Presentation on theme: "Wireless Cellular Networks (basics)"— Presentation transcript:
1 Wireless Cellular Networks (basics) Part 3 – GSM networks
2 History of Cellular systems 1960's: Bell Labs developed cellular concept: First field Trial for Cellular SystemAMPS (Advanced Mobile Phone System), Chicago1981, Sweden, first European SystemsNMT-450 (Nordic Mobile Telephone)1985, first italian cellular systemRTMS (Radio Telefono Mobile di Seconda Generazione), 450 MhZ1990, TACS, first italian widespread systemsTotal Access Communication System (TACS, 900 MHZ)Second generation system:GSM in europe, D-AMPS & IS95 (CDMA) in USA, PDC JapanDigital, versus fist generation analog (frequency modulation)GSM:Specification started in 1982; EU deployment since 1992; DCS-1800 since 1994Generation 2 ½ : GPRS, EDGE (8PSK), HSCSDGeneration 3: UMTS, HSDPA HSPA,In ITA since 2004Generation 4: LTE (2011/2012?)
3 GSM essential components OMCTo fixed network(PSTN, ISDN, PDN)GMSCEIRAUCHLRVLRMSCBSCBTSMS Mobile StationBTS Base Transceiver StationBSC Base Station ControllerMSC Mobile Switching CenterGMSC Gateway MSCOMC Operation and Maintenance CenterEIR Equipment Identity RegisterAUC Authentication CenterHLR Home Location RegisterVLR Visitor Location RegisterBTSBTSBSCBTSBTSMS
4 GSM system hierarchy MSC MSC region LOCATION AREA BSC BTS MSC: Mobile Switching CenterLA: Location AreaBSC: Base Station ControllerBTS: Base Transceiver StationHierarchy: MSC region n x Location Areas m x BSC k x BTS
5 Mobile Station (MS) Key fact: GSM separates user mobility from equipment mobility, by defining two distinct componentsMobile EquipmentThe cellular telephone itself (or the vehicular telephone)Address / identifier:IMEI (International Mobile Equipment Identity)Control: Equipment Identity Register (EIR):White list, black list, gray listStolen terminals, malfunctioning terminaleSubscriber Identity Module (SIM)Fixed installed chip (plug-in SIM) or exchangeable card (SIM card)Addresses / identifiers:IMSI (International Mobile Subscriber Identity)MSISDN (Mobile Subscriber ISDN number – the phone number)
6 Base Station Sub-System Um - RadioInterfaceBSSOSSBTSBSCBTSAInterfaceBTSA-bisInterfaceBase Transceiver Station (BTS)Transmitter and receiver devices, voice coding & decoding, rate adaptation for dataProvides signaling channels on the radio interfaceLimited signal and protocol processing (error protection coding, link layer LAPDm)Base Station Controller (BSC)performs most important radio interface management functions:Radio channels allocation and deallocation; handover management; …
7 Base Transceiver Station - BTS Um Interface(to MS)OutputfilterHFTransmitterTRXDigitalSignalProcessingSlow freq.HoppingTransmissionSystemAbis Interface (to BSC)InputFilterHFReceiverOperation and Maintenance Functionality/clock distributionTRX radio interface functions:- GMSK modulation-demodulation- channel coding- encryption/decryption- burst formatting, interleaving- signal strength measurements- interference measurementsIn essence, BTS is a complex modem!
8 Base Station Controller - BSC DB contains- state information for all BSS - BTS softwareDBBTS-1BTS-2Xswitch matrixFrom/to MSCFUNCTIONS:switch calls from MSC to correct BTSand converselyProtocol and coding conversionfor traffic (voice) & signaling (GSM-specific to ISDN-specific)Manage MS mobilityEnforce power controlBTS-K1 BSC may control up to 40 BTS
9 Transcoding and Rate Adaptation BTS:collects speech trafficDeciphers and removes error protectionResult:13 kbps air-interface GSM speech-coded signalMSC:A modified ISDN switchNeeds to receive ISDN-coded speech64 kbps PCM format (A-law)Transcoding and Rate AdaptationUnit (TRAU) needed!Rationale: re-use existing ISDN switches & protocols
10 TRAU possible placements 13 kbit/s64 kbit/s64 kbit/sMSCOn BTSBTSTRAUBSC13 kbit/s64 kbit/sOn BSC16 kbit/sMSCBTSBSCTRAU64 kbit/s(4x16 sub-mux)On MSC13 kbit/s16 kbit/sMSCBTSBSCTRAUWhy 16 kbps instead of 13? Inband signalling needed for BTS control of TRAU(TRAU needs to receive synchro & decoding information from BTS)
11 Network Switching Sub-System Elements:Mobile Switching Center (MSC) / Gateway MSC (GMSC)Enhanced telephone switching centers (digital, ISDN)With support for user mobility, registration, handoverHome Location Register (HLR ) / Authentication Center (AuC)Visitor Location Register (VLR)Equipment Identity Register (EIR)Functions:Call controlUser managementInter-component communicationVia SS7 signalling network with suitable extensions(e.g. MAP – Mobile Application Part)
12 Location 1 MSC 1 VLR Several Location Areas MSC VLR LA-1 LA-2 LA-3 …LA-n1 MSC1 VLRSeveral Location Areas
13 Location Registration (Update) (very) basic idea 33) Update pointer at HLR, which now knows which LAI/VLR the user is locatedMSCVLRBTSBSCMSHLR22) Register MS ID (IMSI) into local VLR;Authenticate; receive TMSI for local paging purposes1MS switches ON; detects cell through BCCH carrier; Obtain Location Area Identifier (LAI) from BCCH
15 Changing MSC/VLR MSC MSC An MS always has a dedicated entry in the HLR Public switched telephone networkPSTNHLRVLRMSCVLRMSCBase StationBase StationAn MS always has a dedicated entry in the HLRPlus one entry in JUST 1 VLR (related to the MSC the user is connected to)
16 Location Update: different VLR MSVLR-newHLRVLR-oldBSS/MSCLoc. Upd. RequestTMSI(+ old LAI), LAIUpdate Loc. AreaTMSI(+ old LAI), LAIdetermineVLR-oldFrom old LAISend parameters (TMSI, old LAI)IMSI response (IMSI,RAND,SRES,Kc)authenticationUpdate LocationIMSI, MSRNCancel LocationIMSIGenerateNew TMSICancel Locat. ACKActivate cipheringStart CipheringKcInsert Subscrib. DataIMSI, additional dataIns. subs. data ACKLocat. Upd. AcceptIMSIForward new TMSI… …
17 Call switching Gateway MSC – GMSC Needed, as fixed network switches are not mobile capable!!GMSC task: query HLR for current MS location(if fixed network switches were able to query HLR, direct connection with local MSC would be available)XXXXXGMSCMSCMSCHLRMSCPLMNPublic LandMobile Network
18 Notation A call involves two “Parties” Calling Party (caller) user generating the callCalled Party (callee)user receiving the callMobile Originating Call (MOC)Call originated by an MSMobile Terminating Call (MTC)Call directed to an MS
22 Routing calls to Roaming MS ISDN(UK)MSCInternational SwitchingCenterPLMN 2(UK)International SwitchingCenterISDN(ita)Transit ExchangePLMN 1(ITA)GMSC 1MSCMSISDNMSRN +44.NDCLocal ExchangeHLR
23 Is the PRICE (!) to pay for simple routing and billing “tromboning”Call to MSISDNMSCISC(UK)PLMN 2(UK)Call to MSISDNIs the PRICE (!) to pay for simple routing and billingISC(ITA)PLMN 1(ITA)GMSC 1MSCMSISDNMSRN +44.NDCHLR
24 Number portabilitySubscriber may switch operator without changing his numberFirst implemented in fixed networkmay 2002: extended to mobile networksEssential for fair competition among network operatorsUK 2002 survey: 42% of corporate subscribers were willing to change mobile operator; but 96% were, if number could be portedResistence from leading operatorsNumber portability helps newer operators to compete with traditional ones
25 NotationDonor switchThe switch corresponding to a “ported” telephone numberRecipient switchThe switch to which the ported number is attached
26 Technical solutions a) call forwarding Originating networkDonor networkswitchswitchswitchRecipient networkOriginating switch sets-up trunk to donor switchDonor switch sets-up trunk to recipient switchSimplest solution, as call forwarding is a feature available in virtually all switchesBut extremely inefficient routing and trunking resource consumption!
27 Technical solutions b) query on release Originating networkDonor networkSS7 ISUP IAMswitchswitchSS7 ISUP RELNumber PortabilityDataBaseswitchRecipient networkDonor switch “blocks” incoming call with a release message (REL)REL carries a QoR cause value, stating that called party number is ported Originating switch then queries Number Portability database
28 Technical solutions c) all-call query Originating networkDonor networkswitchswitchNumber PortabilityDataBaseswitchRecipient networkOriginating switch queries Number Portability database for every call!!- best solution if majority of numbers are ported (no interaction with donor)- but very high DB load, as EVERY number must be looked-up!
29 Mobile Number Portability Same ideas as fixed number portabilityThe donor switch is the GMSC of the donor networkDonor GMSC Call forwarding (if more efficient fixed number portability not supported)While porting number, may also get MSRN!Recipient networkHLRGMSCMSCNote: If path must cross GMSC:Use Intermediate Routing NumberMSRNIRNMSRN(or IRN)Incoming callHLRGMSCSignaling relay functionDonor networkClearly, still suffers of tromboning!
30 Mobile Number Portability (with all call query approach) Recipient networkQuery MSRNGMSCHLRMSCReturn MSRNIRNIncoming callNumber PortabilityDataBaseQuery IRNswitchReturn IRN
31 Mobile Number Portability improved – (with all call query approach) Recipient networkGMSCHLRMSCMSRNSignaling relay functionIncoming callNumber PortabilityDataBaseQuery MSRNswitchReturn MSRN
32 Wireless Cellular Networks (basics) Part 4 – GSM radio interface
33 GSM Radio Spectrum Frequency [MHz] 2 x 25 Mhz band Duplex spacing: 45 MHz124 carriers x band200 KHz channelsSuggested use: only 122Use top & bottom as additional guard8 TDMA slots x carrierfull rate calls – 13 KbpsIf half-rate used, 16 calls at 6.5 kbps960DOWNLINKBS MS93591512345678890.4UPLINKMS BS890.2“guard band”890
34 Adjacent channels (due to GMSK) 60dB35dBSpecification: 9dBIn practice, due to power control and shadowing, adjacent channelsCannot be used within the same cell…
35 Physical channel time slot time slot 7 time 577 ms 200 KHz bandwidth + GMSK modulation1625/6 kbps gross channel rate ( kbps)1 time slot = 625/4 bitsbits15/26 ms = mstime slottime slot7time577 ms1 frame = 60/13 ms = ms26 frames = 120 ms (this is the key number)
36 Hybrid FDMA-TDMA physical channel = (time slot, frequency) Total n. of channels: 992200 KHz200 KHz200 KHz200 KHz200 KHz200 KHzslot200 KHz200 KHz200 KHz577us577us577us577us577us577us577us577ustime
37 Slow Frequency hopping (optional procedure within individual cell) Hopping sequence (example):… f1 f2 f5 f6 f3 f7 f4 f1…Slow = on a per-frame basis- 1 hop per frame (4.615 ms) = 217 hops/secondPhysical motivation:- combat frequency-selective fading- combat Co-Channel Interferencenext slot may not interferere with adjacent cell slot (different hopping sequence)- improvements: acceptable quality with 9 dB SNR versus 11 dB
38 Duplexing MS uses SAME slot number on uplink and downlink Uplink and downlink carriers always have a 45 MHz separationI.e. if uplink carrier is downlink is 919.23 slot delay shift!!1234567DOWNLINKUPLINK1234567MS: no need to transmit and receive in the same time on two different frequencies!
39 Structure of a TDMA slot Normal burstTB3DATA57S1Trainingsequence26S1Data57TB3GP8.25148 bit burstbit (15/26 ms = ms)Symmetric structureDATA: 2 x 57 data bits114 data bits per burst“gross” bits (error-protected; channel coded)“gross” rate: 24 traffic burst every 26 frames (120 ms)22.8 kbps gross rate13 kbps net rate!S: 2 x 1 stealing bitAlso called stealing flags, toggle bitsNeeded to grab slot for FACCH (other signalling possible)
40 Guard Period rationale BTSdAssume the following synchro mechanism:BTS transmits at time 0MS receives at time d/cMS transmits at time 3+d/cBTS receives at time 3+ 2d/cOffset depending on d!BTS downlink tx1234MS downlink rx1234MS uplink rx1BTS uplink rx11Expected RX time!
41 Guard period sizing … … … … Maximum cell radius: dwlink slot 1dwlink slot 4…dwlink slot 1dwlink slot 4MS time…BTS timeuplink slot 1…uplink slot 1Maximum cell radius:Is there something wrong? (GSM says that cells go up to 35 km)
42 Frame synchronization TA (transmitted in the SACCH)BTSTiming Advance (TA)Parameter periodically transmitted by BTS during MS activity6 bits = 0-63Meaning: anticipate transmission of TA bitsTA=0: no advanceI.e. transmit after bits after downlink slotTA=63:Transmit after bits timedwlink slot 4dwlink slot 4TABTS timeMS timeuplink slot 1uplink slot 1uplink slot 1TA avoids collision!
43 Timing Advance analysis Downlink propagation delay:d/cUplink propagation delay:Uplink delay with TA:d/c-TAPerfect resynchronization occurs whenTA = 2d/cMaximum cell size for perfect resync:8.25 bits Guard time additionally available for imperfect sync (+/- error)
44 And when the user is not connected? But wants to connect… Solution: USE A DIFFERENT BURST FORMATAccess Burst: much longer Guard Period availabledrawback: much less space for useful informationAccess burstTB8Trainingsequence41Data36TB3GP68.2588 bit burstbit (0.577 ms)No collision with subsequent slot for distances up to 37.8 km
45 Logical vs Physical channels Logical channels(traffic channels, signalling (=control) channels)Physical channels(FDMA/TDMA)Physical channelsTime given frequenciesIssues: modulation, slot synchronization, multiple access techniques, duplexing, frequency hopping, etcLogical channelsBuilt on top of phy channelsIssue: which information is exchanged between MS and BSS
46 Logical – physical mapping Physical Channel: data rate r, time slot ifrequencyLogical Channel Mapping:Different channels may share a same physical channelfrequencyFrame 8Frame 9Frame 10Frame 11Frame 12Logical channel A: data rate r/3, time slot i, frame 3kLogical channel B: data rate 2r/3, time slot i, frame 3k+1, 3k+2
47 GSM logical channelsTraffic channel (TCH)TCH/FTCH full rateMSBSSTCH/HTCH half RateBroadcast channelBCCHBroadcast controlBSSMS(same information to all MS in a cell)FCCHFrequency CorrectionSCHSynchronizationCommon Control channel (CCCH)RACHRandom AccessMSBSS(point to multipoint channels)AGCHAccess Grant(used for access management)PCHPagingDedicated Control channel (DCCH)SDCCHStand-alone Dedicated control(point-to-point signalling channels)SACCHSlow associated control(dedicated to a specific MS)FACCHFast associated controlAdditional logical channels available for special purposes(SMS, group calls, …)
48 Traffic channels (TCH/F) Periodic pattern of 26 frames (120 ms = 15/26 ms/TS * 8 TS/frame* 26 frame)12345678910111213141516171819202122232424 TCH frames over 26Same TS in every frame2134567213456721345672134567Theoretical rate: 1/8 channel rate: r=33.85 kbps2 signalling frames: r kbpsBurst overhead (114 bits over ):r 22.8 kbpsGP8.25TB3DATA57S1TrainingSeq. (26)Data148 bit burstbit (0.577 ms)
49 Slow Associated Control Channel Always associated to instaurated call on TCH (TCH + SACCH = TACH)On the same Time SlotPeriodic (order of ½ second) time-scale information for radio link controlTCH/F(0…7)TCH/F(0…7)123456789101112131415161718192021222324SACCH(0…7)IDLE frameSACCH-0SACCH-1SACCH-2SACCH-3SACCH-4SACCH-5SACCH-6SACCH-71 SACCH burst (per TCH) every 26 frames (120 ms)
50 Broadcast Channel (usual) organization 51 frame structure vs 26ms period (vs 120 ms)Sub-blocks with 10 framesStarting with Frequency Correction Channel (FCCH)Immediately followed by Synchronization Channel (SCH)Other frames (numbered from #0 to #50):#50 idle#2,3,4,5 BCCHRemaining: Paging (PCH) / Access Grant (AGCH) [=PAGCH]51 frame structure - downlinkFSBBBBPPPPFSPPPPPPPPFSPPPPPPPPFSPPPPPPPPFSPPPPPPPP10 frame sub-block
51 BCCH contents 184 bits Coded in 456 bits and interleafed in 4 bursts same coding and interleaving as SACCHBCCH capacity184 bits / (51*8*15/26 ms) ~ 782 bpsInformation providedDetails of the control channel configurationParameters to be used in the cellRandom access backoff valuesMaximum power an MS may access (MS_TXPWR_MAX_CCCH)Minimum received power at MS (RXLEV_ACCESS_MIN)Is cell allowed? (CELL_BAR_ACCESS)Etc.List of carriers used in the cellNeeded if frequency hopping is appliedList of BCCH carriers and BSIC of neighboring cells
52 BCCH carrier placement On DownlinkCorresponding uplink dedicated to Random Access Channel51 frame structure - uplinkRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRROn one frequency per cell (beacon)MUST BE on Time Slot #0Other Time slots may be used by TCHProvided that:All empty slots are filled with DUMMY burstsDownlink power control must be disabled
53 Fast Associated Control Channel FACCH: urgent signallingUsed when several signalling information needs to be transmittedCall setupHandoverFACCH block = 184456 after codingInterleaved as voice blockSpreaded on 8 burstsReplaces a voice block (20 ms) on the TCHVia stealing bitsVoice block(s) discardedMaximum FACCH bit rate184*6/120 [bits/ms] = 9.2 kbps (vs 383 bps of SACCH!)
54 FACCH insertion in TCH Via Stealing bits - upper bit = odd bits stolen - lower bit = even bits stolen- both bits = all burst stolenFigure: shows example of 2 FACCH blocks stealing a TCH (note begin and end behavior due to interleaving)time
55 Why paging Channel assignment: Paging only upon explicit request from MSPagingneeded to “wake-up” MS from IDLE state when incoming call arrives to MSMS accesses on RACH to ask for a channelGenerally SDCCH (but immediate TCH assignment is possible)1) pagingBSS/MSCMS2) Random access3) Channel assignmentPaging channel: PCHAccess Grant Channel: AGCHRandom Access Channel: RACHCCCHCommon ControlCHannelPAGCH
56 Paging Paging message generated by MSC Which receives incoming call Transferred to subset of BSCPaging limited to user’s location areaPaging message contains:List of cells where paging should be performedIdentity of paged user (IMSI or TMSI)Paging message coded in 4 consecutive bursts over the air interfaceSame coding/interleaving structure of SACCH (184456 bits)Paging for more MSs may be joined in one unique paging message
57 An example procedure involving signalling Setup for an incoming call (call arriving from fixed network part - MS responds to a call)Steps:paging for MSMS responds on RACHMS granted an SDCCHauthentication & ciphering on SDCCHMS granted a TS (TCH/FACCH)connection completed on FACCHData transmitted on TCH
58 Radio Resource allocation three standardized solutions Non-Off Air Call Set-Up (Non-OACSU)Normally used (previous description)Off Air Call Set-Up (OACSU)TCH assigned only when the called party actually responds!Best utilization of radio resource (avoids allocation if callee not available)Call drop if no TCH is available at this pointVery Early Assignment (VEA)Immediate assignment of TCHFastest signalling processWaste of resourcesVEARACHTCH (FACCH)TCH (DATA)Non-OACSURACHSDCCHTCH (FACCH)TCH (DATA)OACSURACHSDCCHTCH (DATA)Connection establishedCallee responds
59 handoverProcedure in which an MS releases a connection with a BTS, and establishes a connection with a new BTS, while ensuring that the ongoing call is maintainedThe MS remains in dedicated state (unlike cell reselection, where MS is in idle state)Handoff: synonymous of handoverNeeds two mechanismsHandover preparation: detection of cell-border crossingBased on radio link quality measurementsHandover execution: setup of a new channel in a cell, and tear-down of a previous channelImproved handover mechanisms:Seamless handover: when active call performance is not impairedNot possible in GSM: for about ms, communication is interruptedSoft Handover: when two channels are simultaneously set-up (old and new)Not possible in GSM; possible in UMTS
61 Handover classification Classification by motivationClassification by typologyRescue handover (mandatory handover)Driven by radio channel quality degradationConfinement handover (network-directed handover)Target: minimize radio interferenceAssign new channel when old channel results critical for total interferenceTraffic handover (network-directed handover)Driven by traffic congestion conditionsAlso called load-balancingInternal handoverIntra-BTSNew radio channel in the same cellNot termed as “handover” but as“subsequent assignment”Inter-BTS (Intra-BSC)Under control of same BSCExternal handoverInter-BSC (Intra-MSC)Change reference BSC; may imply a location area updateInter-MSCMost complex: need to change MSC
62 managed the current call Switching point for all inter-MSC handover Types of handoverAnchor MSC:the MSC that firstmanaged the current callRelay MSC:the MSC that currentlymanages the callSwitching point for all inter-MSC handoverSwitching point for inter-BSC handoverA-MSCR-MSCASwitching point for internal handoverBSCBSCBSCA-bisBTSBTSBTSBTSradiointerface
63 Handover taxonomy BCHO: Base station Controlled Handover Handover detection: BSHandover Execution: BSMCHO: Mobile Controlled HandoverHandover detection: MSHandover Execution: MSMAHO: Mobile Assisted HandoverGSM: somehow a BCHO with a flavor of MAHOHandover decision always taken by BSCBased on measures taken at both BTS and MSNew channel selection decision taken at BSC or R-MSC or A-MSC (depending on handover type) based on traffic consideration
64 Handover preparation Measurements performed at BTS RX signallevelFrom(dBm)ToRXLEV_0--110RXLEV_1-109RXLEV_2-108RXLEV_3-107…RXLEV_62-49-48RXLEV_63Measurements performed at BTSUp-link signal level received from MS lower than thresholdRXLEV_UL < L_RXLEV_UL_HUp-link signal quality (BER) received from MSRXQUAL_UL < L_RXQUAL_UL_HDistance between MS and BTSadaptive timing advance parameter > MAX_MS_RANGEInterference level in unallocated time slots.Measurements performed at MS.Down-link signal level received from serving cellRXLEV_DL < L_RXLEV_DL_HDown-link signal quality (BER) received from serving cellRXQUAL_DL < L_RXQUAL_DL_HDown-link signal level received from n-th neighbor cellRXLEV_NCELL(n) > RXLEV_MIN(n)Bit errorRatioFrom(%)ToRXQUAL_0-0.2RXQUAL_10.4RXQUAL_20.8RXQUAL_31.6RXQUAL_43.2RXQUAL_56.4RXQUAL_612.8RXQUAL_7
65 Handover preparation – additional metrics Transmission powerMaximum MS transmission powerMaximum serving BTS transmission powerMaximum neighboring BTSs transmission powercongestion statusof serving BTSof neighboring BTSsprovided they can support the MS.Handover MarginTo avoid ping-pong handover effect5-10 dB in normal operation; up to 30dB in urban operation (to fight shadowing)RXLEV(cell A)RXLEV(cell B)HandoverRXLEV(cell A)RXLEV(cell B)HandoverHANDOVER ALGORITHM: operator-dependent!GSM standard SUGGESTS a simple reference algorithm, but implementation left to operatorhysteresis
66 handover procedure skeleton 1) Handover request goes up to switching point1MSCBTSBSC5) Old channel/path torn down52) Switching point prepares new path on fixed net23) Switching point sends HO command to MS34) MS accesses new channel4
67 Inter-MSC handover X X X More complex, as an ISDN circuit must be set between MSCsWe’ll not enter into details (just the basic ideas)Two casesFirst MSC change (basic handover)Second MSC change (subsequent handover)XMSC-AMSC-R1MSC-AMSC-R1MSC-R2XXNote the role of theAnchor MSC!