1. Notes from Stallings, modified/added to1 TDMA and GSM Session 7 Nilesh Jha

2. Differences Between First and Second Generation Systems Digital traffic channels – first-generation systems are analog; second-generation systems are digital Channel access – second-generation systems use TDMA or CDMA, first uses FDMA First in 800-900 MHz band, second also there plus 1800-2000 MHz band Encryption – all second generation systems provide encryption to prevent eavesdropping Error detection and correction – second-generation digital traffic allows for detection and correction, giving clear voice reception

3. Cellular vs PCS Coverage Free Space loss is proportional to 20log 10 f (f in MHz). Difference between PCS (1900 MHz) and cellular (880 MHz) is around 7 db. PCS base stations Cellular base station On average ratio of PCS stations to cellular 3:1

4. Cellular vs PCS Cellular designed for cars Cellular analog portable power: 1/2 to 3 watts FDMA access Large cell sizes PCS goal is for a user not a place or vehicle PCS digital portable power: 100 to 300 milliwatts TDMA access (IS-54/136 and GSM) CDMA access (IS-95) Often cells closer together

5. PCS License Auction Results Auctions raised about $20 billion Blocks A and B (30 MHz)- companies wanting a nationwide footprint (MTAs) Block C (30 MHz)- small companies- dominated by Nextwave which went bankrupt (MTAs) -- now re-organizing? Blocks D, E, F- (10 MHz) - mainly bought to fill coverage gaps (BTAs)

6. DIGITAL CELLULAR DAMPS --- also called US TDMA IS-54 later renamed IS-136 TDMA, 8 kb/s voice, x2 overhead Three 16 kb/s TDMA channels in 30 kHz --- Reuse factor 7 with sectoring 48 kb/s in 30 kHz= 1.6 bits/sec/Hz 3 times more spectrum efficient than analog (AMPS) Approx. 7 calls/MHz/cell Approx. 210 max calls/cell Used by ATT, Cingular and others in US See TDMA Tutorial at http://www.iec.org/online/tutorials/tdma/ See PCS Tutorial at http://www.iec.org/tutorials/pcs/index.html or at at http://www.iec.org/online/tutorials/pcs/http://www.iec.org/tutorials/pcs/index.html http://www.iec.org/online/tutorials/pcs/

7. IS-54 (IS136) TDMA 6 time slots (interleaving of 2 voice samples) 3 users/ frame 324 bits/ time slot 6.667 ms/slot Slot N

8. US TDMA Architecture US TDMA started as IS-54, dual mode terminals, after GSM Adopted MAHO, encryption, associated control channels (instead of FVC/RVC), but uses the AMPS forward and reverse control channels to set up calls and for MM Later established IS-136, with digital control channels (DCCH) separate from the AMPS control channels, and added sleep modes, allowing all digital phones, and various supplementary services like voice mail, caller ID, and short message service IS-136 also specifies an air interface, and a basestation, MSC and interworking function, and going to public, private or residential networks (PSTN, PBX, or cordless) Identifiers: AMPS plus others: A-key to each subscriber (for encryption and authentication), location areas (for easier location tracking and registration), IMSI (international mobile subscriber ID), others

9. From Goodman

11. Radio Transmission 30 KHz, 6 slots per frame, each user 2 slots, 40 msec frame Some time offset between reverse and forward to not transmit and receive at same time, still do full duplex 324 bits per slot, 6 slots/frame, in 40 msec=48.6 kbps Full rate channel is 2 slots/frame = 16.2 kbps; also half rate, 2X, 3X No fixed assignment of frequencies to control channels Uses DQPSK with possible 45 degree, 45+90, 45+180 and -45 degree shifts from each phase angle, so 4 possible next symbols, so 2 bits each, called pi/4 shifted DQPSK --- a 1.62 bps/Hz modulation spectral efficiency Fig. 5.4 --- also, differential, no absolute phase reference or detector needed But not very energy efficient -- BER for given Eb/Nsub0 not great, reuse still 7 Mobile transmits.25 mw up to 4 w, in 4 dB steps, but only 1/3 the time Spectral efficiency: in terms of voice calls: About 3* better than AMPS ( a bit higher, if it uses 21 control channels for one provider in 25 MHz, instead of 21*3), with 7 factor reuse

12. From Goodman

15. Logical Channels Digital traffic channels Data (incl. Voice), associated control channels, sync and other information Typically all in one slot -- see fig. 5.6 eg, 28 bit sync, 260 data bits, 12 SACCH, some guard time SYNC does frame sync, and is training sequence for equalizer SACH is control, at 600 b/s per user, like FVC/RVC in AMPS Mobile only transmits on its slot, power off rest of time FACCH does a blank and burst on the traffic channel Faster rate control for handoffs (about x6), with rate 1/4 code DCCH Forward are both broadcast as well as addressed to one, reverse are random access -- all have SYNC, some preamble, control data Organized hierarchically in half frames (blocks), superframes (32 frames) and hyperframes (64 frames) --- control data is muxed in into superframes Different types of control data are called logical channels eg, SPACH is short message service, paging and access response channel Terminals listen to a specific paging subchannels in the SPACH, sleep otherwise

16. From Goodman

19. Messages and Authentication On AMPS logical channels, on SACCH and FACCH, on DCCH’s Table 5.5 for SACCH and FACCH -- includes call management RRM, authentication, handoff (Table 5.6), etc eg, Handoff: includes new frequency for handoff, power to radiate, half rate or full rate, time slot number, color code of new BS, other On DCCH: system info on broadcast channels, call management messages, message waiting and paging on SPACH, authentication, etc Authentication and privacy in IS-136: due to A-key, in phone and in authentication center (AC) Used by both mobile and AC to generate a shared secret key, SSD, from A- key and a random number generator (random number is transmitted) -- but can not be reversed to A-key --- used for authentication and privacy

20. From Goodman

22. MAHO -- MACA -- Some RRM Terminal measures signal quality on the active traffic channel During time slots it is not active it monitors other BS’s Transmits channel quality information to its BS on the SACCH Mobile is told which other channels to monitor by BS -- 6 or 12 Signal quality is from power level and BER BER is better than just power levels: interference could give good power levels, but bad BER -- better than AMPS BS also measures signal quality on active traffic channel Since in TDMA the BS knows signal quality at nearby BS’s it knows who to handoff to In TDMA most of the processing done at BS, in AMPS at MSC MACA is similar, for channel allocation, helping the BS assign channels; the mobiles measure idle channels and tell the BS SACCH and FACCH have also power adjustment and time alignment messages

23. GSM (Europe/US)) Global System for Mobile Agreed TDMA standard devised for European environment 200 kHz channels with 270.833 kbits/s. eight TDMA users 13kb/s vocoder, 20kb/s w/overhead Reuse factor 3-4 About 5 calls/MHz/cell with sectoring, or 150 calls/cell (30 MHz) See GSM Tutorial Available at http://www.iec.org/tutorials/gsm/index.html http://www.iec.org/tutorials/gsm/index.html

24. From Goodman

26. Mobile Wireless TDMA Design Considerations --- for GSM Number of logical channels (number of time slots in TDMA frame): 8 Maximum cell radius (R): 35 km Frequency: region around 900 MHz Maximum vehicle speed (V m ):250 km/hr Maximum coding delay: approx. 20 ms Really, this is also max. speech sample delay so that one can not distinguish breaks Maximum delay spread (  m ): 10  s Bandwidth: Not to exceed 200 kHz (25 kHz per channel)

27. Steps in Design of TDMA Timeslot

28. Logic for GSM Rate and Modulation Max. delay of 20 msec >>> How much data in 20 msec? If 12 kbps speech codec, that’s 260 bits Add rate 1/2 convolutional code, that’s 480 bits Put in 8 speech slots, that’s 8*480 bits, all in 20 msec That’s 192 kbps Notice that data rate is high enough that 20 msec worth of speech is included, multiplexed in with 7 other users, for each user’s sample Really with 13 kbps and other overhead it turns into 270.8 kbps It uses GMSK modulation -- Gaussian weighted Minimum Shift Keying -- like FSK, but changes frequency while maintaining continuous phase, and shifts the minimum possible --- used because more spectrally efficient than PSK or FSK, and fits data rate into 200 KHz BW, but power efficient (see later)

29. GSM Speech Signal Processing -RPE-LPE (Linear Predictive Coding) -In 20 msec, 260 bits, turned into (with rate 1/2 coding+other) 189*2+78=456 bits, in 20 msec is 22.8 kbps (traffic channel) -Interleaved over multiple slot timeperiods, within 20 msec protects against bursts -Encrypted 114 bits at a time -Into time slots or bursts -GMSK modulation

30. Radio Transmission -- GSM 200 KHz carriers, so fewer transmitters and receivers at a BS GMSK does 1.35 bps/Hz, worse than US TDMA, but has better BER for a given Eb/Nsub0 (so better frequency reuse), and has constant envelope modulation which allows more efficient amplifiers and is better on battery drain than US TDMA Can do FH -- network directed Slot is.577 msec, then a frame is 8 slots at 4.615 msec Slot has 2*57 bits of data, 26 bits training sequence (8 different ones, also used as SAT/DCC function), guard time and tail bits, flags Then organized as multiframes (26 or 51 frames), superframes(26 or 51 multiframes) and hyperframes (2048 superframes -- about 3+1/2 hours, used for encryption periods) Traffic multiframe (26 frames ) is 120 msec A full rate traffic channel (TCH/F) carries one time slot in 24 of 26 traffic frames, in every multiframe -- each TCH/F has its SACCH in one frame of every multiframe

31. From Goodman

33. Spectrum Efficiency GMSK is more power efficient than US TDMA, providing good voice quality at S/I of about 7 dB Thus allows frequency reuse of 3-4-5 With 4 it is 5 calls/cell/MHz 8 calls/200 KHz or 40 in 1 MHz, one way 20 two ways, and with 4 reuse it’s 5 calls/MHz/cell Actually one carrier left as guard, slightly smaller (4.96)

34. TDMA Format – Time Slot Fields -- GSM Trail bits – 3 --- allow synchronization of transmissions from mobile units Encrypted bits – encrypted data, same number of bits -- 114 in two groups of 57 Stealing bit - indicates whether block contains data or is "stolen ” for control signaling Training sequence – used to adapt parameters of receiver to the current path propagation characteristics -- in the middle Ground rule is that it 6*max. delay spread for equalizer training -- that ’ s 60usec, at 270 kbps or so it ’ s about 16 bits -- actually 26 Guard bits – used to avoid overlapping with other bursts

35. From Goodman

36. Logical Channels Traffic channels, half and full rate Signaling channels Broadcast eg, frequency correction (pure sine wave, used to match the BS, SYNC, some control Common Control Channels Paging, Random access, Access Dedicated Control Channels Slow, fast, stand-alone

37. GSM Network Architecture

38. Mobile Station Mobile station communicates across Um interface (air interface) with base station transceiver in same cell as mobile unit Mobile equipment (ME) – physical terminal, such as a telephone or PCS ME includes radio transceiver, digital signal processors and subscriber identity module (SIM) GSM subscriber units are generic until SIM is inserted SIMs roam, not necessarily the subscriber devices

39. Base Station Subsystem (BSS) BSS consists of base station controller and one or more base transceiver stations (BTS) Each BTS defines a single cell Includes radio antenna, radio transceiver and a link to a base station controller (BSC) BSC reserves radio frequencies, manages handoff of mobile unit from one cell to another within BSS, and controls paging

40. Network Subsystem (NS) NS provides link between cellular network and public switched telecommunications networks Controls handoffs between cells in different BSSs Authenticates users and validates accounts Enables worldwide roaming of mobile users Central element of NS is the mobile switching center (MSC)

41. Mobile Switching Center (MSC) Databases Home location register (HLR) database – stores information about each subscriber that belongs to it Visitor location register (VLR) database – maintains information about subscribers currently physically in the region Authentication center database (AuC) – used for authentication activities, holds encryption keys Equipment identity register database (EIR) – keeps track of the type of equipment that exists at the mobile station

42. GSM Signaling Protocol Architecture (m - modified/mobile from ISDN) (Uses CRC, ARQ)

43. Functions Provided by Protocols Protocols above the link layer of the GSM signaling protocol architecture provide specific functions: Radio resource management Does radio channel management, including for handoffs Mobility management Roaming, location databases, authentication Connection management sets up calls between users Mobile application part (MAP) -- Core Network functions, like IS-41 in US systems BTS management SCCP and MTP are from SS7, for control signaling Signal connection control part, message transfer part