Cellular Telecommunications

Architecture
Background
Air interfaces
Network protocols
Application: Messaging
Research

Signaling and control in GSM

Common control channel
structure
broadcast channels
channel access from mobile
procedures and messages for call control
Traffic channel
structure handoffs

GSM control functions

Read system parameters
Register
Receive and originate calls
Manage handoffs

GSM Structure

Traffic Channel (per user in a call)

MS1
Common Control Channel

Base
Station

MS2
TCH (13 Kbps)
Common Control Channel (CCCH)
Used for control information
registration
Paging
Call origination/termination

Traffic Channel (TCH)

information transfer
in-call control (fast/slow associated control channels
3

GSM CCCH

CCCH

Reverse
(MS -> BS)

Forward
(BS -> MS)

Random Access
Control Channel
(RACH)

Paging and
Access Grant
Channel (PAGCH)

Forward
(BS -> MS)

Forward
(BS -> MS)

Broadcast
Control
Channel
(BCCH)

Forward
(BS -> MS)

Synchronization
Channel
(SCH)

Frequency
Correction
Channel
(FCCH)

PCH
AGCH

GSM CCCH structure

TDMA Frame:
Slot 1

Slot 2

Slot 3

Slot 4

Slot 5

Slot 6

Slot 7

Slot 8

Frame: 4.615 msec

Frame 51

51 multiframe:
235 msec

Block
Frame 1 Frame 2 Frame 3

Channel name (frame #):

FCCH (0) SCH (1) BCCH (2-5) PAGCH(6-9)
FCCH (0) SCH (1)

FCCH (0) SCH (1)

.
.
.

PAGCH(2-9)

PAGCH(2-9)

10

CCCH uses 1 slot/frame; other seven used for TCH

TCH: 26 multi-frame repeats every 120 msec)

GSM: BCCH
Broadcast to all users on the CCCH
No addressing
Used to acquire system parameters so mobile may operate within the system
Key parameters (contained in RR SYSTEM INFORMATION MESSAGES)
RACH control parameters
cell channel descriptions (frequencies)
neighbor cells (frequencies)
cell id
Location Area ID (LAI)
Control channel description

GSM: FCCH and SCH

Keeps system synchronization
Broadcasts basestation ID

GSM: Mobile Channel Access Procedures (RACH)

MS communicates with BS over RACH
Feedback provided with AGCH
Functions:
responses to page
location update (registration)
call origination

GSM: RACH procedures (Layer 2)

Slotted ALOHA
mobiles contend when making reservations
when reservation is successful, no more contention
Mobile
sends assignment request with information
Basestation
sends back assignment with information echoed
Creates Radio Resource (RR) connection (Stand-Alone Dedicated Control Channel)
may be a physical channel
may be a traffic channel is signaling-only mode
may eventually be bandwidth stolen from TCH (associated control channel)

b
a

c,d
b

c
e

c
9

GSM: Paging Channel (PCH)

Used to send pages to mobile devices
incoming calls
Done at regular intervals
mobiles belong to a paging class
allows sleeping
More than 1 mobile paged at a time

10

GSM: Access Grant Channel (AGCH)

Allocates dedicated resources
TCH
Stand-alone Dedicated Control Channels
Responds to RACH requests

11

Basic Flow on Air Interface

Mobile

Basestation
Request dedicated signaling channel
Assign dedicated signaling channel

Signal

Release signaling channel

12

GSM Signaling Protocol Structure

Mobile

BTS

BSC

MSC/VLR

HLR
TCAP

Radio Interface Layer 3 Call Control (RIL-3 CC)

RIL-3 Mobility Management (RIL-3 MM)
RIL-3 Radio Resource (RIL-3 RR)

MAP
SCCP
MTP

RIL-3 CC (Uses MM-connection)

call establishment
signaling during a call
tone signaling
call clearing

13

GSM Signaling Protocol Structure

Mobile

BTS

BSC

MSC/VLR

HLR
TCAP

Radio Interface Layer 3 Call Control (RIL-3 CC)

MAP

RIL-3 Mobility Management (RIL-3 MM)

SCCP

RIL-3 Radio Resource (RIL-3 RR)

MTP

RIL-3 MM (Uses RR-connection)

common (over RR)
temporary ID maintenance (TMSI reallocation)
authentication
ID procedures
de-registration (IMSI detach)
specific (no RR required)
location update
periodic update
registration (IMSI attach)
14

GSM Signaling Protocol Structure

Mobile

BTS

BSC

MSC/VLR

HLR
TCAP

Radio Interface Layer 3 Call Control (RIL-3 CC)

RIL-3 Mobility Management (RIL-3 MM)
RIL-3 Radio Resource (RIL-3 RR)

MAP
SCCP
MTP

RIL-3 RR
paging
connection transfer
handoffs
cipher mode

15

GSM Signaling Protocol Structure

Mobile

BTS

BSC

MSC/VLR

HLR
TCAP

Radio Interface Layer 3 Call Control (RIL-3 CC)

MAP

RIL-3 Mobility Management (RIL-3 MM)

SCCP

RIL-3 Radio Resource (RIL-3 RR)

MTP

RIL-3 CC Messages
call establishment

call release

in-call

ALERTING

DISCONNECT

START DTMF

CALL CONFIRMED

RELEASE

START DTMF ACK

CALL PROCEEDING

RELEASE COMPLETE

STOP DTMF

CONNECT

STOP DTMF ACK

CONNECT ACK

* DMTF is tone signaling

SETUP

16

GSM Signaling Protocol Structure

Mobile

BTS

BSC

MSC/VLR

HLR
TCAP

Radio Interface Layer 3 Call Control (RIL-3 CC)

RIL-3 Mobility Management (RIL-3 MM)
RIL-3 Radio Resource (RIL-3 RR)

MAP
SCCP
MTP

RIL-3 MM messages
Registration
Location Update Request (LAI)/Accept
IMSI Detach (de-registration)
Security
Authentication Request (cipher key, seq #, RAND)
Authentication Response (SRES)
TMSI Reallocation Command/Complete
Service Request (service type)/Accept
17

GSM Signaling Protocol Structure

Mobile

BTS

BSC

MSC/VLR

HLR
TCAP

Radio Interface Layer 3 Call Control (RIL-3 CC)

RIL-3 Mobility Management (RIL-3 MM)
RIL-3 Radio Resource (RIL-3 RR)

MAP
SCCP
MTP

RIL-3 messages
Radio Resource
Connection establishment
Assign command (Rf channel)
Paging request (TMSI)
Assignment complete
Channel request (random ref)
Immediate assignment (channel description, Handover command (channel description)
cipher key)
Handover complete
Page response
Measurement report
Channel release
Ciphering
Cipher mode command/complete
18

GSM Registration
Types
power up/down
location area
periodic
User Confidentiality
mobile device may send in real address: International Mobile Subscriber Identity (IMSI)
gets back temporary id (TMSI)
Unique in local area

subsequent registrations use TMSI

19

GSM: Registration, High Level

Mobile

Basestation
Get SDCCH
RR connection
established

Authenticate
Cipher
UpdateLocation

Release RR connection

20

GSM: Registration, Lower Level

Mobile
Get SDCCH

Basestation
Get SDCCH
LOC UPD RQST
Authentication Request (RAND)
Authentication Response (SRES)
Cipher Mode
Cipher Mode Complete
LOC UPD ACC (TMSI)
TMSI REAL Complete
Release RR connection

21

GSM: Registration

Mobile
Get SDCCH

Basestation
Channel request
Immediate assignment
SABM(LOC UPD RQST)

RR connection
established

UA(LOC UPD RQST)

Authentication Request (RAND)
Authentication Response (SRES)
Cipher Mode
Cipher Mode Complete
LOC UPD ACC (TMSI)
TMSI REAL Complete

RR connection
release

Channel Release

22

GSM: Call Termination (Receive a call)

Mobile
Get SDCCH

Page Request (TMSI)

Basestation

Channel request
Immediate assignment

RR connection
established

SABM(Page Response)
UA(Page Response)
Authentication and Ciphering
SETUP
Call Confirmed
Alert
Assignment Command
Assignment Complete

RR connection
release

Connect
Connect ACK

23

GSM: Call Origination

Mobile

Basestation
Channel request

Get SDCCH

Immediate assignment
RR connection
established

SABM(CM Service Request Call Orig)

UA(CM Service Request Call Orig)
Authentication and Ciphering
SETUP
Call Proceeding
Alert
Assignment Command
Assignment Complete
Connect

RR connection
release

Connect ACK

24

GSM: Mobile Assisted Handoff (MAHO)

MSC

Old BS

MS

New BS

Measurement Report
Measurement Report
Measurement Report
Measurement Report

Handoff Order

Handoff Access
Handoff Access

Handoff Complete

25

GSM: Short Messaging Service (SMS)

Bi-directional
Acknowledged service
2 priorities
Validity period
Message storing

26

GSM: SMS Protocols

MS

MSC

SM-Application Layer

Transfer Protocol

SM-Transfer Layer

Relay Protocol

SM-Relay Layer

Control Protocol

CM
Transfer protocol
SMS-Deliver (mobile terminated message)
SMS-Submit (mobile originate message)
Relay protocol
RP-Data (Deliver of Submit payload)
RP-Ack
Control protocol
CP-data (RP-Data or RP-Ack)
CP-Ack
27

GSM: SMS Examples Mobile Termination, High Level

Mobile

Basestation
Page
Page Response
SMS Delivery

28

GSM: SMS Examples Mobile Termination

Mobile

Basestation
Page
Page Response

CP-Data (RP-Data(SMS Delivery))

CP-Ack
CP-Data(RP-Ack)
CP-Ack

29

GSM: SMS Examples Mobile Origination

Mobile

Basestation
CP-Data (RP-Data(SMS Submit))
CP-Ack
CP-Data(RP-Ack)
CP-Ack

30

Review
Mobile Station powers on
locates CCCH and reads system parameters
Mobile Registers
gets a paging class
Monitors paging channel
can receive or make calls
can receive and send messages

31

Other air interfaces

IS-136
digital
TDMA
IS-95
digital
CDMA
CDMA 2000
3G
UMTS
W-CDMA
3G

32

TIA/EIA/IS-136
Supports:
Call origination and termination
Registration
SMS
Digital:
TDMA
Based on IS-54
Primary difference: Digital Control Channel

33

IS-136 Spectrum
Reverse Channel (uplink)
824 849 MHz
Forward Channel (downlink)
869 894 MHz
Carriers spaced at 30 KHz
3 traffic channels per carrier
Frequencies equally divided into 2 systems
each has 12.5 MHz in uplink and downlink

34

IS-136 Structure

Digital Traffic Channel (per user in a call)

MS1
Digital Control Channel (48.6 Kbps)

Base
Station

MS2
DCH (13 Kbps)
Digital Control Channel (DCCH)
Used for control information
registration
Paging
Call origination/termination

Used for SMS

Digital Traffic Channel (DCH)
information transfer
in-call control (fast/slow associated control channels)
35

IS-136 DCCH

DCCH

Reverse
(MS -> BS)

Random Access
Control Channel
(RACH)

Forward
(BS -> MS)

SMS, Paging, and

Access Response
Channel (SPACH)

Forward
(BS -> MS)

Broadcast
Control
Channel
(BCCH)

Forward
(BS -> MS)

Shared Feedback
Control Channel
(SCF)

PCH
ARCH

F-BCCH
E-BCCH

SMSCH

S-BCCH

36

IS-95
Code Division Multiple Access (CDMA) Transmission
Similar call processing to GSM and IS-136
1.23 MHz carriers, each with 65 sub code channels
Operates in similar bands to AMPS/IS-136

37

Network Architecture: CDMA, CDMA2000

VLR
CDMA

BSC

SS7

MSC

BS
RNC/PCF

Soft
handoff

R-P if

BS

PSTN

FA

PDSN

HLR
AAA

IP

HA
Internet

Data path
Voice path
RNC/PCF
BSC
performs frame-selection/power control
Coordinates handoff for voice users
terminates Radio Link Protocol with mobiles
performs frame-selection/power control
performs packet and burst control functions
MSC
PDSN

AAA

terminates Point-to-Point Protocol (PPP) with call control and mobility management
clients
interfaces to the PSTN for voice users
provides foreign agent (FA) support for
HLR
Mobile IP enabled clients
provides location management and AAA
functions for voice users using the IS41 protocol
provides Authentication, Authorization, and
Accounting for data users
38

CDMA: benefits
Higher capacity
interference limited => maximum efficiency
uses voice activity detection to reduce transmission bandwidth
Improved quality
soft handoff
CDMA has frequency, spatial, and time diversity to adapt to wireless errors
EVRC coding at 8kbps of voice includes error correction etc.
Ease of deployment
no frequency planning since frequency reuse=1
Greater coverage
cost effective in sub-urban and rural areas
Increased privacy
spreads small signal (9.6kbps) over large spectrum (1.25Mbps) so that signal appears like noise
Increased talk time
power control (performed 800 times a second) ensures that the mobile station transmits at
optimum power resulting in longer battery life
39

3G CDMA Air Interfaces

CDMA2000

WCDMA

(3GPP2/TIA/TTA I)

(3GPP/ETSI/ARIB/TTA II)

Chip rate: 1.2288,3.6864/... Mc/s

Chip rate: (4.096)/ 3.84/... Mc/s

Channel Bandwidth: 1.25/5MHz

Channel Bandwidth: 5MHz

Network synchronous (base stations

synchronized using GPS)

Network Asynchronous (base stations not

synchronized)

3G3X uses 5 MHz direct spread, 3G1X uses 1.25

MHz multicarrier

Direct Spread

20 ms frames
Common cdm pilot

10 ms frames
Dedicated tdm pilot
Power control (1600 Hz)

Power control (800 Hz)

CDMA Harmonization group is trying to reconcile these and the SCDMA

standard (TDD mode): WCDMA now has chip rate of 3.84 Mcps,
common cdm pilot, synchronous mode...

40

Observations: CDMA2000

CDMA2000 as the 3G air interface is compatible with IS95

CDMA2000 networks can be deployed as overlay on existing 2G
spectrum
Network architecture/protocols designed to gracefully migrate from IS95
Network architecture is more IP friendly than UMTS but still not all-IP
3G1X, 3G1X EV-DO (HDR), 3G3X high data rate options for evolution
3G1X and HDR deployments likely in U.S.; 3G3X farther out in the future

41

Network Architecture: UMTS/GPRS/GSM

Internet
Figure based on
UMTS TS-23.002

Firewall +
IP Router

PSTN

RNC
Radio network controller
manages a set of basestations
(Node B)

GMSC
GGSN

HLR
uses the GSM MAP protocol
for location management
and authentication

HLR

PSTN

MSC/GMSC

VLR

call control and mobility

management for circuit
switched (CS) users

SGSN

MSC
IuPS
A
BSC
BTS

RNC

RNC
BTS

IuPS
BSC

Node BNode B BTS BTS

BTS

Um
2G CS

IuPS

IuCS

Uu
MS

Uu
MS

Um
2.5G
PS

SGSN/GGSN

uses GPRS Tunneling Protocol

(GTP) to provide mobility
management and transport for
packet switched (PS) users

42

Observations: WCDMA
WCDMA is the UMTS air interface and is a disruptive change from GSM
GPRS allows for evolution to higher data rates from GSM, and uses
UMTS network architecture but does not use WCDMA air interface
Network architecture is not pure IP and is not IETF friendly
All IP wireless network architecture is the current predominant theme
Regulations allow UMTS deployment only in new frequency spectrum
Service Providers have paid huge amounts for UMTS spectrum in U.K.,
Germany but are becoming increasingly conservative as in Italy, Austria,
Swiss auctions

UMTS: tremendous money and effort is being poured in;

financial issues will dictate deployment speed

43