Southern Methodist University Fall 2003
EETS 8316/NTU CC745-N
Wireless Networks
Lecture 3: Mobility Management, Air Interface
Instructor: Jila Seraj
email: jseraj@engr.smu.edu
http://www.engr.smu.edu/~jseraj/
tel: 214-505-6303
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#1
Review
In the last meeting we discussed
Basic Structure of PSTN
SS7 as an application of OSI model and its
significance in PSTN
Basic structure of a wireless networks
Basic functionalities of wireless networks
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#2
Access Network
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#3
Access Network
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#4
Why SS7
SCP
EETS 8316/NTU TC 745, Fall 2003
STP
SMU
ENGINEERING
SS7
#5
OSI Model for SS7
Layer 4-7
MUP
TCAP
ISUP
MAP
INAP
OMAP
SCCP
Layer 3
Layer 1-2
MTP
Signaling link function, Signaling link physical requirement
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#6
TDMA Network Structure
PSTN
AUC
EIC
GMSC/MSC
/VLR
HLR
BSC
BSC
Base station controller
BSC
Base station
Base station
Air interface
Mobile
station
Base station
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#7
Basic Functions
Registration
— Power Up/Power Down Registration
— Location Area Update Registration
— Periodical Registration
Initiating a call
Receiving a call
— Paging is the process of searching for an MS in
the network. Location Areas are needed to make
paging efficient
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#8
Location Area, MSC border
MSC-1
LA-1
MSC-1
LA-2
MSC-1
LA-3
MSC-2
LA-1
MSC-2
LA-2
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#9
Handoff
Movement into a different cell requires
MTSO to automatically transfer call to
another base station without interruption
Hard handoff: “break before make”,
connection is broken then re-established
Soft handoff: temporarily connected to two
or more base stations simultaneously
before dropping all but one
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#10
Handoff, (cont)
Initiation: Base station detects measured
signal strength drops below threshold (first
generation) or mobile station detects signal
from another base station is stronger than
current base station (second generation)
Resource reservation: frequencies are
reserved with new base station
Execution: actual handoff of connection
Completion: unneeded resources are
cleared
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#11
Handoff Challenge
 Measured signal strength drop is caused by
momentary fading
 Handoff must be completed before signal strength
drops below a minimum acceptable level
 No channels are free at nearby base stations,
causing call connection problems, dropped calls.
 If mobile station moves to another cellular system
(controlled by different MTSO), an intersystem
handoff is required - more complicated
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#12
Handoff, Cont.
There are three type of handoffs
— MS controlled handoff
— Network controlled handoff
— Mobile assisted handoff (MAHO)
D-AMPS and CDMA use MAHO, AMPS uses
network controlled handoff.
Capabilities required for the MS are taken
into account.
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#13
Handoff, Cont.
BS
BS
PSTN
Target MSC #1
Serving MSC
BS
Target MSC #2
HANDMREQ
HANDMREQ
HANDMREQR
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#14
Handoff, Cont.
BS
BS
PSTN
Target MSC #1
Serving MSC
FACDIR
FACDIRR
MSONCH
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#15
Handoff, Cont.
• What happens if we go back to the anchor MSC?
• IS-41 has handoff back facility
• What if a third MSC gets involved?
• Path minimization process
BS
BS
PSTN
New Serving MSC
Anchor MSC
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#16
Path Optimization Process
6
BS
7
BS
BS
Serving MSC
PSTN
Anchor MSC
4
HANDTHIRD
2
Target MSC
1
FACDIR
FACDIRR
5
HANDTHIRDR
MSONCH
9
FACREL
FACRELR
EETS 8316/NTU TC 745, Fall 2003
3
SMU
8
10
ENGINEERING
#17
Path Optimization Process, (cont)
BS
BS
BS
MSC
PSTN
Anchor MSC
New Serving MSC
Call Path after path minimization process
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#18
More On Roaming
Registration
—Power up/down
—periodical
—New system
—Call origination
MS Service Qualification
—validation information (billing)
—Service profile information, features, restrictions…
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#19
More On Roaming, cont..
MS Location Update Process
— Location update at registration
— Location cancellation, AKA de-registration
• MSC triggered
•
– MSINACT with or without De-registration parameter
– Bulkdereg, remove all mobiles associated with the
MSC
HLR triggered
– Location update in another switch
– Administrative actions
– Data failure in HLR
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#20
MS Location Management, Border Case
Multiple access problem
IS-41 revision C has a procedure for HLR to
determine the best serving system based
on the signal quality information received
from each system
MSC uses the signal quality information to
accept or deny registration cancellation.21
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#21
Paging
Paging is used when there is a terminating
call to a mobile station.
Finding a mobile subscriber requires some
work, since its location is not known
The call towards the mobile subscriber is
routed towards gateway MSC.
Gateway MSC consults HLR to find the
mobiles location
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#22
Paging, cont..
HLR looks up in its directory to find the
current MSC of the mobile
The address of the current MSC is sent
back to the gateway MSC.
Based on that information gateway MSC
routes the call to the visiting MSC.
Visiting MSC checks with VLR to find the
Location Area for the mobile. All cells in
that Location Area are pages
simultaneously.
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#23
Paging, cont..
Mobile station hears the page and respond
to it.
Several base stations in the area might hear
the page response. They all report to MSC
that the mobile is in their coverage area
together with signal level data
MSC filters between these reports and
chooses the one that has the strongest
signal.
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#24
Paging, cont..
MSC chooses an idle voice channel in the
chosen Base Station and prepares to set up
a voice channel connection.
MSC send a message to HLR informing that
the mobile is found together with other
useful information such as signal strength,
Location Area, etc.
HLR updates its database and forwards the
visiting MSC address to the gateway MSC.
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#25
Paging, cont..
Gateway MSC has now sufficient
information to connect to the visiting MSC.
Gateway MSC send call set up request to
the visiting MSC, which sets up the call
What happens when more than one MSC
report to GMC that the mobile is its
coverage area?
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#26
Paging, cont..
When HLR receives more than one
response, it chooses the MSC with
strongest signal.
It send the address of the chosen VMSC to
the gateway MSC and informs other MSC
that the call is off.
How does HLR know it has received
response from all MSCs? Internal timer
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#27
Primer on RF
The radio frequencies are grouped into
bands.
Each set of bands are dedicated to different
purposes by FCC
Each frequency is logically divided into
time slots for communication between
mobile station and the base station.
Some time slots are reserved for user
traffic, such as voice and data and other for
signaling purposes.
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#28
Cellular DCCH Structure
DCCH
Reverse
RACH
PCH
ARCH
EETS 8316/NTU TC 745, Fall 2003
Forward
SPACH
BCCH
SMSCH
FBCCH
SMU
ENGINEERING
SCF
EBCCH
Reserved
SBCCH
#29
Cellular DCCH Structure, cont..
RACH = Random Access Channel
SPACH = SMS, Paging and Access
response Channel
PCH = Paging Channel
ARCH =Access Response Channel
SMSCH = SMS Channel
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#30
Cellular DCCH Structure, cont..
BCCH= Broadcast Channel
F-BCCH = Fast Broadcast Control Channel
E-BCCH = Extended Broadcast Control
Channel
S-BCCH = SMS Broadcast Control Channel
SCF = Shared Channel Feedback
Reserved!
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#31
Cellular DCCH Structure, cont..
DCCH Structure: sent on F-BCCH, indicates
the structure of DCCH
Access Parameters: sent on F-BCCH,
provides data necessary to access RACH.
Power level, maximum number of attempts,
authentication information
Control Channel Selection parameters: sent
on F-BCCH, provides channel reselection
parameters
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#32
Cellular DCCH Structure, cont..
Registration Parameters: sent on F-BCCH,
indicates type of registration, power up,
power down, new system, location area,
forced and periodic. Also indicates options
for de-registration, foreign system
registration
System Identity: sent on F-BCCH, identity
and type of system (public, private,
residential), protocol version, mobile
country code. System identity is 15
characters long text.
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#33
BCCH Message Set
Neighbor Cell: sent on E-BCCH. Included is
also reselection criteria for each neighbor
cell. Up to 24 neighbor cells can be defined
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#34
SPACH Message Set
Analog voice channel designation: sent on
ARCH, contains channel number, power
level, SAT, and protocol version
Digital traffic channel designation: sent on
ARCH, contains DTC channel number, etc.
Directed retry, sent on ARCH, forces the
mobile to access another DCCH from its
neighbor list. Used when resources are not
available.
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#35
SPACH Message Set, cont…
Message Waiting: sent on PCH, inform
mobile a message is waiting. The message
can be a voice message, SMS message or
fax message.
R-DATA: sent on SMSCH, conveys point-topoint teleservice layer message.
R-DATA Accept: sent on SMSCH to
acknowledge reception of R-DATA, may
include a delay data.
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#36
SPACH Message Set, cont…
Registration Accept: sent on ARCH, informs
mobile that registration is complete, may
include paging frame class, current location
area, and other system related information.
SPACH Notification: Sent on PCH, informs
mobile that the network intends to deliver a
message to it on the ARCH or SMSCH and
what type of the information mobile should
expect.
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#37
RACH Message Set
Capability Report: Informing the system of
mobile’s capability, protocol version, etc.
Origination: is sent when a mobile wants to
initiate a voice or data call. Includes calling
party number, type of service etc.
Page Response: is sent in response to
page, includes essentially the same
information as in origination message,
except for calling party number.
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#38
RACH Message Set, cont..
R-DATA: is used to send point-to-point
teleservice layer messages
R-DATA Accept: is sent to acknowledge
reception of R-DATA
Registration: request registration with the
network
SPACH Confirmation: is sent to network to
confirm reception of SPACH notification
message.
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#39
DTC Supervision
DTC has two associated control channels
for supervision of the DTC link on layer 3.
FACCH: Fast Associated Control Channel
SACCH: Slow Associated Control Channel
These associated control channels are
used in the connection phase to send and
receive information.
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#40
FACCH Message Set, Forward
Alert with Info: sent on FACCH, causes
audible or visual signal, may include calling
name and number.
Base Station Ack: sent on FACCH.
Acknowledges the mobile that certain
message is received, such as connect,
release. In the case of release message,
DCCH information element might be sent to
mobile.
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#41
FACCH Message Set, Forward , cont..
Dedicated DTC Handoff: sent on FACCH,
order mobile to change from one DTC to
another DTC.
Flash with Info: sent of FACCH, used to
send message waiting information or
calling party number to mobile
Flash with Info Ack: sent on FACCH.
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#42
FACCH Message Set, Forward , cont..
Handoff: sent on FACCH to order mobile
from one DTC to another DTC or AVC
Release: sent on FACCH
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#43
FACCH & SACCH Message Set, Reverse
Capability Update Request: sent of FACCH
Capability Update Response: sent on
FACCH
Connect, sent on FACCH
Flash with info: sent on FACCH, indicates
that the user wishes to initiate a special
service.
Flash with Info Ack: sent of FACCH,
acknowledge receipt of Flash With Info
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#44
FACCH & SACCH Message Set, Reverse
Mobile Ack: Can be sent on either channel
dependent on the type of message it
acknowledges. Is sent as response to Alert
with info, release, handoff, etc.
Release: sent of FACCH, may contain DCCH
information.
Service Request: sent of FACCH, is used
when mobile wished to change a service
during a call.
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#45
Network Interfaces, TDMA
IS-41 is used for interface between MSCVLR, MSC-HLR, HLR-VLR, MSC-MSC, MSCPSTN, HLR-AC, MC-HLR and MC-MSC
IS-41 can be implemented on the top of
MTP, X.25, or IP protocols, though MTP is
the common one.
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#46
IS-41 Protocol Stack
Application
Layer
Presentation
Layer
Session Layer
IS-41 MAP
TCAP
Null
Transport Layer
Null
Network Layer
SCCP
MTP Level 3
MTP Level 2
MTP Level 1
Data Link Layer
Physical Layer
EETS 8316/NTU TC 745, Fall 2003
SMU
Null
ENGINEERING
#47
GSM Network Structure
PSTN
VLR
GSM Public
land mobile
network
(PLMN)
MSC
HLR
OMC
AUC
A
EIR
BSC
BSS
NMC
BSS
ADC
BTS
BTS
OSS
Um
MT
TE
MS
EETS 8316/NTU TC 745, Fall 2003
OSS: operation subsystem
BSS: base station subsystem
MS: mobile station
MS
SMU
ENGINEERING
#48
North American Numbering Plan
North American Numbering Plan consists of
10 digits, NPA-NXX-XXXX
All phone numbers follow the same
structure.
NPA is the area code
NXX is the switch identifier
XXXX indicates the subscriber in the switch
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#49
North American Numbering Plan, cont…
Due to this structure, there is no way for a
switch to identify that a number belongs to
a mobile subscriber, nor can it identify the
network provider.
Mobile network provider “buy” a certain
number series in each area for their users.
Therefore we can not bill a caller to a
mobile user for the air usage. They do it in
other countries!
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#50
GSM Logical Channel Structure
TCH/F
TCH/H
BCH
FCCH SCH
CBCH
CCH
TCH
CCCH
BCCH
DCCH
PCH AGCH RACH
SACCH
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
ACCH
SDCCH
FACCH
#51
GSM Logical Channels
3 groups of logical control channels
—BCH (broadcast channel): point-tomultipoint downlink only
• BCCH (broadcast control channel): send
cell identities, organization info about
common control channels, cell service
available, etc
• FCCH (frequency correction channel):
send a frequency correction data burst
containing all zeros to effect a constant
frequency shift of RF carrier
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#52
GSM Logical Channels, cont…
• SCH (synchronization channel): send
TDMA frame number and base station
identity code to synchronize MSs
—CCCH (common control channel): for
paging and access
• PCH (paging channel): to page MSs
• AGCH (access grant channel): to assign
MSs to stand-alone dedicated control
channels for initial assignment
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#53
GSM Logical Channels, cont…
—RACH (random access channel): for MS to
send requests for dedicated connections
— DCCH (dedicated control channel): bi-directional
point-to-point -- main signaling channels
• SDCCH (stand-alone dedicated control
channel): for service request, subscriber
authentication, equipment validation,
assignment to a traffic channel
• SACCH (slow associated control channel): for
out-of-band signaling associated with a traffic
channel, eg, signal strength measurements
• FACCH (fast associated control channel): for
preemptive signaling on a traffic channel, eg, for
handoff messages
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#54
GSM Logical Channels, cont…
• FACCH (fast associated control channel):
for preemptive signaling on a traffic
channel, eg, for handoff messages
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#55
GSM Numbers
International mobile station equipment
identity (IMEI). IMEI= TAC + FAC + SNR + SP
— TAC = Type Approval Code, 6 decimals
— FAC = Final Assembly Code, 6 decimals,
assigned by manufacturer
— SNR = Serial Number, 6 decimals, assigned by
manufacturer
— SP = Spare, 1 decimal place
EIR has while, black and optionally grey list
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#56
GSM Numbers, cont…
International mobile Subscriber Identity
(IMSI). Stored on the SIM (Subscriber
Identity Module) card. IMSI is obtained at
the time of subscription. IMSI is not made
public.
IMSI = MCC + MNC + MSIN
MCC = Mobile Country Code, 3 decimals
MNC = Mobile Network Code, 2 decimals
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#57
GSM Numbers, cont…
MSIN = Mobile Subscriber Identification
Number, maximum 10 decimal digits
Mobile Station ISDN number (MSISDN), is
the real phone number of the subscriber.
Stored in HLR and on SIM card
MSISDN = CC + NDC + SN
CC = Country Code, up to 3 decimals
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#58
GSM Numbers, cont…
NDC = National Destination Code, typically
2-3 decimals
SN = Subscriber Number, maximum 10
decimals.
Mobile Station Roaming Number (MSRN),
same format as MSISDN. A temporary
location dependent ISDN number.
Is assigned in two cases, at registration or
at call set up.
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#59
GSM Numbers, cont…
Location Area Identity (LAI). Regularly sent
on BCCH LAI = CC + MNC + LAC,
LAC = Location Area Code, max 5 decimals
(<FFFFhex).
Temporary Mobile Subscriber Identity
(TMSI). Stored only in the VLR and SIM
card. Consists of 4*8 bits excluding value
FFFF FFFFhex
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#60
GSM Numbers, cont…
TMSI has only local meaning and can be
defines according to operator’s
specifications.
LAI + TMSI uniquely identifies the user, I.e.
IMSI is no longer needed for ongoing
communication
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#61