mbn_lec4_cellnets_part1-gsm.ppt

Shahzad A. Malik, Ph.D.
smalik@comsats.edu.pk
EEE613 (MobiNets)
Mobile Broadband Networks

Mobile Cellular Wireless
Networks
This lecture presents system details
of 2G/3G mobile cellular networks:
GSM/GPRS, UMTS and
cdmaOne(IS-95)/cdma2000

Shahzad Malik Lecture 4 3
Mobile Broadband Networks – Cellular Networks
 Global System for Mobile (GSM)
 GPRS
 EDGE (EGPRS)
 UMTS
 cdmaOne – IS 95
 cdma2000
Organization of Lecture 4

Digital PLMN systems
IMT-2000
GSM
CDMA
2000
IS-136
GPRS
EDGE
IS-95
UMTS:
USA
2nd Generation (2G) 3rd Generation (3G) 4G
UTRA FDD
UTRA TDD
(PLMN = Public Land Mobile Network)
Packet
services
More radio
capacity
FDD

GSM: Overview
 GSM - Global System for Mobile
 formerly: Groupe Spéciale Mobile (founded 1982)
 now: Global System for Mobile Communication
 Pan-European standard (ETSI, European Telecommunications
Standardisation Institute)
 simultaneous introduction of essential services in three phases
(1991, 1994, 1996) by the European telecommunication
administrations
 seamless roaming within Europe possible
 today many providers all over the world use GSM (more than
184 countries in Asia, Africa, Europe, Australia, America)
 more than 1000 million subscribers
 more than 70% of all digital mobile phones use GSM
 over 10 billion SMS per month in Germany, > 360 billion/year
worldwide

GSM: Mobile Services
 GSM offers
 several types of connections
 voice connections, data connections, short message service
 multi-service options (combination of basic services)
 Different data rates for voice and data (original standard)
 data service (circuit switched)
 synchronous: 2.4, 4.8 or 9.6 kbit/s
 asynchronous: 300 - 1200 bit/s
 data service (packet switched)
 synchronous: 2.4, 4.8 or 9.6 kbit/s
 asynchronous: 300 - 9600 bit/s
 Offered services
 mobile telephony
primary goal of GSM was to enable mobile telephony offering
the traditional bandwidth of 3.1 kHz
 Emergency number
common number throughout Europe (112); mandatory for all
service providers; free of charge; connection with the
highest priority (preemption of other connections possible)

GSM: Mobile Services
Additional services
Non-Voice-Teleservices
 group 3 fax
 voice mailbox (implemented in the fixed network supporting the
mobile terminals)
 electronic mail (MHS, Message Handling System, implemented in
the fixed network)
 ...
 Short Message Service (SMS)
alphanumeric data transmission to/from the mobile terminal
using the signaling channel, thus allowing simultaneous use of
basic services and SMS
Supplementary services
identification: forwarding of caller number
suppression of number forwarding
automatic call-back
conferencing with up to 7 participants
locking of the mobile terminal (incoming or outgoing calls)
...

Architecture of the GSM system
 GSM is a PLMN (Public Land Mobile Network)
 several providers setup mobile networks following the
GSM standard within each country
 components
 MS (mobile station)
 BS (base station)
 MSC (mobile switching center)
 LR (location register)
 subsystems
 RSS (radio subsystem): covers all radio aspects
 NSS (network and switching subsystem): call forwarding,
handover, switching
 OSS (operation subsystem): management of the network

GSM: overview
fixed network
BSC
BSC
MSC MSC
GMSC
OMC, EIR,
AUC
VLR
HLR
NSS
with OSS
RSS
VLR

GSM: elements and interfaces
NSS
MS MS
BTS
BSC
GMSC
IWF
OMC
BTS
BSC
MSC MSC
Abis
Um
EIR
HLR
VLR VLR
A
BSS
PDN
ISDN, PSTN
RSS
radio cell
radio cell
MS
AUC
OSS
signaling
O

Um
Abis
A
BSS
radio
subsystem
MS MS
BTS
BSC
BTS
BTS
BSC
BTS
network and
switching subsystem
MSC
MSC
fixed
partner networks
IWF
ISDN
PSTN
PSPDN
CSPDN
SS7
EIR
HLR
VLR
ISDN
PSTN
GSM: system architecture

System architecture: radio subsystem
 Components
 MS (Mobile Station)
 BSS (Base Station
Subsystem):
consisting of
 BTS (Base Transceiver
Station):
sender and receiver
 BSC (Base Station
Controller):
controlling several
transceivers
 Interfaces
 Um : radio interface
 Abis : standardized, open
interface with
16 kbit/s user channels
 A: standardized, open
interface with
64 kbit/s user channels
Um
Abis
A
BSS
radio
subsystem
network and switching
subsystem
MS MS
BTS
BSC MSC
BTS
BTS
BSC
BTS
MSC

Radio subsystem
 The Radio Subsystem (RSS) comprises the cellular mobile network
up to the switching centers
 Components
 Base Station Subsystem (BSS):
 Base Transceiver Station (BTS): radio components including
sender, receiver, antenna - if directed antennas are used
one BTS can cover several cells
 Base Station Controller (BSC): switching between BTSs,
controlling BTSs, managing of network resources, mapping
of radio channels (Um) onto terrestrial channels (A
interface)
 BSS = BSC + sum(BTS) + interconnection
 Mobile Stations (MS)

Radio subsystem - BSS
 Base Station Subsystem
It is the wireless point of contact of the network with users
It forms Radio Access Network (RAN)
It translates between the air interface and the wired
infrastructure protocols
The two network segments need different protocols because
the difference of the nature of wireless links
 Unreliable, bandwidth limited, supports mobility
Speech Conversion
 The MS generates radio-efficient 13 kbps digitized voice packets using
speech coder. The backbone PSTN requires 64 kbps PCM digitized voice.
The BSS converts 13 to 64 kbps code.
Signaling
 The multi-tone frequency signaling is used in POTS in the wired backbone,
whereas GSM performs several packet exchange to establish a call. The
signaling conversion takes place at the BSS

Radio subsystem - Mobile station
 Terminal for the use of GSM services
 A mobile station (MS) comprises several functional
groups
 MT (Mobile Terminal):
 offers common functions used by all services the MS
offers
 end-point of the radio interface (Um)
 TA (Terminal Adapter):
 terminal adaptation, hides radio specific characteristics
 TE (Terminal Equipment):
 peripheral device of the MS, offers services to a user
 does not contain GSM specific functions
 SIM (Subscriber Identity Module):
 personalization of the mobile terminal, stores user
parameters
R S
Um
TE TA MT

network and switching subsystem
Components
 MSC (Mobile Services Switching Center):
 IWF (Interworking Functions)
 ISDN (Integrated Services Digital Network)
 PSTN (Public Switched Telephone Network)
 PSPDN (Packet Switched Public Data Net.)
 CSPDN (Circuit Switched Public Data Net.)
Databases
 HLR (Home Location Register)
 VLR (Visitor Location Register)
 EIR (Equipment Identity Register)
network
subsystem
MSC
MSC
fixed partner
networks
IWF
ISDN
PSTN
PSPDN
CSPDN
SS7
EIR
HLR
VLR
ISDN
PSTN

Network and switching subsystem
 NSS is the main component of the public mobile
network GSM
 switching, mobility management, interconnection to other
networks, system control
 Components
 Mobile Services Switching Center (MSC)
controls all connections via a separated network to/from a
mobile terminal within the domain of the MSC - several
BSC can belong to a MSC
 Databases (important: scalability, high capacity, low
delay)
 Home Location Register (HLR)
central master database containing user data, permanent
and semi-permanent data of all subscribers assigned to the
HLR (one provider can have several HLRs)
 Visitor Location Register (VLR)
local database for a subset of user data, including data
about all user currently in the domain of the VLR

Mobile Services Switching Center
 The MSC (mobile switching center) plays a central role
in GSM
 switching functions
 additional functions for mobility support
 management of network resources
 interworking functions via Gateway MSC (GMSC)
 integration of several databases
 Functions of a MSC
 specific functions for paging and call forwarding
 termination of SS7 (signaling system no. 7)
 mobility specific signaling
 location registration and forwarding of location
information
 provision of new services (fax, data calls)
 support of short message service (SMS)
 generation and forwarding of accounting and billing
information

Operation subsystem
 The OSS (Operation Subsystem) enables centralized
operation, management, and maintenance of all GSM
subsystems
 Components
 Authentication Center (AUC)
 generates user specific authentication parameters on
request of a VLR
 authentication parameters used for authentication of
mobile terminals and encryption of user data on the air
interface within the GSM system
 Equipment Identity Register (EIR)
 registers GSM mobile stations and user rights
 stolen or malfunctioning mobile stations can be locked and
sometimes even localized
 Operation and Maintenance Center (OMC)
 different control capabilities for the radio subsystem and
the network subsystem

1 2 3 4 5 6 7 8
higher GSM frame structures
935-960 MHz
124 channels (200 kHz)
downlink
890-915 MHz
124 channels (200 kHz)
uplink
time
GSM TDMA frame
GSM time-slot (normal burst)
4.615 ms
546.5 µs
577 µs
tail user data Training
S
guard
space S user data tail
guard
space
3 bits 57 bits 26 bits 57 bits
1 1 3
GSM - FDMA/TDMA

GSM FDMA
2
1 3 4 124
…
100 KHz
guard band
200 KHz
Carrier Spacing
BW = 25 MHz
Uplink Frequency Band: 890-915 MHz
Downlink Frequency Band: 935-960 MHz
Bc = 200 KHz
Bg = 100 KHz
Number of Channels = 124
Data rate for each carrier = 270.833 kbps
Bit time = 3.69 s
Slot time (or burst time) = 577 s
Number of bits/slot = 156.25 bits
Burst Types: 1. Normal Burst (NB)
2. Frequency Correction Burst
3. Synchronization burst
4. Random Access Burst (RAB)

GSM Physical Channels
:
:
Frequency 124
Frequency 2
Frequency 1 Ch 1
Timeslot 1
Ch 2 Ch 3 Ch 4 Ch 5 Ch 6 Ch 7 Ch 8
Ch 1 Ch 2 Ch 3 Ch 4 Ch 5 Ch 6 Ch 7 Ch 8
Ch 1 Ch 2 Ch 3 Ch 4 Ch 5 Ch 6 Ch 7 Ch 8
:
:
2 3 4 5 6 7 8
TDMA frame = 4.615 ms
ARFCN – Absolute Radio Frequency Channel Number

GSM Air Interface

GSM Logical and Physical Channels
 Um interface: various logical channels are mapped to physical
channels
 A physical channel is a timeslot with timeslot number in a sequence
of TDMA frames on a particular ARFCN
 8 physical channels mapped onto 8 timeslots within TDMA frame
per frequency carrier

GSM Frame Hierarchy
156.25 bits: Burst (0.577 ms)
8 slots: Frame (4.615 ms)
26 traffic frames: Multi frame (120 ms) 51control frames: Multi frame (235.4 ms)
51 traffic or 26 control multi frames: Super frame (6.12 s)
2048 super frames: Hyper frame (3 hr 28 min 53.76 s)

GSM hierarchy of frames
0 1 2 2045 2046 2047
...
hyperframe
0 1 2 48 49 50
...
0 1 24 25
...
superframe
0 1 24 25
...
0 1 2 48 49 50
...
0 1 6 7
...
multiframe
frame
burst
slot
577 µs
4.615 ms
120 ms
235.4 ms
6.12 s
3 h 28 min 53.76 s

GSM Logical Channels
 3 groups of logical channels, TCH, CCH and CBCH
 TCH is used to carry voice or data traffic
 CCH is used for control functions
 CBCH is used for broadcast functions
 Logical traffic channels = full rate (TCH/F) at 22.8 kb/s or half
rate (TCH/H) at 11.4 kb/s
 Physical channel = full rate traffic channel (1 timeslot) or 2 half
rate traffic channels (1 timeslot in alternating frames)
 Full rate channel may carry 13 kb/s speech or data at 12, 6, or 3.6
kb/s
 Half rate channel may carry 6.5 kb/s speech or data at 6 or 3.6
kb/s

GSM Logical Channel Structure
CCH
TCH/F TCH/H
BCH CCCH DCCH
FCCH SCH BCCH PCH AGCH RACH
TCH CBCH
ACCH SDCCH
FACCH
SACCH

GSM Logical Channels, cont..
 CCH consists of 3 groups of logical control channels, BCH, CCCH
and DCCH
 BCH (broadcast channel): point-to-multipoint downlink only.
Contains three sub-channels, BCCH, FCCH and SCH
 BCCH (broadcast control channel): send cell identities,
organization info about common control channels, cell service
available, etc
 FCCH (frequency correction channel): send a frequency
correction data burst containing all zeros to effect a constant
frequency shift of RF carrier
SCH (synchronization channel): send TDMA frame number and
base station identity code to synchronize MSs

GSM Logical Channels, cont…
 CCCH (common control channel): Consists of three sub-channels,
PCH, AGCH and RACH. This channels is used for paging and access
 PCH (paging channel): to page MSs
 AGCH (access grant channel): to assign MSs to stand-alone
dedicated control channels for initial assignment
 RACH (random access channel): for MS to send requests for
dedicated connections

GSM Logical Channels, cont…
 DCCH (dedicated control channel): bi-directional point-to-point --
main signaling channels. Consist of two sub-channels, SDCCH and
ACCH
SDCCH (stand-alone dedicated control channel): for service
request, subscriber authentication, equipment validation,
assignment to a traffic channel
ACCH consist of two sub-channels, SACCH and FACCH
 SACCH (slow associated control channel): for out-of-band
signaling associated with a traffic channel, eg, signal strength
measurements
 FACCH (fast associated control channel): for preemptive
signaling on a traffic channel, eg, for handoff messages

GSM Logical Channels , cont…

GSM Packet Encoding
260 bits (20 ms)
CRC coding
½ convolutional
coding
456 bits (20 ms)
260 bits 50 bits
132 bits
53 bits
4 tail bits
78 bits
378 bits
Speech packet (13 kbps)
Transmitted packet
192 bits (20 ms)
½ convolutional
coding
456 bits (20 ms)
4 tail bits
48 bits
signaling info
Transmitted packet
9600 bps data packet
40 parity bits
½ convolutional
coding
456 bits (20 ms)
4 tail bits
184 bits (20 ms)
Transmitted packet
Signaling packet

GSM Data Bursts

GSM Operation

Protocol Stack
CM
MM
MM
CM
SCCP
RRM
RRM
RRM
RRM
LAPDm
LAPDm LAPD LAPD MTP
MTP
Radio Radio 64kbps 64kbps 64kbps 64kbps
SCCP
Um Air
Interface A-bis A
MS BTS BSC MSC
CM: Connection Management RRM: Radio Resource Management
MM: Mobility Management MTP: Message Transfer Part
SCCP: Signal Connection Control part LAPD: Link access protocol-D

GSM Protocol Layers
 RF : Physical Layer
 LAPD: Link Layer, ISDN protocol based
 SCCP: Signal Connection Control Layer, part of link
layer
 RR: Radio Resource
 MM: Mobility Management
 CC: Call Control

GSM Network Layer
 Network layer consists of 3 sublayers
 Radio resource management (RR) sublayer
 Establishment, maintenance, and termination of radio
channel connections
 Mobility management (MM) sublayer
 Registration, authentication, and location tracking
 Call control (CC) sublayer
 Establishment, maintenance, and termination of circuit-
switched calls

GSM Numbers
 International mobile station equipment identity (IMEI). IMEI= TAC + FAC
+ SNR + SP
 TAC = Type Approval Code, 6 decimals
 FAC = Final Assembly Code, 6 decimals, assigned by manufacturer
 SNR = Serial Number, 6 decimals, assigned by manufacturer
 SP = Spare, 1 decimal place
 EIR has white, black and optionally grey list.
 International mobile Subscriber Identity (IMSI): Stored on the SIM
(Subscriber Identity Module) card. IMSI is obtained at the time of
subscription. IMSI is not made public.
 IMSI = MCC + MNC + MSIN
 MCC = Mobile Country Code, 3 decimals
 MNC = Mobile Network Code, 2 decimals
 MSIN = Mobile Subscriber Identification Number, maximum 10 decimal digits

GSM Numbers
 Mobile Station ISDN number (MSISDN), is the real phone number of the
subscriber. Stored in HLR and on SIM card
 MSISDN = CC + NDC + SN
 CC = Country Code, up to 3 decimals
 NDC = National Destination Code, typically 2-3 decimals
 SN = Subscriber Number, maximum 10 decimals.
 Mobile Station Roaming Number (MSRN), same format as MSISDN. A temporary
location dependent ISDN number; assigned in two cases, at registration or at call
set up.
 Location Area Identity (LAI). Regularly sent on BCCH; LAI = CC + MNC + LAC,
 LAC = Location Area Code, max 5 decimals (<FFFFhex).
 Temporary Mobile Subscriber Identity (TMSI). Stored only in the VLR and SIM
card. Consists of 4*8 bits excluding value FFFF FFFFhex
 TMSI has only local meaning and can be defined according to operator’s
specifications.
 LAI + TMSI uniquely identifies the user, i.e. IMSI is no longer needed for ongoing
communication

GSM mobility management
The GSM network is divided into location areas (LA), each
containing a certain number of cells.
As long as an idle MS
(idle = switched on)
moves within a location
area, it can be
reached through
paging.
If an idle MS moves between two
location areas, it cannot be
reached before it performs a
location update.
Location Area 1
Location Area 3
Location
Area 2

Connectivity states in GSM
Disconnected
Idle
Connected
MS is switched off (circuit mode)
location updates on LA basis
handovers, not location updates
GSM

GSM Handoffs
 3 types of handoffs
 Intra-BSS: if old and new BTSs are attached to same
base station
 MSC is not involved
 Intra-MSC: if old and new BTSs are attached to
different base stations but within same MSC
 Inter-MSC: if MSCs are changed

3 types of handover
MSC MSC
BSC BSC
BSC
BTS BTS BTS
BTS
MS MS MS MS
1
2 3 4

GSM Intra-MSC Handoff
 Mobile station monitors signal quality and determines
handoff is required, sends signal measurements to
serving BSS
 Serving BSS sends handoff request to MSC with
ranked list of qualified target BSSs
 MSC determines that best candidate BSS is under its
control (assumed here)
 MSC reserves a trunk to target BSS

GSM Intra-MSC Handoff, cont..
 Target BSS selects and reserves radio channels for
new connection, sends Ack to MSC
 MSC notifies serving BSS to begin handoff, including
new radio channel assignment
 Serving BSS forwards new radio channel assignment to
mobile station
 Mobile station re-tunes to new radio channel, notifies
target BSS on new channel

GSM Intra-MSC Handoff, cont..
 Target BSS notifies MSC that handoff is detected
 Target BSS and mobile station exchange messages to
synchronize transmission in proper timeslot
 MSC switches voice connection to target BSS, which
responds when handoff is complete
 MSC notifies serving BSS to release old radio traffic
channel

GSM Inter-MSC Handoff
 Mobile station monitors signal quality and determines
handoff is required, sends signal measurements to
serving BSS
 Serving BSS sends handoff request to MSC with
ranked list of qualified target BSSs
 Serving MSC determines that best candidate BSS is
under control of a target MSC (assumed here) and calls
target MSC through PSTN

GSM Inter-MSC Handoff, cont..
 Target MSC notifies its VLR to assign a TMSI
 Target VLR returns TMSI
 Target MSC reserves a trunk to target BSS
 Target BSS selects and reserves radio channels for
new connection, sends Ack to target MSC
 Target MSC notifies serving MSC that it is ready for
handoff

 Serving MSC notifies serving BSS to begin handoff,
including new radio channel assignment
 Serving BSS forwards new radio channel assignment to
mobile station
 Mobile station re-tunes to new radio channel, notifies
target BSS on new channel
 Target BSS notifies target MSC that handoff is
detected

 Target BSS and mobile station exchange messages to
synchronize transmission in proper timeslot
 Voice connection is switched to target BSS, which
responds when handoff is complete
 Target MSC notifies serving MSC
 Old network resources are released

GSM Roaming From Another PLMN
 VLR registers users roaming in its area
 Recognizes mobile station is from another PLMN
 If roaming is allowed, VLR finds the mobile’s HLR in its
home PLMN
 VLR constructs a global title from IMSI to allow
signaling from VLR to mobile’s HLR via public telephone
network
 VLR generates a mobile subscriber roaming number
(MSRN) used to route incoming calls to mobile station
 MSRN is sent to mobile’s HLR

GSM Roaming, cont…
 VLR contains
 MSRN
 TMSI
 Location area where mobile station has registered
 Info for supplementary services (if any)
 IMSI
 HLR or global title
 Local identity for mobile station (if any)

Security in GSM
 Security services
 access control/authentication
 user  SIM (Subscriber Identity Module): secret PIN (personal
identification number)
 SIM  network: challenge response method
 confidentiality
 voice and signaling encrypted on the wireless link (after successful
authentication)
 anonymity
 temporary identity TMSI
(Temporary Mobile Subscriber Identity)
 newly assigned at each new location update (LUP)
 encrypted transmission
 3 algorithms specified in GSM
 A3 for authentication (“secret”, open interface)
 A5 for encryption (standardized)
 A8 for key generation (“secret”, open interface)
“secret”:
• A3 and A8
available via the
Internet
• network providers
can use stronger
mechanisms

GSM - authentication
A3
RAND
Ki
128 bit 128 bit
SRES* 32 bit
A3
RAND Ki
128 bit 128 bit
SRES 32 bit
SRES* =? SRES SRES
RAND
SRES
32 bit
mobile network SIM
AC
MSC
SIM
Ki: individual subscriber authentication key SRES: signed response

GSM - key generation and encryption
A8
RAND
Ki
128 bit 128 bit
Kc
64 bit
A8
RAND Ki
128 bit 128 bit
SRES
RAND
encrypted
data
mobile network (BTS) MS with SIM
AC
BSS
SIM
A5
Kc
64 bit
A5
MS
data data
cipher
key

GSM Initiation
RF + FCCH
Lock on strong freq.
and find FCCH
SCH sync + training
Find SCH channel for
sync. and training
BCCH system parameters
Gets cell and
system parameters
RACH channel request
Request stand alone
dedicated channel
AGCH channel assignment
SDCCH established

GSM Initiation
SDCCH location update
Make location update
request
SDCCH challenge
Computes challenge
response to verify
identity
SDCCH challenge response
SDCCH ciphered mode
Initiate encryption of
data for transmission Ack ciphered mode
Location update confirm
Complete location
update process Ack

GSM Calling from MS
MSC
Setup Request Fetches subscriber info
from VLR to process
call, acks caller
Dial called
party
Call Proceeding
Allocates trunk +
radio channel
Radio channel
Ack
Tune to
radio freq.
Complete Call connected
through PSTN
Alerting
Connect
Connect ack
Alerts caller
Called party picks up
Call can proceed

GSM Calling to MS
MSC
PCH page request Incoming call from PSTN
Request
dedicated
control
channel
RACH channel request
Allocates control
channel
Answer page
Request authentication
SDCCH challenge
Request ciphering on
channel
AGCH assignment
SDCCH paging response
Computes
response
SDCCH challenge response
SDCCH ciphering mode
Ciphering mode complete
Begin
ciphering

GSM Calling to MS
MSC
TMSI reallocation Assign new TMSI
Accept
temporary ID TMSI reallocation complete
Notify call
Accept call
Assign traffic channel
SDCCH assignment
Alert called party
SDCCH setup
SDCCH setup ack
Tune to
freq.
Assignment complete
FACCH alerting/connect
FACCH connect ack
Start
connection

GSM call routing
1. MSISDN
2. MSISDN
VLR
HLR
AUC
EIR
GMSC/I
WF
MSC
BSC
BSC
BTS
BTS
BTS
ISDN
3. MSRN
4. MSRN
5. MSRN
6. TMSI
7. TMSI
7. TMSI
7. TMSI
8. TMSI
LA2
LA1
MS
MS

GSM Channel Use Example
MS BTS BSC MSC
3. Call Establishment Request (SDCCH)
11. Traffic Channel Established (FACCH)
1. Channel Request (RACH)
6. Ciphering Command (SDCCH)
2. Channel Assigned (AGCH)
13. Call Accepted (FACCH)
4. Authentication Request (SDCCH)
5. Authentication Response (SDCCH)
7. Ciphering Ready (SDCCH)
8. Send Destination Address (SDCCH)
10. Assign Traffic Channel (SDCCH)
12. Available/Busy Signal (FACCH)
9. Routing Response (SDCCH)
14. Connection Established (FACCH)
15. Information Exchange (TCH)

Example: Incoming Call Setup
MS  BSS/MSC ------ Paging request (PCH)
MS  BSS/MSC ------ Channel request (RACH)
MS  BSS/MSC ------ Immediate Assignment (AGCH)
MS  BSS/MSC ------ Paging Response (SDCCH)
MS  BSS/MSC ------ Authentication Request (SDCCH)
MS  BSS/MSC ------ Authentication Response (SDCCH)
MS  BSS/MSC ------ Cipher Mode Command (SDCCH)
MS  BSS/MSC ------ Cipher Mode Compl. (SDCCH)
MS  BSS/MSC ------ Setup (SDCCH)
MS  BSS/MSC ------ Call Confirmation (SDCCH)
MS  BSS/MSC ------ Assignment Command (SDCCH)
MS  BSS/MSC ------ Assignment Compl. (FACCH)
MS  BSS/MSC ------ Alert (FACCH)
MS  BSS/MSC ------ Connect (FACCH)
MS  BSS/MSC ------ Connect Acknowledge (FACCH)
MS BSS/MSC ------ Data (TCH)

YES
NO
NO
NO
YES
YES
Power On Scan Channels,
monitor RF levels
Select the channel with
highest RF level among
the control channels
Scan the channel for the
FCCH
Is
FCCH detected?
Scan channel for SCH
Is
SCH detected?
Read data from BCCH
and determine is it BCCH?
Is
the current BCCH
channel included?
Camp on BCCH and
start decoding
Select the channel with
next highest Rf level from
the control list.
From the channel data
update the control channel
list

Summary: GSM 900 and GSM 1800
GSM 900 GSM 1800
Frequency band 890-915 MHz
935-960 MHz
1710-1785 MHz
1805-1880 MHz
Border spacing 25 MHz 75 MHz
Duplex spacing 45 MHz 95 MHz
Carrier spacing 200 kHz 200 kHz
Carriers 124 374
Timeslots per carrier 8 8
Multiple access TDMA/FDMA TDMA/FDMA
Typical cell range <300m – 35 km <100m – 15 km
Handset Power 0.8 & 8 W 0.25 & 1 W

mbn_lec4_cellnets_part1-gsm.ppt

Recommended

Recommended

More Related Content

Similar to mbn_lec4_cellnets_part1-gsm.ppt

Similar to mbn_lec4_cellnets_part1-gsm.ppt (20)

Recently uploaded

Recently uploaded (20)

mbn_lec4_cellnets_part1-gsm.ppt

Editor's Notes