1. Wireless Cellular Networks (basics)
Part 3 – GSM networks

2. History of Cellular systems
1960's: Bell Labs developed cellular concept
: First field Trial for Cellular System
AMPS (Advanced Mobile Phone System), Chicago
1981, Sweden, first European Systems
NMT-450 (Nordic Mobile Telephone)
1985, first italian cellular system
RTMS (Radio Telefono Mobile di Seconda Generazione), 450 MhZ
1990, TACS, first italian widespread systems
Total Access Communication System (TACS, 900 MHZ)
Second generation system:
GSM in europe, D-AMPS & IS95 (CDMA) in USA, PDC Japan
Digital, versus fist generation analog (frequency modulation)
GSM:
Specification started in 1982; EU deployment since 1992; DCS-1800 since 1994
Generation 2 ½ : GPRS, EDGE (8PSK), HSCSD
Generation 3: UMTS, HSDPA  HSPA,
In ITA since 2004
Generation 4: LTE (2011/2012?)

3. GSM essential components
OMC
To fixed network
(PSTN, ISDN, PDN)
GMSC
EIR
AUC
HLR
VLR
MSC
BSC
BTS
MS Mobile Station
BTS Base Transceiver Station
BSC Base Station Controller
MSC Mobile Switching Center
GMSC Gateway MSC
OMC Operation and Maintenance Center
EIR Equipment Identity Register
AUC Authentication Center
HLR Home Location Register
VLR Visitor Location Register
BTS
BTS
BSC
BTS
BTS MS

4. GSM system hierarchy MSC MSC region LOCATION AREA BSC BTS
MSC: Mobile Switching Center
LA: Location Area
BSC: Base Station Controller
BTS: Base Transceiver Station
Hierarchy: MSC region  n x Location Areas  m x BSC  k x BTS

5. Mobile Station (MS) Key fact:
GSM separates user mobility from equipment mobility, by defining two distinct components
Mobile Equipment
The cellular telephone itself (or the vehicular telephone)
Address / identifier:
IMEI (International Mobile Equipment Identity)
Control: Equipment Identity Register (EIR):
White list, black list, gray list
Stolen terminals, malfunctioning terminale
Subscriber Identity Module (SIM)
Fixed installed chip (plug-in SIM) or exchangeable card (SIM card)
Addresses / identifiers:
IMSI (International Mobile Subscriber Identity)
MSISDN (Mobile Subscriber ISDN number – the phone number)

6. Base Station Sub-System
Um - Radio
Interface
BSS
OSS
BTS
BSC
BTS A
Interface
BTS
A-bis
Interface
Base Transceiver Station (BTS)
Transmitter and receiver devices, voice coding & decoding, rate adaptation for data
Provides signaling channels on the radio interface
Limited signal and protocol processing (error protection coding, link layer LAPDm)
Base Station Controller (BSC)
performs most important radio interface management functions:
Radio channels allocation and deallocation; handover management; …

7. Base Transceiver Station - BTS
Um Interface
(to MS)
Output
filter HF
Transmitter
TRX
Digital
Signal
Processing
Slow freq.
Hopping
Transmission
System
Abis Interface (to BSC)
Input
Filter HF
Receiver
Operation and Maintenance Functionality/clock distribution
TRX radio interface functions:
- GMSK modulation-demodulation
- channel coding
- encryption/decryption
- burst formatting, interleaving
- signal strength measurements
- interference measurements
In essence, BTS is a complex modem!

8. Base Station Controller - BSC
DB contains
- state information for all BSS - BTS software DB
BTS-1
BTS-2 X
switch matrix
From/to MSC
FUNCTIONS:
switch calls from MSC to correct BTS
and conversely
Protocol and coding conversion
for traffic (voice) & signaling (GSM-specific to ISDN-specific)
Manage MS mobility
Enforce power control
BTS-K
1 BSC may control up to 40 BTS

9. Transcoding and Rate Adaptation
BTS:
collects speech traffic
Deciphers and removes error protection
Result:
13 kbps air-interface GSM speech-coded signal
MSC:
A modified ISDN switch
Needs to receive ISDN-coded speech
64 kbps PCM format (A-law)
Transcoding and Rate Adaptation
Unit (TRAU) needed!
Rationale: re-use existing ISDN switches & protocols

10. TRAU possible placements
13 kbit/s
64 kbit/s
64 kbit/s
MSC
On BTS
BTS
TRAU
BSC
13 kbit/s
64 kbit/s
On BSC
16 kbit/s
MSC
BTS
BSC
TRAU
64 kbit/s
(4x16 sub-mux)
On MSC
13 kbit/s
16 kbit/s
MSC
BTS
BSC
TRAU
Why 16 kbps instead of 13? Inband signalling needed for BTS control of TRAU
(TRAU needs to receive synchro & decoding information from BTS)

11. Network Switching Sub-System
Elements:
Mobile Switching Center (MSC) / Gateway MSC (GMSC)
Enhanced telephone switching centers (digital, ISDN)
With support for user mobility, registration, handover
Home Location Register (HLR ) / Authentication Center (AuC)
Visitor Location Register (VLR)
Equipment Identity Register (EIR)
Functions:
Call control
User management
Inter-component communication
Via SS7 signalling network with suitable extensions
(e.g. MAP – Mobile Application Part)

12. Location 1 MSC 1 VLR Several Location Areas MSC VLR LA-1 LA-2 LA-3…
LA-n
1 MSC
1 VLR
Several Location Areas

13. Location Registration (Update) (very) basic idea3
3) Update pointer at HLR, which now knows which LAI/VLR the user is located
MSC
VLR
BTS
BSC MS
HLR 2
2) Register MS ID (IMSI) into local VLR;
Authenticate; receive TMSI for local paging purposes 1
MS switches ON; detects cell through BCCH carrier; Obtain Location Area Identifier (LAI) from BCCH

14. Location Registration - detailsMS
VLR
HLR
AUC
BSS/MSC
Loc. Upd. Request
IMSI, LAI
Update Loc. Area
IMSI, LAI
Auth. Param. Req.
IMSI
Auth. Info. Req.
IMSI
Auth. Info
(Auth. Parameters)
authentication
Update Location
IMSI, MSRN
Start Ciphering Kc
Activate ciphering
Insert Subscrib. Data
IMSI, additional data
Forward new TMSI
TMSI
Insert Subscrib. Data
ACK
Locat. Upd. Accept
IMSI
Locat. Upd. Accept
TMSI Realloc Cmd
Locat. Upd. Accept
TMSI Realloc ACK
TMSI ACK

15. Changing MSC/VLR MSC MSC An MS always has a dedicated entry in the HLR
Public switched telephone network
PSTN
HLR
VLR
MSC
VLR
MSC
Base Station
Base Station
An MS always has a dedicated entry in the HLR
Plus one entry in JUST 1 VLR (related to the MSC the user is connected to)

16. Location Update: different VLRMS
VLR-new
HLR
VLR-old
BSS/MSC
Loc. Upd. Request
TMSI(+ old LAI), LAI
Update Loc. Area
TMSI(+ old LAI), LAI
determine
VLR-old
From old LAI
Send parameters (TMSI, old LAI)
IMSI response (IMSI,RAND,SRES,Kc)
authentication
Update Location
IMSI, MSRN
Cancel Location
IMSI
Generate
New TMSI
Cancel Locat. ACK
Activate ciphering
Start Ciphering Kc
Insert Subscrib. Data
IMSI, additional data
Ins. subs. data ACK
Locat. Upd. Accept
IMSI
Forward new TMSI
… …

17. Call switching Gateway MSC – GMSC
Needed, as fixed network switches are not mobile capable!!
GMSC task: query HLR for current MS location
(if fixed network switches were able to query HLR, direct connection with local MSC would be available) X X X X X
GMSC
MSC
MSC
HLR
MSC
PLMN
Public Land
Mobile Network

18. Notation A call involves two “Parties” Calling Party (caller)
user generating the call
Called Party (callee)
user receiving the call
Mobile Originating Call (MOC)
Call originated by an MS
Mobile Terminating Call (MTC)
Call directed to an MS

19. Call establishment basics
Mobile Terminated Call
Mobile Originated Call
Fixed party
Fixed party MS
MSC MS
MSC
setup
setup
setup
setup
Call proceeding
alerting
Call confirmed
alerting
alerting
Connect
alerting
Connect
connect
Connect Ack
connect
DATA
DATA
In ISDN ISUP: - setup = IAM (Initial Address Message);
- Alerting = ACM (Address Complete Message);
- Connect = ANS (Answer)

20. Call establishment stepsMS
Mobile Terminated Call
network MS
Mobile Originated Call
network
Paging request
Channel request
Channel request
Immediate Assignment
Immediate Assignment
Paging Response
Service Request
Authentication Request
Authentication Request
Authentication Response
Authentication Response
Ciphering mode command
Ciphering mode command
Ciphering Mode Complete
Ciphering Mode Complete
Setup
Setup
Call Confirmed
Call proceeding
Assignment Command
Assignment Command
Assignment Complete
Assignment Complete
Alerting
Alerting
Connect
Connect
Connect Acknowledge
Connect Acknowledge

21. Routing an MTC PLMN ISDN 1: MSISDN GMSC 2: MSISDN MSCC 4: MSRN 3: MSRN
MSCA
HLR
MSCC
MSCB
PLMN
ISDN
GMSC
VLRB
1: MSISDN
2: MSISDN
4: MSRN
3: MSRN
5: MSRN
6: TMSI
7: paging

22. Routing calls to Roaming MS
ISDN
(UK)
MSC
International Switching
Center
PLMN 2
(UK)
International Switching
Center
ISDN
(ita)
Transit Exchange
PLMN 1
(ITA)
GMSC 1
MSC
MSISDN
MSRN +44.NDC
Local Exchange
HLR

23. Is the PRICE (!) to pay for simple routing and billing
“tromboning”
Call to MSISDN
MSC
ISC
(UK)
PLMN 2
(UK)
Call to MSISDN
Is the PRICE (!) to pay for simple routing and billing
ISC
(ITA)
PLMN 1
(ITA)
GMSC 1
MSC
MSISDN
MSRN +44.NDC
HLR

24. Number portability
Subscriber may switch operator without changing his number
First implemented in fixed network
may 2002: extended to mobile networks
Essential for fair competition among network operators
UK 2002 survey: 42% of corporate subscribers were willing to change mobile operator; but 96% were, if number could be ported
Resistence from leading operators
Number portability helps newer operators to compete with traditional ones

25. Notation
Donor switch
The switch corresponding to a “ported” telephone number
Recipient switch
The switch to which the ported number is attached

26. Technical solutions a) call forwarding
Originating network
Donor network
switch
switch
switch
Recipient network
Originating switch sets-up trunk to donor switch
Donor switch sets-up trunk to recipient switch
Simplest solution, as call forwarding is a feature available in virtually all switches
But extremely inefficient routing and trunking resource consumption!

27. Technical solutions b) query on release
Originating network
Donor network
SS7 ISUP IAM
switch
switch
SS7 ISUP REL
Number Portability
DataBase
switch
Recipient network
Donor switch “blocks” incoming call with a release message (REL)
REL carries a QoR cause value, stating that called party number is ported Originating switch then queries Number Portability database

28. Technical solutions c) all-call query
Originating network
Donor network
switch
switch
Number Portability
DataBase
switch
Recipient network
Originating switch queries Number Portability database for every call!!
- best solution if majority of numbers are ported (no interaction with donor)
- but very high DB load, as EVERY number must be looked-up!

29. Mobile Number Portability
Same ideas as fixed number portability
The donor switch is the GMSC of the donor network
Donor GMSC Call forwarding (if more efficient fixed number portability not supported)
While porting number, may also get MSRN!
Recipient network
HLR
GMSC
MSC
Note: If path must cross GMSC:
Use Intermediate Routing Number
MSRN
IRN
MSRN
(or IRN)
Incoming call
HLR
GMSC
Signaling relay function
Donor network
Clearly, still suffers of tromboning!

30. Mobile Number Portability (with all call query approach)
Recipient network
Query MSRN
GMSC
HLR
MSC
Return MSRN
IRN
Incoming call
Number Portability
DataBase
Query IRN
switch
Return IRN

31. Mobile Number Portability improved – (with all call query approach)
Recipient network
GMSC
HLR
MSC
MSRN
Signaling relay function
Incoming call
Number Portability
DataBase
Query MSRN
switch
Return MSRN

32. Wireless Cellular Networks (basics)
Part 4 – GSM radio interface

33. GSM Radio Spectrum Frequency [MHz] 2 x 25 Mhz band
Duplex spacing: 45 MHz
124 carriers x band
200 KHz channels
Suggested use: only 122
Use top & bottom as additional guard
8 TDMA slots x carrier
full rate calls – 13 Kbps
If half-rate used, 16 calls at 6.5 kbps
960
DOWNLINK
BS  MS
935
915 1 2 3 4 5 6 7 8
890.4
UPLINK
MS  BS
890.2
“guard band”
890

34. Adjacent channels (due to GMSK)
60dB
35dB
Specification: 9dB
In practice, due to power control and shadowing, adjacent channels
Cannot be used within the same cell…

35. Physical channel time slot time slot 7 time 577 ms
200 KHz bandwidth + GMSK modulation
1625/6 kbps gross channel rate ( kbps)
1 time slot = 625/4 bits
bits
15/26 ms = ms
time slot
time slot 7
time
577 ms
1 frame = 60/13 ms = ms
26 frames = 120 ms (this is the key number)

36. Hybrid FDMA-TDMA physical channel = (time slot, frequency)
Total n. of channels: 992
200 KHz
200 KHz
200 KHz
200 KHz
200 KHz
200 KHz
slot
200 KHz
200 KHz
200 KHz
577us
577us
577us
577us
577us
577us
577us
577us
time

37. Slow Frequency hopping (optional procedure within individual cell)
Hopping sequence (example):
…  f1  f2  f5  f6  f3  f7  f4  f1…
Slow = on a per-frame basis
- 1 hop per frame (4.615 ms) = 217 hops/second
Physical motivation:
- combat frequency-selective fading
- combat Co-Channel Interference
next slot may not interferere with adjacent cell slot (different hopping sequence)
- improvements: acceptable quality with 9 dB SNR versus 11 dB

38. Duplexing MS uses SAME slot number on uplink and downlink
Uplink and downlink carriers always have a 45 MHz separation
I.e. if uplink carrier is  downlink is 919.2
3 slot delay shift!! 1 2 3 4 5 6 7
DOWNLINK
UPLINK 1 2 3 4 5 6 7
MS: no need to transmit and receive in the same time on two different frequencies!

39. Structure of a TDMA slot
Normal burst TB 3
DATA 57 S 1
Training
sequence 26 S 1
Data 57 TB 3 GP
8.25
148 bit burst
bit (15/26 ms = ms)
Symmetric structure
DATA: 2 x 57 data bits
114 data bits per burst
“gross” bits (error-protected; channel coded)
“gross” rate: 24 traffic burst every 26 frames (120 ms)
22.8 kbps gross rate
13 kbps net rate!
S: 2 x 1 stealing bit
Also called stealing flags, toggle bits
Needed to grab slot for FACCH (other signalling possible)

40. Guard Period rationale
BTS d
Assume the following synchro mechanism:
BTS transmits at time 0
MS receives at time d/c
MS transmits at time 3+d/c
BTS receives at time 3+ 2d/c
Offset depending on d!
BTS downlink tx 1 2 3 4
MS downlink rx 1 2 3 4
MS uplink rx 1
BTS uplink rx 1 1
Expected RX time!

41. Guard period sizing … … … … Maximum cell radius:
dwlink slot 1
dwlink slot 4 …
dwlink slot 1
dwlink slot 4
MS time …
BTS time
uplink slot 1 …
uplink slot 1
Maximum cell radius:
Is there something wrong? (GSM says that cells go up to 35 km)

42. Frame synchronization
TA (transmitted in the SACCH)
BTS
Timing Advance (TA)
Parameter periodically transmitted by BTS during MS activity
6 bits = 0-63
Meaning: anticipate transmission of TA bits
TA=0: no advance
I.e. transmit after bits after downlink slot
TA=63:
Transmit after bits time
dwlink slot 4
dwlink slot 4 TA
BTS time
MS time
uplink slot 1
uplink slot 1
uplink slot 1
TA avoids collision!

43. Timing Advance analysis
Downlink propagation delay:
d/c
Uplink propagation delay:
Uplink delay with TA:
d/c-TA
Perfect resynchronization occurs when
TA = 2d/c
Maximum cell size for perfect resync:
8.25 bits Guard time additionally available for imperfect sync (+/- error)

44. And when the user is not connected? But wants to connect…
Solution: USE A DIFFERENT BURST FORMAT
Access Burst: much longer Guard Period available
drawback: much less space for useful information
Access burst TB 8
Training
sequence 41
Data 36 TB 3 GP
68.25
88 bit burst
bit (0.577 ms)
No collision with subsequent slot for distances up to 37.8 km

45. Logical vs Physical channels
Logical channels
(traffic channels, signalling (=control) channels)
Physical channels
(FDMA/TDMA)
Physical channels
Time given frequencies
Issues: modulation, slot synchronization, multiple access techniques, duplexing, frequency hopping, etc
Logical channels
Built on top of phy channels
Issue: which information is exchanged between MS and BSS

46. Logical – physical mapping
Physical Channel: data rate r, time slot i
frequency
Logical Channel Mapping:
Different channels may share a same physical channel
frequency
Frame 8
Frame 9
Frame 10
Frame 11
Frame 12
Logical channel A: data rate r/3, time slot i, frame 3k
Logical channel B: data rate 2r/3, time slot i, frame 3k+1, 3k+2

47. GSM logical channels
Traffic channel (TCH)
TCH/F
TCH full rate
MSBSS
TCH/H
TCH half Rate
Broadcast channel
BCCH
Broadcast control
BSSMS
(same information to all MS in a cell)
FCCH
Frequency Correction
SCH
Synchronization
Common Control channel (CCCH)
RACH
Random Access
MSBSS
(point to multipoint channels)
AGCH
Access Grant
(used for access management)
PCH
Paging
Dedicated Control channel (DCCH)
SDCCH
Stand-alone Dedicated control
(point-to-point signalling channels)
SACCH
Slow associated control
(dedicated to a specific MS)
FACCH
Fast associated control
Additional logical channels available for special purposes
(SMS, group calls, …)

48. Traffic channels (TCH/F)
Periodic pattern of 26 frames (120 ms = 15/26 ms/TS * 8 TS/frame* 26 frame) 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
24 TCH frames over 26
Same TS in every frame 2 1 3 4 5 6 7 2 1 3 4 5 6 7 2 1 3 4 5 6 7 2 1 3 4 5 6 7
Theoretical rate: 1/8 channel rate: r=33.85 kbps
2 signalling frames: r  kbps
Burst overhead (114 bits over ):
r 22.8 kbps GP
8.25 TB 3
DATA 57 S 1
Training
Seq. (26)
Data
148 bit burst
bit (0.577 ms)

49. Slow Associated Control Channel
Always associated to instaurated call on TCH (TCH + SACCH = TACH)
On the same Time Slot
Periodic (order of ½ second) time-scale information for radio link control
TCH/F(0…7)
TCH/F(0…7) 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
SACCH(0…7)
IDLE frame
SACCH-0
SACCH-1
SACCH-2
SACCH-3
SACCH-4
SACCH-5
SACCH-6
SACCH-7
1 SACCH burst (per TCH) every 26 frames (120 ms)

50. Broadcast Channel (usual) organization
51 frame structure vs 26
ms period (vs 120 ms)
Sub-blocks with 10 frames
Starting with Frequency Correction Channel (FCCH)
Immediately followed by Synchronization Channel (SCH)
Other frames (numbered from #0 to #50):
#50 idle
#2,3,4,5 BCCH
Remaining: Paging (PCH) / Access Grant (AGCH) [=PAGCH]
51 frame structure - downlink F S B B B B P P P P F S P P P P P P P P F S P P P P P P P P F S P P P P P P P P F S P P P P P P P P
10 frame sub-block

51. BCCH contents 184 bits Coded in 456 bits and interleafed in 4 bursts
same coding and interleaving as SACCH
BCCH capacity
184 bits / (51*8*15/26 ms) ~ 782 bps
Information provided
Details of the control channel configuration
Parameters to be used in the cell
Random access backoff values
Maximum power an MS may access (MS_TXPWR_MAX_CCCH)
Minimum received power at MS (RXLEV_ACCESS_MIN)
Is cell allowed? (CELL_BAR_ACCESS)
Etc.
List of carriers used in the cell
Needed if frequency hopping is applied
List of BCCH carriers and BSIC of neighboring cells

52. BCCH carrier placement
On Downlink
Corresponding uplink dedicated to Random Access Channel
51 frame structure - uplink R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R
On one frequency per cell (beacon)
MUST BE on Time Slot #0
Other Time slots may be used by TCH
Provided that:
All empty slots are filled with DUMMY bursts
Downlink power control must be disabled

53. Fast Associated Control Channel
FACCH: urgent signalling
Used when several signalling information needs to be transmitted
Call setup
Handover
FACCH block = 184
456 after coding
Interleaved as voice block
Spreaded on 8 bursts
Replaces a voice block (20 ms) on the TCH
Via stealing bits
Voice block(s) discarded
Maximum FACCH bit rate
184*6/120 [bits/ms] = 9.2 kbps (vs 383 bps of SACCH!)

54. FACCH insertion in TCH Via Stealing bits - upper bit = odd bits stolen
- lower bit = even bits stolen
- both bits = all burst stolen
Figure: shows example of 2 FACCH blocks stealing a TCH (note begin and end behavior due to interleaving)
time

55. Why paging Channel assignment: Paging
only upon explicit request from MS
Paging
needed to “wake-up” MS from IDLE state when incoming call arrives to MS
MS accesses on RACH to ask for a channel
Generally SDCCH (but immediate TCH assignment is possible)
1) paging
BSS/MSC MS
2) Random access
3) Channel assignment
Paging channel: PCH
Access Grant Channel: AGCH
Random Access Channel: RACH
CCCH
Common Control
CHannel
PAGCH

56. Paging Paging message generated by MSC Which receives incoming call
Transferred to subset of BSC
Paging limited to user’s location area
Paging message contains:
List of cells where paging should be performed
Identity of paged user (IMSI or TMSI)
Paging message coded in 4 consecutive bursts over the air interface
Same coding/interleaving structure of SACCH (184456 bits)
Paging for more MSs may be joined in one unique paging message

57. An example procedure involving signalling
Setup for an incoming call (call arriving from fixed network part - MS responds to a call)
Steps:
paging for MS
MS responds on RACH
MS granted an SDCCH
authentication & ciphering on SDCCH
MS granted a TS (TCH/FACCH)
connection completed on FACCH
Data transmitted on TCH

58. Radio Resource allocation three standardized solutions
Non-Off Air Call Set-Up (Non-OACSU)
Normally used (previous description)
Off Air Call Set-Up (OACSU)
TCH assigned only when the called party actually responds!
Best utilization of radio resource (avoids allocation if callee not available)
Call drop if no TCH is available at this point
Very Early Assignment (VEA)
Immediate assignment of TCH
Fastest signalling process
Waste of resources
VEA
RACH
TCH (FACCH)
TCH (DATA)
Non-OACSU
RACH
SDCCH
TCH (FACCH)
TCH (DATA)
OACSU
RACH
SDCCH
TCH (DATA)
Connection established
Callee responds

59. handover
Procedure in which an MS releases a connection with a BTS, and establishes a connection with a new BTS, while ensuring that the ongoing call is maintained
The MS remains in dedicated state (unlike cell reselection, where MS is in idle state)
Handoff: synonymous of handover
Needs two mechanisms
Handover preparation: detection of cell-border crossing
Based on radio link quality measurements
Handover execution: setup of a new channel in a cell, and tear-down of a previous channel
Improved handover mechanisms:
Seamless handover: when active call performance is not impaired
Not possible in GSM: for about ms, communication is interrupted
Soft Handover: when two channels are simultaneously set-up (old and new)
Not possible in GSM; possible in UMTS

60. Hard, Seamless, Soft handover
MSC
BSS 1
BSS 2 MS f1 f2
before
during
after
Hard
handover
(GSM)
Seamless
(DECT)
Soft
(UMTS)

61. Handover classification
Classification by motivation
Classification by typology
Rescue handover (mandatory handover)
Driven by radio channel quality degradation
Confinement handover (network-directed handover)
Target: minimize radio interference
Assign new channel when old channel results critical for total interference
Traffic handover (network-directed handover)
Driven by traffic congestion conditions
Also called load-balancing
Internal handover
Intra-BTS
New radio channel in the same cell
Not termed as “handover” but as“subsequent assignment”
Inter-BTS (Intra-BSC)
Under control of same BSC
External handover
Inter-BSC (Intra-MSC)
Change reference BSC; may imply a location area update
Inter-MSC
Most complex: need to change MSC

62. managed the current call Switching point for all inter-MSC handover
Types of handover
Anchor MSC:
the MSC that first
managed the current call
Relay MSC:
the MSC that currently
manages the call
Switching point for all inter-MSC handover
Switching point for inter-BSC handover
A-MSC
R-MSC A
Switching point for internal handover
BSC
BSC
BSC
A-bis
BTS
BTS
BTS
BTS
radio
interface

63. Handover taxonomy BCHO: Base station Controlled Handover
Handover detection: BS
Handover Execution: BS
MCHO: Mobile Controlled Handover
Handover detection: MS
Handover Execution: MS
MAHO: Mobile Assisted Handover
GSM: somehow a BCHO with a flavor of MAHO
Handover decision always taken by BSC
Based on measures taken at both BTS and MS
New channel selection decision taken at BSC or R-MSC or A-MSC (depending on handover type) based on traffic consideration

64. Handover preparation Measurements performed at BTS
RX signal
level
From
(dBm) To
RXLEV_0 -
-110
RXLEV_1
-109
RXLEV_2
-108
RXLEV_3
-107 …
RXLEV_62
-49
-48
RXLEV_63
Measurements performed at BTS
Up-link signal level received from MS lower than threshold
RXLEV_UL < L_RXLEV_UL_H
Up-link signal quality (BER) received from MS
RXQUAL_UL < L_RXQUAL_UL_H
Distance between MS and BTS
adaptive timing advance parameter > MAX_MS_RANGE
Interference level in unallocated time slots.
Measurements performed at MS.
Down-link signal level received from serving cell
RXLEV_DL < L_RXLEV_DL_H
Down-link signal quality (BER) received from serving cell
RXQUAL_DL < L_RXQUAL_DL_H
Down-link signal level received from n-th neighbor cell
RXLEV_NCELL(n) > RXLEV_MIN(n)
Bit error
Ratio
From
(%) To
RXQUAL_0 -
0.2
RXQUAL_1
0.4
RXQUAL_2
0.8
RXQUAL_3
1.6
RXQUAL_4
3.2
RXQUAL_5
6.4
RXQUAL_6
12.8
RXQUAL_7

65. Handover preparation – additional metrics
Transmission power
Maximum MS transmission power
Maximum serving BTS transmission power
Maximum neighboring BTSs transmission power
congestion status
of serving BTS
of neighboring BTSs
provided they can support the MS.
Handover Margin
To avoid ping-pong handover effect
5-10 dB in normal operation; up to 30dB in urban operation (to fight shadowing)
RXLEV
(cell A)
RXLEV
(cell B)
Handover
RXLEV
(cell A)
RXLEV
(cell B)
Handover
HANDOVER ALGORITHM: operator-dependent!
GSM standard SUGGESTS a simple reference algorithm, but implementation left to operator
hysteresis

66. handover procedure skeleton
1) Handover request goes up to switching point 1
MSC
BTS
BSC
5) Old channel/path torn down 5
2) Switching point prepares new path on fixed net 2
3) Switching point sends HO command to MS 3
4) MS accesses new channel 4

67. Inter-MSC handover X X X
More complex, as an ISDN circuit must be set between MSCs
We’ll not enter into details (just the basic ideas)
Two cases
First MSC change (basic handover)
Second MSC change (subsequent handover) X
MSC-A
MSC-R1
MSC-A
MSC-R1
MSC-R2 X X
Note the role of the
Anchor MSC!