Second Generation Systems Lectures 2 and 3 Second Generation Systems Prof. Hamid Aghvami Centre for Telecommunications Research - King’s College London

Digital Cellular Mobile Communications Technologies (Second Generation) Global System for Mobile Communications (GSM) specified by ETSI: - to replace the first generation analogue systems American TDMA System (IS-54) specified by TIA - to enhance the existing analogue system -Dual Mode Japanese Personal Digital Cellular (PDC) specified by MPT -to enhance the existing analogue system CDMA Systems (IS-95)

Personal Communication Networks Digital Cellular System at 900 and 1800 MHz (GSM-900 & GSM-1800) - Europe Personal Communication Systems at 1900 MHz (GSM-1900) - North America D-AMPS at 1900 MHz (IS-136) CDMA Systems at 1900 MHz (cdma one) Personal Handy-Phone System (PHS) - Japan

Radio Local Area Networks Cordless Telecommunication Systems IEEE Project 802.11 High Performance Radio LAN (HIPERLAN ) Cordless Telecommunication Systems Digital Enhanced Cordless Telecommunications (DECT ) Other Systems Trans-European Trunked Radio (TETRA)

GSM

Three phases of the GSM standard GSM Phase 1 Completed in 1990 GSM Phase 2 Completed in 1994 GSM Phase 2+ Being Standardized

Global System for Mobile Communications (GSM ) GSM digital cellular mobile radio was introduced into Europe in1992, the common European standard for a cellular radio system. Background: 1982 - Conference of European Post and Telecommunications (CEPT ) administration set up the “Groupe Special Mobile” to derive the specification of a common European cellular mobile system. 1986 - A decision was reached to implement a digital transmission system.

Basic Architecture of GSM AUC other VLRs Base Station Subsystem (BSS) H G D EIR HLR VLR OMC C B F BTS other BSSs A-bis Mobile Services Switching Centre (MSC) A BSC BTS PSTN ISDN CSPDN PSPDN Um BTS E BTS – simple transceiver (transmitter + receiver) without any intelligent BSC – responsible for radio resource allocation, terrestrial channel management, mapping of radio channels onto wired channels and execution of hand-over. MSC – switching and routing HLR – a data base holding general information about subscribers VLR – a temporary data base holding visiting subscriber’s general information during their visit. It also holds location area identities of the roaming users. EIR – a data base holding user equipment identities. OMC – a data base holding relevant information about overall operation and maintenance of the network. MS other MSCs BTS: Base Transceiver Station BSC: Base Station Controller HLR: Home Location Register VLR: Visited Location Register OMC: Operation & Maintenance Centre EIR: Equipment Identity Register AUC: Authentication Centre Basic Architecture of GSM

Frequency Bands and Bandwidth Uplink 890 – 915 MHz 25 MHz Downlink 935 – 960 MHz 25 MHz ……………. 1 2 3 4 124 100 KHz 200 KHz 100 KHz A 200 KHz carrier spacing has been chosen. Excluding 2x100 KHz edges of the band, this gives 124 possible carriers for the uplink and downlink. The use of carrier 1 and 124 are optional for operators. Multiple Access Technique FDMA/TDMA. The total band is divided into 124x200 KHz bands (FDMA). Each group of 8 users transmit through a 200 KHz band sharing transmission time (TDMA).

Logical Channel Types Logical Traffic channels (TCHs) The traffic channels are intended to carry encoded speech or user data. Logical Control Channels (CCHs) The control channels are intended to carry signalling and Synchronization data between the base station and the Mobile station.

Logical Traffic Channels Traffic channels are intended to carry encoded speech and user data. Full rate traffic channels at a net bit rate of 22.8 Kb/s (TCH/F) Half rate traffic channels at a net bit rate of 11.4 Kb/s (TCH/H) Data Channels Speech Channels Speech channels are defined for both full rate and half rate traffic channels. The latter for the future system. Data channels support a variety of data rates (2.4, 4.8 and 9.6 Kb/s) on both half and full rate traffic channels. The 9.6 Kb/s data rate is only defined for full rate application.

Logical Control Channels Downlink Uplink Broadcast Control Channels Frequency Correction - FCCH Synchronization – SCH Broadcast - BCCH - Common Control Channels Access Grant - AGCH Paging - PCH Common Control Channels Random Access - RACH Dedicated Control Channels Stand – alone Dedicated - SDCCH Slow Associated – SACCH Fast Associated - FACCH

Broadcast Control Channels (Downlink only Channels) Broadcast Control Channels (BCCH) – Broadcasts to all mobiles general information regarding their own cell as well as the neighbouring (up to 16) cells, e.g. information used for cell selection and for describing the current control channel structure. Frequency Correction Channels (FCCH) – for mobiles for frequency correction. Synchronization Channels (SCH) – for frame synchronization of mobiles and identification of the base station.

Common Control Channels Access Grant Channels (AGCH) – for assignment of a dedicated Channel after a successful random access. Paging Channels (PCH) – for paging to mobiles. For downlink Random Access Channels (RACH) – used for random access Attempts by mobiles. For uplink There are three downlink only channels and one uplink only channel.

Dedicated Control Channels Stand-alone Dedicated Control Channels (SDCCH) – are major signalling channels used for location updating, registration, point-to-point SMS and handover preparation. 8 SDCCH sent through one physical channel each having a bit rate of approximately 782 bits/s. Slow Associated Control Channels (SACCH) – always associated with TCH, SDCCH or FACH and carry timing advance and power control measurement results and information. The bit rate per channel is 391 bits/s.

Fast Associated Control Channels (FACCH) – carry the same Signalling data as SDCCH. They are used in the case when a very fast exchange of information is needed, e.g. , in the case of a hand-over. It accesses to the physical resource by stealing frames From the TCH. The bit rate of this channel is 9.2 kbits/s.

One full-rate channel (multiframe) 1 TDMA frame = 8 timeslots (4.615 ms) 1 2 3 4 5 6 7 120ms TC0 TC1 TC10 TC11 SACCH TC12 TC13 TC23 Idle One full-rate channel (multiframe) GSM uses both FDMA and TDMA. The total band per operator is divided into 200 KHz sub-bands (FDMA). Each group of 8 users transmit through a 200 KHz band sharing transmission time (TDMA). The transmission time is divided into multi-frame (120 ms period). Each multi-frame consists of consecutive 26 frames. 24 frames in each multi-frame are assigned to traffic channels (TC) and one frame (13th frame) to SACCH and one frame (26th frame) is not used (Idle frame). Each frame, in turn, divided into 8 time slots (physical channels). Each time slot is assigned to a user during a call.

Burst types in GSM stealing flags (1) (1) normal burst guard period(8.25) data(57) training sequence(26) data(57) start(3) stop(3) frequency correction fixed bits(142) burst synchronisation data(39) extended training(64) data(39) burst start(3) stop(3) mixed bits(58) training(26) mixed bits(58) dummy burst There are 5 burst structures defined in GSM. The most important one is the normal burst. The normal burst consists of two data fields, each containing 57 bits of data. A 26 bit training sequence is used to estimate the characteristic of radio channel (impulse response) in the receiver. A 3 bit start and a 3 bit stop are used to reset the adaptive equalizer at the receiver. 2 bits stealing flags are used to inform the receiver that the two data fields contain the actual traffic or replaced with FACCH signalling. In the guard period (8.25 bit duration) no signal is transmitted. The existence of the guard period is due to ramp-up and ramp-down of the power amplifier at the start and stop of a burst transmission. extended start(8) stop(3) extended guard period access burst synch. seq.(41) data(36) (68.25) Burst types in GSM

Channel Combinations The four most common channel combinations are: Full rate traffic channel combination TCH/F + FACCH + SACCH (any timeslot) Broadcast channel combination BCCH + CCCH (0,2,4,6-0 is used first) Dedicated channel combination SDCCH/8 + SACCH/C8 (any timeslot) Combined channel combination BCCH + CCCH + SDCCH/4 + SACCH/C4 (only 0)

Low capacity cell configuration 1 RF carrier: 8 physical channels 1 physical channel (timeslot 0) configured as: BCCH + CCCH + SDCCH/4 + SACCH/C4 7 physical channels (timeslots 1, …., 7) configured as: TCH/F + FACCH + SACCH

High capacity cell configuration 5 RF carrier: 40 physical channels 1 physical channel (timeslot 0) configured as: BCCH + CCCH 2 physical channels (timeslots 2, 4) configured as: CCCH 2 physical channels (timeslots 0, …., 7) configured as: SDCCH/8 + SACCH/C8 35 physical channels (timeslots 0, …., 7) configured as: TCH/F + FACCH + SACCH

Block Diagram of the Digital Mobile Radio System Mobile Station (MS) Base Station System (BSS) FEC Encoder De- Burst-to FEC Decoder Speech Burst & Modulator Tx Rx modulator -Continous & Encoder Interleaving Former Rate De-Interleaving Transcoder Converter to MSC Speech FEC Decoder Burst-to Burst De- FEC Encoder & Rx Tx Modulator Transcoder Decoder -Continous modulator Former & De-lnterleaving Rate Interleaving Converter from MSC Block Diagram of the Digital Mobile Radio System

GSM system features Adaptive time alignment BS is initially calculated the timing advance of MSs on the basis of the received access burst on the RACH The required timing advance for each MS is calculated in terms of the number of bit periods and sent to the MS as a 6 bit number. Timing advances from 0 to 63 bit periods can therefore be accommodated, giving a maximum BS – MS separation of 35 Km

2. Power control RF power control will be used in the GSM MS and BS to reduce the transmit power to the minimum required to achieve the minimum quality objective and hence reduce the level of co-channel interference The MS will be capable of varying its transmit power form its maximum output down to 20 mW in steps of nominally 2 dB The BS calculates the RF Power level to be used by the MS and sends a 4 bit number instruction to the corresponding MS

A GSM mobile is only active, i.e., either transmitting or receiving, 3. Handover A GSM mobile is only active, i.e., either transmitting or receiving, in 2 or the 8 timeslots in one frame The MS scans transmissions from surrounding BSs in the spare timeslots. It then reports the measured results, together with those for the serving BS, back to the fixed network via the BS, where the handover decision is made. This mechanism is referred to Mobile Assisted HandOver (MAHO). GSM uses the following Handover mechanisms: Backward handover – The signalling related to handover, just before the handover, is exchanged between the MS and the network through the current BS (not through the target BS).   Hard handover – The MS disconnects from the current BS and connects immediately to the target BS (Break and make). The MS is always connected to one BS. MAHO – The MS assists the network on handover decision by measuring the received powers from its serving and neighbouring BSs and reports them to the network. These results are used by the network in the handover algorithm. The handover decision and control are the sole responsibility of the network.

Inter-BSS Handover Procedure

GSM mandatory features Discontinuous transmission and reception (with the aid of Voice activity detector) Advantages: The level of co-channel interference is, on average, reduced By about 3 dB For a hand-held portable unit, the battery life can be significantly extended

2. Slow frequency hopping Advantages: The receive TDMA bursts with high error rates will be more spread in time The co-channel interference is more evenly spread between all the MSs

GSM Network Protocol Architecture MS BTS BSC MSC CM CM MM MM Layer 3 BSSAP RR BSSAP RR RR BTSM BTSM SCCP SCCP Layer 2 LAPDm LAPDm LAPD LAPD MPT MTP physical physical physical physical Layer 1 layer layer layer layer Um Interface A-bis interface A interface GSM Network Protocol Architecture

Layer 3 Functions are divided into 3 categories: 1. Radio Resource (RR) Management: Function relating to the establishment of physical connections for the purpose of transmitting call-related signalling information. 2. Mobility Management (MM): Functions relating to location registration, paging, attachment/detachment, handover, dynamic channel allocation and management. 3. Connection Management (CM): Call control related functions, SMS and service handling functions.

The data link layer (layer 2) over the radio link is based on a modified LAPD (Link Access Protocol for the D channel) referred to as LAPDm. On the A-bis interface, the layer 2 protocol is based on the LAPD from ISDN. The Message Transfer Part (MTP) level 2 of the SS& protocol is used at the A interface.

LAPD frame structure 0 1 1 1 1 1 1 0 Address octet 1 Address octet 2 0 1 1 1 1 1 1 0 Address octet 1 Address octet 2 Control octet 1 Control octet 2 Layer 3 information FCS octet 1 FCS octet 2 Octet 1 Opening flag Octet 2 Octet 3 Octet 4 The structure of the control filed depends on the frame type Octet 5 Octet 6 Layer 3 information is only presented in Layer in Layer 2 ‘information frame’ Octet N-3 Octet N-2 Frame check sequence Octet N-1 Frame check sequence Octet N Closing flag LAPD frame structure

A – bis interface CM and MM messages are not interpreted by the BSC or the BTS. they are transferred over the A-bis interface as transparent messages and over the A interface using the Direct Transfer Application Part (DTAP). RR messages are mapped to the BSS Application Part (BSSAP) in the BSC. In the BTS, most of them are handled as transparent by the BTS (e.g. random access, start ciphering, paging). BTS Management (BTSM) is used to transfer all OAM related information to the BTS.

A interface The Message Transfer Part (MPT) and the SCCP (Signalling connection Control Point) are used to support the transfer of signalling messages between the MSC and the BSS. The SCCP part is used to provide a referencing mechanism to Identify a particular transaction relating to, for instant, a particular call. The SCCP can also be used to enhance message routing, operation and maintenance information.

The MTP part provides a mechanism for providing the reliable transfer of signalling messages. A subset of MTP is used between the BSS and the MSC. The BSSAP provides the channel switching and aerial functions, it performs RR management, and the interworking functions between the data link protocols used on the radio and the BSS-MSC side for transporting signalling related messages.

MSISDN is the ‘directory number’ used to call GSM subscribers. IMSI is the main subscriber number used internally within GSM. MSRN is the routing number used on the second leg of an incoming call between GMSC and serving MSC. It is not known to GSM users. Both MSISDN and IMSI contain a country identity and a network identity Within the country. MSRN can be contained in the HLR record if the serving MSC/VLR has provided it when updating the location information.

HLR (1) MSISDN (2) IMSI (4) MSRN (3) MSRN Incoming Call MSRN GMSC MSC / VLR MSISDN An example of a call routing (to route an incoming call towards serving MSC) The HLR stores within each subscriber record an address of the visited MSC/VLR. The HLR record may also store an MSRN, if the visited MSC/VLR has provided such a roaming number when updating the visited MSC/VLR address. If such a roaming number is not stored in the HLR record, the HLR will interrogate the MSC/VLR using the subscriber IMSI to get an MSRN. The MSRN is then used to route the call from GMSC to the MSC/VLR (second leg of the call). The visited MSC/VLR chooses the MSRN from a pool of free numbers, and associates it temporarily with the called Subscriber’s IMSI. MSISDN Mobile Station ISDN Number IMSI International Mobile Subscriber Identity MSRN Mobile Station Roaming Number

Protocols in the call control producers MAP/D HLR RIL3-CC MAP/C MS MSC/VLR GMSC Protocols in the call control producers RIL3-CC Radio Interface Layer 3 - Call Control MAP Mobile Application Part

Service Telephony Emergency Call Messaging Data up to 9.6Kb/s Fax

Supplementary Services Number Identification Call Barring Call Forwarding Call Waiting Advice of Charge Group Multi-party Service Closed User Group

GSM phase 2 Correction of error and limitations Introducing half-rate speech coding standard (optional) Implementation of new data services and supplementary services -Call waiting -call hold -multi party -closed user group -advice of charge -line identification Fax (G3) Merging of GSM and DCS-1800 standards and extended frequency bands (+10 MHz) GSM phase 2 recommendations were published in December 1994

GSM phase 2 + General Packet Radio Services (GPRS) High Speed Circuit Switched Data (HSCSD) Enhanced Data rates for GSM Evolution (EDGE) Customised Applications for Mobile network Enhanced Logic (CAMEL)

General Packet Radio Service (GPRS) GPRS is a packet switched transmission mode currently being standardized by SMG2 within GSM phase 2+ framework. Intended to support frequent transmission of small volumes and infrequent transmission of medium volumes (but not packetized speech). Support point-to-pint (ptp) Connectionless (CL), ptp Connection-oriented (CO) and point-to-multipoint (ptm) services. A GPRS traffic channel may occupy one or more TDMA time slots within a GSM carrier frame. It is possible to increase or decrease the number of physical channels allocated to GPRS on a dynamic basis.

Overview of the GPRS Logical Architecture SGSN BSS GGSN SMS-GMSC SMS-IWMSC A Gc Gn Gb MT Um HLR Gi Gd D SM-SC Other PLMN Gp R TE MSC / VLR Gr Gs C E PDN EIR Gf SGSN: Serving GPRS Support Node GGSN: Gate GPRS Support Node PDN: Packet Data Network Signalling and Data Transfer Interface Signalling Interface Overview of the GPRS Logical Architecture

GPRS Network Elements MS : Both software and hardware upgrade needed BTS : Software upgrade needed – No change in hardware BSC : Software upgrade needed –The only hardware change is PCU interface TRAU : No change HLR and VLR : Software upgrade needed – No change in hardware SGSN : New GGSN : New

GPRS Mobile Station Operation Modes Class A : Circuit-switched and packet-switched simultaneous services. Class B : Automatic selection of circuit-switched or packet-switched service but not simultaneously. Class C : Packet-switched service only.

(Uplink / Downlink and uni-directional) Logical channel Traffic channels Control Channels Packet Data Traffic Channel / Full rate (PDTCH / F) Packet Data Traffic Channel / Half rate (PDTCH / H) (Uplink / Downlink and uni-directional) Packet Broadcast Control Channel (PBCCH) (Downlink) Packet Timing advance Control Channel Downlink (PTCCH / D) Packet Paging Channel (PPCH) (Downlink) Packet Access Grant Channel (PAGCH) (Downlink) Packet Notification Channel (PNCH) (Downlink) Packet Associated Control Channel (PACCH) (bi-directional) Packet Random Access Channel (PRACH) (Uplink) Packet Timing advance Control Channel Uplink (PTCCH / U)

Multiframe Structure for PDCH 52 TDMA Frames B0 B1 B2 I I B9 B B10 B11 I I: Idle frames B: Radio blocks Multiframe Structure for PDCH BH Information field BCS Normal Burst Normal Burst Normal Burst Normal Burst BH: Block Header BCH: Block Check Sequence Block Structure

Coding parameters for the coding schemes

GPRS Layered Protocol Structure (User Plane) MAC GSM RF SNDCP LLC RLC Application IP / X.25 IP / X.25 Relay GTP SNDCP GTP LLC UDP/ TCP UDP/ TCP Relay RLC BSSGP BSSGP IP IP Network Service Network Service L2 MAC L2 GSM RF L1bis L1bis L1 L1 MS Um BSS Gb SGSN Gn GGSN Gi PLL : Physical Link Layer RFL : Radio Physical Layer FR : Frame Relay TCP : Transmission Control Protocol UDP : User Datagram Protocol GTP : GPRS Tunnelling Protocol RLC : Radio Link Control NS : Network Service MAC : Medium Access Control LLC : Logical Link Protocol SNDCP : SubNetwork Dependent Convergence Protocol BSSGP : BSS GPRS Protocol

GPRS Layered Protocol Structure (Control Plane) Interworking Relay GMM SM MAP MAP GMM SM GTP GTP TCAP TCAP LLC LLC UDP UDP SCCP SCCP Relay RLC BSSGP RLC BSSGP IP IP MTP3 MTP3 MAC MAC NS(FR) NS(FR) L2 L2 MTP2 MTP2 PLL PLL Phy- sical Phy- sical Phy- sical Phy- sical MTP1 MTP1 RFL RFL MS BSS SGSN GGSN HLR Um Gb Gn Gc SM : Session Management GMM : GPRS Mobility Management MAP : Mobile Application Part MTP : Message Transfer Part TCAP : Transaction Capabilities Application Part SCCP : Signaling Connection Control Part BSSAP+ : Base Station System Application Part+

GPRS Protocols GPRS special protocols SNDCP, LLC, RLC, MAC, BSSGP, BSSAP+, GTP GSM protocols PLL, RFL, GMM / SM, MAP SS7 protocols TCAP, SCCP and MTP Internet protocols IP, UDP / TCP

Medium Access Control (MAC) Sublayer MAC sublayer maneges and controls access to shared medium between a multiple of MSs and the network. It’s functionalities include scheduling, queueing, contention resolution, PDCH multiplexing and power control. Radio Link Control (RLC) Sublayer The RLC sublayer is responsible for segmentation and reassemble of higher layer PDUs into RLC / MAC blocks, buffering and the selective re-transmission of unsuccessfully delievered RLC / MAC blocks with backward error correction. Logical Link Control (LLC) Sublayer The purpose of LLC is to transfer information between layer 3 entities in the MS and SGSN independent of the underlying radio interface protocols. It’s functions include sequence control, detection and recovery of format and operational errors on a logical link connection, notification of unrecoverable errors, flow control and ciphering.

Subnetwork Dependent Convergence (SNDC) Sublayer The SNDC sublayer provides protocol transparency of network layer protocol data units from a wide variety of subnetworks and data links through the underlying radio interface. Base Station System GPRS Protocol (BSSGP) Layer The main function of BSSGP is to provide the radio related QoS and routing information required to transmit user data between a BSS and SGSN. It’s secondary function is to enable two physically distinct nodes (BSS and SGSN) to operate node management control Functions. Network Service (NS) Layer The NS layer transfers upper layer protocol data units (NS SDUs) between a BSS and SGSN that are connected by a direct point-to-point frame relay link or through an intermediate frame relay network.

High Speed Circuit Switched Data (HSCSD) HSCSD is a high speed circuit switched transmission mode currently being standardised by SMG2 committee of ETSI. HSCSD is a GSM bearer service intended to use multiple time-slots for increased data rate over the GSM air interface. HSCSD may be used for a wide variety of transparent and non-transparent tele-services. For two timeslots allocated to one MS no need for simultaneous reception and transmission.

In both symmetric and asymmetric HSCSD configurations, one bi-directional channel (the main channel) carries a FACCH used for all the signalling not carried on the SACCH. The same frequency hopping sequence and training sequence are used for all the channels in the HSCSD. The same channel coding schemes as specified for TCH/F9.6 and TCH/F4.8 data channels are used. A different channel coding may be considered at the later stage.

An example of HSCSD Configuration

Enhanced Data rates for GSM Evolution (EDGE) The aim of EDGE is to use new modulation and channel coding techniques to evolve data services in GSM reusing as much of the physical layer as possible. The EDGE concept has been considered for both GPRS (EGPRS) and Circuit Switched Data (ECSD). 8 PSK is the preferred modulation technique to provide high data rates. It supports data rates from 22.8 Kb/s to 69.2 Kb/s depending on the channel coding. Different coding proposals have been made, but no decision has been taken yet.

Coding parameters for the EGPRS coding schemes MCS-9 MCS-8 MCS-7 MCS-6 MCS-5 MCS-4 MCS-3 MCS-2 MCS-1 Code rate 1.0 0.92 0.76 0.49 0.37 0.80 0.66 0.53 Header Code rate 0.36 1/3 0.53 Modulation RLC blocks Per Radio Block (20ms) 2 1 Raw Data Within one Radio Block 2x592 2x544 2x448 592 544+48 448 352 29 272+24 224 176 Family A B C BCS Tail payload HCS Data rate Kb/s 59.2 54.4 44.8 29.6 27.2 22.4 17.6 14.8 13.6 11.2 8.8 2x12 2x6 8PSK 8 12 6 GMSK Note: The italic captions indicate the padding.

For more information about GPRS Yi-Bing Lin, Herman C-H Rao and Imrich Chlamtac, “ General packet radio service (GPRS): architecture, interfaces, and deployment “, Wireless Communications & Mobile Computing, Vol.1, No.1, Jan-Mar 2001, ISSN 1530-8669.