisions is random and managed by BSS (transmitted on BCCH)
•Release procedure. •“Tx-integer: random scheduling of each attempt over 3 to 50 slots.
•Handling of signal measurements, •Max retrans: up to 1, 2, 4 0r 7 repetitions are allowed
•Timing advance, •Trade of between resistance to overload and QoS! This method is only for short peaks.
•Power control
•Frequency redefinition. •Overload control: all resources must fit to each other, e.g. RACH, PAGCH,TACH capacity.
•Broadcast on BCCH Overload should cut traffic at the source, e.g. prevent RACH in case all TACHs are loaded.
• RIL3-RR “immediate assignment reject” message prevents MS from access attempts
•“Abnormal cases”, like e.g. failures and collisions of events can not be dealt with here, even so •Blocking access for a “class” of MS: by mobile operators, the SIM cards distributed to
they typically consumed a large portion of the R&D effort. “normal” subscribers contain randomly chosen a class (1 out of ten). In case of overload
complete classes are rotating blocked for a certain time (controlled by BSC).
190 192
48
1.8.3.1.3 The initial channel assignment
1.8.3.1.1 Random Access (continued)
MS Channel Request
Channel Required
BTS frame number BSC
•Additionally the following “VIP” classes are defined:
delay
•The corresponding users belong to one of the “special” Subscriber category
classes 1…10 additionally and may access access class Channel Activation
if one of their classes is allowed. 11 Left open to PLMN operator Immediate Assignment
12 Security services (or immediate assignment extended)
•Emergency calls are treated separately, so that frame number
they pass, even if the class is barred. 13 Public utilities ? delay
14 Emergency services
•“Channel required” message: contains estimation of of transmission delay (for timing advance)
•Neighbouring Cells: in case a MS is rejected in 15 PLMN staff •Timing advance is based on the delay estimation, the BSC indicates back to BTS (BTS can not
one cell it may retry in the next (second best )
correlate the assignment of the BSC with the original request of the mobile).
cell. Disadvantage: increase of interference.
•Immediate assignment to MS via PAGCH contains:
•Description of allocated channel.
•The BSS may as well forbid MS to retry in neighbour cells. •Initial timing advance to be used by MS.
•Initial maximum transmission power of MS.
•In case MS has repeated its “channel request”, BSS can not recognise this repetition, so •Reference, so that MS can see whether the response of the BSS is the answer to its request:
multiple channels are allocated to the MS. MS will take the first allocation, the other ones •Exact content of original channel request message + TDMA frame number
remain idle for some seconds, till they are cleared by the BSS. •In order to get this message, MS must continuously decode all PAGCH messages in real time!
193 195

1.8.3.1.4 The initial message
1.8.3.1.2 The contents of the RIL3-RR “channel request” message
•After reception of initial assignment the addressed MS:
•Only 8 bits useful signalling information in the ”channel request” message: •Modifies frequency and time characteristics to adapt to the assigned channel.
•3 bit “establishment cause”: •Transmission power level is adjusted.
•answer to paging, •Transmission starts with prescribed TA.
•emergency call
•Call re-establishment •Than the new channel is ready for usage:
•User request •MS sends a link layer SABM frame fro SAPI=0. The frame is for establishment of link
•5 bit random discriminator. layer connection in acknowledged mode.
•Problem: it might still be that
•The random discriminator is used by the BSS to discriminate 2 different MS transmitting •2 MS did an RACH at the same time,
RACH messages at the same time. •with the same channel request message (same random number),
•one was correctly decoded and answered by the BTS.
•So both MS believe they got the same channel assigned!
•Solution:SABM-UA contains unequivocal information identifying the MS.
•If a MS receives UA with difference from the content of the SABM it send,
•it has to leave the channel and start all over again (see next picture)

194 196
49
1.8.3.1.4 The initial message (continued) 1.8.3.1.5 The Mobile Station Classmark
MS1 MS2 •MS classmark contains information about MS capabilities.

SABM I1 •A subscriber may at any time put the SIM into another mobile. Therefore the classmark has to
I1 BTS
be signalled at the beginning of each new connection.
I2 Class GSM900 DCS1800
SABM I2 •Parameters contained in classmark:
•Revision level, 1 20 W 1W
I1 •RF power capability
UA 2 8W 0,25 W
•Encryption algorithm
•Frequency capability 3 5W -
•Short message capability 4 2W -
≠ MS2 leaves 5 0,8 W -
•Revision level:
= MS1 leaves •Upward compatibility handling for different revisions of the GSM Standard.
•There are 4 “initial messages” depending on the reason why the access was triggered: •RF power capability:
•All contain the MS classmark: indicating key features of the MS, like max.transm,power. •Also called transmission power class: max. transmit power of MS.
•GSM: Class 1 was probably never developed, class 4 is for most handhelds.

197 199

1.8.3.1.4 The initial message (continued) 1.8.3.1.5 The Mobile Station Classmark (continued)
Reason for access Initial message
Response to paging RIL3-RR paging response •Encryption algorithm:
•Indicates which ciphering algorithm is implemented
Normal location updating, RIL3-MM IMSI detach •Ciphering is subject to strict export regulations.
Periodic location updating
“IMSI attach” •Frequency capabilities:
•GSM extension band;
IMSI detach RIL3-MM IMSI detach
All other cases (call set-up, short message transmission, RIL3-MM CM service •SMS capabilities:
supplementary service management, …) request •Little use, as all MS today are able to handle SMS.
•After “initial message” has been exchanged between BTS and MS (see previous picture): •RIL3-RR classmarrk change message: allows to change classmark during a RR session, e.g.
•BSC is informed in an “RSM establish indication” message. vehicle mounted MS with antenna amplifier is dismounted during a call.
•MS classmark is stored in the BSS
•BSC sets SCCP connection towards MSC: “SCCP connection request”
•The initial message to MSC is carried in a “BSSMAP complete layer 3 information “
message, allowing MSC to trigger all necessary steps in upper layers.
•With the establishment of the SCCP connection the MSC takes control …

198 200
50
1.8.3.2. Paging Procedures 1.8.3.3. Procedures for transmission mode + cipher mode management
•Paging sequence: •The amount of different transmission modes expands as the GSM standard is enhanced with
•Incoming call from the network side to the GMSC. new features (see table in 1.8.1.3.1.)
•GMSC routes call to the MSC controlling a given location area (= LA) where the •Another property of the transmission chain is the cipher mode.
subscriber is expected to be.
•An LA may consist of 1 or more cells distributed between 1 or more BSC. •At initial assignment the BSC selects the the transmission mode (TACH/8 or TACH/F) for
•MSC sends BSSMAP Paging message to all BSCs of the respective LA. signalling.
•Message contains:
•Temporary IMSI (= International Mobil Subscriber Identity) or •Afterwards the transmission mode is changed according to the communication needs. This can
•IMSI (need for paging sub-channel in case of discontinuous reception). change during a communication as e.g. additional data channels are opened.
•List of cells for paging.
•BSC sends Paging Command to the BTSs. This contains the paging sub-channel. •Transmission mode is changed by the “assignment “ procedure.
•MSC/VLR Î BSC: “BSSMAP assignment request” message containg the transmission
•Paging repetition: characteristics as commanded by MSC.
•Paging repetition algorithm is up to manufacturer and operator. •BSC Î MSC/VLR: “ BSSMAP assignment complete” message acknowledgment after
•Problem: BTS and BSC are best suited for managing repetitions as they manage the successful change or in negative case “BSSMAP assignment failure” or “BSSMAP queuing
physical resources (I.e. the PAGCH), but they cannot relate an answer of a MS to a paging. indication” in case BSC can not immediately follow the command.
The MSC can do this.
•Solution: Stepwise repetition: BTS repeats e.g. 3 times automatically, than MSC
201 203

1.8.3.2. Paging Procedures (continued) 1.8.3.3. Procedures for transmission mode + cipher mode management
(continued)
•Page Mode:
•PAGCH configuration any change at any time due changed traffic conditions. • After receiving the BSSMAP assignment request message 3 different actions are possible
•Change may happen automatically as commanded by BSC or by the operator via OSS. in the BSC:
•PAGCH configuration must be known to the mobiles Î BSC must first inform the
mobiles via broadcast, than wait some seconds and than change the PAGCH. 1. If both modes are the same: BSC sends back to MSC BSSMAP assignment complete
message without further action.
•Page mode indicates to MS where they can find their pagings: 2. If both modes differ by type of information to be transmitted, but use the same type of
•“Normal” page mode: pagings are only send on the sub-channel as defined by the channel: BSC performs “mode modify” before acknowledging MSC request
PAGCH configuration and the IMSI. 3. If new mode requires a channel of different type from the one in use: BSC performs a
•“Full” page mode: designed for dynamic change of PAGCH configuration. Indicates that “subsequent assignment” procedure (= transfer of connection to a channel of the
a page may not only come on the given sub-channel, but anywhere on the PAGCH of the required type) before acknowledgment.
same timeslot!
• “next-but-one” page mode: for sophisticated scheduling algorithms. The pagings for the The cases 2. and 3. are described in the next chapters.
mobiles of the sub-channel n are additionally transmitted on sub-channel n+2. Useful in
case of temporary overload of a sub-channel or in case of a block has to be freed for
transmitting initial assignment messages.

202 204
51
1.8.3.3.1. The Mode Modify Procedure 1.8.3.3.2. The Subsequent Assignment Procedure
• Mode modify procedure consists of 2 parts: • Subsequent assignment is necessary, if additionally to the ”mode modify” another radio
1. Configuration of the transmission devices on infrastructure side (BTS, TRAU, BSC) channel is required (see figure 1.8.-2).
2. Configuration of MS. • The whole operation is centrally controlled by BSC and similar to a HO. (note: the radio
• No synchronisation means between these 2 parts are available Î short period of transmission devices inside a BTS are independent and do not need to communicate!)
inconsistent configuration. • 1st step of channel transfer: setting a new path in the infrastructure consist of
• BSC triggers reconfiguration of BTS and TRAU by “RSM mode modify request” to BTS: • Allocation of new radio channel.
• BTS modifies its coding and decoding • Activation of corresponding BTS device.
• BTS changes in-band information in the BTS-TRAU frames • Allocation of TRAU if needed.
• TRAU reacts by modifying its data processing. • Switching to connect all terrestrial segments.
• If new mode is speech, than synchronisation between TRAU and BTS is needed. • Activation of BTS is started by BSC with “RSM channel activation” message, containing:
• When chain is ready BTS answers the BSC by sending “RSM mode modify • Specification of the required transmission mode,
acknowledge” • required cipher mode,
• BSC triggers in parallel MS by “RIL3-RR channel mode modify” message: • downlink DTX mode,
• Containing the new mode to be applied. • uplink DTX mode.
• MS executes change and responds “RIL3-RR channel mode modify acknowledge” to • After reception of this message BTS starts:
BSC via BTS • in-band signalling with TRAU, to set basic transmission mode and DTX mode,
• BSC alters the circuits between BTS and MSC, if needed. Additionally the connection to • so synchronisation between BTS and TRAU starts.
different circuits in the TRAU is switched if necessary.
205 207
1.8.-1 The “mode modify” procedure 1.8.-2 Activation of a new channel in the BTS
TRAU TRAU
BSC BSC
MS BTS MS BTS
Mode modify request channel activation

m1 > m2 Ch.
BTS / TRAU Ch.
m1 > m2 configuration channel activation acknowledge
Mode modify acknowledge assignment command
Old
channel Error indication
channel mode modify
Ch.
m1 > m2 MS new assignment complete MS
channel mode modify acknowledge configuration channel configuration
m1 > m2 change of configuration from mode 1 to mode 2 in-band control Ch. Configuration of the equipment for the new channel in-band control
BSC is in charge of configuring BTS / TRAU and MS. Order of configuration steps is up After activation handshake on Abis, BSC orders MS to change channel by “RIL3-RR assignment
to manufacturer. TRAU is configured through in-band signalling from BTS command” message, which is is acknowledged by the MS on the new channel
206 208
52
1.8.3.3.2. The Subsequent Assignment Procedure (continued) 1.8.3.3.3. The Change of Cipher Mode
• After BTS/TRAU are activated (i.e. BSC has received “RSM channel activation ackn.”) Î • During an RR-session the cipher mode may change on the air interface.
BSC orders MS to perform transfer of channel by “RIL3-RR assignment command”. • Problem: ciphering is applied to all transmitted information: signalling and data !
• Previous path is not yet released, so MS can “fall back” in case of problems by using Î Change of ciphering is a signalling break with the possibility of message loss.
link establishment procedure on the old channel. So all old contexts would be reset.
• MS after reception of RIL3-RR assignment command : • Solution: it would have been to complicated to require the BTS to decode with and without
• In case of “timed assignment” MS stays on the old channel till instant of change as ciphering at the same time. So a stepwise mechanism was developed:
indicated by infrastructure, • Step 1: BTS transmits according to old mode and receives according to new mode.
• else MS transfers immediately to new channel after RIL3-RR assignment command • Step 2: MS is fully in new mode (Rx and Tx)
even without acknowledging the corresponding frame on layer 2 on the old channel. • Step 3: BTS is fully in new mode (Rx and Tx)
• BTS, due to this lack of acknowledgment :
• Repeats message on old channel, till it decides that a link failure has happened, • Critical period with loss for message loss is split in 2, however in no case a single message
• than BTS informs BSC about this, but BSC does not react, because it knows reason. loss can jeopardise the whole connection (see next picture):
• From step 1 to 2: BTS to MS transmission works correctly: so a DL message
• Problem: in both cases (successful or return to old channel) the interruption of the link- triggering step 2 can be repeated by infrastructure if necessary.
layer may result in leaving a message sent by MS in non-acknowledged state: • From step 2 to 3 : MS to BTS transmission is correct: so MS can retransmit the UL
• Solution: after the new link is established, MS sends an “RIL3-RR assignment acknowledgement message required after step 2 (is required for step 3).
complete” message to BSC before any other message (or RIL3-RR assignment failure in
case of return to old channel). Than all messages waiting for transmission can be sent • “Cipher mode change” relies on link layer mechanism: repetition of messages after a given
(non-acknowledged ones and the ones arisen under the procedure) time out period, if no acknowledgment from the other side was received.
209 211
1.8. Radio Resource Management 1.8.-3 Cipher mode change: the 3 steps
1.8.3.3.2. The Subsequent Assignment Procedure (continued)
• Problem of message duplication:
• Message sent by MS before link interruption cannot be lost but may be duplicated. BTS
• In case of upper layer messages (MM or CC) duplication might be harmful. MS
• So suppression of duplicated messages is done in the anchor MSC, 1
(Non ciphered)
• using the 1 bit sequence number (called N(SD) in the GSM Standard).
• When 2 successive messages are received, the second one is discarded (done on RR (Non ciphered, repeated) BTS deciphers
level). 2 (ciphered) the received flow
• This is performed in anchor MSC, as this is the only one stable during the but sends in clear
transmission. (ciphered, repeated)
MS deciphers the 3
received flow and (ciphered)
ciphers for sending BTS deciphers the
(ciphered, repeated)
received flow and
ciphers for sending
Short interruption of signalling link
In order to avoid a break down of the signalling link due to a message loss during the critical
phase of ”cipher mode change”, the procedure is cut in 3 steps
210 212
53
1.8.3.3.3. The Change of Cipher Mode (continued) 1.8.3.4. Handover Execution
• Command sequence fro cipher mode setting (see picture below): • Handover= network commanded transfer of a MS in dedicated mode from one cell to
• MSC decides on ciphering, than another.
• BSC transmits an order to BTS, than
• BTS manages this procedure, • HO procedure is very similar to the subsequent assignment procedure. Differences:
because it is doing the ciphering and because the correct sequence is crucial. • Fundamental difference is the change of cell.
• Additionally timing advance is applied for HO,
• some additional data specific to new cell are transmitted and
• some limitations are valid …
MS BTS BSC MSC VLR
1 • Another variant of HO is “directed retry”:
RIL3-RR ciphering BSSMAP cipher mode command
mode command RSM Encryption command • When a connection is initially established, the cell is chosen by MS,
2
• however while in connected mode, the cell is determined by the network.
3
• As the 2 selection algorithms are different, the resulting cell may be different as well.
(data indication)
Cipher mode complete • When this happens and the initial channel is TACH/8, a HO directly to the TACH/F
RIL3-RR Ciphering
mode complete
in the right cell is faster than “subsequent assignment” to TACH/F in the old cell and
HO to the new cell.
• This is called directed retry.
• After reception of RIL3-RR ciphering mode complete the BTS fully switches to the
new mode
213 215

1.8.3.3.4. Discontinuous Transmission Modes 1.8.3.4. Handover Execution (continued)
• Generally a receiver does not need to know beforehand whether DTX is applied or not Î • HO has different variants according to 2 criteria:
no procedure exists to inform the receiver in MS or TRAU beforehand. 1st criterion is related to the timing advance with two different cases:
• Downlink DTX: • Synchronised HO: MS is able to compute new TA because old and new cells are
• is ordered by MSC to the BSC for each connection individually. synchronized.
• BSC configures BTS, • Asynchronous HO: TA must be initialised at MS and BTS during HO.
• BTS configures TRAU. 2nd criterion concerns the location of switching point in the infrastructure:
• On transmitting side, DTX results in: • Intra-BSC HO: between two BTSs of same BSC
• some frames not being send • Intra-MSC, inter-BSC HO: between 2 BTSs of different BSCs
• and modification of speech algorithm (I.e. sending of comfort noise frames) • Inter-MSC HO: between 2 BTSs of different MSCs Î
• Initial command for DTX is issued through a DL DTX indicator included in the message original MSC stays as anchor MSC
used for management of the basic transmission mode:
• From MSC: in “BSSMAP assignment request” • HO always goes through 2 phases:
• and for channel activation towards BTS in “RSM channel activation”. • BSC-old triggers set of events which lead to the establishment of the new
• TRAU is configured through an in-band indicator set by BTS. communication path. After this is done, the MS gets a HO command.
• On an already installed DL RR connection the DTX change can be done via an indicator in • MS accesses new channel. This triggers the switch of paths in infrastructure and
• “RSM mode modify request” message from the BSC to the BTS and release of old path.
• another indicator in “BSSMAP assignment request” of MSC towards BSC,
• The MS needs not be warned in DL, so no procedure exists for this.
• As a cell option (broadcast on BCCH) , the MS can be ordered to use UL DTX
214 216
54
1.8. Radio Resource Management 1.8.-4 HO requirement from the serving BSC to the switching point
1.8.3.4.1 The Set-Up of the New Path Switching
BSC-old BSC-new
MS BSC-old
Switching point
point BSC-new
Decision
phase 1
HO is required HO is required Start of path

Start of path establishment
Allocation and activation
establishment
end of path establishment of radio channel
HO command to MS and HO command to MS
HO command End of path est. and
to MS HO command to MS
MS access to
phase 2
MS
The MS has accessed new cell
Release of path the new cell
BSC-old MSC-old Anchor

•After decision of HO has been made by BSC-old, this is indicated to switching point.
MSC
•Switching point must: A) (internal)
•Establish terrestrial resources,
•Signal to BSC-new in order to allocate radio resource
•Provide all machines with HO related information, including: BSSMAP handover required
B)
•Required transmission mode
•Cipher mode
•Identity of origin cell (in order to determine whether HO is synchronous or not). BSSMAP handover required MAP/E perform subsequent handover
C)
•MS classmark.
•The details of HO execution sequence are described in the following steps:
217 219

1.8.3.4.1 The Set-Up of the New Path (continued) 1.8.3.4.1 The Set-Up of the New Path (continued)
From BSC-old to switching point (see next picture 1.8.-4) From switching point to BSC-new (see next picture 1.8.-5)
• Purpose of this exchange: transmission of information, that a HO is needed and towards • Purpose of this step:
which cell • Establish signalling path between switching point and BSC-new.
• Different cases depending on the switching point: • Establish circuit if needed.
1. BSC-old is switching point = BSC-new: internal step, no problem • Supply required information to all machines on the signal path.
2. MSC-old is switching point (BSC-old ≠ BSC-new):
• BSC-old sends BSSMAP handover required message to MSC-old, containing • Three different cases, depending on the switching point:
identities of target cell(s) and of the origin cell. A. BSC-new = BSC-old = switching point:
3. Anchor-MSC is switching point (and different from MSC-old): Internal handling in BSC. BSC holds all required information.
• BSC-old does same procedure as under 2. above. B. MSC-new= MSC-old = switching point (BSC-new ≠ BSC-old):
• MSC-old translates the message into MAP/E perform subsequent handover • After reception of indication that HO is required: MSC-new establishes SCCP connection
message toward anchor MSC. to BSC-new
• MSC-new transmits “BSSMAP handover request” message to BSC-new incl. information:
• On both cells (origin and target cell),
• Transmission mode (may be differ from the old connection)
• Cipher mode (must remain unchanged)
• Classmark
• Reference to terrestrial channel between MSC-new and BSC-new if needed

218 220
55
1.8.3.4.1 The Set-Up of the New Path (continued) 1.8.3.4.1 The Set-Up of the New Path (continued)
From switching point to BSC-new (see next picture 1.8.-5) From to BSC-new back to the switching point (see next picture 1.8.-6)
C. Anchor MSC is switching point and different from MSC-new. • Now BSC-new must allocate the radio channel: positive or negative answer is possible.
• More complex case Î several steps, as the new communication path may transit • No queuing, because other machines wait for answer. Timers are running.
through PSTN or ISDN. • BSC exchanges “RSM channel activation” & “RSM channel activation acknowledge” with BTS
• Î standard inter switch procedures are used (e.g. TUP or ISUP). These • BSC-new builds and transmits “RIL3-RR handover command” to MS via switching point and
old resource, containing:
protocols can not convey GSM specific info Î they are just used for circuit set
• Decision, whether synchronous or asynchronous HO is used,
up. • Chooses HO reference
• Than MAP/E procedures are used for HO signalling. • Sets initial MS transmission power.
• Anchor MSC provides the required info to MSC-new through “MAP/E perform • So BSC-new takes over control from this moment!
handover” message.
• After reception: • 3 different cases are distinguished:
• MSC-new establishes SCCP connection with BSC-new a. BSC- new is switching point:
• Allocates A-interface circuit, if needed At this point in time both terrestrial paths to old and new BTS are set up.
• Transmits “BSSMAP handover request” message to BSC-new containing b. MSC-new is switching point:
same information as received in case b above. • BSC-new encapsulates the “RIL3-RR handover command” message in a
“BSSMAP handover request acknowledge” message.
• Nothing else necessary, because the terrestrial path already is completely
established.
221 223
1.8.-5 Start of path establishment at handover 1.8. Radio Resource Management

Switching 1.8.3.4.1 The Set-Up of the New Path (continued)
BSC-old BSC-new
point
b. The anchor MSC is the switching point and differs from MSC-new:
HO is required Start of path • BSC acts as case b above.
establishment • After reception of “BSSMAP handover request acknowledge” message, MSC-
new inserts the included “RIL3-RR handover command” message in a new
HO command End of path est. and envelope, the “MAP/E perform handover command”. This contains :
to MS HO command to MS • Telephony like number (provided by MSC-new) to allow Anchor MSC to
set up a normal circuit connection through ISUP or TUP.
• Than MAP/E exchange on this circuit provides:
Anchor • Information needed for circuit establishment and …
MSC-new BSC-new
MSC • … carrying the “RIL3-RR handover command” back …
A) • … which shall be send to MS via the old path.
(internal)
• After reception of “MAP/E perform handover result” message, the
BSSMAP handover request
anchor MSC can set up communication to MSC-new.
B)
MAP/E perform handover BSSMAP handover request

C)

222 224
56
1.8.-6 end of path establishment at handover 1.8. Radio Resource Management
Switching 1.8.3.4.1 The Set-Up of the New Path (continued)
BSC-old BSC-new
point
From the switching point (see next picture 1.8.-7)
HO is required Start of path
establishment • Last step of first phase of handover execution: sending “RIL3-RR handover command” to
MS as shown in next picture.
HO command End of path est. and • The RIL3-RR Handover command message is carried unaltered over different interfaces in
to MS HO command to MS a variety of different envelopes:
Interface between Encapsulating message
Anchor BSC-new and MSC-new BSSMAP handover request acknowledge

MSC-new BSC-new
MSC
MSC-new and Anchor MSC MAP/E perform handover result
A) (internal)
Anchor MSC and MSC-old MAP/E perform subsequent handover result
BSSMAP handover request ack MSC-old and BSC-old BSSMAP handover command
B)
• RIL3-RR handover command message identifies the new cell only via beacon frequency
MAP/E perform handover ack BSSMAP handover request ack and BSIC. The full cell identity will be read by the MS on SACCH later on.
C)

225 227
1.8. Radio Resource Management 1.8.-7 Sending back of Handover Command

1.8.3.4.1 The Set-Up of the New Path (continued) Switching
BSC-old BSC-new
point
• Depending on implementation choices for the BSC the paths at this stage
may be linked in … HO is required Start of path
• … a two ways conference bridge establishment
• So user data are transmitted to MS via both BTSs HO command End of path est. and
• Uplink flows are combined into a single one towards MSC to MS HO command to MS
• … a one-way conference bridge
• So user data are transmitted to MS via both BTSs
• … or not linked at all
• Such a “conference bridge” improves HO performance, but not always BSC-old MSC-old Anchor
feasible. MSC
A) (internal)
BTS BSSMAP handover command

B)
BSC MSC VLR
BSSMAP handover command MAP/E perform subsequent

C)
handover acknowledge
BTS
226 228
57
1.8.3.4.1 The Set-Up of the New Path (continued) 1.8.3.4.2 MS access and the conclusion of the HO procedure
• RIL3-RR handover command message to MS:
The not successful alternatives • Before reception of this message: MS did not know anything of the HO preparation.
• This message contains all information for transmission on the new channel.
• The HO as described before may fail, e.g. due to lack of radio or terrestrial resources. • (except cipher mode, because assumption is, that this remains unchanged).
• In the failure case either • Message indicates whether asynchronous or synchronous HO is applied.
• a failure message is carried all the way back from BSC-new to BSC-old or
• a timer at BSC-old expires: • MS reception from now on:
• Due to pre-synchronisation: MS receiver synchronises quickly on new channel
• Speech or data reception is now possible, if switching point uses conference bridge.
Anchor MSC
Subsequent handover failure
No radio resource available • MS transmission from now on:
• For synchronous HO:
• MS first sends some access bursts (RIL3-RR handover access)
Handover required MSC-old MSC-new • Than normal transmission with pre-computed TA.
reject • For asynchronous HO (see next picture):
handover failure • MS sends access bursts till it receives RIL3-RR physical information from BTS-new.
• …this contains the timing advance information. Then normal transmission starts.
• RIL3-RR handover message is the only short access burst on a dedicated channel:
BSC-old BSC-new
containing 8-bit HO reference as a reply to the reference send by BTS in RIL3-RR
handover command message as an additional check, that the right MS is accessing.
229 231
1.8. Radio Resource Management 1.8.-8 Access in case of an asynchronous handover

1.8.3.4.1 The Set-Up of the New Path (continued)
• 2 possibilities for recovery after failed HO: BSC-new
MS BTS-new MSC-new Anchor MSC
Handover
1. New HO attempt to same cell after some time:
Access
• Failure indication goes all the way back to BSC-old. (Handover
Detection) (Handover
• All resources along transmission path, which had been allocated are released again. Detect)
Physical
• BSC-old may later decide to retry.
Information
2. HO attempt to another cell:

• Same procedure as 1. Above however with different target cell, or…
SABM
• … BSC-old provides MSC-old with an ordered list of target cells (e.g. in case of
rescue handover). UA
• This list is not send to anchor-MSC, if MSC-old is the the switching point. Handover Complete
• Upon reception of failure indication MSC-old will targets on list one after another. Handover
Complete Send End
• Only after all targets have been tried in vain, BSC-old gets failure indication.
Signal
• Possibility of multiple cell choice is an option for BSSMAP handover required
message First after reception of “RIL3-RR physical information message does MS switch to normal
• Trade-off: multiple cell choice is better for speed, however cell allocation is better by transmission with the indicated TA.
BSC-old in line with latest measurements. Then SAPI0 is established on the new dedicated channel.
Then RIL3-RR handover complete Message is send.
230 232
58
1.8.3.4.2 MS access and the conclusion of the HO procedure (continued) 1.8.3.4.2 MS access and the conclusion of the HO procedure (continued)
• Option for manufacturer/ operator: • Return to old channel in case of problems:
• After reception of RIL3-RR handover access burst, BTS may send RSM handover • Solution: Anchor MSC reacts upon timer expiry and non reception of handover complete
detection message to BSC. message from BSC.
• BSC-new passes message on to MSC-new through BSSMAP handover detection • After detection of failure: switching point releases new path.
message. (not possible in case MSC-new is anchor MSC, as this information is not • Then BSC-old has to decide upon further actions.
carried on MAP/E protocol).
• Effect of this mechanism: MSC may switch communication path, before complete • Intra-BSC HO:
protocol • Normally performed autonomously by BSC.
• BSS implementation option not to involve MSC in selecting the best cell( if inside the
• The RIL3-RR physical information message: domain of this BSC).
• = only message send autonomously by BTS • BSSMAP handover performed message from BSC informs relay MSC about this
• Reason: performance. completed HO.
• Message may be send several times (for efficiency reasons), till reception of a normal • This can be relayed to anchor MSC (if it is different from relay MSC) by MAP/E
burst from MS. note internal handover.
• This message may may also be used in case of MSC-internal HO.
• Sending of message depends on “Operation & Maintenance” setting.
• When MS is in transmission mode:
• MS sets link layer to acknowledged mode for signalling: MS sends SABM, answered
by UA frame.
• MS sends RIL3-RR handover complete message to switching point.
233 235

1.8.3.4.2 MS access and the conclusion of the HO procedure (continued) 1.8.3.5. Call Re-Establishment
• When MS is in transmission mode (continued): • Call Re-Establishment = kind of mobile triggered HO
• Then switching point releases the old resources: as opposed to the GSM concept of network controlled handovers !
• From anchor MSC to MSC-old: MAP/E send end signal result.
• From MSC-old to BSC-old: BSSMAP clear command • General trade off between mobile and network triggered handover:
• Then BSC-old releases radio channel. • MS triggered HO is faster and better performing in micro- and pico-cell
• Release procedures at Abis-, A-interface and BTS are identical to RR-session environments
termination. • Network has better overview of network situation (e.g. resources, traffic, topology)
• “Handover complete” indication triggers switching from old to new path, if not already
done after “Access Detection” on new channel. Why this 2 stage approach?- • Call re-establishment has 2 parts:
• First stage : shortens interruption time. • 1st part: very close to initial access. MS has leading role:
• Second stage: release of ressources, so MS can not easily return to old channel ! • MS has to start from scratch after link loss.
• Speed requirement: after link loss a timer in MSC is started in order to clear the
• Return to old channel in case of problems: transmission path (which probably became obsolete) Î MS must be “quick”.
• = similar to subsequent assignment, … • 2nd part: consist in recovering of upper layer connections. Network has leading role.
• only “RIL3-RR handover failure” message instead of “RIL3-RR assignment failure”.
• BSC-old detects unsuccessful HO and transmits information up to MSC-old through • Details of first part:
BSSMAP handover failure message (if applicable). • Cell choice: cells already known by MS, because MS is pre-synchronised (a new
• Problem in case Anchor MSC is switching point: MAP/E protocol does not foresee synchronisation would take seconds).
means/message to pass this failure information to Anchor MSC! • Cell selection rule: cell with highest signal strength.
234 236
59
1.8.3.5. Call Re-Establishment (continued) 1.8.3.6. RR-Session Release (see figure 1.8.-9.)
• Details of first part: (continued) • When call is over and no RR-connection is needed any more:
• MS must analyse radio criteria of selected cell (required by GSM Standard): • “normal “ release procedure is triggered by anchor MSC..
• Î BCCH must be read • All resources are released and MS goes to “idle” mode.
• Cell must not be barred for call re-establishment (signalled as well in BCCH) • If relay MSC ≠ anchor MSC:
• Then MS sends access request” on RACH, in which • Anchor MSC sends “MAP/E Send End Signal Result” to relay MSC
• Call re-establishment is indicated as cause (so network knows urgency) • … and releases circuit through ISUP release procedure.
• However no required channel (so network might always provide TACH/F).
• Then MS sends“CM Re-Establishment Request”: • Then “BSSMAP Clear Command” from relay MSC to BSC:
• … with minimal information content: subscriber identity and classmark • This message may be “piggybacked” on an “SCCP Release” message, releasing BSC-
• Network has to find out everything else: MSC connection.
• Cell with which connection was lost, • In this case BSC acknowledgement “BSSMAP clear complete” must be piggybacked
• Identity of anchor MSC. on SCCP release complete message.
• Required type and mode of channel. • Clearing action of BSC can be in parallel to this message.
• Then MSC is running the recovery based on the known subscriber identity: • BSC orders MS back to idle with “RIL3-RR Channel Release”
• MS disconnects signalling link.
• Find old context (if not lost due to timer expiry or correspondent who lost patience)
• BTS reports this disconnect by: “RSM Release Indication” message to BSC.
• Then MSC starts assignment procedure & “ciphering start” procedure • This clearing is secured by timers and repetitions against frame loss Î it must be avoided
• Telling BSC the type of required channel, mode etc.
to allocate a channel which is still used to a new MS !
• Allocating BSC-MSC terrestrial path.
• First after BSC is sure MS has left, it deactivates BTS device and adds it to free resources
• Maybe even authentication is started by MSC (additional delay!)
by “RSM RF Channel Release” / “RSM Channel acknowledge” exchange!
237 239
1.8. Radio Resource Management 1.8.-9 Normal release procedure of an RR session

1.8.3.5. Call Re-Establishment (continued) Relay MSC Anchor MSC
• Details of first part: (continued)

MS BTS BSC MSC/VLR MSC/VLR
• Then BSC performs:
• needed procedures in BSC and MS, …
send end
• like subsequent assignment, ciphering start, mode modification, … clear signal result
channel release command
• Then “RIL3-MM CM service accept” message can be send to MS.
• … or “RIL3-MM CM service reject” e.g. with cause “call cannot be identified” clear
Link disconnection: complete
• Further complications dealt with in standardisation: DISC
• Recovery of several CM-transactions. release
UA
indication
• Connection loss during an ongoing procedure in any other layer …
RF channel
release
RF channel
release ack
•Normal release is always triggered by anchor MSC

•BSC manages return of MS to idle mode before releasing BSS resources.

238 240
60
1.8.3.6. RR-Session Release (continued)
1.8.3.7. Load Management Procedures
• “Abnormal” RR-session release:
• In case radio connection with MS was lost, network must release its resources. • Load management procedures = Procedures in RR-plane to allow MSC and BSC to deal
• Mechanism: with overload.
• Both in MS and BTS correctly received SACCH frames are counted. • Procedures are available in 2 areas: RACH / PAGCH load and TCH load.
• (SACCH frames are regularly send twice per second in dedicated mode)
• Counter increments (till max. value) in case of good SACCH frame reception • Load on common channels:
and decrements in case of no or damaged reception (SACCH frame loss). • BTS is in charge to assess the load on RACH and PAGCH.
• At minimum threshold of counter the reception is considered broken. • BTS to BSC message on load situation: “RSM CCCH Load Indication”
• In case of broken connection : • Conditions (thresholds, frequency, …) for this message are set by OSS.
• MS goes to idle mode. • Possible reaction by BSC upon reception of this message:
• BTS sends “RSM Connection Failure” message to BSC. • Change of RACH load control parameters on BCCH
• Change assignment priority rules.
radio link counter
• Load on traffic channels:
4
• BSC knows/manages the dedicated channels .
link assumed • Number of currently allocated TACHs can be signalled to MSC by “BSSMAP
broken SACC frame decoded, resource indication” message.
expected, but not decoded • MSC can ask for this information (due to many reasons) with “BSSMAP Resource
0 Request”
SACCH blocks
241 243

1.8.3.6. RR-Session Release (continued)
1.8.3.7. Load Management Procedures (continued)
• Complication: uplink and downlink SACCH radio link counters do not expire at the same
time Î network might detect a broken link, whilst MS still is above counter threshold Î • MSC actions on overload:
MS might continue to transmit. • Handovers are used for traffic management:
• Solution: BSC commands BTS to stop transmission of SACCH: “RSM Deactivate • “handover enquiry procedure” in case overloaded cell has neighbour cells under
SACCH” message. different BSC.
• Monitoring of the uplink channel continues in BTS or BSC. • BSC responds with “BSSMAP Handover Required” message with appropriate
• (if in BTS, than it reports back “RSM Connection Failure Indication” to BSC, cause for each of a number of connections.
when UL channel is gone) • BSC sends “BSSMAP Candidate Response” message.
• After link failure is detected: same A-interface exchange as in normal case. • Precise measures of BSC are left for manufacturer and operator.
• Problem : traffic balancing is in contradiction to interference and radio
optimisation!
• General overload control:

• The GSM standard describes messages to be exchanged for load control between
entities. Implementation is vendor/ operator dependant.
• Basic principle of load control: control traffic at its source !
• BTS to BSC case: BTS is normally designed to cope with simultaneous usage of all
radio channels. So only common control channels may be overloaded if traffic is
strongly deviating from standard traffic pattern, or if design was wrong.
242 244
61
1.8.3.7. Load Management Procedures (continued) 1.8.3.8. SACCH Procedures
1.8.3.8.1. Radio Transmission Control (continued)
• BSC to MSC:
• only traffic on the Abis interface under the control of MSC are MS terminating
• Power control and timing advance:
calls.
• Commands from network are carried in L1-header (= physical layer in radio path
• So MSC could decide to reject calls from the network side and not send paging.
protocol architecture)
• Paging and the overloaded cells are however controlled by BSC …
• Send once per SACCH burst (= 2 times / second)
• UL: similar coding as DL. Contains the two values used by MS at the end of the
• MSC to BSC: if MSC is overloaded, BSC can reduce MS originated traffic.
measurement period (TA should be the same, Power Level might be different due to
the limited variation speed) .
• TA is managed autonomously by BTS.
• Transmission power is controlled by BSC (“RSM MS Power Control” and “RSM BS
Power Control”) messages.
• Measurement results:
• Send UL by MS at least once per second: RIL3-RR Measurement Report.
• BTS generates at every measurement period (twice / sec.) a “RSM Measurement
Result” message to BSC.
• This contains measurements of MS and BS.
• BSC computes data for power control and HO preparation.
245 247

1.8.3.8. SACCH Procedures 1.8.3.8. SACCH Procedures
1.8.3.8.1. Radio Transmission Control (continued)
• The SACCH exists only in dedicated mode as a small “associated” control channel
• Primarily for keeping the radio channel stable (power control, measurement reporting, • Design trade offs:
timing advance) • Measurement computing centralised in BSC is simpler and efficient, however it
• But as well for general information of the MS. induces heavy signalling load between BSC and BTS.
• As an alternative the option of pre-processing in the BTS is left to the vendor.
1.8.3.8.1. Radio Transmission Control 6.3.8.2. General Information
• Power control and timing advance: • Purpose of DL SACCH general info.: transmission of radio parameters, which are
• Commands from network are carried in L1-header (= physical layer in radio path particularly needed at the beginning of a channel connection. Information are similar to
protocol architecture) information transmitted on BCCH , including:
• Send once per SACCH burst (= 2 times / second) • Parameters to control the monitoring process:
• UL: similar coding as DL. Contains the two values used by MS at the end of the • List of frequencies to be monitored.
measurement period (TA should be the same, Power Level might be different due to • BSIC screening
the limited variation speed) . • BCCH frequency indication
• TA is managed autonomously by BTS. • Parameters for controlling the radio link failure detection (counter and threshold)
• Transmission power is controlled by BSC (“RSM MS Power Control” and “RSM BS • Requirements for application of UL DTX.
Power Control”) messages. • Further information (like full cell identity etc.)
246 248
62
1.8.3.8. SACCH Procedures 1.8.3.10. General Information Broadcasting
6.3.8.2. General Information
• Data broadcast to MS in idle mode is done via BCCH.
• In dedicated mode SACCH is always used in both directions for transmission (even if no
information is transmitted!): the other side must be able to do measurements and detect • BCCH is a low capacity channel:
radio link failure. • 23-octet every 0.235 seconds
• Repetition rate : trade off between usage of BCCH resource and speed of information
• SMS in dedicated mode: are carried by SACCH . for MS.
• Different periods are used for different information.
1.8..3.10.1. Cell Selection Information

L1 header message: • Information contained:
• LAI: Location Area Identity
downlink: system information or • Cell Selection Parameters
SMS related information • RACH Control Parameters (for the Cell_Bar_Access): indicating whether the cell is
barred.
uplink: measurement report or
SMS related message
249 251

1.8.3.9. Frequency redefinition 1.8.3.10. General Information Broadcasting
1.8..3.10.1. Cell Selection Information (continued)
• Frequency Redefinition = process for changing frequency properties of a FH channel
synchronously between MS and BTS. • Frequency of transmission:
• 2 out of 4 occurrences.
• “RIL3-RR Frequency Redefinition” message is send to each concerned MS (includes • Cell_Bar_Access in every BACC message
starting time and RF parameters) .
• Note: even if several BCCH time slots are used, MS in neighbour cells only listen to TN0 !
• Between BTS and BSC message from O&M is used for setting RF parameters in BTS. • So repetition frequency on BCCH timeslots other than TN0 is not important.
• Problem : Masking of BCCH by PAGCH subchannels:

MS in neighbour cells must listen to their paging subchannel and to the BCCH of
neighbour cells! If these transmit at the same time Î masking effect.
• Solution:
• Paging subchannel has half the rate of BCCH Î at worst only half the BCCH is
masked.
• Cell selection information is not transmitted on every second message , but in pairs
(e.g. 11 00 11 00 …)
At worst only every 2nd occurrence of cell selection information on BCCH is masked…
250 252
63
1.8.3.10. General Information Broadcasting 1.8.3.10. General Information Broadcasting
1.8..3.10.2. Information for Idle Mode Functions 1.8..3.10.4. Information for MS in dedicated mode
• Information for idle mode functions = used by MS once it has selected a cell to “camp on “ • Some information on BCCH is first needed after access by MS.
in idle mode.
• Information contained in “Cell Options” parameter:
• Information contained: • Parameter to control reporting on measurements (BSIC screening information
• “Control Channel Description” parameter contains: preventing to measure cells of “forbidden” PLMNs)
• Configuration of common channels: number of the time slots used for common • “Power Control Indicator”
channels. • Parameter controlling UL DTX.
• Parameters enabling MS to calculate its paging subchannel
• Information about which neighbour cells to monitor: beacon frequencies of neighbour
BTSs contained in “Neighbour Cells Description” parameter. 1.8.3.10.5. Cell Identity
• Configuration for cell broadcast messages: “CBCH Channel Description” (and
“CBCH Mobile Allocation”) parameter tells whether CBCH (Cell Broadcast Channel) • “Cell Identity” parameter transmitted on each 4th message (for network testing purposes,
is available and where. no operative usage in GSM).
• Frequency of transmission: once every 4 messages (for all 3 types of parameters)

253 255

1.9. Mobility and Security Management
1.8.3.10. General Information Broadcasting
1.8..3.10.3. Information Needed for Access
•Aspects of Mobility Management :
• When needed for Location Updating or Call Re-establishment, this information is of time •How does the MS deal with changing environment? How to choose the right
critical nature. cell and network?
Î So all information controlling access attempt is transmitted in each message (4/sec) •How does the infrastructure manage subscriber location data, in order to
establish calls to GSM subscribers? How to get and update location
• Control information for limiting access in “RACH Control Parameter”:
• List of allowed access classes is contained on BCCH.
information.
• Flag allowing Call Re-establishment.
• Parameter for controlling scheduling of access attempts and repetitions. •Aspects of GSM security features, against:
•Fraud (impersonating another user and thereby let him pay the bill)
• “Cell Channel Description” parameter: •Eavesdropping on the radio path
• = list of all frequencies for dedicated channels in the cell.
• (information is needed at initial access in order to control FH. Without this information on •Both aspects involve same equipment (SIM and HLR) and interact.
BCCH, the “Channel Assignment” message would need to contain this information, but it would
not fit in …)
• Broadcast 1/sec.

254 256
64
1.9. Mobility and Security Management 1.9. Mobility and Security Management
1.9.1.1.1. Administrative Aspects
•The notion of PLMN:

1.9.1. Location Management = commercial coverage area of an operator (typically confined to a nation).
•Corner stone of GSM due to competition between operators in the region.
•Technical consequences of of subscriber mobility: •“Home PLMN”= PLMN where user is subscribed to
•“Visited PLMN”= other than home PLMN.
•Radio propagation: subscriber may leave coverage area.
•Geographically limited subscription (e.g. no roaming allowed). •Roaming:
•Different services when served by different networks. •… leads to complex system requirements and standardisation:
ÎPLMNs must communicate between themselves.
•Mobility management functions are determined by ÎSubscriber must use network compatible Mobiles and SIM cards (SIM roaming).
•Administrative aspects.
•Radio propagation, •Subscription:
•System behaviour (e.g. regarding congestion control). •… defines the set of services and access rights a subscriber has (e.g. “no roaming”)
•The rights a user has in a visited PLMN might be different from home PLMN and are
subject to agreements between operators.
•The above aspects determine the way a mobile chooses the right network.
•PLMN accessibility:
•Regional or local access (different price structures) Î e.g. based on CAMEL (IN
4/2/2003 U.A.Hermann: GSM network
4/2/2003
technology) U.A.Hermann: GSM
257 259
1.9.1.1. Factors determining the Service •National roaming: e.g. for DCS-1800 operators without complete national coverage.
•International roaming: if a subscriber is not allowed to roam in a foreign PLMN, the
•In GSM the service observed by a subscriber may differ depending on his/her location, e.g. Location Update will be rejected by the network.
•HSCSD or GPRS may for a given PLMN (Public Land Mobile Network) only be •PLMN selection:
available in major cities. •When entering a new PLMN, the subscriber may choose manually or
•In case of roaming again different operates will offer different services at different automatically (as coded in the SIM) one out of several available visited PLMNs.
prices. •MS in idle mode only monitors neighbour stations as encoded on the frequency
list BCCH regularly. Other frequencies are scanned at greater intervals Î in an
•3 different, basic levels of service: overlap area, there might pass some time, before a roaming MS discovers its home
•Normal service: whatever user has subscribed to PLMN. (note monitoring in idle mode consumes battery power !)
•Limited service: emergency calls only .
•No service: outside coverage area. 1.9.1.1.2. Radio considerations
•Radio aspects govern strongly the service which can be given in a particular cell.
•In GSM a MS typically does initial access (e.g. answering a paging) in the cell on which it
camps (exception: directed retry)
•Î cell selection criteria in idle mode are crucial, they are based on :
•MS reception level (Rx lev and RX qual) of beacon frequency,
•Maximum transmission power of MS
•Several parameters as transmitted by BCCH.
258 260
65
1.9.1.1.3. System Load Control 1.9.1.1.4. Paging and Location Areas (= LA) (continued)
•Traffic overload in a particular cell : redirect traffic to neighbour cells. • Several outcomes of LA are possible:
• Successful registration or
•Barr a cell: “Cell_Bar_Access” flag • Unsuccessful with a meaningful answer of the network (e.g. rejection)
•Completely locks a cell for all mobiles (e.g. during repair or test) except for special test • Unsuccessful with a meaningless or no answer of the network.
mobiles.
• 3 possible meaningful negative outcomes:
•Access class mechanism: 1. Cell belongs to a PLMN not supported by the subscription :
•Some of the 10 standard user classes may be blocked in a rotating way fro a certain • Mechanisms are available: “forbidden PLMNs” list
period. • So cell will not be tried again.
•The MS are however still allowed to camp on this cell Î swap over of barred MS to • MS looks for cells of other PLMNs.
neighbour cells is prevented. 2. Location area not suitable because of regional subscription:
• MS must stay in that cell, but only with limited service.
3. In case of national roaming - cell does not accept national roamers:
• MS will not do further attempts in the cells of this LA,
• … but look for availability of home PLMN.

261 263
1.9.1.1.4. Paging and Location Areas (= LA) 1.9.1.1.4. Paging and Location Areas (= LA) (continued)
•In order to page a subscriber: infrastructure needs to know MS location. • If reject comes from home PLMN or PLMN connected with home PLMN:
• Subscriber is deregistered in HLR, so he / she can not be called !
•In order to save signalling capacity: Cells are grouped into location areas. Î MS is only • In other cases old HLR state remains and MS considers itself as deregistered
paged in certain location areas. • … because there was no confirmation from the network upon location update .
Î MS must inform infrastructure when it changes location area and infrastructure must store • Generally MS looks for other PLMNs after negative answer.
it: location update procedure.
• If no PLMN can be found: MS goes to limited service state.
•Location areas: must be managed by a single MSC. One MSC may have several LAs.
• There are many “abnormal cases” specified = cases where no reasonable answer can be
•Location updating: received by MS upon location update attempt.
•Must be performed when MS enters new LA. Triggered by MS! • In the first phase MS will try again a couple of times.
•Part of location updating is the registration in the network. • Then MS goes to a “special state” where it assumes no service.
•The status of the registration is stored in the SIM. • From time to time MS will try location update in order to get out of this state
•After successful registration, the MS assumes normal service • In this state MS does not reject a call attempt of the user, but tries a location update .
If this is not answered positively by a network, MS rejects call attempt.
•Status after location updating:
•Several outcomes of LA are possible.
262 264
66
1.9.1.2. Cell and PLMN Selection 1.9.1.2.1. PLMN Selection (continued)
1.9.1.2.1. PLMN Selection
• Automatic Mode:
• The GSM Standard details PLMN selection, though it only affects the MS, because: • Selection out of “Found PLMN” list in order as encoded in “Preferred PLMN” list
• Users shall see similar behaviour if ME is exchanged. on SIM.
• PLMN selection shall not be biased by MS… • User may edit this list of preference. Else list is put into SIM by operator.
• User can force automatic PLMN selection at any moment.
• Normal Case: • If no “preferred PLMN” can be found: procedure as defined by ME vendor.
• In normal service mode MS only looks for cells of serving PLMN.
• Change of PLMN only possible, if: • Limited service case:
• User decides so and starts PLMN selection. • Only emergency call is possible.
• Serving PLMN no longer covers area. • Cell selection by MS is independently done from PLMN or LA: by strongest signal.
• PLMN selection is either by • MS keeps on to seek for available PLMNs at certain intervals.
• Automatic mode • Limited service case in home PLMN:
• … or manual mode. • Only possible in case of regional subscription.
• Common aspect for both access modes: • MS will try each new location area of home PLMN,
• Home PLMN: always first try to log on home PLMN after power on, even if • … but no other PLMN, till home PLMN has disappeared (roaming case)
abroad.
• List of forbidden PLMNs (as learned from access attempts) is stored on non • The “No Service Case”: MS regularly scans all 124 GSM carriers (374 DCS carriers).
4/2/2003 volatile section of SIM. U.A.Hermann: GSM 265 4/2/2003 U.A.Hermann: GSM
267
1.9.1.2.1. PLMN Selection (continued) 1.9.1.2.2. Cell Selection
• Radio criteria decide for cell selection: maximise transmission quality:

• Forbidden PLMN means: user may still select manually and it is still allowed for
• Based on
emergency calls.
• Level of received signal on beacon frequency,
• Other MS stored PLMN list :
• Maximum transmission power of MS
• Storage of location areas, which have been rejected access due to national
• Some cell specific parameters transmitted by BCCH.
roaming limitations.
• Definition of C1 Criterion:
• Cells of these LA (or PLMN if all LAs rejected access) can not be accessed.
• List is deleted when MS is switched off or SIM removed. C1 := (A- Max.(B, 0))
A:= Received Level Average – pl
• Manual Mode: B:= p2 – Maximum RF power of the mobile station
• User may select all PLMNs even forbidden ones (which might be useful after change p1= RXLEV_Access_Min (broadcast on BCCH)
of subscription, when previously forbidden PLMN is now allowed). p2= MX_TXPWR_MAX_CCH (broadcast on BCCH)
• Translation of network code is done in ME. So if there is a new network and the (all values expressed in dB)
ME is old, possibly only some strange code is displayed.
• If PLMN access failed: new list of PLMNs is presented to user …
• p1 = between –110 dBm and –48 dBm
• p2= between 13 dBm and 43 dBm (different between DCS and GSM).
• P2= max transmit power for MS on RACCH (29 … 43 dBm allowed for MS!)
266 268
67
1.9.1.2.2. Cell Selection (continued) 1.9.1.2.2. Cell Selection (continued)
• Cell selection strategy (for neighbour cells or PLMN): • The cell selection algorithm:
• Only cells with positive C1 are taken into account. • Aim of cell selection: in order to get normal service, the MS must camp on one of
• Between several cells: cell with best C1 is chosen. the cells fulfilling the following conditions:
• Consequence, C1 determines: • A valid SIM must be inserted and the subscriber must b eregistered in the LA
• Coverage limit of each cell in isolation: outside the area with positive C1 the the cell belongs to;
cell does not exist for MS! • Criterion C1 for the cell must be higher than 0;
• The boundary between 2 adjacent cells for selection in idle mode is determined • Cell must not be barred.
a the place where C1= C1’ And if there are several cells fulfilling above criteria:
• Boundary with all adjacent cells determining a second cell limit , usually inside • The chosen cells C1 must be higher than the C1 of any other cell found by the
area delimited by C1= 0. MS in the same LA.
Figure:
• The chosen cells C1 must be higher than the C1 of any other cell found by the
2 cells with there C1= 0 limits and the
MS in different LAs of the same PLMN, corrected by the handicap factor.
(dashed) line with C1A = C1B
B • Note: better cells in PLMNs other than the one the MS is registered in are not taken
• Due to different transmit powers of MS
A into account! PLMN selection is only triggered if MS leaves coverage area or if
classes, different cell limits exist for them.
triggered by user.
• Operator optimises cell boundaries by
adjusting p1 and p2.
269 271
1.9.1.2.2. Cell Selection (continued) 1.9.1.2.2. Cell Selection (continued)
• Criteria other than C1: • Cell selection in normal service state:

• Disadvantage of above C1 definition: due to radio effects (e.g. shadowing) C1 varies • MS receives a list (from BCCH) of beacon frequencies of neighbouring cells.
quickly, sometimes randomly Î MS would often change cell !! • MS tunes receiver on these frequencies, gets synchronisation information,
• As this is unacceptable a “hysteresis” function was introduced: • …decodes broadcast information.
• C1 for each cell is “biased”by a “handicap” added to the C1. • MS checks whether cell is barred and reads identity of LA, radio parameters (for C1)
• “Handicap” = Cell Reselect_Hysteresis parameter broadcast on BCCH • Only cells of the right PLMN are taken into account.
individually for for each cell. • All this is in parallel to the listening to the PAGCH of the current cell.
• Applied specifically if different cells belong to different location areas ! • If there is better cell in another LA (considering the bias):
• Consequence: Cell boundaries are not the same, depending whether MS goes • … MS changes to this cell.
from cell A to cell B or vice versa ! • MS tries immediate location update in order to be reachable in the new LA.
b
a c Boundaries between cell A and B depend on the
• Cell selection at switch on time:
requirement fro a mobile to perform location
updating:
• First PLMN to look for after power on is home PLMN.
B a: Cell A and B belong to different LAs and MS is • MS looks for non-barred and C1 positive cells.
A in B • Typically MS stores in non-volatile sector of SIM the neighbour frequencies of the
b: Cell A and B belong to same LAs last (home) PLMN for quicker frequency scan.
c: Cell A and B belong to different LAs and MS is • If none of these frequencies can be found, all GSM/DCS frequencies have to be
in A. searched Î lengthy process !
270 272
68
1.9.1.2.2. Cell Selection (continued) 1.9.1.3. Architecture for Location and Mobility Management
• If chosen cell belongs to LA as stored in SIM: MS goes directly to normal service,
maybe with “IMSI attach/detach” • HLR: permanently stores subscriber data, e.g. present position (target MSC/VLR) for
• … else MS starts with Location Update. mobile terminating calls.
• If no cell was found in home PLMN, MS looks for other PLMNs.
• VLR: stores temporarily subscriber data for the time a MS is in its area.
• Cell selection at PLMN Change: • VLR is normally part of an MSC: MSC/VLR.
• E.g. if MS has moved out of serving PLMN area and cell selection starts
automatically or if user triggered it. • MSC: routes page to particular LA.
• Similar process as for switch on, but MS has no frequency information Î to analyse
all frequencies: • Consequence: Subscriber data are copied from HLR to VLR each time a MS “registers”
• Search whole GSM/DCS spectrum
• Select 30 strongest beacon frequencies. • Advantage of architecture: signalling load between visited MSC and HLR is limited
• Analyse information on respective BCCHs:
• Which PLMN?
• Barred or not?
• Radio parameters for C1 computation.
• Establish list of acceptable PLMNs (found list)
• Compare with preferred list and access acceptable candidate PLMN.
273 275
1.9.1.2.2. Cell Selection (continued) 1.9.1.3.1. Functions of location management
• Cell selection in limited service mode: • Home Location Register (HLR):
• E.g. subscriber Is not entitled to normal service in any found PLMN. • HLR may be one or several distributed machines
• Normal cell selection is performed , however without location updating. • HLR has no switching functionality.
• Cell with best C1 is camped on (but without bias) • HLR is not a simple database (with “store” and “retrieve”), but actively managing
• MS continues to search whole spectrum for acceptable PLMN. subscriber data, e.g.:
• Tell old VLR to delete subscriber record, if subscriber is registered under a new
VLR.
• Visitor Location register (VLR)

• VLR may manage subscriber data for one or several MSC.
• VLR may be physically distinct from MSC.
• 3 different architectural concepts:
1. HLR / VLR as a single distributed database: VLR exists only in order to
distribute/minimise signalling load.
2. Opposite view - VLR is just fulfilling ancillary tasks of MSC (implemented by
most manufacturers)
3. VLR as own , independent unit with its own tasks.
274 276
69
1.9.1.3.1. Functions of location management (continued) 1.9.1.4. The Location Updating Procedures
1.9.1.4.1 The Basic Procedures
• Mobile Station (MS) role on mobility management:
• Canonical work split between Mobile Equipment (ME) and SIM: • Normal reason for change of LA: MS moved into another cell belonging to a different LA
• Non-volatile memory of SIM holds all user related data (incl. mobility related), • Process of location information updating:
ME not. • MS identifies need for location update.
• Manufacturers are however free to put user specific data in ME… • (1) MS notifies MSC/VLR, to which the new cell belongs.
• Volatile data (e.g. forbidden location area for national roaming or list of beacon • This MSC/VLR may be the same, if it controls both LAs or a new one.
frequencies) are kept in ME. • If it is a new one: MSC/VLR notifies HLR (2), which notifies previous VLR (3).
• SIM Card role on mobility management :
• SIM is a passive information container for: 4’ HLR
• Update status (= result of last LA updating attempt)
• Location area identity “old” MSC/VLR 3
• Î function: avoid location update after power on, if MS still is registered. 4
• List of beacon frequencies (of home PLMN or last serving PLMN) 2
• Forbidden PLMN list (Ordered list of the last 4 entries). 1
• Preferred PLMN list (Typically supplied by the service provider. User may edit
this list) 5 “new” MSC/VLR
MS
277 279
1.9.1.3.2. MM Protocols 1.9.1.4. The Location Updating Procedures
1.9.1.4.1 The Basic Procedures (continued)
• For HLR must be able to communicate with all VLR in the world Î MAP/D (part of
SS7) is used. • In case data base update did not work out due to some failures: special procedures are
• SIM – ME interface: limited to simple read, write, delete commands. executed to correct the failed database.
• In order to cover those cases, following elementary procedures are defined:
HLR • Updating of MSC/VLR storage at the request of the MS.
RIL3-MM MAP/D • Updating of HLR storage at request of MSC/VLR.
• Cancellation of a subscriber record in MSC/VLR at request of HLR.
MSC/VLR
MS • MS to MSC Location Updating Procedure:
• Location Update Request is carried by “RIL3-MM Location Updating Request”
SIM-ME message: contains information to identify subscriber.
• MSC/VLR may respond “on its own”, if the user is already registered there.
• MSCVLR may answer with :
SIM • “RIL3-MM Location Updating Accept” or
• “RIL3-MM Location Updating Reject”.
… with a suitable cause

278 280
70
1.9.1.4. The Location Updating Procedures 1.9.1.4. The Location Updating Procedures
1.9.1.4.1 The Basic Procedures (continued) 1.9.1.4.2 Periodic Updating and Database Failure Recovery (continued)
• MSC to HLR Location Updating Procedure: • No direct attempt is made to restore the inconsistency. Else system overload!
• Procedure is used if, • Than an insecure subscriber record is corrected, when some event happens…
• MS asks for registration under new MSC/VLR • Periodic location updating has been introduced as a means to ensure restoration of
• … or HLR had a failure and asks MSC/VLR for confirmation of subscriber databases:
locations. • periodicity is adjusted by operator and broadcast: trade off between signalling
• Request is send by “MAP/D Update Location” message from MSC/VLR, containing: load and time interval when a MS might not be reachable.
• Subscriber identity, • MS start periodic LA.
• Routing data to send up a mobile terminating call (i.e. SS/ address of
MSC/VLR, not precise location area). MSC/VLR Failure
• If subscriber is entitled to normal service: • After failure MSC/VLR restores all records from backup and marks them as insecure.
• HLR updates its memory and … • Then “MAP/D Reset” is send to all HLRs for which it has subscribers in its memory.
• … triggers a location cancellation in the previous MSC/VLR. • MSC/VLR will notice that an MS is missing in its database, when service is requested for
• HLR sends “MAP/D Update Location result” to MSC/VLR. an unknown MS.
• If subscriber is not entitled: HLR puts “Location unknown” in its memory. • MS does call set-up and MSC/VLR notices missing entry in its database.
• Than MSC/VLR puts subscriber into its database and HLR provides further • ThenMSC/VLR enforces new location update by a call rejection with the failure
subscriber data by “MAP/D Insert Subscriber Data” message. cause “IMSI unknown in VLR”.
281 283
1.9.1.4. The Location Updating Procedures 1.9.1.4. The Location Updating Procedures
1.9.1.4.1 The Basic Procedures (continued) 1.9.1.4.2 Periodic Updating and Database Failure Recovery (continued)
• HLR to MSC/VLR Location Cancellation Procedure: • If MS calls from a different LA than registered in VLRÎ record is simply corrected
• Location cancellation from HLR to MSC/VLR consist of “MAP/D Cancel Location” • In case of MS terminating call: VLR notices problem if service request from HLR
message for a MS which is not in its table:
• And acknowledgment in “MAP/D Cancel Location Result” from MSC/VLR. • VLR enters subscriber into its database and
• … asks HLR for subscriber information: “MAP/D Send Parameters” message .
• After reception of “MAP/D Send Parameters” answer the LA addresses are
1.9.1.4.2 Periodic Updating and Database Failure Recovery still missing.
• So MSC/VLR pages to all cells in all LAs !
• An HLR or MSC/VLR may suffer failure and database damage. Recovery:
• From secure backup. • Problem: If MS is in VLR1 area, but HLR imagines, that it is in VLR2 area:
• But if the backup might no longer up to date, several additional recovery • Error will be corrected in VLR1 and HLR, when MS performs periodic location
mechanisms are foreseen: update
• Marking of insecure information in the database and • Error un VLR2 will be corrected by internal house keeping, if e.g. no periodic
• additionally information to all other databases (which share information). location update appeared after a given time.
• These mark the information as well as insecure
• No direct attempt is made to restore the inconsistency. Else system overload!
282 284
71
1.9.1.4. The Location Updating Procedures 1.9.2. Security Management
1.9.1.4.2 Periodic Updating and Database Failure Recovery (continued)
1.9.2.1. The requirements
•2 goals of security on the air interface:
HLR Failure
•Protecting the network against unauthorised access (and users against fraudulent
• Problem: HLR is not necessarily contacted in case of location updates or MS
impersonation)
originated calls.,
•Protecting privacy of users.
• Solution:
•Unauthorised access is prevented by authentication:
• HLR sends “MAP/D Reset” to all VLRs for which it has entries in its back up
•A secure check, whether the subscriber identity provided by the MS corresponds to the
files.
SIM.
• MSC/VLR marks the corresponding records as to be marked with HLR,
•Importance: when subscriber is roaming, the visited network can not check the
• … so the next radio contact with the corresponding MS triggers location
subscribers ability to pay his telephone bill.
updating from MSC/VLR to HLR.
•Privacy is achieved by:
•Ciphering of user data,
•Ciphering of signalling to prevent third party from knowing who is calling/called.
•Preventing eavesdropper from tracing mobiles by using temporary identities.
•Security measures are only used on the air interface. Inside the infrastructure all
communication is clear text !
•All security is handled by the operator. The subscriber has no choice.
•GSM specification leave open many options of applying security (e.g. different ciphering)
285 287
1.9.1.4. The Location Updating Procedures 1.9.2.2. The Functions Ki RAND Ki RAND
1.9.1.4.3 The IMSI Attach and Detach Procedures 1.9.2.2.1. Authentication
A3 A3
• Purpose of this procedure: when a MS is switched off, paging attempts to this MS are in •PIN : is only checked locally versus the PIN stored in
vain, load network resources and are not paid for ! the SIM. No radio transmission, as this would be to
• Solution: when MS is switched off Î MS Detach is performed risky against eavesdropping. SRES SRES
• MS Attach is performed, when the MS is switched on again in the same location area. MS Network
Else a normal location update is performed. •RAND= random figure ( one out of 2128- 1) as
• Detach information is stored in the VLR, so HLR will still try to establish a call till it “question” which is asked by the network.
receives the rejection from the VLR. Equal ?
• So call forwarding can be applied by VLR or HLR as a network option. •SRES = Signed RESponse as an answer to that cryptographic question.
• Support of Attach/Detach is a network option as well.
• AT IMSI Detach MS just sends “RIL3-MM IMSI Detach” and does not wait for an •A3 is secret algorithm. Each operator may use his own:
acknowledge. •A3 is a “trap door” function, i.e. easy to compute SRES out of Ki and RAND, but
• When MS is switched on again in the same LA, it performs IMSI Attach (which is difficult the other way around: to compute Ki out of RAND and SRES.
practically identical to Location Update)
•Ki is the secret authentification of a subscriber stored in a secure area of the SIM. Ki may be of
any format and length .
•A broken authentification key is more critical than a broken communication ciphering !
286 288
72
1.9.2.2. The Functions 1.9.2.2.2. Encryption (continued) Ki RAND Ki RAND
Frame nr Kc
1.9.2.2.2. Encryption Frame number
(22 bits)
Kc
(64 bits) (22 bits) (64 bits)
•A8 algorithm is used to compute Kc.
A8 A8
•Either all (speech/data and signalling) or
A5 A5 •RAND is same as for authentication.
nothing is encrypted – due to simplicity.
S1 S2 S1 S2 Kc Kc
(114 bits) (114 bits) (114 bits) (114 bits) •A8 is again operators choice and not part of GSM
•Ciphering and deciphering = EXOR + + MS Network
ciphering deciphering standard.
between 114 bit of burst and 114 bit generated
by A5 algorithm +
deciphering
+ ciphering
•Kc is limited to max. significant 64 bit. Insignificant
MS BTS bits are filled up with 0.
•Ciphering key Kc is agreed between MS and BTS.
•A3 and A8 are always running together and often implemented as a single algorithm.
•Uplink and downlink use different deciphering sequences S1 and S2.
•Frame number representation is a concatenation of 3 values (T1, T3, T2). The resulting cycle is
the “hyper-frame”, lasting about 3,5 hours (if a call ever lasts that long!).
•Kc is controlled by signalling means and typically changes with each call Î Kc does not need
as strong a protection as Ki, e.g. Kc can be read from SIM.
289 291
1.9.2.2.2. Encryption (continued) 1.9.2.2.3. User Identity Protection
•A5 is specified on international level, as it must be implemented in each MS and BTS in order •Encryption can only be initiated after the identity of the subscriber has been signalled on the
to support roaming. radio channel.
•Several A5 algorithms are implemented (depending e.g. on export regulations for different
countries) •This would be a security loop hole, as it would allow to eavesdrop on this initial part of the
•Level of protection (“hardness”) depends on the computing power needed to break Kc based signalling exchange.
on FN and 114 bit ciphering sequence
•TMSI (Temporary Mobile Subscriber Identity) has been introduced as an alias in order to
avoid this clear text identification of IMSI.
Key Management:
•TMSI is agreed beforehand between MS and network during protected (i.e. ciphered)
•Kc is agreed between MS and network prior to encryption Î during authentication process. signalling !
•
•Kc is then stored in non volatile part of the SIM and in MSC/VLR = “dormant key”.
•If authentication happens, while transmission already is ciphered, Î the active key for the
running ciphering is not affected, but the new “dormant” key is stored for use at the next
transmission between clear mode and cipher mode.
290 292
73
1.9.2.3. Architecture and Protocols 1.9.2.4. The Signalling Mechanisms
1.9.2.4.1. Authentication and Encryption Key Management
•SIM and AUC (typically part of HLR) store Ki and perform A3 and A8 computation.
•2 different procedures:
•Ki is written during card initialisation into SIM under tight control of operator. •Real time authentication procedure and Key setting procedure between MS and
MSC/VLR.
•Ki is only accessed internally in SIM during Kc and SRES computation. •Procedure for transporting security related data between HLR/AUC and MSC/VLR.
•Functions of MSC/VLR: The MS – MSC Procedure

•To initiate authentication,
•Decision when to switch to cipher mode. •Authentication procedure between MSC/VLR and MS:
•Comparison of SRES provided by MS with SRES provided by AUC •“RIL3-MM Authentication Request” message from visited MSC/VLR to MS.
•Storage of dormant Kc •“Run GSM Algorithm” message containing RAND from MS to SIM and shortly after …
•Management of TMSI. •“Get Response” message from MS to SIM, which is answered
•… with SRES and Kc from SIM.
•Security management functions are performed by the same protocols as location management •Kc is stored back in SIM and …
(plus some additional ones), see next figure. •“RIL3-MM Authentication Response” from MS to MSC/VLR giving SRES for checking.
•MAP/G is a small protocol to transfer subscriber data between 2 MSC/VLRs.

293 295
1.9.-1 Security Management Protocols 1.9. Mobility and Security Management

1.9.2.4.1. Authentication and Encryption Key Management (cont’d)
•Dealing with inconsistencies of dormant Kc:
•MSC/VLR provides CKSN (= Ciphering Key Sequence Number) which is stored in SIM
HLR together with Kc.
RIL3-MM MAP/D •CKSN is given back to MSC/VLR at initial access.
•If this is not consistent with stored CKSN in MSC/VLR Î a new authentification
procedure is needed before ordering cipher mode.
MSC/VLR
MS
SIM-ME MAP/G The MSC-HLR Procedures

• Standard allows to do A3/A8 computation in MSC/VLR or in AUC.
SIM AUC •Security breach: if computation in MSC/VLR, than the Ki would be transmitted via SS7
network to another switch. Additionally 2 or more operators would need to share A3/A8 !!!
MSC/VLR
•Computation in AUC requires transmission of (RAND, Kc, SRES) via SS7. Typically
MSC/VLR stores several such triplets for use after roaming subscriber did first location update.
After each call a new triplet (“use and throw away”) is used …
294 296
74
1.9.2.4.2. User Identity Protection 1.9.3. Miscellaneous MM Functions
•TMSI is allocated on LA basis . TMSI code = TMSI + LA code = TIC. Generic Mobile Originating CM-Transaction Establishment
•If MS does location updating attempt in new LA Î TMSI plus LAI is transmitted ! The new
MSC/VLR than asks the old one via MAP/G for the subscriber records … •Why is this procedure needed:
•TIC = 4 octets length, which is shorter than IMSI (consisting of 15 digits coded in 9 octets), so •The initial message of the MS can only be unciphered, as the decision to cipher is made
radio spectrum is saved. by the network.
•However the MS has to give enough information to the network to make the decision to
•TMSI is allocated to a MS when it registers 1st time in an LA and … cipher or not …
•… released, when MS leaves LA.
•TMSI allocation can either be done by a stand alone procedure or in conjunction with a •Solution:
location updating between MS and MSC/VLR: •MS sends “RIL3-MM CM Service Request” message to the network.
•Based on this message th enetwork may start authentication (“RIL3-MM Authentication
MSC/VLR Request” message) or …
MS: Location Updating request Location Updating request
•… answer with “RIL3-MM CM Service Accept” message or …
Location Updating Accept •… by starting the ciphering mode setting procedure (“RIL3-RR Ciphering Mode
or Location Updating Accept Command” message ) …
TMSI Reallocation Command •… or by a rejection: “RIL3-MM CM Service Reject” message
TMSI Reallocation Complete TMSI Reallocation Complete •An equivalent mobile terminated procedure does not exist, as the network decides to apply
ciphering before starting any upper layer procedure.
297 299
1.9.2.4.2. User Identity Protection (continued) 1.9.3. Miscellaneous MM Functions (continued)
•In the combined procedure: TMSI is part of the “RIL3-MM Location Updating Accept”. Upper Layer Synchronisation:
•TMSI Cancellation is normally implicit in MS •Requirement: No MM or CC procedure may be started during a location updating procedure
•upon allocation of new TMSI or in a location area different from the one in which the MS was previously registered Î till
•upon location updating accept. “RIL3-MM Location Updating Accept” message has been received.
•Explicit cancellation:
•By sending IMSI in “RIL3-MM Location Updating” message. This is understood by MS •Reason: A subscriber must be correctly registered, before accessing any network service.
as a cancellation of previous TMSI.
•TMSI is stored in the subscriber record in the VLR, not in HLR: Infrastructure Activity Monitoring:
•Record is deleted upon location cancellation by HLR
•Problem in case of data base crash: •Problem:
•TMSI might be inconsistent and not allocated to the paged subscriber or (worse) to •Radio channel release is done by the infrastructure.
another subscriber. •But due to a signalling failure the MS might be unaware, that the channel had been
•Solution: Network uses a procedure asking MS for its full IMSI: released.
•“RIL3-MM Identity Request “ and “RIL3-MM Identity Response “ from MS. •Solution:
•Used e.g. if authentication failed or a MS calls with unknown TMSI. •MS goes automatically back to idle mode without sending any message to the network, if
there had been no CM-transaction for a given period (T3240 watchdog timer).
298 300
75
1.9. Mobility and Security Management 1.10. Communication Management
1.9.3. Miscellaneous MM Functions (continued)
1.10.1. Basics of Communication Management
Re-Establishment
•Definition: “A communication is a temporary relationship between
•Problem: telecommunication users for the purpose of exchanging information.”
•A MS might loose contact to the network whilst some service is ongoing.
•Normally handover should salvage this situation.
•But if HO is too slow (e.g. steep propagation loss) there might be a chance to resume
•A communication makes use of a transmission chain established through networks
contact in the next cell … between users.
•Solution: •A communication is by essence a distributed “object” existing over distances.

•Re-establishment is very similar to MS triggered handover.
•The initial message of the MS is “RIL3-MM CM Re-Establishment Request”. •Cooperative management of the machines along the transmission line is needed .
•Than the network uses the same procedures as the for CM establishment:
•“RIL3-MM CM Re-Establishment Accept” or •Attributes of a communication may be static (initialized at the beginning of the
•“RIL3-MM CM Re-Establishment Reject”.
communication) or dynamic (changing during the call) .
•The feature is optional for networks, but mandatory for mobiles.
•If the feature is used in the network, the call context must be kept a little after contact
loss.

301 303
1.10. Communication Management 1.10. Communication Management

•Managing calls is a standard task of all communication systems: 1.10.2. Call Control
•So GSM reused many concepts of existing ISDN protocols 1.10.2.1. Routing of Mobile terminating calls
•… and has to interwork with existing telecom networks.
•GSM is seen as an “access network” to the global telecom network.
•MSISDN:
•Number of a mobile phone, is part of the ISDN numbering plan, consisting of e.g
•However the ISDN signalling was extended by the concept of the gateway MSC. . National
Country Code destination Code
•The key issues of Communication Management are how to
CC NDC Subscriber number
•set up,
•maintain and e.g.: +49 172 1234567
•terminate
a communication •A MT call does not go directly to a MS, but MSISDN points to a HLR, where the
subscription is held.
•The HLR holds the location information of the mobile.
•So the questions are:
•So a call is separated in 2 phases: before and after interrogation of HLR.
•What is a communication, •2 different cases, depending on where second part of the call goes through:
•What are its attributes PSTN or ISDN (described here) or through data networks (not described here)
•What are the key functions of call management. •SMS is handled differently from .
302 304
76
1.10. Communication Management 1.10. Communication Management
1.10.2.1. Routing of Mobile terminating calls (continued) 1.10.4. Short Messages
•First part (Interrogation phase) of call :
•Routing is done as for any ISDN number : with tables in the switches. •SMS is packet oriented, so no end-to-end connection is required.
•A call from an external network is routed to the next GMSC.
•GMSC runs request-answer procedure with HLR. •SMS may go on in parallel to a call .
•HLR answer contains:
•Identity of subscriber (for billing) •SMS is asymmetric: MT SMS is considered as a different service from MO SMS .
•Information for the next routing: routing number pointing to the called subscriber
in present location (or a third user in case of forwarding). •Short message communication is always between a user and an SM-SC. So the ultimate
•Second part of call (after interrogation) is directly switched from GMSC to MSC/VLR destination of the message is not relevant for the GSM infrastructure, but only for the SM-
SC.
Directory
number HLR
MT Call
Routing
number
Directory
Number GMSC
Routing
number
4/2/2003 U.A.Hermann: GSM MSC VLR 305 4/2/2003 U.A.Hermann: GSM

307
1.10. Communication Management 1.11. Network Management

1.10.3. Supplementary Services What does a network operator do in order to operate his net ?
•Defining/Managing locations (=> cellular planning) and capacities of
•Generally Supplementary Services can be infrastructure
•Activated •Procurement, installation, linking of machines.
•Deactivated •Configure machines => configuration management.
•Evtl. Parameters may be set (e.g. forward-to number)
•Fault handling => fault management.
•Parameters may be interrogated
•Tuning and optimizing the network => performance management
•SS interact with call handling, e.g. •Management of subscribers and their data.
•Call forwarding, •Billing and charging.
•Call waiting
•Call hold … The OSS (=Operation Subsystem) is supporting the operator in these tasks:
•These tasks are not particular for GSM, but usual for many kinds of telecom
operations.
•TMN (= Telecommunications Management Network) => architecture of the
OSS

306 308
77
1.11. Network Management 1.11. Network Management
1.11.1. Subscriber Management 1.11.3. Mobile Station Management
•Subscription = entitlement to obtain services from the network. •Defective MS might disturb the network and other users.
•Certain activities have to be performed to manage subscriptions
•Measures:
•Billing and charging: •Preventive approach: type approval : to prevent badly designed MS to enter service.
•Curative approach: to identify faulty mobiles, inform users, bar services
•CDRs (=Charge Data Records) have to be created and managed in order to
calculate call charges.
•Additional aspect compared to fixed networks: Due to roaming inter-PLMN
billing and accounting has to be done.
•Charging information is exchanged between networks.

309 311
1.11. Network Management 1.11. Network Management

1.11.2. Maintenance 1.11.4. System Engineering and Operation
•Fault management includes: •Activities of system engineering:

• minimisation of loss of service quality due to failure. •Calculate capacity requirements,
•Detect failures •Determine/Select locations.
•Report failures accurately. •Dimension & design interconnecting network (backbone network)
•Restore operational state of the failed network entity •Configure system, parameter setting (e.g. handover parameters, routing tables etc.)
•Typical failure causes: •Cost effectiveness:

•Limited lifetime of electronic components: with millions of components in a net with e.g. •Adapt network configuration to the traffic and …
10.000 BTS even a component lifetime of many years leads statistically to many faults per •… to quality of service requirements.
day! •Network planning= multidimensional, time variant optimisation problem !
•External impacts: lightning, electricity break down, storm, accident, … •Market forecasts needed in order to prepare net to expected traffic load.
•SW errors: SW complexity is so high, that a complete testing, particularly of all load, •A network is a living and growing object undergoing many changes as technologies
overload and abnormal cases is impossible. develops (e.g. from GSM to GPRS) Î change management required.
•Aspects of maintenance: •Planning:

•Preventive maintenance and testing (e.g. self test, test loops etc.) to minimize failures. •Cellular planning as particular task for mobile networks.
•Watch dogs, performance monitors, drive tests etc. to detect failures. •Planning of switching and transmission systems as standard task.
•Automatic
4/2/2003
recovery: switch to redundant HW,
U.A.Hermann: GSMrestart of SW, etc. 4/2/2003 U.A.Hermann: GSM
310 312
78
1.11. Network Management
1.11.5 Architecture and Protocols
•Operation & Maintenance has to be done from remote and centralized machines:
Due to cost and efficiency reasons a typical German GSM net is managed from
10- 12 OMCs (Operation and Maintenance Centres) and central 1 NMC (=
Network Management Centre) for e.g. night time concentration.
•Typical OMC tasks:

•Change parameters,
•Download SW
•Start tests
•Receive alarms, etc.
•TMN is about
•the machines designed for these tasks …
•… and the networks and protocols between the machines
313
Bibliography
[Mouly, Pautet – 1992]: Michel Mouly, Marie-Bernadette

Pautet : “The GSM System for Mobile
Communications”, 1992.
[Hildebrand - 2002]: Friedhelm Hildebrand: “GSM and

UMTS, the Creation of Global Communication”, Wiley
[Sklar - 1988]: Bernard Sklar: “Digital Communications –

Fundamentals and Applications” , Prentice Hall

314
79
2.1. Introduction (continued)
2. •Advantages:
•“Always on” feature.
•Possibility for charging on traffic volume: user doesn’t pay for idle capacity
General •Variable transmission rates up to 171.2 kbps.
•Sharing of scarce system resources for bursty data traffic between several users
•Target applications with transmission of:
Packet Radio •Frequent transmission of small volumes and
•Infrequent transmission of small to medium data volumes
•Not for big volumes: circuit switched connections are more efficient (HSCSD)
Service • Interface between GPRS service and application protocols is based on
•Point-to-point protocol (PPP) or
•Commonly used drivers ( e.g. NDIS= Network Driver Interface Specification)
[Zvonar, Jung, Kammerlander - 1999]
2.1. Introduction 2.2. GPRS Network Architecture and Protocols

• GPRS network architecture is built on top of the existing GSM network
•GPRS belongs to GSM phase 2+ infrastructure
•GPRS = data service providing • New network elements are needed for packet switching functionality
•Packet radio access for GSM mobile phones (figure 2.2.-1)
•And packet switched routing functionality in GSM infrastructure – Gateway GPRS Support Node (GGSN)
•Optimised for • Maintains the location information of the mobiles. This is needed in order
•Bursty data transfer and to perform the routing of the data packages.
•Occasional transfer of large volumes of data • Serves as an interworking node between GPRS PLMN and the external
•ETSI standard release contains: data network (e.g. Internet or X.25 network)
•Point to point transfer of user data • Tunneling : based on the address of the packet received by the external
•Internet and X.25 interworking data network, the GGSN can tunnel the packet to the appropriate SGSN.
Also packets transmitted by a mobile station via SGSN to GGSN are
•Quick SMS transfer using GPRS routed to the external network.
•Filtering functionality for security reasons • Collecting charging information for billing purposes.
•Volume based charging tools. – Serving GPRS Support Node (SGSN)
•Anonymous access (e.g. used for prepaid cards in traffic information systems) • Participates in routing and mobility management functions
•Roaming between PLMNs (= Public Land Mobile Networks) • Detects and registers new GPRS mobiles located in its service area
•Point-to-multipoint transfer (= PTM): PTM-Group call and PTM-Multicast • Transfers data packets between mobiles and GGSNs
•Supplementary Services
•Additional interworking functionality (e.g. ISDN and modem interworking)
1
2.2. –1. Logical architecture for GPRS PLMNs 2.2. GPRS Network Architecture and Protocols (continued)
• Base Station Subsystem (= BSS)

Border – Runs low layer transmission protocols
GW GPRS
GPRS – GPRS BSS runs additionally medium access and automatic retransmission
Visited protocol.
MSC/VLR backbone
backbone
Border
GW PLMN
• Packet Control Unit (PCU) may be in the BTS (= Base Transceiver Station)
– Or remote in the BSC (Base Station Controller) or SGSN.
HLR
– In that case case data and signalling messages are carried by PCU frames,
that are extended TRAU (= Transcoder and Rate adaptation Unit) frames.
SGSN SGSN
• Protocol architecture between BSS and SGSN:
EIR – Based on Frame Relay
BTS – Utilising virtual circuits to multiplex data from several mobiles.
SGSN
– The link may be point-to-point or multi-hop.
GGSN
Home PLMN GGSN – A GPRS specific BSSGP (BSS GPRS Protocol) is used on top of the
Frame Relay.
Internet
Internet – BSSGP provides message formats and procedures for transfer of data and
paging messages, and mechanisms for management of the link.
Internet
host
• For the overview on the protocol architecture of the GPRS transmission
plane, see figure 2.2.-2.
2.2. GPRS Network Architecture and Protocols (continued) 2.2.-2 Protocol architecture in GPRS transmission plane
Um Gb Gn Gi
– Backbone network connects SGSN and GGSN nodes Applications
• Tunneling of data and signalling messages between GPRS support L3
S X25 IP IP X25
nodes is carried over GPRS backbone network. M
MM
S SNDCP
SNDCP GTP GTP
• Protocol architecture is based on Internet Protocol (= IP)
• TCP/IP is used for network protocols requiring reliable transfer over LLC LLC UDP/TCP UDP/TCP
backbone, RLC RLC BSSGP BSSGP IP IP
• … else the User Datagram Protocol (= UDP) I sused with IP (e.g. for MAC Frame
MAC Frame Relay Relay L2 L2
Internet communication.
• Type of Backbone network that is selected by a roaming agreement,
GSM RF GSM RF L1bis L1bis L1 L1
can be a public Internet or a leased line MS BSS SGSN GGSN
SNDCP= Subnetwork Dependent BSSGP= BSS GPRS Application
– Border gateway handles transfer between GPRS PLMNs
Convergence Protocol Protocol
• Provides security over the backbone network
LLC= Logical Link Control GTP= GPRS Tunneling Protocol
MAC= Media Access Control TCP= Transmission Control Protocol
– Domain server can be used for address translation. RLC= Radio Link Control UDP= User Datagram Protocol
RF= Radio Frequency IP= Internet Protocol
(Physical Layer)
2
2.2. GPRS Network Architecture and Protocols (continued) 2.3.-4. State Model of a GPRS mobile station
• MSC (= Mobile Switching Centre) and VLR (= Visiting Location Register)

are not needed for routing of GPRS data,
– But for co-operation between GPRS and other GSM services, IDLE
– … like for class A mobiles using GSM and GPRS simultaneously.
• HLR (= Home Location Register) contains the GPRS subscription and GPRS Attach GPRS Detach
Routing information
• AuC (= Authentication Centre) generates authentication and ciphering
Standby
parameters. Ready
timer
• EIR (= Equipment Identity Register) authenticates mobiles, and removes
stolen mobiles from the network. expired
• SGSN interacts with MSC/VLR, HLR, AuC and EIR using SS7 Ready time expired or Transmission of packets
Force to STANDBY
(= Signalling System no. 7)
Standby
2.3. GPRS Mobility Management 2.3. GPRS Mobility Management
2.3.1. Mobility Management States (continued)

Layer three Mobility Management (L3MM) protocols support continuous
service, independently of the mobility of the subscriber.
In GPRS the L3MM covers –Standby State is a state, when the mobile is prepared for data transfer, but not
actively transferring at the very moment:
–Initialisation of service and data protocol (PDP) context
–MM context between mobile and SGSN is active
–Tracking the location of the subscriber.
–Mobile informs SGSN every time it changes from one routing area to
another
2.3.1. Mobility Management States –Routing area is a set of cells (from one cell to the size of a location area)
defined by the operator
There are 3 MM stages in GPRS: –The mobile may receive pagings for :
–Idle , Standby , Ready (see figure 2.3.-3.) –Circuit switched services
–GPRS point-to-point (PTP)
–Idle state: –Point-to-multipoint group call (PTM-G) data
–mobile may perform GPRS cell selection, re-selection –PTM-M
–But MM and routing contexts are not active in the mobile and the SGSN.
–Mobile may only receive point-to-multipoint – multicast (PTM-M) data.
3
2.3.2. Attach Procedure (continued)
2.3.1. Mobility Management States (continued) The SGSN controls the data exchange, that means the SGSN may:
–request authentication of the mobile,
–Ready state must be entered, if the mobile intends to receive or transmit data –initiate ciphering,
(except for PTM-M). –check the IMEI.
–…, because the network needs to know the exact location of the cell , –In case of change of location:
where the mobile camps. –Location information in the HLR is updated.
–The mobile informs the SGSN each time, it switches between cells. –Context in the old SGSN is deleted
–Ready state is guarder by a timer: Times is reset after each reception or –Subscription information in the old SGSN is updated.
transmission of a packet. When timer elapses, the mobiles falls back into
standby state. –Location information is delivered to the new MSC/VLR
–Change from Standby to to Ready may be initiated by the network, using a –Information in old MSC/VLR is deleted.
paging procedure. –During Attach the TLLI may be changed.
–When mobile sends data, it transfers data immediately and changes state –After attach is completed, the mobile may
automatically from Standby to Ready. –Transfer SMS
–Receive PTM-M messages
–Activate PDP context for some packet data protocol

2.3.3. Activation of PDP context and session management (figure 2.3.-5.)
2.3.2. Attach Procedure –To exchange data packets with external PDNs (= Packet Data Network) a
mobile station must apply for an PDP address used in that PDN.
–Attach procedure is carried out, when GPRS subscriber wants to send or –In case the PDN is an IP network, the PDP address will be an IP address.
receive data. –PDP context is created for each session., containing
–Attach is initiated by the mobile –PDP address assigned to the mobile.
–Under Attach mobile delivers : –Requested QoS (= Quality of Service) class.
–Identity of the mobile station –The PDP context is stored in mobile, SGSN, GGSN.
–TLLI (= temporary identifying link identity) combined with routing –After PDP context is active, the mobile can send and receive data packets.
area identity where TLLI was given –In case of static PDP address allocation:
–… or IMSI, in case TLLI was never given before –The mobile permanently owns a PDP address, which has been assigned
–IMEI by the operator of the home network.
–If the identity is known only by another SGSN, an identification from –In case of a dynamic PDP address allocation:
this SGSN is requested –A PDP address is assigned upon activation of PDP context.
–Ciphering key sequence number –PDP address can be assigned by home-PLMN.
–Classmark of the mobile station –… or by the visited PLMN
–GGSN is responsible for the allocation and deactivation of the address.
4
2.3.-5. PDP context activation 2.3. GPRS Mobility Management
2.3.4. Location Management (continued)
–When a mobile moves to a new RA, it sends a Routing Area Update Request
SGSN GGSN to its assigned SGSN.
MS
–Intra-SGSN Routing Area Update : SGSN already has user profile and
assigns immediately a new P-TMSI
Activate PDP Context Request –Inter-SGSN Routing Area Update: the new RA is admistered by a new
[PDP Type, PDP Address, SGSN. The new SGSN requests the old SGSN to send the PDP context of
QoS Requested, Access Point, …] the user. Afterwards the new SGSN informs the involved GGSN abouit the
user’s new routing context The HLR (if needed) and the MSC/VLR are
Security Functions informed about the new SGSN number.
Create PDP Context Request –Routing area and location area update may be combined, if the mobile is GPRS
[PDP Type, PDP Address, and IMSI attached (I.e. GPRS and GSM service is used at the same time): the
QoS Negotiated, Access point] message Routing Area Update Request contains a parameter update type to
indicate that an LA (= Location Area ) update is requested as well.
Create PDP Context Response –Summary: 2 levels of mobility management:
[PDP Type, PDP Address, –Micro mobility management keeps track of current RA or cell.
Activate PDP Context Accept QoS Negotiated, Access point] –Macro mobility management keeps track of current SGSN and stores it in
[PDP type, PDP Address, HLR, VLR and GGSN.
QoS Negotiated, …]
2.3. GPRS Mobility Management 2.4. GPRS Air Interface

2.3.4. Location Management
–When a mobile is moving, the location must be known by the network. • Key aspect in GPRS: the enhanced air interface offers higher data rates
and a packet-oriented transmission
–For this purpose the mobile frequently sends location update messages to its
SGSN. There is a trade-off: • This chapter describes
–Seldom updates: the network must perform a paging in order to search the – How several mobiles can share one physical channel (multiple
mobile. This means delivery delay. access).
–Frequent updates: lot of uplink radio bandwidth and battery power is used. – how the assignment of radio resources between circuit-switched
GSM services and GPRS services is controlled.
–Location update frequency depends on the mobile state:
–Idle: no location update is performed, I.e. the location of the mobile is
unknown to the GPRS network. 2.4.1. Multiple Access and Radio Resource Management
–Ready: each movement to a new cell is signalled to the SGSN. No paging – In circuit switched GSM a physical channel (i.e. 1 time slot of
is needed. successive TDMA frames in uplink and downlink) is permanently
allocated for a particular mobile during the entire call, no matter
–Standby: only changes to the Routing Area are signalled. A routing Area whether data is transmitted or not.
comprises one or more cells and is typically smaller than the Location Area.
In case of incoming packets a paging procedure must be done in order to – GPRS is far more flexible for packet transmission. AGPRS mobile can
find the mobile. transmit on several of the 8 time slots within the same TDMA frame
(multislot operation). The number of slots determines the multislot
class. Up- and downlink are allocated separately. Advantage for
asymmetric traffic.
5
2.4. GPRS Air Interface 2.4. GPRS Air Interface
2.4.1. Multiple Access and Radio Resource Management (continued) 2.4.2. Logical channels
– A cell supporting GPRS must allocate physical channels for GPRS
traffic. The radio resources of the cell are shared by all mobile stations Group Subgroup Channel Function Direction
(GSM and GPRS) in that cell.
– PDCH (= Packet Data Channel), a physical channel which has been Traffic Channels Packet Data traffic PDTCH Packet data traffic MS <> BSS
allocated for GPRS transmission. Channel
– Capacity on demand principle: the number of PDCHs can be adjusted Signalling Channels Packet broadcast PBCCH Packet broadcast control MS << BSS
according to the current traffic demand. E.g. physical channels control channel
currently not used can be allocated as PDCHs for GPRS in order to Packet common PRACH Packet random access MS >> BSS
increase the quality of GPRS service. Equally PDCHs may be de- control channel
allocated, when there is a resource demand for GSM. (PCCCH) PAGCH Packet access grant MS << BSS
– Dynamic channel allocation: a particular PDCH is only allocated for a PPCH Packet paging MS << BSS
particular MS, when it sends or receives data. So multiple MSs can PNCH Packet notification MS << BSS
share one physical channel. For bursty traffic, this results in a much Packet dedicated PACCH Packet associated Control MS <> BSS
more efficient use of the radio resources. control channels
PTCCH Packet timing advance control MS <> BSS
– Channel allocation is controlled by BSC:
2.4.1. Multiple Access and Radio Resource Management (continued) 2.4.2. Logical channels (continued)
– PDTCH: is for transfer of user data. Assigned to 1 mobile (or in case of PTM to
– Channel allocation is controlled by BSC: multiple mobiles). One mobile can use several PDTCHs simultaneously.
– The allocation of PDCHs to a mobile depends on its multislot class – PBCCH: unidirectional, point-to-multipoint signalling channel. For BSS to
and the QoS of the session. broadcast information about the organisation of the GPRS radio network to all
– Collision prevention: network indicates in the downlink, which mobiles of a cell. For GSM/GPRS mobiles as well information about circuit
channels are currently available. An Uplink State Flag (= USF) in the switched channels is transmitted, so that the mobiles do not need to listen to
header of downlink packets shows which MS is allowed to use this BCCH (= Broadcast Control Channel).
channel in uplink. – PCCCH: transports signalling information for functions of the network access
management, I.e. allocation of radio channels, medium access control, paging.
Sub-channels:
– PRACH: used by mobile to request one or more PDTCH.
– PAGCH: used to allocate one or more PDTCH to a mobile.
– PPCH: used by the BSS to find the location of a mobile station prior to downlink
packet transmission.
– PNCH: used to inform mobile stations of incoming messages.
6
2.4. GPRS Air Interface 2.4.-2 Paging (mobile terminated packet transfer)
2.4.2. Logical channels (continued)
– Packet Dedicated Control Channel: bi-directional point-to-point signalling
channel containing: MS BSS
– PACCH always allocated in combination with one or more PDTCH. It transports
signalling information related to one specific mobile station (e.g. power control) Packet Paging
– PTCCH: used for adaptive frame synchronisation. Mobile sends over the uplink Request PPCH or PCH
part of the PTCCH (= PTCCH/U) access bursts to the BTS. From the delay of
these bursts, the correct value for Timing Advance (= TA) is derived. This value Packet Channel
is than transmitted in the downlink part (= PTCCH/D) to the mobile.
PRACH or RACH Request
– Figure 2.4.-1. Shows the principle of uplink channel allocation:
– Once the Packet Channel Request is successful, a so-called “Temporary Block
Flow” (= TBF) is established.
– With that TBF, resources (e.g. PDTCH and buffers ) are allocated for the mobile Packet Immediate
station, and data transmission can start. Assignment PAGCH or AGCH
– In the optional case of a 2 phase access, the packet channel request leads to the
reservation of a packet associated control channel (PACCH) The packet resource
request of the mobile will than contain all the details of the requested service
Packet Paging
PACCH Response
– Figure 2.4.-2. Shows the paging procedure of a mobile. Paging may be subject to
discontinuous transmission in order to save battery power
2.4.-1 Uplink channel allocation (mobile originated packet 2.4. GPRS Air Interface
transfer)
2.4.3. Subnetwork dependent convergence protocol (SNDCP, fig. 2.2.-2.)

MS BSS
Packet Channel – SNSDCP is between mobile and SGSN.
PRACH or RACH – Used to transfer packets of the network layer (IP and X.25 packets)
Request
– Functions:
Packet Immediate – Multiplexing of several PDP contexts of the network layer onto one virtual logical
Assignment PAGCH or AGCH connection of the underlying LLC layer and,
– … segmentation of network layer packets onto one frame of the underlying LLC
Layer and reassembly on the receiver side.
– Compression and decompression of user data and redundant head information (e.g.
Packet Resource TCP/IP header)
PACCH Request
(optional)
Packet Resource
Assignment PACCH
(optional)
7
2.4.4. Data Link Layer (see figure 2.2.-2.) 2.4.5. Summary
– Data link layer is subdivided into 2 sublayers: – Figure 2.4.- 3. Illustrates the data flow between the protocol layers in the mobile
– Logical Link Control (LLC) between MS and SGSN station.
– Radio Link Control / Medium Access Control (RLC/MAC) between MS and – Packets of the network layer (e.g. IP packets) are passed down to the SNDCP
BSS. layer, where they are segmented to LLC frames.
– After adding header information and a Frame Check Sequence (= FCS) for
– LLC provides a reliable logical link between mobile and its assigned SGSN error protection, these frames are segmented into one or several RLC data
including: blocks.
– In-order delivery – Those are then passed down to the MAC layer
– Flow control – One RLC/MAC block contains a MAC and RLC header, the RLC payload
– Error functions ( “information bits”) and a Block Check Sequence (= BCS) at the end..
– Support of variable frame length and – This user data is than mapped on the PDTCH..
– … different QoS classes
– Point-to-multipoint and point-to-point.
2.4. GPRS Air Interface 2.4.-3. Data Flow and segmentation between the protocol
layers in the MS GPRS Air Interface
2.4.4. Data Link Layer ( continued)

Header Payload e.g. IP packet
– Functions of RLC :
– Purpose of RLC is to establish a reliable link between the MS and the BSS.
– Including segmentation and reassembly of LLC frames into RLC data blocks and RAQ of
uncorrectable blocks. Segment … Segment SNDCP Layer
– Functions of MAC
– Purpose of the MAC is to control the access attempts of mobile stations on the radio channel.
This is based on the “Slotted-Aloha” principle. Header FCS LLC Layer
– MAC contains algorithms for contention resolution of access attempts and
– … statistical multiplexing of channels (how several mobiles can access the same physical
channel) and
– … a scheduling and prioritising scheme , which takes into account the QoS
– MAC protocol allows, that a single MS simultaneously uses several physical channels.
Segment … Segment
RLC / MAC Layer
RLC / MAC block Header Information bits BCS
8
2.5. Summary: example of GPRS data transfer 2. Bibliography
• The mobile is ready for receiving and transmitting data,

– … when it has been successfully attached to the network [Zvonar, Jung, Kammerlander - 1999]: Zoran Zvonar, Peter Jung, Karl
Kammerlander: “GSM – Evolution towards 3rd Generation Systems”,
– … and the PDP context for IP (in this example) has been established.
Kluwer Academic Publishers; Boston, Dorderecht, London
• The IP datagram is compressed and encapsulated into an SNDC protocol
unit.
• That is sent to the SGSN over the air interface using LLC, RLC/MAC and [Eberspächer, Vögel, Bettstetter - 2001]: Jörg Eberspächer, Hans-Jörg Vögel,
physical protocols. Christian Bettstetter: “GSM – Switching, Services and Protocols”, John
Wiley and sons;
• When the SGSN has received error free, it tunnels the packet through the
GPRS backbone net work to the GGSN.
• GGSN removes the tunneling and forwards the IP datagram to the Internet,
• The Internet passes the packet to the recipient.
• Internet host does not need to know, that the peer entity is a GPRS mobile. It
just uses the attached IP address of the mobile
• Internet routing protocols are used to route the packet to the subnetwork from
which the the IP address of the mobile has been acquired.
2.5. Summary: example of GPRS data transfer
•When the IP datagram arrives at the GGSN: the IP address of the receiver is
extracted and mapped to the current location of the mobile station.
•The IP datagram is tunneled through the backbone network to the SGSN that is
currently serving the mobile station.
•The SGSSN removes the tunneling and the original datagram is encapsulated
into the SNDC protocol data unit.
•This is send to the mobile over the air interface using LLC, RLC/MAC and the
physical protocols
9
3.1. Introducing the Wireless Application Protocol
3. The 3.1.3. Some History
Wireless Access •
–
Requirement of bearer independence:
GSM, D-AMPS, CDMA, GPRS, PDC,
Protocol
– Even non voice: Mobitex, paging systems
• The WAP Forum Ltd.
– Founded in Dec. 1997 by the four parties (Nokia, Ericsson, Motorola,
(WAP)
Phone.Com)
– WAP 1.0 standard in April 1998
– May 1999: first commercial version WAP 1.1.
– May 2000: more than 200 members
[Heijden, Taylor - 2000]
3.1. Introducing the Wireless Application Protocol [Heijden, Taylor - 2000] 3.2. Executive Summary of WAP [Heijden, Taylor - 2000]
3.1.1. Introduction
• WAP= global Standard, independent of underlying bearer.
• First introduction of data-oriented mass services.
• Started 1997 by Ericsson, Nokia, Motorola, Phone.Com 3.2.1. Optimised for wireless communications
• Wireless restrictions:
3.1.2. Why was it done – Display size,
• Fragmentation of market into different, mutually incompatible, – Number of keys
proprietary protocols – CPU capacity
– Phone.Com: HDML (= handheld device markup language) for Internet – Power consumption
access over CDPD (= cellular digital packet data) networks. – Limited bandwidth etc.
– Nokia: TTML (= tagged text markup language), similar focus as Lead to differences compared to Internet
HDML, but designed for GSM
• Over-the-air interface communication = binary coded
– Ericsson: ITTP (= intelligent terminal transfer protocol) for telecom-
related services and messaging inside GSM networks. • Message headers and frequently send plaintext messages =
– Plus lots of others …
represented as bytes
• Market did not take off due to fragmentation. • Original Content is restored in the receiver (WAP browser)
• Need for a worldwide, open, generic standard.
1
3.2. Executive Summary of WAP 3.2. Executive Summary of WAP
3.2.2. Deck of cards 3.2.4. Microbrowser

• “Deck of Cards” metaphor: • WAP Microbrowser = similar to Internet browsers
• Applications to be written in WML (= Wireless Markup Language)
“a deck is send from the network to a user’s terminal, when a
• WML follows XML as opposed to HTML, but similar structure as HTML
command is entered to invoke a service”
• Easy conversion (= filtering) of HTML to WML.
• User navigates through deck to make a choice. • WAP spec. does not cover filtering nor browser spec., but just minimal
• If choice is not included in the deck another one is transmitted. functions which are required.
• When user choice is done, the required action is performed.
3.2.5. WMLScript
• Depending on capacity of phone decks and cards can be cached for
• Very similar to JavaScript / ECMAScript
future use.
• Objective: to enable the handset to process more information locally before
sending to server.
3.2.3. The WAP stack
• WAP stack is similar to the layers used in the Internet 3.2.6. Wireless telephony application and the WTA interface (= WTAI)
• WTA uses WTAI to do call-control, call-handling etc.
• See figure 3.2.-1
• WTAI ensures that WTA user agent interacts with mobile network
functions (e.g. call set up) and device specific functions (e.g. phone book
manipulations)
Figure 3.2.-1 Schematic representation of WAP

3.2. Executive Summary of WAP
stack and Internet Stack
Internet Wireless Application Protocol 3.2.7. The WAP gateway (= G/W)
HTML Application Layer Other services • WAP G/W = intermediary, connecting the mobile network to the
JavaScript Internet.
and
• WAP G/W translates the HTTP (= hypertext transfer protocol) to
Session Layer applications the wireless session protocol (= WSP)
HTTP • WAP G/W may be owned by an operator or a company (inside the
Transaction Layer firewall)
Internet
• WAP G/W may also convert content, e.g. HTML page conversion
into WML
TLS-SSL Security Layer • See picture 3.2.-2
TCP/IP Transport Layer (WDP) WCMP

UDP/IP Bearers
SMS USSD CSD IS-136 CDMA CDPD PDC …
2
3.2.-2 simplified WAP network architecture 3.2. Executive Summary of WAP
3.2.9. Benefits and market opportunities

Web Corporate WAP • Operator gets a new category of services for the subscribers.
G/W-proxy
server • Opening mobile services to third party providers.
Corporate Environment
• … such as content providers.
Firewall • Improved customer services and help desk
Filter • Remote tailoring of MMI and menu’s in telephones for service
differentiation.
HTML WML • New business case for operators: remain “air time provider” or go
into content business or be a content broker?
• Mass Market: order of magnitude more phones than PCs world wide
WML
Web WAP G/W
Binary WML
(soon 1 Mrd. mobile phones) !
proxy
server • E-payment as a precondition for commercial success (see picture
Wireless 3.2.-3)
network WTA
: not defined in WAP server
3.2. Executive Summary of WAP 3.2.-3. Advanced Payment Architecture [Kocsis – 1999]:
3.2.8. Applications using WAP

• “… only imagination sets the limit …”
• Internet surfing: limited by handset restrictions > Usability and
MMI design aspects dominate.
• Service-personnel: e.g. data retrieval on inventory, delivery dates
etc.
• User / Push Notification: e.g. e-mail, voice-mail has arrived, retrieve
or redirect information. E.g. notification of share values passing
limits.
• Mobile Commerce: auctions, banking, ticket sales, hotel booking…
• Guidance functions: e.g. “where do I find ….”, traffic information,
flight schedules etc.
• “Kill Time” <> “Save Time” services.
• Kill Time= Games , gambling, infotainment, …
3
3.3Wireless Application Environment (= WAE) for 3.3.-1. HTML “page” concept compared to WML “deck
Creating WAP Services and Applications of cards” concept
3.3.1. Introduction
• Advantages of Internet vs. Mobile Networks:
– Internet: rich and comfortable user interface, high data rates.
– Mobility (wherever you are)
• WAE = for application developers 2 1
• WAE consists of
– WML (= wireless markup language) 2 1
– WML Script (= wireless markup language script)
1 3
– WTAI (= wireless telephony application interface)
• WAP communication protocol layers deal with:
– Low bandwidth
3
– Long delays
– Unreliable connection of the air interface
• WAP developer: may achieve data compression by encoding in
binary format HTML “page” concept WML deck of cards concept
3.3Wireless Application Environment (= WAE) for 3.3Wireless Application Environment (= WAE) for
Creating WAP Services and Applications Creating WAP Services and Applications
3.3.2. Wireless markup language 3.3.3. Deck of cards
• WML is described using the extensible markup language (= XML) • The markup part of WML consists of tags (the markup) with attributes
• WML document type definition (DTD) describes the format of a specific XML conveying additional information.
document • Tags may have 2 standard optional attributes:
• Documents that are marked up following the format of XML Spec.= “well – Id = uniquely references a particular element within a deck
formed”, … – Class = for use by the server side
• when also complying with DTD = “valid” • WML file must be enclosed within: <wml> and </wml> tags.
• Internet= “page” metaphor, WML = “deck of cards” metaphor. • Within this pair cards are created by <card> and </card> tags.
– Reduction of required screen area and graphical capabilities • Standard attributes (id and class) and card elements can have a title attribute:
– Reduction of network transactions. can be used by UA (= user agent) to render WML content.
– See figure 3.3.-1 • Id attribute for cards can be used to reference the card directly from an URL.
• Contrast to web browsers: how a UA renders WML depends on device type: • “Shadowing”: template for all cards within a deck, in which certain WML event
– Text only mobile phone, or bindings can be predefined, so they need not be repeated in every card:
– PDA or – Opening tag : <template>, closing tag: </template>
– Smart phone with big graphical display • Head element: specifies information relevant to the entire deck of cards.
• WML endures readability and usability of content regardless of handset type Provides a mechanism for including various types of meta-information related
(problem e.g. how to display an image map… ?!) to the deck, such as access control information, details of character set, …
• WML deck consists of text, with structure provided by elements (= tags) .
• Each element may have attributes (often used to instruct the browser how to
render the content)
4
3.3.4. User Input 3.3.6. WML Script
• Input elements are similar to HTML, but detail of implementation is similar: • Scripting language based on JavaScrip,
– however WMLScript code is not embedded within the WML deck,
information is not just send to the remote server, but stored on the UA as
– but compiled into binary files, called compilation units.
“browser variables”. – Compilation units are send to the user agent, rather than textual files.
• input element for numeric or alphanumeric input data. • WMLScript = “dynamically typed language”,
• format, e.g. YYYY-MM-DD, or length of input, empty input etc. – All variables within the language have a type internally, but
– Variables are not explicitly typed: any variable can contain a value of any type !
• select element : presents to the user a set of options from which to choose.
• 4 Datatypes: integer (32 bit signed), boolean (true or false), floating point numbers
• Considering the wide range of possible WAP devices: (IEEEE single precision), strings (any length)
– Intelligent use of attributes • Java operators supported: normal arithmetic, bit-wise, comparison, logical,
– Tuning interface constructs conditional.
• WMLScript standard libraries:
– Intelligent use of options
– String: operations – also promitives useful for array operations
For improving usability – Dialogs: to alert and prompt the user.
– URL: functions for parsing URLs, esacaping and unescaping, and downloading content
directly into WMLScript variables.
– WMLBrowser: interaction with the user agent – refreshing, getting and setting variables,
changing the displayed URL, …
3.3.5. Task invocation
• Control for user interaction: 3.3.7. Wireless telephony application interface (WTAI)
– HTML: either hyperlinked text or images, which when activated send the
browser to a different URL
– WML: generalized concept of “task” – additionally different potential tasks upon
• Provides means to access telephony functions (far beyond HTML
the browser. Sending to a new URL is done by go task in WML. URL is given capabilities) of the running WAP applications, e.g.
by the href attribute of go. – An application might make a voice call on behalf of the user
– pref sends the browser to the last task. – Send a text message
– refresh forces browser to redraw the display. – Access the phone book etc.
– noop: does nothing (no operation). • WTAI functions are collected in WTAI libraries:
• Task invocation by: – Public: universally available high-level operations for all WAP applications.
– Events – Network specific functions: specific for the given network (e.g. GSM)
– Selection on a select element – Network common functions: rather low level, not relevant for developers
– As the result of a script action
– On timer expiration
5
3.3Wireless Application Environment (= WAE) for 3.4.-1 High level WAP architecture and its relationship
Creating WAP Services and Applications to the mobile network
Mobile operator’s domain
3.3.8. User Agent capabilities
• Multitude of available channels for providers causes need to minimize development WAP gateway
and maintenance cost and to maintain flexibility for future technologies: WAP enabled handset
– XML [Bray - 1998]: generic presentation of the content. HTTP
– Presentation of data is separated from data themselves. Bearer I/f
– Information is stored in a format portable across platforms, applications and display e.g. SMS)
methods.
• WAP developing is more complex than Web developing - WAP devices vary
Radio I/f WAP server
enormously in their capabilities: different screen resolutions, different methods of HTTP
user interaction, different sets of optional features, etc.
• WAP development requires knowledge of WAP devices;
– User agent can identify itself by means of protocol headers while communicating with Mobile operators
gateway network
– Initiation of connection between client and the gateway includes the negotiation of a set of
mutually acceptable capabilities Wireless telephony
Application server
3.4. Integrating WAP gateways into wireless Networks 3.4. Integrating WAP gateways into wireless Networks
3.4.1. Positioning of WAP functionality in a mobile network (figure 3.4.-1) 3.4.2. Functional Requirements of a WAP gateway
• WAP Gateway provides: • Standardised functionality specified by the WAP Forum (Figure 3.4.-2)
– a link between the mobile network and the Internet – WAP protocol stack is required on both the handset and the WAP gateway, so
– Efficient bandwidth usage by encoding the WML or compiling the WMLScript that peer-to-peer protocol connections can be performed.
into compact binary form, and forwarding the resulting data to the mobile device
– Wireless datagram protocol (= WDP) layer
• WAP enabled mobile devices • Performs adaptation to different bearers as: SMS, Circuit Switched Data (CSD),
• WAP origin server unstructured supplementary service data (USSD), cell broadcast (CB), GPRS
– Provides content in WML or WMLScript (rather than HTML) • Like breaking up data into fragments of an appropriate size for the bearer,
• Wireless telephony application (=WTA) server • Interfacing to the bearer network to transport the data,
– Delivers custom-developed WAP services in order to differentiate from • So that the higher layers of the stack do not need to know about the bearer.
competitor (e.g. advanced telephony or messaging services). • Wireless transaction layer security (= WTLS, optional)
– WTA contains repository management applications, allowing the operator to – Provides security: privacy, data integrity, authentication between communicating
alter WAP handset content.
applications.
– Typically a WTA service reacts to a network event (e.g. incoming call)
– Compressing/decompressing and encrypting/decrypting data
6
3.4.-2 High-level architecture of WAP gateway and interfaces
3.4. Integrating WAP gateways into wireless Networks
Network Billing Interface to Application 2

Management Mediation Subscriber Application 1
interface database 3.4.2. Functional Requirements of a WAP gateway (continued)
interface
– Connectionless mode service
Compiling • Provides a service without acknowledgments or retransmissions between the
Gateway intelligence And
client and the WAP gateway
encoding • Messages of this service don’t use WTP layer, but pass through to WDP
directly
WSP • Compiler and encoder functionality:
WAP WTP HTTP – Is part of the presentation layer of the WAP stack.
stack – Encoder: encoding of WML into binary form
WTLS (optional) – Compiler: encoding if WMLScript into binary form
WDP TCP / IP
functionality and
interfaces specified
by the WAP forum
Bearer service IP network or Firewall, etc.
3.4. Integrating WAP gateways into wireless Networks 3.4. Integrating WAP gateways into wireless Networks
3.4.2. Functional Requirements of a WAP gateway (continued) 3.4.3. Functions required for a real network implementation of a
• Wireless transaction protocol layer (= WTP) WAP gateway
– Provides retransmission and acknowledgment services. “Gateway intelligence”
– Together with WDP, it forms the transport layer. According OSI model. – The standard specifies “what must be done”, but no implementation.
• Wireless session protocol layer (= WSP) This is up to the industry and manufacturers.
– Provides session service to the WAP application laxer – Therefore additional functions are needed in order to build a WAP
– Allowing to exchange information within a session. gateway.
– Connection oriented service: consists of proprietary gateway management properties and functions like:
• Allows session to be reliable by using acknowledgment and retransmission. – Scalability, flexibility and distribution:
of WTP layer. • Scalability: ability to grow in size, I.e. traffic volume
• Mobile device and WAP gateway can negotiate mutually acceptable set of • Flexibility: ability to introduce new functions and features
capabilities • Distribution: distribute the WAP gateway over more than one geographical
• Suspend and resume session on another bearer if required. region and/or distribute the different layers over different servers.
7
3.4. Integrating WAP gateways into wireless Networks 3. Bibliography
– Event management function:

• Logging all kinds of events for monitoring and triggering purposes, like
[Kocsis – 1999]: Frank Kocsis, “E-payment and billing in
• Billing events, information events, alarm events WAP/GPRS/UMTS Environment”, The second International WAP
– Gateway management / network management (OMC= Operation and Congress, Barcelona 15.- 18.11.1999.
Maintenance Centre)
• Start-up / shutdown of WAP gateway or individual components
[Heijden, Taylor - 2000]: Marcel van der Heijden, Marcus Taylor
• Monitoring / restart of components.
• Fault and alarm handling
“Understanding WAP – Wireless Applications, Devices and
• Configuration Management Services” ; Artech House; Boston, London, 2000
• Output of statistics, etc.
– Push applications [Bray, T. – 1998]: Bray, T., et al. “Extensible Markup Language (XML)”,
• Are presently not yet specified, so it is up to the manufacturer
W3C Proposed Recommendation 10; February 1998; REC-xml-
• Push allows sending of unsolicited information to mobile terminals.
19980210
– Billing data interface
• Are not standardized
• Should connect to the existing billing system of the network operator.
3.4. Integrating WAP gateways into wireless Networks
– Subscriber data:
• Provide basic authentication as to whether the subscriber has access to WAP
• … or to a specific URL
• … or to a specific service / application (e.g. based on MSISDN)
• Determine the bearers to which the mobile is subscribed (SMS, GPRS, …)
• Blacklisting-, spamming- service management.
– Caching, in order to reduce processing and response times for the mobile
device
8
4.1. Introduction
4. UMTS 4.1.1. The global requirements (continued)

• Market expectations are today visions for future communication
needs:
Universal – Computer data with Internet access, electronic mail, real time image
transfer, multimedia document transfer, mobile computing;
– Telecommunications with mobility, video conferencing, GSM –based
Mobile and integrated switched digital network (ISDN)-based services, video

telephony, wideband data services;
– Audio/video-content with video on demand, interactive video services,
Telecommunications •
infotainment, electronic newspaper, tele-shopping, value-added Internet
services, TV and radio contribution
Assumption of parallel operation of GSM and UMTS for a long
System period, therefore FMA (= Frames multiple access scheme) was

harmonised with the GSM network in terms of radio parameters and
protocol stack as far as possible.
[Prassad, Mohr, Kohnhäuser – 2000]
4.1. Introduction 4.1. Introduction

4.1.1. The global requirements 4.1.2. Basic architectural considerations, evolution from
• ITU (= International Telecommunications Union) launched the most 2nd to 3rd generation systems
ambitious project ever: a federation of systems for third generation • GRAN concept (= generic radio access network): separate the core
mobile telecommunications that will provide wireless access to the network from the radio access network and keep radio-dependent
global telecommunication infrastructure at anytime and functionalities within GRAN.
anywhere. • “Evolution” in the fixed network (i.e. stepwise migration towards IP
• IMT-2000 (International Mobile Telecommunications-2000) = and Frame Relay.
framework of standards for UMTS. • “Revolution” on the radio network side, i.e. introduction of a
• Key requirements: completely new system in order to support the high data rate
– High speed access, supporting broadband services such as fast Internet services.
access or multimedia-type applications • Goals “save our investment” and roaming between 2nd and 3rd
– Flexibility, supporting new kinds of services such as universal personal generation networks.
numbering and satellite telephony. • Multi-mode 3rd generation mobiles may access (figure 4.1.-1.) :
– Affordable, as those terminals of today, if not more so. – Public 3rd generation radio access networks (RAN),
– Compatible, perhaps most vital, offering an effective evolutionary path – Private networks (SOHO – small office home office)
for existing wireless networks.
– Public 2nd generation RAN (like GSM)
1
4.1. Introduction 4.2. UTRA Transport Control Function
4.1.2. Basic architectural considerations, evolution from 2nd to 4.2.1. Motivation and basics
3rd generation systems (continued)
• UMTS introduction will start in “hot spots”, islands as business areas, • Unique for UMTS transport control as compared to GSM : ability to
where more capacity and advanced services are needed. seamlessly combine an arbitrary number of different variable-rate data
• For this hot spot introduction of UMTS an evolved GSM core network sources (circuit switched or packet switched) with a flexible set of
comprising MSC, HLR, VLR, SGSN and GGSN is needed transport characteristics.
• The RANs are linked to the related fixed networks: • Approach for UMTS was not bit-exact description of coding for a given
– Via the A interface and the MSC for circuit switched calls, radio bearer service, but definition of concepts that can support ranges
– Via the Gb interface, the serving GPRS support node (SGSN), and the of parameter values.
gateway GPRS support node (GGSN) for packet-oriented services. • This results in many alternative ways to map a set of traffic and QoS
• Mobility Management is based on MAP (mobile application part) by parameters for radio transmission.
reusing the HLR and VLR databases. • Definitions of service capabilities will restrict these limits for given
• The Iu Interface between RNC (radio network controller) and the types of terminals, but still maintain the flexibility to provide different
MSC/SGSN is completely standardised. kinds of network implementations and operator parameterisation without
• Different regions will have different evolution paths. violating the compatibility of equipment conforming the standard.
4.1.-1. Second generation scenario: introduction of 3rd 4.2. UTRA Transport Control Function
generation mobile radio systems
Multiservice Broadband
4.2.1. Motivation and basics (continued)
Corporate Network Network Best
Besteffort
effort
Ethernet, PABX, TDM, ATM, voice, FR, IP, … IP
IPnetwork
network
FR, ATM, best effort IP
ATM • Central aspect of UTRA (= UMTS terrestrial radio access) transport
ATM
Multiservice Global control: multirate support provided by the physical layer - execute a
Backbone
N-ISDN Network FR Internet change of data rate combinations at maximum once per radio frame (10
Internet Access FR msec.)
Broadband Node IN PSTN/ISDN
IN • Task for MAC (Media access control): selects the channel combinations
to be applied based on offered load from the set of logical channel
inputs.
Residential
Residential
SOHO
Direct
DirectInternet
Internet • RLC (radio link control): segmentation and retransmission services for
SOHO MSC/VLR Access
Access both user and control data.
A Gb HLR, AC, • RRC (radio resource control) (RRC): handles all configuration
RAN
RAN
22ndndGen.
IN / Camel operations with peer-to-peer control signalling between network and
Gen.
GSM
GSM IWU IA
terminal. Configuring the operation of all lower radio layers.
IWU IGB SGSN GGSN

UTRA
3rd Gen. island IU
2
4.2. UTRA Transport Control Function 4.2. UTRA Transport Control Function
4.2.2. Simplified Radio interface protocol architecture (See figure 4.2.2. Simplified Radio interface protocol architecture (continued)
4.2.-1.)
• Logical channels are defined to be bidirectional where applicable (broadcast
• Blocks represent instances of the respective protocols control and paging control only exist in downlink).
• SAPs (Service access points) for peer-to-peer communication are

marked with circles at the interfaces between sublayers.
• Radio interface is split into
– Physical layer (L1)
– Data link layer (L2): consisting of RLC and MAC
– Network Layer (L3): RRC is the sublayer belonging to the radio if .
• RRC together with RLC entities serving transportation between peer
RRC entities belong to the control plane.
• In MAC data from control and user plane can be multiplexed to the same
transport resource, result in in unification of user and control plane.
• The separation of user and control plane is visible down to MAC.
4.2. UTRA Transport Control Function Bibliography

4.2.2. Simplified Radio interface protocol architecture (continued)
• Figure 4.2.-1. shows: [Prassad, Mohr, Kohnhäuser – 2000]: Ramjee Prassad, Werner Mohr, Walter
Konhäuser: “Third Generations Mobile Communication Systems”, Artech
– … transport channels provided by physical layer. House, Boston, London; 2000
• Transport channels are defined according to how information is
transferred.
[Lescuyer - 2001] Pierre Lescuyer “UMTS – Grundlagen , Architektur und
• Here control and user data need not be separated (I.e. one and the same Standard”dpunkt Verlag Stuttgart
transport channel may well carry RRC signalling and user data).
• Different types of transport channels are distinguished by attributes,
related to to physical layer processing (e.g. fixed or variable bit rate, [Hildebrand - 2002] Friedhelm Hildebrand “The Creation of Global Mobile
power control and /or beam forming possible etc.) Communication”, John Wiley& Sons
• All transport channels are defined to be unidirectional. Broadcast
(BCH), paging (PCH), forward access (FACH) channel in downlink. [Bostelmann, Zarits - 2002] Gerd Bostelmann, Rudolf Zarits: “Inside UMTS -
Random (RACH) access in uplink. Dedicated channels (DCH) in uplink Technology & System Operation”, Inacon, Karlsruhe 2002
or downlink
– … logical channels provided my MAC. They are defined according [T.O.P. BusinesInteractive GmbH - 2002] [T.O.P. BusinesInteractive GmbH :
to the type of information that is transferred. “UMTS Basics – Die Grundkonzepte des Universal Mobile
Telecommunications System”, J.Schlembach Fachverlag, 2002
• Transport channels distinguish between user and control data.

Mobile Protocol

Enviado por

Dados do documento

Direitos autorais

Formatos disponíveis

Compartilhar este documento

Compartilhar ou incorporar documento

Opções de compartilhamento

Você considera este documento útil?

Este conteúdo é inapropriado?

Direitos autorais:

Formatos disponíveis

Mobile Protocol

Enviado por

Direitos autorais:

Formatos disponíveis

Network Protocols and The Motivation (continued)

Architectures of Mobile Radio “GSM with its enhancements (GPRS,HSCSD,WAP,

4/2/2003 U.A.Hermann: GSM 4/2/2003 U.A.Hermann: GSM

The Motivation The Motivation (continued)

1.Global System for

– The system shall be capable of offering encryption of user

4/2/2003 U.A.Hermann: GSM 4/2/2003 U.A.Hermann: GSM

1.1. Introduction 1.1. Introduction

1.2. Architecture 1.2. Architecture

1.2. Architecture Figure 1.2.-3 GSM subsystem organisation

1.2.2. Subsystems 1.2.2.2. Base Station Subsystem (= BSS, figure 1.2.-5.)

terminal terminal mobile

1.2. Architecture 1.2. Architecture

4/2/2003 U.A.Hermann: GSM 4/2/2003 U.A.Hermann: GSM

1.2.2.4. Operation Sub-System (continued) 1.3.1. Overview of GSM protocol architecture

4/2/2003 U.A.Hermann: GSM 4/2/2003 U.A.Hermann: GSM

1.2.-7. OSS Organisation 1.3. -1 General Protocol Architecture

The three main parts of OSS are: Trans

1.3.2. Overview of Transmission

4/2/2003 U.A.Hermann: GSM 4/2/2003 U.A.Hermann: GSM

1.3. Functional Planes 1.4. Overview of Interfaces and Protocols

4/2/2003 U.A.Hermann: GSM 4/2/2003 U.A.Hermann: GSM

1.4.-2. Different MAP/x protocols between entities 1.5. Transmission

MAP/F 1.5.2. An End-To-End view of Data Transmission

4/2/2003 U.A.Hermann: GSM 4/2/2003 U.A.Hermann: GSM

1.5. Transmission 1.5.-2. Schematic Interconnection with PSTN

a: PSTN user to PSTN User

1.5.2.2 The ISDN Case 1.5.2.3 The PSPDN Case

a) Dedicated PAD access to PSPDN from GSM

1.5. Transmission 1.5.-5 Positions of the TRAU

4/2/2003 U.A.Hermann: GSM 4/2/2003 U.A.Hermann: GSM

1.5. Transmission 1.5. Transmission

Performance versus rate in T mode: •“NT” (Non Transparent Connections):

1.5. Transmission 1.5. Transmission

1.6.1. The requirements

1.6. The Radio Interface 1.6. The Radio Interface

1.6.1.3. Idle Mode Terminology : “What is a Channel”

1.6. The Radio Interface 1.6. The Radio Interface

•Uplink, unidirectional channel:

Relationship between Uplink and Downlink:

1.6. The Radio Interface 1.6. The Radio Interface

0 4 8 12 16 20 24 28 32 36 40 48 50 BCCH and PAGCH

T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T S S S S S S S S S S S S S S S S •Both are DL channels.

1.6. The Radio Interface 1.6. The Radio Interface

1.6. The Radio Interface 1.6. The Radio Interface

4/2/2003 U.A.Hermann: GSM 4/2/2003 U.A.Hermann: GSM

1.6. The Radio Interface 1.6. The Radio Interface

4/2/2003 U.A.Hermann: GSM 4/2/2003 U.A.Hermann: GSM

1.6. The Radio Interface 1.6. The Radio Interface

4/2/2003 U.A.Hermann: GSM 4/2/2003 U.A.Hermann: GSM

1.6. The Radio Interface 1.6. The Radio Interface

1.6. The Radio Interface 1.6. The Radio Interface

1.6. The Radio Interface 1.6. The Radio Interface

4/2/2003 U.A.Hermann: GSM 4/2/2003 U.A.Hermann: GSM

1.6. The Radio Interface 1.6. The Radio Interface

1.7. Signalling Transfer 1.7. Signalling Transfer

1.7. Signalling Transfer 1.7. Signalling Transfer

1.7.2.1. Structuring in Frames(continued) 1.7.2.3. Error Detection and Correction

•The effective information may be smaller, than 23 or 21 octets, •Error Detection:

1.7. Signalling Transfer 1.7.-1 Window mechanism for acknowledgement

4/2/2003 U.A.Hermann: GSM 4/2/2003 U.A.Hermann: GSM

1.7. Signalling Transfer 1.7. Signalling Transfer

1.7. Signalling Transfer 1.7. Signalling Transfer

1.7. Signalling Transfer 1.7. Signalling Transfer