Modern Mobile Networks Dr. Dóra Maros Modern Mobile Networks GSM FDMA/TDMA Cell structure, reuse factor Logical channels Bursts Multiframes

GSM Frequency Bands GSM900 : Uplink: 890~915MHz Downlink: 935~960MHz Duplex distance: 45MHz Bandwidth: 25MHz Channel bandwidth: 200KHz 124 duplex carriers Channel numbering: 1-124 EGSM900 : Uplink: 880~890MHz Downlink: 925~935MHz Duplex distance: 45MHz Bandwidth: 10MHz Channel bandwidth: 200KHz GSM1800 : Uplink: 1710-1785MHz Downlink: 1805-1880MHz Duplex distance : 95MHz Bandwidth: 75MHz Channel Bandwidth: 200KHz 374 duplex carriers Channel numbering: 512-885 GSM1900MHz: Uplink:1850~1910MHz Downlink:1930~1990MHz Duplex distance: 80MHz Bandwidth: 60MHz Channel bandwidth: 200KHz

GSM Radio Interface TS0-TS7 1 TDMA frame = 8 timeslots Physical channel: One carrier, one timeslot - fxTy 1 TDMA frame = 8 timeslots 1 2 3 4 5 6 7 time TS0-TS7 DL and UL timing BTS

GSM Antennas Omni-directional antenna 360° radiation (sector antenna) 120°, 60° radiation

Hexagonal Cell Pattern Omni antennas On the green line we can measure same signal strength

Theory of Frequency Reuse Cells using same carrier frequencies, reuse factor:7 Using the same carriers is not allowed in the adjacent cells! We apply omni antennas!

3/9 Cluster We apply 120° sector antennas Reuse factor = 9

4/12 Cluster We apply 120° sector antennas Reuse factor = 12

Adjacent Channel Interference No overlapping between two frequency bands 200 KHz f 200 KHz Overlapping causes adjacent channel interference f

C/I and C/A C/I C/A Carrrier f1/ carrier f1 interference Carrier f1/ adjacent carrier f2 interference

GSM Logical Channels 14.4Kbit/s FR TCH 9.6Kbit/s FR TCH Traffic Channels Data CH 4.8Kbit/s FR TCH 4.8Kbit/s HR TCH (TCH/H4.8) TCH FR (Full Rate, 13Kbit/s)) Voice CH HR (Half Rate, 6.5 Kbit/s) FCCH (DL): Frequency Correction CH. BCH SCH (DL): Synchronization CH. Control Channels BCCH (DL): Broadcast Control CH. RACH (UL): Random Access CH. CCH CCCH AGCH (DL): Access Grant CH. PCH (DL): Paging CH. SDCCH: Stand-alone Dedicated CCH. DCCH FACCH: Fast Associated CCH. SACCH: Slow Associated CCH.

Broadcast Channels Broadcast Channels (BCH): Downlink channels. Responsible for sychronization, frequency correction, the BTS broadcasts general information about cell and network. Point to multipoint connection, all MS in the cell receives the information on BCH. Broadcast Control Channel (BCCH): BTS sends general information around the cell (eg. Cell identity, Location Area Code, Network Code, maximum MS output power, etc.). Frequency Correction Channel (FCCH): MS can find the BCCH carrier in the cell by FCCH. The channel sends an unmodulated sine signal (it sends only zeros), so the MS can tune to BCCH carrier frequency. FCCH also helps to find a new BCCH carrier in the new cell after power on. Synchronization Channel (SCH): BTS sends a synchronization sequence for all MS for time synchronization. Base Station Identity Code (BSIC) and TDMA Frame Number (TFN) is also sent on this channel. TDMA frame number plays an important role in cryptografical algorithm (ciphering) on the radio channel.

Common Control Channels Common Control Channels (CCCH): Common physical cannel, but the messages is addressed only for one MS. Directional (uplink or downlink) Paging Channel (PCH): Downlink channel. If MS has an incoming call, network sends a paging (searching) message in the cells inside Location Area. IMSI or TMSI is also sent in the paging message. Access Grant Channel (AGCH): Downlink channel. This channel grants (offers) an SDCCH (numbered 0-7) in the cell for the MS point to point signalling. Random Access Channel (RACH): Uplink channel. MS uses when it initiates a connection to the network in case of power on, outgoing (MS originated) call, or location update procedure, etc.

Dedicated Control Channels Dedicated Control Channels (DCCH): Dedicated means that the channel is unique for one MS (point to point connection). These channels are used for connection establishment procedures, for signalling information in case of handover and other control information (power and timing control). DCCHs are bidirectional. Stand-alone Dedicated Control Channel (SDCCH): There are 8 SDCCHs in a cell (0-7). Used for connection establishment (authentication, ciphering, IMEI checking, and TCH assignment). When a TCH is assigned for MS, the mobile tunes to another channel. Slow Associated Control Channel (SACCH): Uplink: MS sends measurement report to BTS. Downlink: power regulation of MS, time alignment (accurate timing) of MS. Associates to TCH and SDCCH-hoz. Fast Associated Control Channel (FACCH): Used when handover procedure is needed. Downlink: a handover command (new channel and timeslot) is sent on TCH when Stealing Flags (F) bits are not zero. Uplink: handover acknowledge, power regulation, timing. Associates to TCH.

Types of GSM Bursts All „0” Information Sychronization bits Training bits Information Sychronization bits Information Dummy bits Training bits Dummy bits

FC, S and A Burst SCH FCCH RACH 148 bits 86 bits 0,577 ms, 156,25 bit Information Sychronization bits Information 148 bits FCCH RACH 86 bits Sychronization bits Information 0,577 ms, 156,25 bit G Guard perriod: no information transmitted T Tail bits:000

IDLE: no user info, predefined bit sequence N and D burst TCH, BCCH, PCH, AGCH, SDCCH, SACCH, FACCH Information Training bits Information IDLE: no user info, predefined bit sequence Dummy bits Training bits Dummy bits 0,577 ms, 156,25 bit F Stealing Flag

Guard Period Guard period Burst contents

TCH Multiframe

Multiframe on BCCH Carrier TS0 TDMA frames DL Downlink F:FCCH S:SCH C:Common TDMA frames DL Uplink RACH Repetition time: 51 frame

Multiframe on BCCH Carrier TS1 Dowlink multiframe structure is the same, but it is shifted in time!

Frame Structure

Modern Mobile Networks Dr. Dóra Maros Modern Mobile Networks GSM Radio propagation Path loss Shadowing Multipath fading, ISI Frequency hopping Interleaving

Radio propagation I. Frequency and wavelength The wavelength is inversly proportional to the frequency of elektromagnetic wave : λ = c/f, where λ - wavelength (m) c - velocity of electromagnetic wave (in vacuum and in the air about 3*108 m/s, accurate value: 299792458 m/s) f - frequency (Hz) Example: 1. f=900 MHz (9*108 Hz) λ =? 3*108 / 9*108 = 3/9 [m] ~ 0,33 [m] f=2,6 GHz (2,6*109) 3*108 / 2,6*109 = 1,154 * 10-1 ~ 0,1154 [m]

Radio propagation II. Path loss RSL Received Signal Level (dB) Free space attenuation: a0 = 20 log (4Πd/λ) a0 = 20 log (df) + 28,14 d (distance from antenna)

Radio Propagation III. Propagation Models Makrocell propagation models: Relative small traffic (rural, road), high speed of movement (>100 km/h) Hata, COST231 Mikrocell propagation models: High traffic (urban, suburban), smaller speed of movement (30-80 km/h) Walfish-Ikegami modell, COST 231 Indoor propagation models: Mootley-Keenan (félempirikus) Ray-tracing

Radio Propagation IV. Shadowing RSL (dB) Base Station Mobile Equipment Mean value d (distance from antenna) Slow fading caused by shadowing

Radio Propagation V. Multipath Fading Base Station Mobile Equipment Fast fading caused by reflections

Radio Propagation VI. Frequency Hopping Consecutive bursts are transmitted on different carriers Number of hopping: 217/s 4 frequencies Different wavelengths Fading dips shift!

Radio Propagation VII. Inter Symbol Interference (ISI) Bit error in the receiver! 1 or 0? Base Station Mobile Equipment If delay of received bit is > 1 bit duration, it may cause Inter Symbol Interference (ISI) in the receiver. Two consecutive bits interfere each other.

Radio Propagation VIII. VITERBI Demodulator and Decoder Burst contents on radio channel (received) Modified training sequence (noisy channel) Training sequence pattern in the receiver Correlator Modified channel model Viterbi Decoder Reconstructed bits Radio channel

Radio Propagation IX. Interleaving Original sequence Interleaved sequence Packet loss Reconstructed sequence Original sequence is segmented into blocks Consecutive blocks are sent in different bursts (different timeslots and frames )

Radio Propagation X. Interleaving on GSM Speech Channel (example) Segmentation 456 bits (20 ms speech) are divided into 8 blocks (57 bits each) 57 bits I. Level interleaving II. Level interleaving

Modern Mobile Networks Dr. Dóra Maros Modern Mobile Networks GSM Security functions Authenticaton Ciphering Location update Cell selection Handover

GSM Security Functions I. The network elements which take part in security functions :   Mobile Station (MS) Base Station (BTS) Mobile Switching Center (MSC or MSS) Autentication Center (AUC) Home Location Register (HLR) Visitor Location Register(VLR).

GSM Security Functions II. SIM card unlock: PIN = Personal Identity Number (4 digits) PIN unlock key: PUK code Authentication: A procedure of verification of IMSI validity on SIM card. Ciphering: This is an encyption procedure in BTS and MS for protection of user information (speech or data) on radio interface. IMEI checking: This procedure checks the ME IMEI number. If IMEI is on the black list of EIR, the connection establishment is denied! If IMEI is on the white list, MS can connect to the network. When IMEI is on the grey list , mobile has some restrictions in communication, but attach is allowed.

Random number generator AUC and TRIPLETs Kc: Ciphering Key Ki: Subscriber Identity Key Random number generator IMSI1 – Ki1 IMSI2 - Ki2 IMSI3 – Ki3 RAND Ki AUC A8 algorithm A3 algorithm SRES Kc Signed Response Ki Ciphering Key RAND Random Number

Authentication procedure SIM SRESSIM = SRESAUC ?

Kc Generation Kc: Ciphering Key Ki: Subscriber Identity Key SIM

In Mobile Equipment (ME) Ciphering Procedure In Mobile Equipment (ME)

Cell Selection (IDLE mode) Mobile tunes to the strongest BCCH carrier in its IDLE mode BCCH carrier 1 BCCH carrier 3 BCCH carrier 2 Serving BTS RSL carrier1 > RSL carrier2 > RSL carrier 3

IMSI Attach/Detach, az IMSI flag Power On: IMSI attached (1) Power Off: IMSI detached (0) IMSI record 1 VLR IMSI flag SDCCH

Location Area and LAC Location Area 2 (LAC2) Location Area 1 (LAC1) Location Area 3 (LAC3) MSC/MSS

Location Area in Paging Procedure Paging message is sent in all cells inside LA! Serving cell, where the connection is established

Location Update Procedure On BCCH LAC (Location Area Code) is transmitted Location Area 2 (LAC2) Location Area 1 (LAC1) IMSI record LAC1 LAC2 VLR Location Update procedure updates LAC in VLR IMSI record!

Location Update Procedure inside MSC/MSS Service Area LA2 LA1 BSC1 VLR MSC BSC 2 (1) new LAI (2) Channel Req. IMSI (RACH) (3) Channel required IMSI: LA1 LA2 (6) (7)Loc. Upd. Accept. (7) Loc. Upd. Accept. (SDCCH) (4) Immediate Assign. (AGCH) (5) Loc. Upd, Req. (SDCCH)

Location Update Procedure Between MSC/MSS Service Areas (8) Loc. Upd. Ack (SDCCH) (4) Suscriber Information Request VLR MSC2 IMSI: VLR1 VLR2 BSC2 MSC1 (5) LA 2 LA 1 BSC1 (1) new LAI (2) Loc. Upd. Req. (SDCCH) (2) Loc. Upd. Request (6) Loc. Upd. Acknowledge HLR IMSI  MGT (3) (6) Subscriber Information (7) Location Cancellation

Types of Handover (Handoff) Rescue handover: System rescues the connection if the received signal is too weak or noisy (caused by path loss or shadowing) BSC sends a handover command to the MS and BTS if measurement report evaluation results indicate weak connection quality Traffic handover: Handover because of high traffic in the serving cell. (eg. traffic is increasing suddenly in the cell, and probability of congestion is very high) Confinement handover: S/N optimization, TRX power minimalization

Measurements on the Adjacents Cells TCH multiframe 24. 25.  IDLE  Downlink 1 2 3 4 5 6 7   Uplink At the end of TCH multiframe we have 12 timeslots duration for checking BSIC on the adjacent cell’s SCH!

Measurement Report TCH SACCH BSC Adjacent cells Serving BTS BCCH carrier2 BCCH carrier1 Serving BTS On TCH (serving cell): RXLEV RXQUAL DISTANCE On BCCH carrier (adjacent cells) Measurement report on SACCH MR from MS nad BTS BSC On TCH: RXLEV RXQUAL DISTANCE

Handover Margin BTS A BTS B a b c HO. MARGIN (B) SS MIN. (A) Jelerősség (SS) BTS A BTS B SS MIN. (A) SS MIN. (B) HO. MARGIN (B)

Handover Cases I. Intracell Handover Forrás: Alien Coders: Basics of GSM in depth

Handover Cases II. Intercell handover Source: Alien Coders: Basics of GSM in depth

Handover Cases II. Inter BSC Handover Source: Alien Coders: Basics of GSM in depth

Handover Cases III. Inter MSC handover Source: Alien Coders: Basics of GSM in depth