Mobile Communications

Chapter 4: Wireless
Telecommunication Systems
 Market  DECT
 GSM  TETRA
 Overview  UMTS/IMT-2000
 Services
 Sub-systems
 Components

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.1

 Mobile phone subscribers worldwide

1200

1000

GSM total
Subscribers [million]

800
TDMA total
CDMA total
600 PDC total
Analogue total
Total wireless
400
Prediction (1998)

200

0
year
1996 1997 1998 1999 2000 2001 2002

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.2

 Development of mobile telecommunication systems

CT0/1
FDMA

AMPS
NMT CT2
IMT-FT
IS-136 DECT
TDMA
TDMA

EDGE IMT-SC
D-AMPS
IS-136HS
GSM GPRS
UWC-136
PDC
IMT-DS
UTRA FDD / W-CDMA
IMT-TC
UTRA TDD / TD-CDMA
CDMA

IMT-TC
TD-SCDMA
IS-95 IMT-MC
cdma2000 1X
cdmaOne cdma2000 1X EV-DO
1X EV-DV
1G 2G 2.5G 3G (3X)

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.3

 GSM: Overview

GSM
 formerly: Groupe Spéciale Mobile (founded 1982)
 now: Global System for Mobile Communication
 Pan-European standard (ETSI, European Telecommunications
Standardisation Institute)
 simultaneous introduction of essential services in three phases (1991,
1994, 1996) by the European telecommunication administrations
(Germany: D1 and D2)
 seamless roaming within Europe possible
 today many providers all over the world use GSM (more than 184
countries in Asia, Africa, Europe, Australia, America)
 more than 747 million subscribers
 more than 70% of all digital mobile phones use GSM
 over 10 billion SMS per month in Germany, > 360 billion/year worldwide

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.4

 Performance characteristics of GSM (wrt. analog sys.)
Communication
 mobile, wireless communication; support for voice and data
services
Total mobility
 international access, chip-card enables use of access points of
different providers
Worldwide connectivity
 one number, the network handles localization
High capacity
 better frequency efficiency, smaller cells, more customers per cell
High transmission quality
 high audio quality and reliability for wireless, uninterrupted phone
calls at higher speeds (e.g., from cars, trains)
Security functions
 access control, authentication via chip-card and PIN

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.5

 Disadvantages of GSM

There is no perfect system!!

 no end-to-end encryption of user data
 no full ISDN bandwidth of 64 kbit/s to the user, no transparent B-
channel

 reduced concentration while driving

 electromagnetic radiation

 abuse of private data possible

 roaming profiles accessible

 high complexity of the system

 several incompatibilities within the GSM standards

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.6

 GSM: Mobile Services

GSM offers
 several types of connections
 voice connections, data connections, short message service
 multi-service options (combination of basic services)
Three service domains
 Bearer Services (transmission only, connection oriented, ps or cs)
 Telematic Services (application specific)
 Supplementary Services (user identification, call forwarding, groups, …)

bearer services
MS
transit source/
TE MT GSM-PLMN network destination TE
R, S Um (PSTN, ISDN) network (U, S, R)

tele services

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.7

 Bearer Services

 Telecommunication services to transfer data between access points

 Specification of services up to the terminal interface (OSI layers 1-3)
 Different data rates for voice and data (original standard)
 data service (circuit switched)
 synchronous: 2.4, 4.8 or 9.6 kbit/s
 asynchronous: 300 - 1200 bit/s
 data service (packet switched)
 synchronous: 2.4, 4.8 or 9.6 kbit/s
 asynchronous: 300 - 9600 bit/s

Today: data rates of approx. 50 kbit/s possible – will be covered later!

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.8

 Tele Services I

 Telecommunication services that enable voice communication

via mobile phones
 All these basic services have to obey cellular functions, security
measurements etc.
 Offered services
 mobile telephony
primary goal of GSM was to enable mobile telephony offering the
traditional bandwidth of 3.1 kHz
 Emergency number
common number throughout Europe (112); mandatory for all
service providers; free of charge; connection with the highest
priority (preemption of other connections possible)
 Multinumbering
several ISDN phone numbers per user possible

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.9

 Tele Services II

Additional services
 Non-Voice-Teleservices
 group 3 fax
 voice mailbox (implemented in the fixed network supporting the mobile
terminals)
 electronic mail (MHS, Message Handling System, implemented in the fixed
network)
 ...

 Short Message Service (SMS)

alphanumeric data transmission to/from the mobile terminal using the
signaling channel, thus allowing simultaneous use of basic services and
SMS

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.10

 Supplementary services

 Services in addition to the basic services, cannot be offered

stand-alone
 Similar to ISDN services besides lower bandwidth due to the
radio link
 May differ between different service providers, countries and
protocol versions
 Important services
 identification: forwarding of caller number
 suppression of number forwarding
 automatic call-back
 conferencing with up to 7 participants
 locking of the mobile terminal (incoming or outgoing calls)
 ...

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.11

 Architecture of the GSM system

GSM is a PLMN (Public Land Mobile Network)

 several providers setup mobile networks following the GSM standard within
each country
 components
 MS (mobile station)
 BS (base station)
 MSC (mobile switching center)
 LR (location register)
 subsystems
 RSS (radio subsystem): covers all radio aspects
 NSS (network and switching subsystem): call forwarding, handover, switching
 OSS (operation subsystem): management of the network

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.12

 GSM: overview
OMC, EIR,
AUC
HLR
GMSC
NSS fixed network
with OSS

VLR MSC MSC

VLR

BSC
BTS
BSC

BTS BTS
RSS BSS

BTS
BTS
MS

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.13

 GSM: elements and interfaces

radio cell
BSS
MS MS

Um radio cell
BSS: Base Station subsystem
RSS BTS MS
BTS: Base transfer station
BSC: Base Station Controller
MS: Mobile Station
BTS MSC: Mobile Switching Center
VLR:Visitor Location Register
Abis HLR: Home location Register
BSC BSC
GMSC: Gateway MSC
IWF: InterWorking Function
A
AUC: Authentication Center
EIR: Equipment Identity Register
MSC MSC OMC: Operation and Maintenance Center
PDN: Public Data Network
NSS signallng PSTN: Public Switched Telephone Network
VLR VLR
ISDN, PSTN ISDN: Integrated Service Digital Network
HLR GMSC
PDN
IWF
O

OSS
EIR AUC OMC

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.14

 GSM: system architecture
radio network and fixed
subsystem switching subsystem partner networks

MS MS
ISDN
PSTN
Um MSC

BTS Abis
BSC EIR
BTS

SS7
HLR

BTS VLR
BSC ISDN
BTS MSC PSTN
A
BSS IWF
PSPDN
CSPDN

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.15

 System architecture: radio subsystem
radio network and switching
subsystem subsystem

MS MS
Components
 MS (Mobile Station)
Um  BSS (Base Station Subsystem):
Abis consisting of
BTS
BSC MSC
 BTS (Base Transceiver Station):
BTS sender and receiver
 BSC (Base Station Controller):
controlling several transceivers

Interfaces
 Um : radio interface
A
BTS  Abis : standardized, open interface with
BSC MSC
16 kbit/s user channels
BTS
 A: standardized, open interface with
BSS
64 kbit/s user channels

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.16

 System architecture: network and switching subsystem
network fixed partner
subsystem networks Components
 MSC (Mobile Services Switching Center):
ISDN  IWF (Interworking Functions)
PSTN
MSC
 ISDN (Integrated Services Digital Network)
 PSTN (Public Switched Telephone Network)
EIR  PSPDN (Packet Switched Public Data Net.)
 CSPDN (Circuit Switched Public Data Net.)
SS7

HLR
 Databases
 HLR (Home Location Register)
VLR  VLR (Visitor Location Register)
ISDN  EIR (Equipment Identity Register)
MSC
PSTN
IWF
PSPDN
CSPDN

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.17

 Radio subsystem

The Radio Subsystem (RSS) comprises the cellular mobile network up to

the switching centers
 Components
 Base Station Subsystem (BSS):
 Base Transceiver Station (BTS): radio components including sender, receiver,
antenna - if directed antennas are used one BTS can cover several cells
 Base Station Controller (BSC): switching between BTSs, controlling BTSs,
managing of network resources, mapping of radio channels (U m) onto terrestrial
channels (A interface)

 BSS = BSC + sum(BTS) + interconnection

 Mobile Stations (MS)

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.18

 GSM: cellular network

segmentation of the area into cells

possible radio coverage of the cell

idealized shape of the cell

cell

 use of several carrier frequencies

 not the same frequency in adjoining cells
 cell sizes vary from some 100 m up to 35 km depending on user
density, geography, transceiver power etc.
 hexagonal shape of cells is idealized (cells overlap, shapes depend on
geography)
 if a mobile user changes cells
 handover of the connection to the neighbor cell

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.19

 Example coverage of GSM networks (www.gsmworld.com)

T-Mobile (GSM-900/1800) Berlin Vodafone (GSM-900/1800)

e-plus (GSM-1800) O2 (GSM-1800)

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.20

 Base Transceiver Station and Base Station Controller

Tasks of a BSS are distributed over BSC and BTS

 BTS comprises radio specific functions
 BSC is the switching center for radio channels

Functions BTS BSC

Management of radio channels X
Frequency hopping (FH) X X
Management of terrestrial channels X
Mapping of terrestrial onto radio channels X
Channel coding and decoding X
Rate adaptation X
Encryption and decryption X X
Paging X X
Uplink signal measurements X
Traffic measurement X
Authentication X
Location registry, location update X
Handover management X

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.21

 Mobile station

Terminal for the use of GSM services

 A mobile station (MS) comprises several functional groups
 MT (Mobile Terminal):
 offers common functions used by all services the MS offers
 corresponds to the network termination (NT) of an ISDN access
 end-point of the radio interface (Um)

 TA (Terminal Adapter):
 terminal adaptation, hides radio specific characteristics
 TE (Terminal Equipment):
 peripheral device of the MS, offers services to a user
 does not contain GSM specific functions
 SIM (Subscriber Identity Module):
 personalization of the mobile terminal, stores user parameters

TE TA MT
Um
R S

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.22

 Network and switching subsystem

NSS is the main component of the public mobile network GSM

 switching, mobility management, interconnection to other networks, system
control
 Components
 Mobile Services Switching Center (MSC)
controls all connections via a separated network to/from a mobile terminal
within the domain of the MSC - several BSC can belong to a MSC
 Databases (important: scalability, high capacity, low delay)
 Home Location Register (HLR)
central master database containing user data, permanent and semi-permanent
data of all subscribers assigned to the HLR (one provider can have several
HLRs)
 Visitor Location Register (VLR)
local database for a subset of user data, including data about all user currently
in the domain of the VLR

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.23

 Mobile Services Switching Center

The MSC (mobile switching center) plays a central role in GSM

 switching functions
 additional functions for mobility support
 management of network resources
 interworking functions via Gateway MSC (GMSC)
 integration of several databases
 Functions of a MSC
 specific functions for paging and call forwarding
 termination of SS7 (signaling system no. 7)
 mobility specific signaling
 location registration and forwarding of location information
 provision of new services (fax, data calls)
 support of short message service (SMS)
 generation and forwarding of accounting and billing information

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.24

 Operation SubSystem

The OSS (Operation Subsystem) enables centralized operation,

management, and maintenance of all GSM subsystems
 Components
 Authentication Center (AUC)
 generates user specific authentication parameters on request of a VLR
 authentication parameters used for authentication of mobile terminals and
encryption of user data on the air interface within the GSM system
 Equipment Identity Register (EIR)
 registers GSM mobile stations and user rights
 stolen or malfunctioning mobile stations can be locked and sometimes even
localized (IMEI)
 Operation and Maintenance Center (OMC)
 different control capabilities for the radio subsystem and the network subsystem

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.25

 GSM - TDMA/FDMA

935-960 MHz
124 channels (200 kHz)
downlink
y c
en
qu

890-915 MHz
fre

124 channels (200 kHz)

uplink
higher GSM frame structures
time

GSM TDMA frame

1 2 3 4 5 6 7 8
4.615 ms

GSM time-slot (normal burst)

guard guard
space tail user data S Training S user data tail space
3 bits 57 bits 1 26 bits 1 57 bits 3
546.5 µs
577 µs
Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.26
 GSM hierarchy of frames
hyperframe
0 1 2 ... 2045 2046 2047 3 h 28 min 53.76 s

superframe
0 1 2 ... 48 49 50
6.12 s
0 1 ... 24 25

multiframe
0 1 ... 24 25 120 ms

0 1 2 ... 48 49 50 235.4 ms

frame
0 1 ... 6 7 4.615 ms
slot
burst 577 µs

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.27

 GSM protocol layers for signaling

Um Abis A
MS BTS BSC MSC

CM CM

MM MM
BSSAP BSSAP
RR RR’
BTSM
RR’ BTSM SS7 SS7
LAPDm LAPDm LAPD LAPD

radio radio PCM PCM PCM PCM

16/64 kbit/s 64 kbit/s /

2.048 Mbit/s
RR: Radio Resource Mgmt, LAPD: Link Access Procedure D Channel, MM: Mobility Management,
CM: Call Management (CC, SMS, SS), BSSAP: BSS Application Part

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.28

 Mobile Terminated Call

1: calling a GSM subscriber

2: forwarding call to GMSC
3: signal call setup to HLR 4
HLR VLR
4, 5: request MSRN from VLR 5
8 9
6: forward responsible 3 6 14 15
MSC to GMSC calling 7
PSTN GMSC MSC
7: forward call to station 1 2
current MSC 10 10 13 10
16
8, 9: get current status of MS
BSS BSS BSS
10, 11: paging of MS 11 11 11
12, 13: MS answers
14, 15: security checks 11 12
17
16, 17: set up connection
MS
MSRN: Mobile Station Roaming Number

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.29

 Mobile Originated Call

1, 2: connection request
3, 4: security check
5-8: check resources (free circuit)
9-10: set up call
VLR

3 4
6 5
PSTN GMSC MSC
7 8
2 9
MS localization numbers:
MSISDN: Mobile station ISDN 1
MS BSS
IMSI: International Mobile Subscriber Identity 10
MCC(62), MNC(812), MSIN
TMSI: Temporary MSI (security)
MSRN: MS Roaming Number

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.30

 MTC/MOC
MS MTC BTS MS MOC BTS
paging request
channel request channel request
immediate assignment immediate assignment
paging response service request
authentication request authentication request
authentication response authentication response
ciphering command ciphering command
ciphering complete ciphering complete
setup setup
call confirmed call confirmed
assignment command assignment command
assignment complete assignment complete
alerting alerting
connect connect
connect acknowledge connect acknowledge
data/speech exchange data/speech exchange

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.31

 4 types of handover

1
2 3 4
MS MS MS MS

BTS BTS BTS BTS

BSC BSC BSC

MSC MSC

Intra-cell: narrow frequency interference, frequency change

Inter-cell: signal strength/traffic, BTS change
Inter-BSC: signal strength/traffic, BSC change
Inter-MSC: signal strength, MSC change

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.32

 Handover decision

receive level receive level

BTSold BTSold

HO_MARGIN

MS MS

BTSold BTSnew

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.33

 Handover procedure

MS BTSold BSCold MSC BSCnew BTSnew

measurement measurement
report result

HO decision
HO required HO request
resource allocation
ch. activation

HO command HO request ack ch. activation ack

HO command HO command
HO access
Link establishment

HO complete HO complete
clear command clear command
clear complete clear complete

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.34

 Security in GSM

Security services
 access control/authentication
 user  SIM (Subscriber Identity Module): secret PIN (personal
identification number)
 SIM  network: challenge response method
 confidentiality
 voice and signaling encrypted on the wireless link (after successful
authentication)
 anonymity
“secret”:
 temporary identity TMSI
• A3 and A8
(Temporary Mobile Subscriber Identity) available via the
 newly assigned at each new location update (LUP) Internet (1998)
 encrypted transmission • network providers
can use stronger
3 algorithms specified in GSM mechanisms
 A3 for authentication (“secret”, open interface)
 A5 for encryption (standardized)
 A8 for key generation (“secret”, open interface)

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.35

 GSM - authentication

mobile network SIM

RAND
Ki RAND RAND Ki

AC 128 bit 128 bit 128 bit 128 bit

A3 A3
SIM
SRES* 32 bit SRES 32 bit

SRES
MSC SRES* =? SRES SRES
32 bit

Ki: individual subscriber authentication key SRES: signed response

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.36

 GSM - key generation and encryption

mobile network (BTS) MS with SIM

RAND
Ki RAND RAND Ki
AC 128 bit 128 bit 128 bit 128 bit SIM

A8 A8

cipher Kc
key 64 bit Kc
64 bit
data encrypted SRES
data
BSS
data MS
A5 A5

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.37

 GSM Logical Channels

- TCH (Traffic Channel)

- Full rate (TCH/F)=22.8Kbit/s, Half rate (TCH/H)=11.4kbit/s
TCH/FS error correction (early GSM era)
- CCH (Control Channel)
- BCCH (Broadcast Control Channel): from BTS to MSs, to transmit CellId,
options (frequencies, hopping) available for this cell.
- FCCH (Frequency correction),
- SCH (Synchronization)
- CCCH (Common Control Channel): for connection setup
- PCH (Paging Channel)
- RACH (Random Access Channel): slotted Aloha
- AGCH (Access Granted Channel)
- DCCH (Dedicated Control Channel)
- SDCCH (Standalone DCCH) for signaling (authentication, registration, etc)
- SACCH (Slow Associated DCCH): channel quality, power level
- FACCH (Fast Associated DCCH): data exchange during handover
- Typical slot usage pattern: TTTTTTTTTTTTSTTTTTTTTTTTTx

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.38

 Data services in GSM I
Data transmission standardized with only 9.6 kbit/s
 advanced coding allows 14,4 kbit/s
 not enough for Internet and multimedia applications

HSCSD (High-Speed Circuit Switched Data)

 mainly software update
 bundling of several time-slots to get higher
AIUR (Air Interface User Rate)
(e.g., 57.6 kbit/s using 4 slots, 14.4 each)
 advantage: ready to use, constant quality, simple
 disadvantage: channels blocked for voice transmission
AIUR [kbit/s] TCH/F4.8 TCH/F9.6 TCH/F14.4
4.8 1
9.6 2 1
14.4 3 1
19.2 4 2
28.8 3 2
38.4 4
43.2 3
57.6 4

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.39

 Data services in GSM II
GPRS (General Packet Radio Service)
 packet switching
 using free slots only if data packets ready to send
(e.g., 50 kbit/s using 4 slots temporarily)
 standardization 1998, introduction 2001
 advantage: one step towards UMTS, more flexible
 disadvantage: more investment needed (new hardware)
GPRS network elements
 GSN (GPRS Support Nodes): GGSN and SGSN
 GGSN (Gateway GSN)
 interworking unit between GPRS and PDN (Packet Data Network)
 SGSN (Serving GSN)
 supports the MS (location, billing, security)
 GR (GPRS Register)
 user addresses

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.40

 GPRS quality of service

Reliability Lost SDU Duplicate Out of Corrupt SDU

class probability SDU sequence probability
probability SDU
probability
1 10-9 10-9 10-9 10-9
2 10-4 10-5 10-5 10-6
3 10-2 10-5 10-5 10-2

Delay SDU size 128 byte SDU size 1024 byte

class mean 95 percentile mean 95 percentile
1 < 0.5 s < 1.5 s <2s <7s
2 <5s < 25 s < 15 s < 75 s
3 < 50 s < 250 s < 75 s < 375 s
4 unspecified

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.41

 Examples for GPRS device classes

Receiving
Class Sending slots Maximum number of slots
slots
1 1 1 2
2 2 1 3
3 2 2 3
5 2 2 4
8 4 1 5
10 4 2 5
12 4 4 5

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.42

 GPRS user data rates in kbit/s

Coding 1 slot 2 slots 3 slots 4 slots 5 slots 6 slots 7 slots 8 slots

scheme

CS-1 9.05 18.2 27.15 36.2 45.25 54.3 63.35 72.4

CS-2 13.4 26.8 40.2 53.6 67 80.4 93.8 107.2
CS-3 15.6 31.2 46.8 62.4 78 93.6 109.2 124.8
CS-4 21.4 42.8 64.2 85.6 107 128.4 149.8 171.2

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.43

 GPRS architecture and interfaces

SGSN

Gn

BSS SGSN GGSN PDN

MS

Um Gb Gn Gi

MSC HLR/
GR

VLR EIR

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.44

 GPRS protocol architecture

MS Um BSS Gb SGSN Gn GGSN Gi

apps.

IP/X.25 IP/X.25

SNDCP GTP GTP

SNDCP
LLC LLC UDP/TCP UDP/TCP

RLC BSSGP BSSGP IP IP

RLC
MAC MAC
FR FR L1/L2 L1/L2
radio radio

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.45

 DECT

DECT (Digital European Cordless Telephone) standardized by

ETSI (ETS 300.175-x) for cordless telephones
 standard describes air interface between base-station and
mobile phone
 DECT has been renamed for international marketing reasons
into „Digital Enhanced Cordless Telecommunication“
 Characteristics
 frequency: 1880-1990 MHz
 channels: 120 full duplex
 duplex mechanism: TDD (Time Division Duplex) with 10 ms frame
length
 multplexing scheme: FDMA with 10 carrier frequencies,
TDMA with 2x 12 slots
 modulation: digital, Gaußian Minimum Shift Key (GMSK)
 power: 10 mW average (max. 250 mW)
 range: approx. 50 m in buildings, 300 m open space

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.46

 DECT system architecture reference model

D4 D3
D2 VDB
PA PT
FT
local HDB
network
PA PT D1
global
FT network

local
network

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.47

 DECT reference model

C-Plane U-Plane
signaling, application
 close to the OSI reference
interworking processes model
 management plane over
all layers
 several services in
network C(ontrol)- and U(ser)-
management

OSI layer 3
layer plane
data link data link
control control
OSI layer 2
medium access control

physical layer OSI layer 1

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.48

 DECT layers I

 Physical layer
 modulation/demodulation GMSK
 generation of the physical channel structure with a guaranteed
throughput
 controlling of radio transmission
 channel assignment on request of the MAC layer
 detection of incoming signals
 sender/receiver synchronization
 collecting status information for the management plane

 MAC layer
 maintaining basic services, activating/deactivating physical
channels
 multiplexing of logical channels
 e.g., C: signaling, I: user data, P: paging, Q: broadcast
 segmentation/reassembly
 error control/error correction

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.49

 DECT time multiplex frame
1 frame = 10 ms

12 down slots 12 up slots

slot guard 420 bit + 52 µs guard time („60 bit“)

0 419
in 0.4167 ms
sync D field
0 31 0 387
A: network control
B: user data A field B field X field
0 63 0 319 0 3
X: transmission quality

protected DATA C DATA C DATA C DATA C

25.6 kbit/s 64 16 64 16 64 16 64 16
mode
simplex bearer
unprotected
32 kbit/s mode DATA

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.50

 DECT layers II

 Data link control layer

 creation and keeping up reliable connections between the mobile terminal
and basestation
 two DLC protocols for the control plane (C-Plane)
 connectionless broadcast service:
paging functionality
 Lc+LAPC protocol:
in-call signaling (similar to LAPD within ISDN), adapted to the underlying MAC
service
 several services specified for the user plane (U-Plane)
 null-service: offers unmodified MAC services
 frame relay: simple packet transmission
 frame switching: time-bounded packet transmission
 error correcting transmission: uses FEC, for delay critical, time-bounded
services
 bandwidth adaptive transmission
 „Escape“ service: for further enhancements of the standard

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.51

 DECT layers III

 Network layer
 similar to ISDN (Q.931) and GSM (04.08)
 offers services to request, check, reserve, control, and release resources
at the basestation and mobile terminal
 resources
 necessary for a wireless connection
 necessary for the connection of the DECT system to the fixed network
 main tasks
 call control: setup, release, negotiation, control
 call independent services: call forwarding, accounting, call redirecting
 mobility management: identity management, authentication, management of the
location register

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.52

 Enhancements of the standard

Several „DECT Application Profiles“ in addition to the DECT

specification
 GAP (Generic Access Profile) standardized by ETSI in 1997
 assures interoperability between DECT equipment of different
manufacturers (minimal requirements for voice communication)
 enhanced management capabilities through the fixed network: Cordless
Terminal Mobility (CTM)
DECT DECT DECT
basestation Common Portable Part
Air Interface
fixed network

GAP
 DECT/GSM Interworking Profile (GIP): connection to GSM
 ISDN Interworking Profiles (IAP, IIP): connection to ISDN
 Radio Local Loop Access Profile (RAP): public telephone service
 CTM Access Profile (CAP): support for user mobility

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.53

 TETRA - Terrestrial Trunked Radio

Trunked radio systems

 many different radio carriers
 assign single carrier for a short period to one user/group of users
 taxi service, fleet management, rescue teams
 interfaces to public networks, voice and data services
 very reliable, fast call setup, local operation
TETRA - ETSI standard
 formerly: Trans European Trunked Radio
 offers Voice+Data and Packet Data Optimized service
 point-to-point and point-to-multipoint
 ad-hoc and infrastructure networks
 several frequencies: 380-400 MHz, 410-430 MHz
 FDD, DQPSK
 group call, broadcast, sub-second group-call setup

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.54

 TETRA Architecture

Similar to GSM, but simpler:

- MS (mobile station)
- SwMI (Switching and management Infrastructure)
- Um radio interface
- HDB (Home Database)
- VDB (Visitor Database)
- Base station (not always needed)
- No Handover
- Main services:
- V+D: Circuit switched up to four TDMA channel
- PDO: connection less, statistical mux
- Additional services:
- Group call, acknowledged group call, broadcast call

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.55

 TDMA structure of the voice+data system

hyperframe
0 1 2 ... 57 58 59 61.2 s

multiframe
0 1 2 ... 15 16 17 1.02 s
CF
frame
0 1 2 3 56.67 ms Control Frame

0 slot 509 14.17 ms

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.56

 UMTS and IMT-2000

Proposals for IMT-2000 (International Mobile Telecommunications

formerly FPLMTS)
 UWC-136 (IS-136), cdma2000(IS-95), WP-CDMA
 UMTS (Universal Mobile Telecommunications System) from ETSI

UMTS
 UTRA (was: UMTS, now: Universal Terrestrial Radio Access)
 enhancements of GSM
 EDGE (Enhanced Data rates for GSM Evolution): GSM up to 384 kbit/s
 CAMEL (Customized Application for Mobile Enhanced Logic)
 VHE (virtual Home Environment)
 fits into GMM (Global Multimedia Mobility) initiative from ETSI
 requirements
 min. 144 kbit/s rural (goal: 384 kbit/s)
 min. 384 kbit/s suburban (goal: 512 kbit/s)
 up to 2 Mbit/s urban

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.57

 IMT-2000 Services/Capabilities

Capabilities to support circuit and packet data at high bit rates:

- 144 kbs or higher in high mobility (vehicular) traffic
- 384 kbs or higher for pedestrian traffic
- 2 mbs or higher for indoor traffic

Interoperability and roaming among IMT-2000 family of systems

Common billing/user profiles:

- Sharing of usage/rate information between service providers
- Standardized call detail recording
- Standardized user profiles

Capability to determine geographic position of mobiles and report it to

both the network and the mobile terminal

Support of multimedia services/capabilities:

- Fixed and variable rate bit traffic
- Bandwidth on demand
- Asymmetric data rates in the forward and reverse links
- Multimedia mail store and forward
- Broadband access up to 2 mbs

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.58

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.59
Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.60
 Frequencies for IMT-2000

1850 1900 1950 2000 2050 2100 2150 2200 MHz

ITU allocation MSS MSS
(WRC 1992) IMT-2000 
IMT-2000


T T
GSM DE UTRA MSS UTRA MSS
Europe D D
1800 CT D FDD   D FDD  

GSM MSS MSS

China IMT-2000 
IMT-2000

1800

cdma2000 MSS cdma2000 MSS

Japan PHS
W-CDMA  W-CDMA 

MSS MSS
North PCS rsv.
 
America
1850 1900 1950 2000 2050 2100 2150 2200 MHz

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.61

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.62
Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.63
 Why New Spectrum?

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.64

 Mobility, range, throughput trade-off

• Mobile radio access networks are designed to meet certain maximum requirements
for grade of mobility and range
• WLANs are designed for high data rates, low ranges and generally low mobility

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.65

 IMT-2000 family

Interface
for Internetworking

IMT-2000 GSM ANSI-41

Core Network IP-Network
(MAP) (IS-634)
ITU-T

Initial UMTS Flexible assignment of

(R99 w/ FDD) Core Network and Radio Access

IMT-DS IMT-TC IMT-MC IMT-SC IMT-FT

(Direct Spread) (Time Code) (Multi Carrier) (Single Carrier) (Freq. Time)
IMT-2000 UTRA TDD
Radio Access UTRA FDD (TD-CDMA); cdma2000 UWC-136 DECT
ITU-R (W-CDMA) TD-SCDMA (EDGE)
3GPP 3GPP 3GPP2 UWCC/3GPP ETSI

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.66

 Licensing Example: UMTS in Germany, 18. August 2000

 UTRA-FDD:
 Uplink 1920-1980 MHz
 Downlink 2110-2170 MHz
 duplex spacing 190 MHz
 12 channels, each 5 MHz
 UTRA-TDD:
 1900-1920 MHz,
 2010-2025 MHz;
 5 MHz channels
 Coverage: 25% of the
population until 12/2003,
50% until 12/2005

Sum: 50.81 billion €

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.67

 UMTS architecture (Release 99 used here!)

UTRAN (UTRA Network)

 Cell level mobility
 Radio Network Subsystem (RNS)
 Encapsulation of all radio specific tasks

UE (User Equipment)
CN (Core Network)
 Inter system handover
 Location management if there is no dedicated connection between UE and
UTRAN

Uu Iu

UE UTRAN CN

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.68

 UMTS domains and interfaces I

Home
Network
Domain

Zu
Cu Uu Iu Yu
Mobile Access Serving Transit
USIM
Equipment Network Network Network
Domain
Domain Domain Domain Domain

Core Network Domain

User Equipment Domain Infrastructure Domain

User Equipment Domain

 Assigned to a single user in order to access UMTS services
Infrastructure Domain
 Shared among all users
 Offers UMTS services to all accepted users

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.69

 UMTS domains and interfaces II

Universal Subscriber Identity Module (USIM)

 Functions for encryption and authentication of users
 Located on a SIM inserted into a mobile device

Mobile Equipment Domain

 Functions for radio transmission
 User interface for establishing/maintaining end-to-end connections

Access Network Domain

 Access network dependent functions
Core Network Domain
 Access network independent functions
 Serving Network Domain
 Network currently responsible for communication
 Home Network Domain
 Location and access network independent functions

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.70

 Spreading and scrambling of user data

Constant chipping rate of 3.84 Mchip/s

Different user data rates supported via different spreading factors
 higher data rate: less chips per bit and vice versa
User separation via unique, quasi orthogonal scrambling codes
 users are not separated via orthogonal spreading codes
 much simpler management of codes: each station can use the same orthogonal
spreading codes
 precise synchronisation not necessary as the scrambling codes stay quasi-
orthogonal
data1 data2 data3 data4 data5

spr. spr. spr. spr. spr.

code1 code2 code3 code1 code4

scrambling scrambling
code1 code2

sender1 sender2

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.71

 OSVF coding

1,1,1,1,1,1,1,1
1,1,1,1 ...
1,1,1,1,-1,-1,-1,-1
1,1
1,1,-1,-1,1,1,-1,-1
1,1,-1,-1 ...
X,X
1,1,-1,-1,-1,-1,1,1
X 1
1,-1,1,-1,1,-1,1,-1
X,-X 1,-1,1,-1 ...
1,-1,1,-1,-1,1,-1,1
SF=n SF=2n 1,-1
1,-1,-1,1,1,-1,-1,1
1,-1,-1,1 ...
1,-1,-1,1,-1,1,1,-1

SF=1 SF=2 SF=4 SF=8

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.72

 OVSF

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.73

 OVSF example

Data Code Transmission

User1 -1 +1 +1 +1 +1 -1 -1 -1 -1
x x x x
User2 +1 -1 +1 -1 +1 -1 -1 +1
|| || || ||
-1 +1 +1 -1 = 0

Two Users, two different data rates, orthogonal transmission.

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.74

 UMTS FDD frame structure

W-CDMA
• 1920-1980 MHz uplink
Radio frame
• 2110-2170 MHz downlink
10 ms 0 1 2 ... 12 13 14 • chipping rate:
3.840 Mchip/s
Time slot • soft handover
• QPSK
666.7 µs Pilot TFCI FBI TPC uplink DPCCH • complex power control
2560 chips, 10 bits
(1500 power control
cycles/s)
666.7 µs Data uplink DPDCH • spreading: UL: 4-256;
DL:4-512
2560 chips, 10*2k bits (k = 0...6)

666.7 µs Data1 TPC TFCI Data2 Pilot downlink DPCH

FBI: Feedback Information
DPDCH DPCCH DPDCH DPCCH TPC: Transmit Power Control
TFCI: Transport Format Combination Indicator
2560 chips, 10*2k bits (k = 0...7) DPCCH: Dedicated Physical Control Channel
DPDCH: Dedicated Physical Data Channel
Slot structure NOT for user separation DPCH: Dedicated Physical Channel
but synchronisation for periodic functions!

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.75

 Typical UTRA-FDD uplink data rates

12.2 64 144 384

User data rate [kbit/s] (voice)

DPDCH [kbit/s] 60 240 480 960

DPCCH [kbit/s] 15 15 15 15

Spreading 64 16 8 4

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.76

 UMTS TDD frame structure (burst type 2)

Radio frame
10 ms 0 1 2 ... 12 13 14

Time slot
666.7 µs Data Midample Data Traffic burst
GP
1104 chips 256 chips 1104 chips
GP: guard period
2560 chips 96 chips

TD-CDMA
• 2560 chips per slot
• spreading: 1-16
• symmetric or asymmetric slot assignment to UL/DL (min. 1 per direction)
• tight synchronisation needed
• simpler power control (100-800 power control cycles/s)

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.77

 UTRAN architecture
RNS RNC: Radio Network Controller
RNS: Radio Network Subsystem
UE1 Node B Iub
Iu

RNC CN
UE2
Node B
UTRAN comprises several
RNSs
UE3 Node B can support FDD or
TDD or both
Iur
Node B RNC is responsible for handover
Iub decisions requiring
signalingto the UE
Node B
RNC Cell offers FDD or TDD

Node B

RNS

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.78

 UTRAN architecture
RNS RNC: Radio Network Controller
UE
RNS: Radio Network Subsystem
Node B Iub
UTRAN comprises several RNSs
RNC Node B can support FDD or TDD or
Iu both
Node B

CN

Iur RNC is responsible for handover

Node B
decisions requiring signaling to the
Iub UE
Cell offers FDD or TDD
Node B
RNC

Node B
RNS

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.79

 UTRAN functions

Admission control
Congestion control
System information broadcasting
Radio channel encryption
Handover
SRNS moving
Radio network configuration
Channel quality measurements
Macro diversity
Radio carrier control
Radio resource control
Data transmission over the radio interface
Outer loop power control (FDD and TDD)
Channel coding
Access control

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.80

 UTRAN and System Architecture

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.81

 Connections in Serving RNC relocation

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.82

 Core network: protocols

VLR

PSTN/
MSC GMSC
GSM-CS ISDN
RNS
backbone

HLR

RNS

SGSN GGSN PDN (X.25),

Layer 3: IP Internet (IP)
GPRS backbone (IP)
Layer 2: ATM
SS 7
Layer 1: PDH,
SDH, SONET

UTRAN CN

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.83

 Core network: architecture

VLR
BSS
BTS Abis Iu

BSC MSC GMSC

PSTN
Node
BTSB
IuCS
AuC
EIR HLR

GR
Node B
Iub

Node B
RNC SGSN GGSN
Gn Gi
Node B IuPS CN
RNS

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.84

 Core network

The Core Network (CN) and thus the Interface Iu, too, are separated into
two logical domains:
 Circuit Switched Domain (CSD)
 Circuit switched service incl. signaling
 Resource reservation at connection setup
 GSM components (MSC, GMSC, VLR)
 IuCS
 Packet Switched Domain (PSD)
 GPRS components (SGSN, GGSN)
 IuPS

Release 99 uses the GSM/GPRS network and adds a new radio access!
 Helps to save a lot of money …
 Much faster deployment
 Not as flexible as newer releases (5, 6)

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.85

 UMTS protocol stacks (user plane)
UE Uu UTRAN IuCS 3G
MSC
apps. &
protocols
Circuit RLC
RLC
SAR SAR
switched MAC MAC AAL2 AAL2

radio radio ATM ATM

UE Uu UTRAN IuPS 3G Gn 3G
apps. & SGSN GGSN
protocols
IP, PPP, IP tunnel IP, PPP,
… …
Packet PDCP GTP GTP GTP
PDCP GTP
switched RLC RLC UDP/IP UDP/IP UDP/IP UDP/IP
MAC MAC AAL5 AAL5 L2 L2
radio radio ATM ATM L1 L1

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.86

 Support of mobility: macro diversity

Multicasting of data via several

physical channels
 Enables soft handover
 FDD mode only

Uplink
UE Node B  simultaneous reception of UE
data at several Node Bs
 Reconstruction of data at Node
B, SRNC or DRNC
Node B RNC CN Downlink
 Simultaneous transmission of
data via different cells
 Different spreading codes in
different cells

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.87

 Support of mobility: handover

From and to other systems (e.g., UMTS to GSM)

 This is a must as UMTS coverage will be poor in the beginning
RNS controlling the connection is called SRNS (Serving RNS)
RNS offering additional resources (e.g., for soft handover) is called Drift
RNS (DRNS)
End-to-end connections between UE and CN only via Iu at the SRNS
 Change of SRNS requires change of Iu
 Initiated by the SRNS
 Controlled by the RNC and CN

Node B SRNC CN
Iub Iu
UE Iur

Node B DRNC
Iub

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.88

 Example handover types in UMTS/GSM

UE1
Node B1 RNC1 3G MSC1
Iu
UE2
Node B2 Iub Iur

UE3 Node B3 RNC2 3G MSC2

UE4
BTS BSC 2G MSC3
Abis A

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.89

 UMTS services (originally)

Data transmission service profiles

Service Profile Bandwidth Transport mode
High Interactive MM 128 kbit/s Circuit switched Bidirectional, video telephone
High MM 2 Mbit/s Packet switched Low coverage, max. 6 km/h
Medium MM 384 kbit/s Circuit switched asymmetrical, MM, downloads
Switched Data 14.4 kbit/s Circuit switched
Simple Messaging 14.4 kbit/s Packet switched SMS successor, E-Mail
Voice 16 kbit/s Circuit switched

Virtual Home Environment (VHE)

 Enables access to personalized data independent of location, access
network, and device
 Network operators may offer new services without changing the network
 Service providers may offer services based on components which allow the
automatic adaptation to new networks and devices
 Integration of existing IN services

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.90

 URLs for this chapter

www.ericsson.com
www.nokia.com
www.motorola.com
www.umts-forum.org
www.tetramou.com
www.itu.int
www.gsmworld.com
www.etsi.org
www.dect.ch
www.nobbi.com (German)
www.3gpp.org
www.3gpp2.org

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.91