1. Modern Mobile Networks
Dr. Dóra Maros
Modern Mobile Networks
GSM
FDMA/TDMA
Cell structure, reuse factor
Logical channels
Bursts
Multiframes

2. GSM Frequency Bands GSM900 : Uplink: 890~915MHz Downlink: 935~960MHz
Duplex distance: 45MHz
Bandwidth: 25MHz
Channel bandwidth: 200KHz
124 duplex carriers
Channel numbering: 1-124
EGSM900 :
Uplink: 880~890MHz
Downlink: 925~935MHz
Duplex distance: 45MHz
Bandwidth: 10MHz
Channel bandwidth: 200KHz
GSM1800 :
Uplink: MHz
Downlink: MHz
Duplex distance : 95MHz
Bandwidth: 75MHz
Channel Bandwidth: 200KHz
374 duplex carriers
Channel numbering:
GSM1900MHz:
Uplink:1850~1910MHz
Downlink:1930~1990MHz
Duplex distance: 80MHz Bandwidth: 60MHz
Channel bandwidth: 200KHz

3. GSM Radio Interface TS0-TS7 1 TDMA frame = 8 timeslots
Physical channel:
One carrier, one timeslot - fxTy
1 TDMA frame = 8 timeslots 1 2 3 4 5 6 7
time
TS0-TS7
DL and UL timing
BTS

4. GSM Antennas Omni-directional antenna 360° radiation
(sector antenna)
120°, 60° radiation

5. Hexagonal Cell Pattern
Omni antennas
On the green line we can measure same signal strength

6. Theory of Frequency Reuse
Cells using same carrier frequencies, reuse factor:7
Using the same carriers is not allowed in the adjacent cells!
We apply omni antennas!

7. 3/9 Cluster
We apply 120° sector antennas
Reuse factor = 9

8. 4/12 Cluster
We apply 120° sector antennas
Reuse factor = 12

9. Adjacent Channel Interference
No overlapping between two frequency bands
200 KHz f
200 KHz
Overlapping causes adjacent channel interference f

10. C/I and C/A C/I C/A Carrrier f1/ carrier f1 interference
Carrier f1/ adjacent carrier f2 interference

11. GSM Logical Channels 14.4Kbit/s FR TCH 9.6Kbit/s FR TCH
Traffic Channels
Data CH
4.8Kbit/s FR TCH
4.8Kbit/s HR TCH (TCH/H4.8)
TCH
FR (Full Rate, 13Kbit/s))
Voice CH
HR (Half Rate, 6.5 Kbit/s)
FCCH (DL): Frequency Correction CH.
BCH
SCH (DL): Synchronization CH.
Control Channels
BCCH (DL): Broadcast Control CH.
RACH (UL): Random Access CH.
CCH
CCCH
AGCH (DL): Access Grant CH.
PCH (DL): Paging CH.
SDCCH: Stand-alone Dedicated CCH.
DCCH
FACCH: Fast Associated CCH.
SACCH: Slow Associated CCH.

12. Broadcast Channels
Broadcast Channels (BCH): Downlink channels. Responsible for sychronization, frequency correction, the BTS broadcasts general information about cell and network. Point to multipoint connection, all MS in the cell receives the information on BCH. Broadcast Control Channel (BCCH): BTS sends general information around the cell (eg. Cell identity, Location Area Code, Network Code, maximum MS output power, etc.). Frequency Correction Channel (FCCH): MS can find the BCCH carrier in the cell by FCCH. The channel sends an unmodulated sine signal (it sends only zeros), so the MS can tune to BCCH carrier frequency. FCCH also helps to find a new BCCH carrier in the new cell after power on. Synchronization Channel (SCH): BTS sends a synchronization sequence for all MS for time synchronization. Base Station Identity Code (BSIC) and TDMA Frame Number (TFN) is also sent on this channel. TDMA frame number plays an important role in cryptografical algorithm (ciphering) on the radio channel.

13. Common Control Channels
Common Control Channels (CCCH): Common physical cannel, but the messages is addressed only for one MS. Directional (uplink or downlink) Paging Channel (PCH): Downlink channel. If MS has an incoming call, network sends a paging (searching) message in the cells inside Location Area. IMSI or TMSI is also sent in the paging message. Access Grant Channel (AGCH): Downlink channel. This channel grants (offers) an SDCCH (numbered 0-7) in the cell for the MS point to point signalling. Random Access Channel (RACH): Uplink channel. MS uses when it initiates a connection to the network in case of power on, outgoing (MS originated) call, or location update procedure, etc.

14. Dedicated Control Channels
Dedicated Control Channels (DCCH): Dedicated means that the channel is unique for one MS (point to point connection). These channels are used for connection establishment procedures, for signalling information in case of handover and other control information (power and timing control). DCCHs are bidirectional. Stand-alone Dedicated Control Channel (SDCCH): There are 8 SDCCHs in a cell (0-7). Used for connection establishment (authentication, ciphering, IMEI checking, and TCH assignment). When a TCH is assigned for MS, the mobile tunes to another channel. Slow Associated Control Channel (SACCH): Uplink: MS sends measurement report to BTS. Downlink: power regulation of MS, time alignment (accurate timing) of MS. Associates to TCH and SDCCH-hoz. Fast Associated Control Channel (FACCH): Used when handover procedure is needed. Downlink: a handover command (new channel and timeslot) is sent on TCH when Stealing Flags (F) bits are not zero. Uplink: handover acknowledge, power regulation, timing. Associates to TCH.

15. Types of GSM Bursts All „0” Information Sychronization bits
Training bits
Information
Sychronization bits
Information
Dummy bits
Training bits
Dummy bits

16. FC, S and A Burst SCH FCCH RACH 148 bits 86 bits 0,577 ms, 156,25 bit
Information
Sychronization bits
Information
148 bits
FCCH
RACH
86 bits
Sychronization bits
Information
0,577 ms, 156,25 bit G
Guard perriod: no information transmitted T
Tail bits:000

17. IDLE: no user info, predefined bit sequence
N and D burst
TCH, BCCH, PCH, AGCH, SDCCH, SACCH, FACCH
Information
Training bits
Information
IDLE: no user info, predefined bit sequence
Dummy bits
Training bits
Dummy bits
0,577 ms, 156,25 bit F
Stealing Flag

18. Guard Period
Guard period
Burst contents

19. TCH Multiframe

20. Multiframe on BCCH Carrier TS0
TDMA frames DL
Downlink
F:FCCH
S:SCH
C:Common
TDMA frames DL
Uplink
RACH
Repetition time: 51 frame

21. Multiframe on BCCH Carrier TS1
Dowlink multiframe structure is the same, but it is shifted in time!

22. Frame Structure

23. Modern Mobile Networks
Dr. Dóra Maros
Modern Mobile Networks
GSM
Radio propagation
Path loss
Shadowing
Multipath fading, ISI
Frequency hopping
Interleaving

24. Radio propagation I. Frequency and wavelength
The wavelength is inversly proportional to the frequency of elektromagnetic wave :
λ = c/f, where
λ - wavelength (m)
c - velocity of electromagnetic wave
(in vacuum and in the air about 3*108 m/s, accurate value: m/s)
f - frequency (Hz)
Example:
1. f=900 MHz (9*108 Hz) λ =?
3*108 / 9*108 = 3/9 [m] ~ 0,33 [m]
f=2,6 GHz (2,6*109)
3*108 / 2,6*109 = 1,154 * 10-1 ~ 0,1154 [m]

25. Radio propagation II. Path loss
RSL Received Signal Level (dB)
Free space attenuation:
a0 = 20 log (4Πd/λ)
a0 = 20 log (df) + 28,14
d (distance from antenna)

26. Radio Propagation III. Propagation Models
Makrocell propagation models:
Relative small traffic (rural, road), high speed of movement (>100 km/h)
Hata, COST231
Mikrocell propagation models:
High traffic (urban, suburban), smaller speed of movement (30-80 km/h)
Walfish-Ikegami modell, COST 231
Indoor propagation models:
Mootley-Keenan (félempirikus)
Ray-tracing

27. Radio Propagation IV. Shadowing
RSL (dB)
Base Station
Mobile
Equipment
Mean value
d (distance from antenna)
Slow fading caused by shadowing

28. Radio Propagation V. Multipath Fading
Base Station
Mobile Equipment
Fast fading caused by reflections

29. Radio Propagation VI. Frequency Hopping
Consecutive bursts are transmitted on different carriers
Number of hopping: 217/s
4 frequencies
Different wavelengths
Fading dips shift!

30. Radio Propagation VII. Inter Symbol Interference (ISI)
Bit error in the receiver!
1 or 0?
Base Station
Mobile Equipment
If delay of received bit is > 1 bit duration, it may cause Inter Symbol Interference (ISI) in the receiver. Two consecutive bits interfere each other.

31. Radio Propagation VIII. VITERBI Demodulator and Decoder
Burst contents on radio channel (received)
Modified training sequence (noisy channel)
Training sequence pattern in the receiver
Correlator
Modified channel model
Viterbi Decoder
Reconstructed bits
Radio channel

32. Radio Propagation IX. Interleaving
Original sequence
Interleaved sequence
Packet loss
Reconstructed sequence
Original sequence is segmented into blocks
Consecutive blocks are sent in different bursts (different timeslots and frames )

33. Radio Propagation X. Interleaving on GSM Speech Channel (example)
Segmentation
456 bits (20 ms speech) are divided
into 8 blocks (57 bits each)
57 bits
I. Level interleaving
II. Level interleaving

34. Modern Mobile Networks
Dr. Dóra Maros
Modern Mobile Networks
GSM
Security functions
Authenticaton
Ciphering
Location update
Cell selection
Handover

35. GSM Security Functions I.
The network elements which take part in security functions :
Mobile Station (MS)
Base Station (BTS)
Mobile Switching Center (MSC or MSS)
Autentication Center (AUC)
Home Location Register (HLR)
Visitor Location Register(VLR).

36. GSM Security Functions II.
SIM card unlock: PIN = Personal Identity Number (4 digits)
PIN unlock key: PUK code
Authentication: A procedure of verification of IMSI validity on SIM card.
Ciphering: This is an encyption procedure in BTS and MS for protection of user information (speech or data) on radio interface.
IMEI checking: This procedure checks the ME IMEI number.
If IMEI is on the black list of EIR, the connection establishment is denied!
If IMEI is on the white list, MS can connect to the network.
When IMEI is on the grey list , mobile has some restrictions in communication, but attach is allowed.

37. Random number generator
AUC and TRIPLETs
Kc: Ciphering Key Ki: Subscriber Identity Key
Random number generator
IMSI1 – Ki1
IMSI2 - Ki2
IMSI3 – Ki3
RAND Ki
AUC
A8 algorithm
A3 algorithm
SRES Kc
Signed Response Ki
Ciphering Key
RAND
Random Number

38. Authentication procedure
SIM
SRESSIM = SRESAUC ?

39. Kc Generation
Kc: Ciphering Key Ki: Subscriber Identity Key
SIM

40. In Mobile Equipment (ME)
Ciphering Procedure
In Mobile Equipment (ME)

41. Cell Selection (IDLE mode)
Mobile tunes to the strongest BCCH carrier in its IDLE mode
BCCH carrier 1
BCCH carrier 3
BCCH carrier 2
Serving BTS
RSL carrier1 > RSL carrier2 > RSL carrier 3

42. IMSI Attach/Detach, az IMSI flag
Power On: IMSI attached (1)
Power Off: IMSI detached (0)
IMSI record 1
VLR
IMSI flag
SDCCH

43. Location Area and LAC
Location Area 2 (LAC2)
Location Area 1 (LAC1)
Location Area 3 (LAC3)
MSC/MSS

44. Location Area in Paging Procedure
Paging message is sent in all cells inside LA!
Serving cell, where the connection is established

45. Location Update Procedure
On BCCH LAC (Location Area Code) is transmitted
Location Area 2 (LAC2)
Location Area 1 (LAC1)
IMSI record
LAC1 LAC2
VLR
Location Update procedure updates LAC in VLR IMSI record!

46. Location Update Procedure inside MSC/MSS Service Area
LA2
LA1
BSC1
VLR
MSC
BSC 2
(1) new LAI
(2) Channel Req. IMSI (RACH)
(3) Channel required
IMSI: LA1 LA2
(6)
(7)Loc. Upd. Accept.
(7) Loc. Upd. Accept. (SDCCH)
(4) Immediate Assign. (AGCH)
(5) Loc. Upd, Req. (SDCCH)

47. Location Update Procedure Between MSC/MSS Service Areas
(8) Loc. Upd. Ack
(SDCCH)
(4) Suscriber Information Request
VLR
MSC2
IMSI: VLR1 VLR2
BSC2
MSC1
(5)
LA 2
LA 1
BSC1
(1) new LAI
(2) Loc. Upd. Req. (SDCCH)
(2) Loc. Upd. Request
(6) Loc. Upd. Acknowledge
HLR
IMSI  MGT
(3)
(6) Subscriber Information
(7) Location Cancellation

48. Types of Handover (Handoff)
Rescue handover:
System rescues the connection if the received signal is too weak or noisy (caused by path loss or shadowing)
BSC sends a handover command to the MS and BTS if measurement report evaluation results indicate weak connection quality
Traffic handover:
Handover because of high traffic in the serving cell. (eg. traffic is increasing suddenly in the cell, and probability of congestion is very high)
Confinement handover:
S/N optimization, TRX power minimalization

49. Measurements on the Adjacents Cells
TCH multiframe
24.
25.
 IDLE 
Downlink 1 2 3 4 5 6 7  
Uplink
At the end of TCH multiframe we have 12 timeslots duration for checking BSIC on the adjacent cell’s SCH!

50. Measurement Report TCH SACCH BSC Adjacent cells Serving BTS
BCCH carrier2
BCCH carrier1
Serving BTS
On TCH (serving cell):
RXLEV
RXQUAL
DISTANCE
On BCCH carrier (adjacent cells)
Measurement report on
SACCH
MR from MS nad BTS
BSC
On TCH:
RXLEV
RXQUAL
DISTANCE

51. Handover Margin BTS A BTS B a b c HO. MARGIN (B) SS MIN. (A)
Jelerősség (SS)
BTS A
BTS B
SS MIN. (A)
SS MIN. (B)
HO. MARGIN (B)

52. Handover Cases I. Intracell Handover
Forrás:
Alien Coders: Basics of GSM in depth

53. Handover Cases II. Intercell handover
Source:
Alien Coders: Basics of GSM in depth

54. Handover Cases II. Inter BSC Handover
Source:
Alien Coders: Basics of GSM in depth

55. Handover Cases III. Inter MSC handover
Source:
Alien Coders: Basics of GSM in depth