Mobile Communications Chapter 4: Wireless Telecommunication Systems

1
Mobile CommunicationsChapter 4 Wireless
Telecommunication Systems

• Market
• GSM
• Overview
• Services
• Sub-systems
• Components

• DECT
• TETRA
• UMTS/IMT-2000

2
Mobile phone subscribers worldwide
3
Development of mobile telecommunication systems
CT0/1
AMPS
FDMA
CT2
NMT
IMT-FT DECT
IS-136 TDMA D-AMPS
EDGE
IMT-SC IS-136HS UWC-136
TDMA
GSM
GPRS
PDC
IMT-DS UTRA FDD / W-CDMA
IMT-TC UTRA TDD / TD-CDMA
IMT-TC TD-SCDMA
CDMA
IS-95 cdmaOne
IMT-MC cdma2000 1X EV-DO
cdma2000 1X
1X EV-DV (3X)
1G
2G
3G
2.5G
4
GSM Overview

• GSM ( http//www.gsmworld.com/index.shtml )
• formerly Groupe Spéciale Mobile (founded 1982)
• now Global System for Mobile Communication
• Pan-European standard (ETSI European
  Telecommunications Standardisation Institute)
• simultaneous introduction of essential services
  in three phases (1991 1994 1996) by the
  European telecommunication administrations
  (Germany D1 and D2) seamless roaming within
  Europe possible
• today many providers all over the world use GSM
  (more than 184 countries in Asia Africa Europe
  Australia America)
• more than 970.8 million subscribers (Dec 2003)
• more than 73 of all digital mobile phones use
  GSM
• over 10 billion SMS (Short Message Service) per
  month in Germany gt 360 billion/year worldwide

5
Performance characteristics of GSM (wrt. analog
sys.)

• Communication
• mobile wireless communication support for voice
  and data services
• Total mobility
• international access chip-card enables use of
  access points of different providers
• Worldwide connectivity
• one number the network handles localization
• High capacity
• better frequency efficiency smaller cells more
  customers per cell
• High transmission quality
• high audio quality and reliability for wireless
  uninterrupted phone calls at higher speeds (e.g.
  from cars trains)
• Security functions
• access control authentication via chip-card and
  PIN

6
Disadvantages of GSM

• There is no perfect system!!
• no end-to-end encryption of user data
• no full ISDN bandwidth of 64 kbit/s to the user
  no transparent B-channel (ISDN bearer ISDN
  channel that carries the main data)
• reduced concentration while driving
• electromagnetic radiation
• abuse of private data possible
• roaming profiles accessible
• high complexity of the system
• several incompatibilities within the GSM
  standards

7
GSM Mobile Services

• GSM offers
• several types of connections
• voice connections data connections short
  message service
• multi-service options (combination of basic
  services)
• Three service domains
• Bearer Services - data
• Telematic Services - voice
• Supplementary Services short message service
  (SMS)

bearer services
MS
GSM-PLMN
transit network (PSTN ISDN)
source/ destination network
TE
TE
MT
R S
(U S R)
Um
tele services
8
Bearer Services

• Telecommunication services to transfer data
  between access points
• Specification of services up to the terminal
  interface (OSI layers 1-3)
• Different data rates for voice and data (original
  standard)
• data service (circuit switched)
• synchronous 2.4 4.8 or 9.6 kbit/s
• asynchronous 300 - 1200 bit/s
• data service (packet switched)
• synchronous 2.4 4.8 or 9.6 kbit/s
• asynchronous 300 - 9600 bit/s
• Today data rates of approx. 50 kbit/s possible
  will be covered later!

9
Tele Services I

• Telecommunication services that enable voice
  communication via mobile phones
• All these basic services have to obey cellular
  functions security measurements etc.
• Offered services
• mobile telephonyprimary goal of GSM was to
  enable mobile telephony offering the traditional
  bandwidth of 3.1 kHz
• Emergency numbercommon number throughout Europe
  (112) mandatory for all service providers free
  of charge connection with the highest priority
  (preemption of other connections possible)
• Multinumberingseveral ISDN phone numbers per
  user possible

10
Tele Services II

• Additional services
• Non-Voice-Teleservices
• group 3 fax
• voice mailbox (implemented in the fixed network
  supporting the mobile terminals)
• electronic mail (MHS Message Handling System
  implemented in the fixed network)
• ...
• Short Message Service (SMS)alphanumeric data
  transmission to/from the mobile terminal using
  the signaling channel thus allowing simultaneous
  use of basic services and SMS

11
Supplementary services

• Services in addition to the basic services
  cannot be offered stand-alone
• Similar to ISDN services besides lower bandwidth
  due to the radio link
• May differ between different service providers
  countries and protocol versions
• Important services
• identification forwarding of caller number
• suppression of number forwarding
• automatic call-back
• conferencing with up to 7 participants
• locking of the mobile terminal (incoming or
  outgoing calls)
• ...

12
Architecture of the GSM system

• GSM is a PLMN (Public Land Mobile Network)
• several providers setup mobile networks following
  the GSM standard within each country
• components
• MS (mobile station)
• BS (base station)
• MSC (mobile switching center)
• LR (location register)
• subsystems
• RSS (radio subsystem) covers all radio aspects
• NSS (network and switching subsystem) call
  forwarding handover switching
• OSS (operation subsystem) management of the
  network

13
GSM overview
OMC EIR AUC
fixed network
HLR
GMSC
NSS with OSS
VLR
MSC
MSC
VLR
BSC
BSC
RSS
14
GSM elements and interfaces
radio cell
BSS
MS
MS
Um
radio cell
MS
RSS
BTS
BTS
Abis
BSC
BSC
A
MSC
MSC
NSS
VLR
VLR
signaling
HLR
ISDN PSTN
GMSC
PDN
IWF
O
EIR
OSS
OMC
AUC
15
GSM system architecture
radiosubsystem
network and switching subsystem
fixedpartner networks
MS
MS
ISDNPSTN
Um
MSC
Abis
BTS
BSC
EIR
BTS
SS7
HLR
VLR
BTS
BSC
ISDNPSTN
BTS
MSC
A
IWF
BSS
PSPDNCSPDN
16
System architecture radio subsystem
radiosubsystem
network and switchingsubsystem
MS
MS

• Components
• MS (Mobile Station)
• BSS (Base Station Subsystem)consisting of
• BTS (Base Transceiver Station)sender and
  receiver
• BSC (Base Station Controller)controlling
  several transceivers
• Interfaces
• Um radio interface
• Abis standardized open interface with 16
  kbit/s user channels
• A standardized open interface with 64 kbit/s
  user channels

Um
Abis
BTS
MSC
BSC
BTS
A
BTS
MSC
BSC
BTS
BSS
17
System architecture network and switching
subsystem
networksubsystem
fixed partnernetworks

• Components
• MSC (Mobile Services Switching Center)
• IWF (Interworking Functions)
• ISDN (Integrated Services Digital Network)
• PSTN (Public Switched Telephone Network)
• PSPDN (Packet Switched Public Data Net.)
• CSPDN (Circuit Switched Public Data Net.)
• Databases
• HLR (Home Location Register)
• VLR (Visitor Location Register)
• EIR (Equipment Identity Register)

ISDNPSTN
MSC
EIR
SS7
HLR
VLR
ISDNPSTN
MSC
IWF
PSPDNCSPDN
18
Radio subsystem

• The Radio Subsystem (RSS) comprises the cellular
  mobile network up to the switching centers
• Components
• Base Station Subsystem (BSS)
• Base Transceiver Station (BTS) radio components
  including sender receiver antenna - if directed
  antennas are used one BTS can cover several cells
• Base Station Controller (BSC) switching between
  BTSs controlling BTSs managing of network
  resources mapping of radio channels (Um) onto
  terrestrial channels (A interface)
• BSS BSC sum(BTS) interconnection
• Mobile Stations (MS)

19
GSM cellular network
segmentation of the area into cells
possible radio coverage of the cell
idealized shape of the cell

• use of several carrier frequencies
• not the same frequency in adjoining cells
• cell sizes vary from some 100 m up to 35 km
  depending on user density geography transceiver
  power etc.
• hexagonal shape of cells is idealized (cells
  overlap shapes depend on geography)
• if a mobile user changes cells handover of the
  connection to the neighbor cell

20
Example coverage of GSM networks
(www.gsmworld.com)
Vodafone (GSM-900/1800)
T-Mobile (GSM-900/1800) Berlin
e-plus (GSM-1800)
O2 (GSM-1800)
21
Base Transceiver Station and Base Station
Controller

• Tasks of a BSS are distributed over BSC and BTS
• BTS comprises radio specific functions
• BSC is the switching center for radio channels

22
Mobile station

• Terminal for the use of GSM services
• A mobile station (MS) comprises several
  functional groups
• MT (Mobile Terminal)
• offers common functions used by all services the
  MS offers
• corresponds to the network termination (NT) of an
  ISDN access
• end-point of the radio interface (Um)
• TA (Terminal Adapter)
• terminal adaptation hides radio specific
  characteristics
• TE (Terminal Equipment)
• peripheral device of the MS offers services to a
  user
• does not contain GSM specific functions
• SIM (Subscriber Identity Module)
• personalization of the mobile terminal stores
  user parameters

23
Network and switching subsystem

• NSS is the main component of the public mobile
  network GSM
• switching mobility management interconnection
  to other networks system control
• Components
• Mobile Services Switching Center (MSC)controls
  all connections via a separated network to/from a
  mobile terminal within the domain of the MSC -
  several BSC can belong to a MSC
• Databases (important scalability high capacity
  low delay)
• Home Location Register (HLR)central master
  database containing user data permanent and
  semi-permanent data of all subscribers assigned
  to the HLR (one provider can have several HLRs)
• Visitor Location Register (VLR)local database
  for a subset of user data including data about
  all user currently in the domain of the VLR

24
Mobile Services Switching Center

• The MSC (mobile switching center) plays a central
  role in GSM
• switching functions
• additional functions for mobility support
• management of network resources
• interworking functions via Gateway MSC (GMSC)
• integration of several databases
• Functions of a MSC
• specific functions for paging and call forwarding
• termination of SS7 (signaling system no. 7)
• mobility specific signaling
• location registration and forwarding of location
  information
• provision of new services (fax data calls)
• support of short message service (SMS)
• generation and forwarding of accounting and
  billing information

25
Operation subsystem

• The OSS (Operation Subsystem) enables centralized
  operation management and maintenance of all GSM
  subsystems
• Components
• Authentication Center (AUC)
• generates user specific authentication parameters
  on request of a VLR
• authentication parameters used for authentication
  of mobile terminals and encryption of user data
  on the air interface within the GSM system
• Equipment Identity Register (EIR)
• registers GSM mobile stations and user rights
• stolen or malfunctioning mobile stations can be
  locked and sometimes even localized
• Operation and Maintenance Center (OMC)
• different control capabilities for the radio
  subsystem and the network subsystem

26
GSM - TDMA/FDMA
935-960 MHz 124 channels (200 kHz) downlink
frequency
890-915 MHz 124 channels (200 kHz) uplink
time
GSM TDMA frame
GSM time-slot (normal burst)
guard space
guard space
tail
user data
Training
S
S
user data
tail
3 bits
57 bits
26 bits
57 bits
1
1
3
27
GSM - TDMA/FDMA

• GSM time-slot (normal burst)
• Tail are all set to 0 and can be used to enhance
  the receiver performance.
• The training sequence is used to adapt the
  parameters and select the strongest signal.
• A flag S indicates whether the data field
  contains user or network control data.
• GSM bursts
• A normal burst for data transmission
• A frequency correction burst allows the MS to
  correct the local oscillator to avoid
  interference
• A synchronization burst with an extended training
  sequence synchronizes the MS with BTS in time.
• An access burst is used for the initial
  connection setup.
• A dummy burst is used if no data is available for
  a slot.

28
GSM Logical channels and frame hierarchy

• GSM specifies two basic groups of logical
  channels
• Traffic channels (TCH) GSM uses a TCH to
  transmit user data.
• Control channels (CCH) CCHs are used to control
  medium access allocation of traffic channels or
  mobility management.
• Broadcast control channel (BCCH)A BTS uses this
  channel to signal information such as the cell
  identifier options and frequencies to all MSs
  within a cell.
• Common control channel (CCCH) All information
  regarding connection setup between MS and BS is
  exchanged via the CCCH.
• Dedicated control channel (DCCH) Before a MS
  established a TCH with the BTS it uses DCCH for
  signaling.
• Logical frame hierarchy
• 26 frame multi-frame 26 multi-frames 51
  frames or 51 multi-frames 26 frames 2048
  superframe hyperframe

29
GSM hierarchy of frames
hyperframe
0
1
2
2045
2046
2047
...
3 h 28 min 53.76 s
superframe
0
1
2
48
49
50
...
6.12 s
0
1
24
25
...
multiframe
0
1
24
25
...
120 ms
0
1
2
48
49
50
...
235.4 ms
frame
0
1
6
7
...
4.615 ms
slot
burst
577 µs
30
GSM protocol layers for signaling
Um
Abis
A
MS
BTS
BSC
MSC
CM
CM
MM
MM
RR BTSM
BSSAP
RR
BSSAP
RR
BTSM
SS7
SS7
LAPDm
LAPDm
LAPD
LAPD
radio
radio
PCM
PCM
PCM
PCM
16/64 kbit/s
64 kbit/s / 2.048 Mbit/s
31
Mobile Terminated Call (Wired phone call)

• 1 calling a GSM subscriber
• 2 forwarding call to GMSC
• 3 signal call setup to HLR
• 4 5 request MSRN from VLR
• 6 forward responsible MSC to GMSC
• 7 forward call to
• current MSC
• 8 9 get current status of MS
• 10 11 paging of MS
• 12 13 MS answers
• 14 15 security checks
• 16 17 set up connection

4
HLR
VLR
5
8
9
3
6
14
15
7
calling station
GMSC
MSC
1
2
10
13
10
10
16
BSS
BSS
BSS
11
11
11
11
12
17
MS
32
Mobile Originated Call

• 1 2 connection request
• 3 4 security check
• 5-8 check resources (free circuit)
• 9-10 set up call

VLR
3
4
6
5
GMSC
MSC
7
8
2
9
1
BSS
MS
10
33
MTC/MOC
34
4 types of handover

• GSM handover
• Intra-cell A new frequency needs to be arranged
  by BSC because of interference.
• Inter-cell intra-BSC handover The mobile
  station moves from one cell to another. The BSC
  performs a handover.
• Inter-BSC intra-MSC handover The handover is
  controlled by the MSC.
• Inter MSC handover Both MSCs perform the
  handover together.

35
4 types of handover
1
2
3
4
MS
MS
MS
MS
BTS
BTS
BTS
BTS
BSC
BSC
BSC
MSC
MSC
36
Handover decision
receive level BTSold
receive level BTSold
HO_MARGIN
MS
MS
BTSold
BTSnew
37
Handover procedure
MSC
BTSold
BSCnew
BSCold
MS
BTSnew
measurement report
measurement result
HO decision
HO required
HO request
resource allocation
ch. activation
ch. activation ack
HO request ack
HO command
HO command
HO command
HO access
Link establishment
HO complete
HO complete
clear command
clear command
clear complete
clear complete
38
Security in GSM

• Security services
• access control/authentication
• user SIM (Subscriber Identity Module) secret
  PIN (personal identification number)
• SIM network challenge response method
• confidentiality
• voice and signaling encrypted on the wireless
  link (after successful authentication)
• anonymity
• temporary identity TMSI (Temporary Mobile
  Subscriber Identity)
• newly assigned at each new location update (LUP)
• encrypted transmission
• 3 algorithms specified in GSM
• A3 for authentication (secret open interface)
• A5 for encryption (standardized)
• A8 for key generation (secret open interface)

• secret
• A3 and A8 available via the Internet
• network providers can use stronger mechanisms

39
GSM - authentication
SIM
mobile network
RAND
RAND
Ki
RAND
Ki
128 bit
128 bit
128 bit
128 bit
AC
A3
A3
SIM
SRES 32 bit
SRES 32 bit
SRES
SRES SRES
MSC
SRES
32 bit
Ki individual subscriber authentication
key SRES signed response
40
GSM - key generation and encryption
MS with SIM
mobile network (BTS)
RAND
RAND
Ki
RAND
Ki
AC
SIM
128 bit
128 bit
128 bit
128 bit
A8
A8
cipher key
Kc 64 bit
Kc 64 bit
SRES
encrypteddata
data
data
BSS
MS
A5
A5
41
Data services in GSM I

• Data transmission standardized with only 9.6
  kbit/s
• advanced coding allows 144 kbit/s
• not enough for Internet and multimedia
  applications
• HSCSD (High-Speed Circuit Switched Data)
• mainly software update on MS and MSC to split a
  traffic stream into several streams.
• bundling of several time-slots to get higher
  AIUR (Air Interface User Rate)(e.g. 57.6
  kbit/s using 4 slots 14.4 each)
• advantage ready to use constant quality simple
• disadvantage channels blocked for voice
  transmission

42
Data services in GSM II

• GPRS (General Packet Radio Service)
• packet switching
• using free slots only if data packets ready to
  send (e.g. 50 kbit/s using 4 slots temporarily)
• standardization 1998 introduction 2001
• advantage one step towards UMTS more flexible
• disadvantage more investment needed (new
  hardware)
• GPRS network elements
• GSN (GPRS Support Nodes) GGSN and SGSN
• GGSN (Gateway GSN)
• interworking unit between GPRS and PDN (Packet
  Data Network)
• SGSN (Serving GSN)
• supports the MS (location billing security)
• GR (GPRS Register)
• user addresses

43
GPRS user data rates in kbit/s
44
Examples for GPRS device classes
45
GPRS quality of service
46
GPRS architecture and interfaces
47
GPRS protocol architecture
MS
BSS
SGSN
GGSN
Um
Gb
Gn
Gi
apps.
IP/X.25
IP/X.25
GTP
SNDCP
SNDCP
GTP
LLC
UDP/TCP
LLC
UDP/TCP
RLC
BSSGP
RLC
BSSGP
IP
IP
MAC
MAC
FR
FR
L1/L2
L1/L2
radio
radio
48
DECT

• DECT (Digital European Cordless Telephone)
  standardized by ETSI (ETS 300.175-x) for cordless
  telephones
• standard describes air interface between
  base-station and mobile phone
• DECT has been renamed for international marketing
  reasons into Digital Enhanced Cordless
  Telecommunication
• Characteristics
• frequency 1880-1990 MHz
• channels 120 full duplex
• duplex mechanism TDD (Time Division Duplex) with
  10 ms frame length
• multiplexing scheme FDMA with 10 carrier
  frequencies TDMA with 2x 12 slots
• modulation digital Gaußian Minimum Shift Key
  (GMSK)
• power 10 mW average (max. 250 mW)
• range approx. 50 m in buildings 300 m open space

49
DECT system architecture reference model
D3
D4
VDB
D2
local network
FT
PT
PA
HDB
PT
PA
D1
global network
FT
local network
50
DECT layers I

• Physical layer
• modulation/demodulation
• generation of the physical channel structure with
  a guaranteed throughput
• controlling of radio transmission
• channel assignment on request of the MAC layer
• detection of incoming signals
• sender/receiver synchronization
• collecting status information for the management
  plane
• MAC layer
• maintaining basic services activating/deactivatin
  g physical channels
• multiplexing of logical channels
• e.g. C signaling I user data P paging Q
  broadcast
• segmentation/reassembly
• error control/error correction

51
DECT layers II

• Data link control layer
• creation and keeping up reliable connections
  between the mobile terminal and basestation
• two DLC protocols for the control plane (C-Plane)
• connectionless broadcast servicepaging
  functionality
• LcLAPC protocolin-call signaling (similar to
  LAPD within ISDN) adapted to the underlying MAC
  service
• several services specified for the user plane
  (U-Plane)
• null-service offers unmodified MAC services
• frame relay simple packet transmission
• frame switching time-bounded packet transmission
• error correcting transmission uses FEC for
  delay critical time-bounded services
• bandwidth adaptive transmission
• Escape service for further enhancements of the
  standard

52
DECT layers III

• Network layer
• similar to ISDN (Q.931) and GSM (04.08)
• offers services to request check reserve
  control and release resources at the basestation
  and mobile terminal
• resources
• necessary for a wireless connection
• necessary for the connection of the DECT system
  to the fixed network
• main tasks
• call control setup release negotiation
  control
• call independent services call forwarding
  accounting call redirecting
• mobility management identity management
  authentication management of the location
  register

53
DECT reference model
U-Plane
C-Plane

• close to the OSI reference model
• management plane over all layers
• several services in C(ontrol)- and U(ser)-plane

signaling interworking
application processes
network layer
OSI layer 3
management
data link control
data link control
OSI layer 2
medium access control
physical layer
OSI layer 1
54
DECT time multiplex frame
1 frame 10 ms
12 down slots
12 up slots
slot
420 bit 52 µs guard time (60 bit) in 0.4167
ms
guard
0
419
sync
D field
0
31
0
387
A network control B user data X transmission
quality
A field
B field
X field
0
63
0
319
0
3
protected mode
25.6 kbit/s
simplex bearer
unprotected mode
DATA
32 kbit/s
55
Enhancements of the standard

• Several DECT Application Profiles in addition
  to the DECT specification
• GAP (Generic Access Profile) standardized by ETSI
  in 1997
• assures interoperability between DECT equipment
  of different manufacturers (minimal requirements
  for voice communication)
• enhanced management capabilities through the
  fixed network Cordless Terminal Mobility (CTM)
• DECT/GSM Interworking Profile (GIP) connection
  to GSM
• ISDN Interworking Profiles (IAP IIP) connection
  to ISDN
• Radio Local Loop Access Profile (RAP) public
  telephone service
• CTM Access Profile (CAP) support for user
  mobility

56
TETRA - Terrestrial Trunked Radio

• Trunked radio systems
• many different radio carriers
• assign single carrier for a short period to one
  user/group of users
• taxi service fleet management rescue teams
• interfaces to public networks voice and data
  services
• very reliable fast call setup local operation
• TETRA - ETSI standard
• formerly Trans European Trunked Radio
• offers VoiceData and Packet Data Optimized
  service
• point-to-point and point-to-multipoint
• ad-hoc and infrastructure networks
• several frequencies 380-400 MHz 410-430 MHz
• FDD DQPSK
• group call broadcast sub-second group-call setup

57
TDMA structure of the voicedata system
hyperframe
0
1
2
57
58
59
...
61.2 s
multiframe
0
1
2
15
16
17
...
1.02 s
CF
frame
Control Frame
0
1
2
3
56.67 ms
0 slot 509
14.17 ms
58
UMTS and IMT-2000

• Proposals for IMT-2000 (International Mobile
  Telecommunications)
• UWC-136 (Universal Wireless Consortium (US))
  cdma2000 (based on IS-95) WP-CDMA (Wideband
  packet-CDMA)
• UMTS (Universal Mobile Telecommunications System)
  from ETSI
• UMTS
• UTRA (was UMTS now Universal Terrestrial Radio
  Access)
• enhancements of GSM
• EDGE (Enhanced Data rates for GSM Evolution) GSM
  up to 384 kbit/s
• CAMEL (Customized Application for Mobile Enhanced
  Logic) intelligent network support
• VHE (virtual Home Environment)
• fits into GMM (Global Multimedia Mobility)
  initiative from ETSI
• GMM provides an architecture to integrate mobile
  and fixed terminals different access networks
  and several core transport networks.
• requirements for UMTS and UTRA
• min. 144 kbit/s rural (goal 384 kbit/s)
• min. 384 kbit/s suburban (goal 512 kbit/s)
• up to 2 Mbit/s urban

59
Frequencies for IMT-2000
1850
1900
1950
2000
2050
2100
2150
2200
MHz
ITU allocation (WRC 1992)
IMT-2000
MSS
IMT-2000
MSS
UTRA FDD
UTRA FDD
T D D
T D D
MSS
MSS
DE CT
GSM 1800
Europe
IMT-2000
MSS
IMT-2000
MSS
GSM 1800
China
cdma2000 W-CDMA
MSS
MSS
cdma2000 W-CDMA
PHS
Japan
MSS
MSS
PCS
rsv.
North America
MHz
1850
1900
1950
2000
2050
2100
2150
2200
60
UMTS and IMT-2000

• IMT-2000 family
• IMT-DS The direct spread technology comprises
  wideband CDMA (W-CDMA) systems. It consists of
  UTRA-FDD in Europe and FOMA (Freedom of Mobile
  Multimedia Access in Japan developed by 3GPP (3rd
  Generation Partnership Project).
• IMT-TC The time code technology uses
  time-division CDMA (TD-CDMA). It consists of
  UTRA-TDD in Europe and TD-synchronous CDMA
  (TD-SCDMA) in China developed by 3GPP.
• IMT-MC The multi-carrier technology comprises
  cdma2000 developed by 3GPP2.
• IMT-SC The single carrier technology comprises
  the enhancement of the US TDMA UWC-136. It
  applies EDGE (Enhanced Data Rates for Global
  Evolution) developed by 3GPP/UWCC.
• IMT-FT The frequency time technology comprises
  an enhanced version of DECT developed by ETSI.

61
IMT-2000 family
Interface for Internetworking
IMT-2000 Core Network ITU-T (Telecomm.)
GSM (MAP)
ANSI-41 (IS-634)
IP-Network
Initial UMTS (R99 w/ FDD)
IMT-DS (Direct Spread) UTRA FDD (W-CDMA) 3GPP
IMT-TC (Time Code) UTRA TDD (TD-CDMA) TD-SCDMA 3G
PP
IMT-MC (Multi Carrier) cdma2000 3GPP2
IMT-SC (Single Carrier) UWC-136 (EDGE) UWCC/3GPP
IMT-FT (Freq. Time) DECT ETSI
IMT-2000 Radio Access ITU-R (Radiocomm.)
The main driving forces are 3GPP (European and
Japanese) and 3GPP2 (Qualcomm and CDMA).
62
Licensing Example UMTS in Germany 18. August
2000

• UTRA-FDD
• Uplink 1920-1980 MHz
• Downlink 2110-2170 MHz
• duplex spacing 190 MHz
• 12 channels each 5 MHz
• UTRA-TDD
• 1900-1920 MHz
• 2010-2025 MHz
• 5 MHz channels
• Coverage 25 of the population until 12/2003
  50 until 12/2005

Sum 50.81 billion
63
UMTS releases and standardization

• UMTS releases and standardization
• Release 99 It describes the new radio access
  technologies UTRA-FDD and UTRA-TDD and
  standardizes the use of a GSM/GPRS network as
  core. This enables a cost effective migration
  from GSM to UMTS. It is currently deployed.
• Release 4 It introduces quality of service in
  the fixed network plus several execution
  environment.
• Release 5 It specifies a different core network.
  The GSM/GPRS based network will be replaced by an
  almost all-IP-core.
• Release 6 3GPP is currently working on release 6
  (release 7).

64
UMTS architecture (Release 99 used here!)

• UTRAN (UTRA Network)
• Cell level mobility
• Radio Network Subsystem (RNS)
• Encapsulation of all radio specific tasks
• UE (User Equipment)
• CN (Core Network)
• Inter system handover
• Location management if there is no dedicated
  connection between UE and UTRAN

Iu
Uu
UTRAN
UE
CN
65
UMTS domains and interfaces

• User Equipment Domain
• Assigned to a single user in order to access UMTS
  services
• Infrastructure Domain
• Shared among all users
• Offers UMTS services to all accepted users

Home Network Domain
Zu
Cu
Uu
Iu
Yu
USIM Domain
MobileEquipment Domain
Access Network Domain
Serving Network Domain
Transit Network Domain
Core Network Domain
User Equipment Domain
Infrastructure Domain
66
UMTS domains and interfaces

• Universal Subscriber Identity Module (USIM)
• Functions for encryption and authentication of
  users
• Located on a SIM inserted into a mobile device
• Mobile Equipment Domain
• Functions for radio transmission
• User interface for establishing/maintaining
  end-to-end connections
• Access Network Domain
• Access network dependent functions
• Core Network Domain
• Access network independent functions
• Serving Network Domain
• Network currently responsible for communication
• Home Network Domain
• Location and access network independent functions

67
UMTS radio interface - Spreading and scrambling
of user data

• Constant chipping rate of 3.84 Mchip/s
• Different user data rates supported via different
  spreading factors ( of chips/bit)
• higher data rate less chips per bit and vice
  versa
• User separation via unique quasi orthogonal
  (their cross-correlation should be almost zero)
  scrambling codes
• users are not separated via orthogonal spreading
  codes
• much simpler management of codes each station
  can use the same orthogonal spreading codes
• precise synchronization not necessary as the
  scrambling codes stay quasi-orthogonal

data1
data2
data3
data4
data5
spr. code3
spr. code2
spr. code1
spr. code4
spr. code1
scrambling code1
scrambling code2
sender1
sender2
68
OVSF (Orthogonal Variable Spreading Factor) coding
11111111
...
1111
1111-1-1-1-1
11
11-1-111-1-1
...
11-1-1
XX
11-1-1-1-111
1
X
1-11-11-11-1
X-X
...
1-11-1
1-11-1-11-11
1-1
SFn
SF2n
1-1-111-1-11
...
1-1-11
1-1-11-111-1
SF1
SF2
SF4
SF8
69
UTRA-FDD (W-CDMA)

• UTRA-FDD (W-CDMA)
• The FDD mode for UTRA uses wideband CDMA (W-CDMA)
  with direct sequence spreading.
• Uplink and downlink use different frequencies.
  Uplink (1920 1980 MHz) and downlink (2110
  2170 MHz).
• Time slots are not used for user separation but
  to support periodic functions. Each time slot is
  38400 chips/s x 10 ms x 1/15 2560 chips (2/3
  ms).
• The occupied bandwidth per W-CDMA channel is 4.4
  to 5 MHz.
• In Germany the FDD spectrum was sold over 50
  billion Euros.
• The provide higher data rates the infrastructure
  should be improved Twice as many base stations
  as GSM (500 m cell diameters)

70
Typical UTRA-FDD uplink data rates

• Dedicated physical data channel (DPDCH)
• conveys user or signaling data
• Dedicated physical control channel (DPCCH)
• Conveys control data for the physical layer and
  uses the constant spreading factor 256.
• Dedicated physical channel (DPCH)
• The downlink time multiplexes control and user
  data.
• Physical random access channel (PRACH)
• Used for coordinating medium access on the uplink.

71
UMTS FDD frame structure

• W-CDMA
• 1920-1980 MHz uplink
• 2110-2170 MHz downlink
• chipping rate 3.840 Mchip/s
• soft handover
• QPSK
• complex power control (1500 power control
  cycles/s)
• spreading factors
• Uplink 4-256 Downlink4-512

Radio frame
0
1
2
12
13
14
...
10 ms
Time slot
Pilot
FBI
TPC
TFCI
666.7 µs
uplink DPCCH
2560 chips 10 bits
Data
uplink DPDCH
666.7 µs
2560 chips 102k bits (k 0...6)
Data1
TPC
TFCI
Pilot
Data2
downlink DPCH
666.7 µs
FBI Feedback Information TPC Transmit Power
Control TFCI Transport Format Combination
Indicator DPCCH Dedicated Physical Control
Channel DPDCH Dedicated Physical Data
Channel DPCH Dedicated Physical Channel
DPCCH
DPDCH
DPDCH
DPCCH
2560 chips 102k bits (k 0...7)
Slot structure NOT for user separation but
synchronisation for periodic functions!
72
UE in UTRA-FDD (W-CDMA)

• A UE has to perform the following steps during
  the search for a cell after power on
• Primary synchronization A UE has to synchronize
  with the help of a 256 chip primary
  synchronization code.
• Secondary synchronization This defines the group
  of scrambling codes.
• Identification of the scrambling code the UE
  tries all scrambling codes within the group of
  codes to find the right code with the help of a
  correlator.
• After these three steps the UE can receive all
  further data over a broadcast channel.

73
UTRA-TDD (TD-CDMA)

• UTRA-TDD (TD-CDMA)
• Separates up and downlink in time using a frame
  structure similar to FDD.
• 15 slots with 2560 chips per slot for a radio
  frame with a duration of 10 ms.
• The chipping rate is 3.84 Mchips/s.
• TDD frame can be symmetrical or asymmetrical.
• The switching points is used to indicate the
  switching between up and downlink.
• At least one slot must be allocated for the
  uplink and downlink respectively.
• UTRA TDD occupies 5 MHz bandwidth per channel.
• Germany paid less than 300 million Euros.
• It is unclear to what extend this system will be
  deployed.
• The coverage per cell is less than using
  UTRA-FDD.
• UEs must not move too fast (like WLANs).

74
UMTS TDD frame structure (burst type 2)
Radio frame
0
1
2
12
13
14
...
10 ms
Time slot
Data 1104 chips
Midample 256 chips
Data 1104 chips
GP
666.7 µs
Traffic burst
GP guard period 96 chips
2560 chips
Midample is used for tranning and channel
estimation.

• TD-CDMA
• 2560 chips per slot
• spreading 1-16
• symmetric or asymmetric slot assignment to
  UpLink/DownLink (min. 1 per direction)
• tight synchronisation needed
• simpler power control (100-800 power control
  cycles/s)

75
UTRA architecture

• UTRA architecture
• Radio network subsystems (RNS)
• Radio network controller (RNC) controls several
  node Bs over the interface (Iub) and is connected
  with the core network (CN) over Iu. The interface
  Iur is the interface for connecting two RNCs.
• Each node B can control several antennas which
  make a radio cell.
• The mobile device user equipment (UE) can be
  connected to one or more antennas.
• Core network
• The circuit switched domain (CSD) comprises the
  classical circuit switched services and connects
  to the RNS via the IuCS.
• The packet switched domain (PSD) uses the GPRS
  components SGSN and GGSN and connects to the RNS
  via the IuPS.

76
UTRAN architecture
RNC Radio Network Controller RNS Radio Network
Subsystem
RNS
UE
Iub
Node B
UTRAN comprises several RNSs Node B can support
FDD or TDD or both RNC is responsible for
handover decisions requiring signaling to the
UE Cell offers FDD or TDD
RNC
Iu
Node B
Node B
CN
Iur
Node B
Iub
Node B
RNC
Node B
Node B
RNS
77
UTRAN RNC functions

• Call admission control
• Congestion control
• Radio channel encryption/decryption
• ATM switching and multiplexing protocol
  conversion - Radio network configuration
• Channel quality measurements
• Macro diversity
• Radio resource control
• Radio carrier control bearer setup and release
• Data transmission over the radio interface
• Channel allocation (coding)
• Outer loop power control (FDD and TDD)
• Handover control and RNS relocation (moving)
• Management - System information including current
  load current traffic error states

78
UTRAN Components

• Node B
• The name node B was chosen during standardization
  until a new and better name was found.
• The main task is the inner loop power control to
  mitigate near-far effect.
• Measures connection qualities and signal
  strengths.
• Supports a special case of handover
  (soft-handover).
• User Equipment (UE)
• The UE performs signal quality measurements
  inner loop power control spreading and
  modulation and rate matching. (counterpart of a
  node B).
• The UE has to cooperate during handover and cell
  selection performs encryption and decryption.
  (RNC)
• The UE has to implement mobility management. (CN)

79
Core network

• The Core Network (CN) and thus the Interface Iu
  are separated into two logical domains
• Circuit Switched Domain (CSD)
• Circuit switched service including signaling
• Resource reservation at connection setup
• GSM components (MSC GMSC VLR)
• IuCS
• Packet Switched Domain (PSD)
• GPRS components (SGSN GGSN)
• IuPS
• Release 99 uses the GSM/GPRS network and adds a
  new radio access!
• Helps to save a lot of money
• Much faster deployment
• Not as flexible as newer releases (5 6)

80
Core network architecture with 3G RNS and 2G BSS
VLR
BSS
Abis
BTS
Iu
BSC
MSC
GMSC
PSTN
Node B
BTS

• IuCS

AuC
HLR
EIR
GR
Node B
Iub
Node B
RNC
SGSN
GGSN
Gi
Gn
Node B
Node B

• IuPS

CN
RNS
81
Core network protocols with 3G RNS and 2G BSS
VLR
MSC
GMSC
GSM-CS backbone
RNS
HLR
RNS
SGSN
GGSN
Layer 3 IP
GPRS backbone (IP)
Layer 2 ATM
SS 7
Layer 1 PDH SDH SONET
UTRAN
CN
82
UMTS protocol stacks (user plane)
IuCS
UTRAN
3G MSC
Uu
UE
apps. protocols
RLC
SAR
RLC
SAR
Circuit switched
MAC
MAC
AAL2
AAL2
radio
radio
ATM
ATM
Uu
IuPS
UE
UTRAN
3G SGSN
Gn
3G GGSN
apps. protocols
IP PPP
IP PPP
IP tunnel
Packet switched
GTP
PDCP
GTP
PDCP
GTP
GTP
RLC
UDP/IP
RLC
UDP/IP
UDP/IP
UDP/IP
MAC
MAC
AAL5
AAL5
L2
L2
radio
radio
ATM
ATM
L1
L1
83
UMTS protocol stacks

• Circuit Switched Domain (CSD)
• Radio link control (RLC)
• Segmentation and reassembly (SAR)
• ATM Adaptation Layer 2 (AAL2)
• Asynchronous Transfer Mode (ATM)
• Packet Switched Domain (PSD)
• Packet Data Convergence Protocol (PDCP)
• GPRS Tunneling Protocol (GTP)
• Handover
• Hard handover
• UTRA-TDD can only use this type. Switching
  between TDD cells is done between the slots of
  different frames at a certain point in time.
• Inter frequency handover (changing the carrier
  frequency) is a hard handover.
• All inter system handover are hard handovers in
  UMTS (to and from GSM or IMT-2000 systems).
• During a compressed mode which enables a UE to
  listen into GSM or other frequency bands the
  spreading factor can be lowered or less data is
  sent before and after the break in transmission.
• Soft handover In CDMA they use macro diversity.
  A UE receiving data from different antennas at
  the same time makes a handover soft.

84
Support of mobility macro diversity

• Multicasting of data via several physical
  channels
• Enables soft handover
• FDD mode only
• Downlink
• The RNC splits the data stream and forwards it to
  different nodes B. It allows simultaneous
  transmission of data via different cells. The UE
  combines the received data again.
• Different spreading codes in different cells
• Uplink
• The UE sends its data which is then received by
  several Node Bs.
• Reconstruction of data at Node B SRNC (Serving
  RNC) or DRNC (Drift RNC)

UE
Node B
CN
Node B
RNC
85
Support of mobility handover

• From and to other systems (e.g. UMTS to GSM)
• This is a must as UMTS coverage will be poor in
  the beginning
• RNC controlling the connection is called SRNC
  (Serving RNC)
• RNS offering additional resources (e.g. for soft
  handover) is called Drift RNC (DRNC)
• End-to-end connections between UE and CN only via
  Iu at the SRNS
• Change of SRNC requires change of Iu
• Initiated by the SRNC
• Controlled by the RNC and CN

CN
SRNC
Node B
Iub
Iu
UE
Iur
DRNC
Node B
Iub
86
Example handover types in UMTS/GSM
UE1
RNC1
3G MSC1
Node B1
Iu
UE2
Node B2
Iur
Iub
UE3
RNC2
Node B3
3G MSC2
UE4
BSC
BTS
2G MSC3
Abis
A

• Intra-node B intra-RNC UE1 moves from one
  antenna soft handover
• Inter-node B intra-RNC UE2 moves from node B1
  to node B2 soft handover
• Inter-RNC UE3 moves from node B2 to node B3
  Intra-RNC soft handover Inter-RNC hard
  handover.
• Inter-MSC MSC2 takes over and perform a hard
  handover
• Inter-system UE4moves from a 3G UMTS network
  into a 2G GSM network hard handover.

87
Handover

• Intra-node B intra-RNC
• UE1 moves from one antenna
• Inter-node B intra-RNC
• UE2 moves from node B1 to node B2
• Inter-RNC
• UE3 moves from node B2 to node B3
• Inter-MSC
• MSC2 takes over and perform a handover
• Inter-system
• UE4moves from a 3G UMTS network into a 2G GSM
  network.

88
UMTS services (originally)

• Data transmission service profiles
• Virtual Home Environment (VHE)
• Enables access to personalized data independent
  of location access network and device
• Network operators may offer new services without
  changing the network
• Service providers may offer services based on
  components which allow the automatic adaptation
  to new networks and devices
• Integration of existing IN services