GSM & GPRS Primer By Erick O’Connor February 2005 Topics Background General Packet Radio System (GPRS) • The history of cellular communications • Key statistics – Worldwide subscribers • Protocol layers • Key information • Dimensioning a Network – Top 20 global mobile operators • Mobility Management Global System for Mobile (GSM) Third-Generation Systems (UMTS) • The Radio environment • Basestation & Network subsystems • Evolution paths • Core components • • • • Subscriber data & addressing Circuit-switched network architecture Overview of PDH transmission Common Channel Signalling & GSM MAP ©2001 - 2005 Erick O’Connor The following symbol indicates that the slide contains animations. Press the A space bar to advance the animation 2 History of Cellular Communications 1960s to the Present Day …the early years 1960 – 1970s • Idea of a cell-based mobile radio system developed by AT&T’s Bell Labs in late 1960s • First commercial analogue mobile cellular systems deployed 1978 1980s (1st Generation Analogue Systems) • Usage in N.America grows rapidly – Advanced Mobile Phone System (AMPS) becoming the de facto standard • Europe, run by the PTTs, characterised by multiple incompatible analogue standards – – – – – Nordic Mobile Telecommunications (NMT-450) Total Access Communications (TAC) – United Kingdom C-Netz – West Germany Radiocom 2000 – France RTM / RTMS – Italy etc. etc. • Capacity limitations already becoming apparent by end of decade…. ©2001 - 2005 Erick O’Connor 4 … going digital Late 1980s to early 1990s (2nd Generation Digital Systems) • N.America relies on de facto “let the best technology win” standardisation • By contrast Europe decides to rely on standardisation & co-operation – Huge pent-up demand for mobility can not be met by upgrading existing purely analogue systems. Parallel advances in digital techniques and Very Large Scale Integration (VLSI) chipset manufacture suggest a new way forward – However European domestic markets individually too small to achieve the economies of scale necessary for vendors to take the risk of developing such a risky new solution – Enter the European Commission with a political agenda – demonstrate Europe’s “technology leadership” and ensure European manufacturers can compete globally • New spectrum auctions in USA in early 1990 (PCS 1900) lead to plethora of standards – D-AMPS IS-54 – Motorola sponsored, TDMA IS-136, CDMA IS-95 – Qualcomm sponsored – Plus, limited GSM • Meanwhile in Europe… ©2001 - 2005 Erick O’Connor 5 …GSM is born Late 1980s to early 1990s (2nd Generation Digital Systems) • Guided by European Commission & European Telecommunications Standard Institute • 26 European telecommunication administrations establish the Groupe Spéciale Mobile (GSM) in 1982 with aim to develop a new specification for a fully digital pan-European mobile communications network • The Group notes that the “new industry’s economic future will rely on unprecedented levels of pan-European co-operation” • Political decision to force member countries to: – allocate frequencies at 900 MHz in every EC country (later 1800 MHz) – specify the exact technology to be used and; – deploy systems by 1991 • First commercial GSM networks deployed in 1992 – Denmark / Finland / France / Germany / Italy / Portugal / Sweden / United Kingdom ©2001 - 2005 Erick O’Connor 6 …beginning of the GSM success story By End of 1993 • One million subscribers using GSM • GSM Association has 70 members, 48 countries • First non-European operator, Telstra of Australia And, by technology.… www.gsmworld.com ….Subscribers ©2001 - 2005 Erick O’Connor 7 …the turn of the century & 3rd generation services • Multiple operators per country & worldwide (800+) – intense price based competition – Huge growth in subscribers thanks to pre-paid but falling ARPU & high churn (c.25%) – Market close to saturation – slowing subscriber penetration growth rates (c.85%) • The challenge – what to do in future? • Europe keen to replicate commercial success of GSM but, Americans & Japanese had different views and needs – Japan had run out of spectrum for voice – Americans unhappy at being “dictated to” by a European standard – European vision of always on data & rich value added content services • America & Japan jointly force Europe to open up standardisation process so as not to once again “lock-out” other trading blocs’ vendors – Creation of 3rd Gen Partnership Programme (3GPP) body – Heated standardisation on Wideband CDMA (Qualcomm vs Ericsson) – Final agreement on Universal Mobile Telecommunications Standard (UMTS) in 1998…. ©2001 - 2005 Erick O’Connor 8 The market today – key statistics ©2001 - 2005 Erick O’Connor 9 GSM design Radio & Network subsystems, Signalling & Transmission A Basic GSM network elements PSTN Network Subsystem ISDN PDN ISC BTS BSC GMSC SIWF XCDR User Data & Authentication MSC BTS BSC BTS MS + SIM Radio Subsystem ©2001 - 2005 Erick O’Connor EIR AUC HLR VLR AUC BSC BTS EIR GMSC HLR ISC ISDN MSC PDN PSTN SIWF VLR XCDR Authentication Centre Basestation Controller Basestation Transceiver Equipment Identity Register Gateway Mobile Switching Centre Home Location Register International Switching Centre Integrated Services Digital Network Mobile Switching Centre Packet Data Network (X25) Public Switched Telephony Network Shared Interworking Function Visitor Location Register Transcoder (16 / 64kbps coding) 11 GSM air interface design • Access Techniques – Time Division Multiple Access – Frequency Division Multiple Access – Space Division Multiple Access • Radio characteristics Gaussian Minimum Shift Keying (GMSK) – Slow Frequency Hopping 8 Timeslots per Carrier – 1 Downlink Timeslot reserved for signalling – 3 timeslot difference between uplink & downlink +400 kHz GMSK Spectrum 8 timeslots f3 f2 • Logical structure – f0 -400 kHz Frequency – Multiple cells f1 f0 FDMA & TDMA Time • Frame structure used for synchronisation – 51-frame Multiframe (235.4 ms) – 51 or 26 Multiframe Superframe (6.12 sec) – 2048 Superframe Hyperframe (3 hr 28 mins) 2 3 4 5 6 7 Downlink Uplink 0 1 2 3 4 5 0 1 6 7 Delay ©2001 - 2005 Erick O’Connor 12 Radio subsystem (i) • Basestation Transceiver (BTS) provides radio channels for signalling & user data BTS BSC • A BTS has 1 to 6 RF carriers per sector and 1(omni) to 6 sectors – e.g. 3/3/3 = 3 sector with 3 carriers per sector – 3 x 7 Timeslots x 3 = 63 Timeslots total – c.52 Erlangs @ 2% Grade of Service – c.2,000 users per BTS @ 25 mErl / User (90 seconds) • Frequency reuse depends on terrain, frequencies available etc. BTS BSC BTS MS + SIM 2 Frequency reuse & cluster formation 3 2 1 3 1 f2 f3 f1 K=3 • Paired spectrum shared by Operators – 900 / 1800 MHz in Europe / Asia (25 & 75 MHz) 6 – 1900 MHz in N.America 5 7 1 4 • 200 kHz channel separation f6 • 125 Channels @ 900 MHz f5 ©2001 - 2005 Erick O’Connor XCDR 2 3 f7 f1 f4 6 5 f2 f3 7 1 4 2 3 K=7 13 Radio subsystem (ii) BTS BSC • Basestation Controller (BSC) controls a number of BTS XCDR – Acts as a small switch BTS – Assists in handover between cells and between BTS – Manages the Radio Resource, allocating channels on the air interface BSC BTS MS + SIM • Transcoding (XCDR) function is logically associated with BTS – But, typically located at BSC to save on transmission costs – XCDR provides 13 kbps Coding / Decoding between GSM Codec & standard 64 kbps A-law encoded voice • Interfaces – “Abis” – BTS to BSC interface (never fully standardised so vendor-specific variants exist) – “A” – BSC to MSC interface carrying voice, BSC signalling and Radio – Traffic Channels are mapped one-to-one between BTS and Transcoder – BTS can be connected in “Star” or “Daisy-chain” arrangement to BSC (max. 15) ©2001 - 2005 Erick O’Connor 14 Network subsystem (i) PSTN ISDN PDN ISC • Core component is Mobile Switching Centre (MSC) GMSC SIWF – Performs all switching functions of a fixed-network switch MSC – Allocates and administers radio resources & controls mobility of users – Multiple BSC hosted by one MSC • Gateway MSC (GMSC) provide interworking with other fixed & mobile networks – Crucial role in delivering in-coming call to mobile user in association with Home Location Register (HLR) interrogation • Shared Interworking Function (SIWF) – Bearer Services are defined in GSM including 3.1 kHz Voice, ISDN, 9.6 kbps Data & 14.4 kbps – IWF provides “modem” capabilities to convert between digital bearer & PSTN, ISDN & PDN • International Switching Centre (ISC) – Provides switching of calls internationally. Switch may be provided by another carrier ©2001 - 2005 Erick O’Connor 15 Network subsystem (ii) • Home Location Register (HLR) holds master database of all subscribers – Stores all permanent subscriber data & relevant temporary data including: • MS-ISDN (Mobile Subscriber’s telephone no.) • MSRN (Mobile Station Roaming no.) • Current Mobile Location Area – Actively involved in incoming call set-up & supplementary services • Visitor Location Register (VLR) associated with individual MSCs – VLR stores temporary subscriber information obtained from HLR of mobiles currently registered in serving area of MSC EIR AUC HLR VLR • Authentication Centre (AUC) & Equipment Identity Register (EIR) – GSM is inherently secure using encryption over the air-interface and for authentication / registration – AUC holds each subscriber’s secret key (Ki) & calculates “triplet” for challenge / respond authentication with mobile – SIM is sent data and must calculate appropriate response – EIR is used to store mobile terminals serial numbers – Involved in registration of mobiles – Assists in delivery of supplementary service features such as Call Waiting / Call Hold ©2001 - 2005 Erick O’Connor 16 GSM call setup & Signalling Signalling – Air interface Air Interface Signalling • Downlink signalling (to Mobile Station) – Relies on Bearer Control Channel (BCCH) set at fixed frequency per cell • • Mobile Stations use this to lock-on to network Mobile Stations periodically scan environment and report back other BCCH power levels to BSC to assist in handover – Access Grant Channel (AGCH) – used to assign a Control or Traffic Channel to the mobile – Paging Channel (PCH) – paging to find specific mobiles ©2001 - 2005 Erick O’Connor • Uplink signalling (from MS) more complicated – Random Access Channel (RACH) – competitive multi-access mode using slotted ALOHA to request dedicated signalling channel (SDCCH) • Bidirectional channels include – Traffic Channels (TCH) – Carrying full rate voice @ 13 kbps / half-rate voice – Standalone Dedicated Control Channel (SDCCH) – used for updating location information or parts of connection set-up – Slow Associated Control Channel (SACCH) – used to report radio conditions & measurement reports – Fast Associated Control Channel (FACCH) – uses “stolen” traffic channel capacity to add extra signalling capacity 18 Signalling – Mobile Application Part interfaces Network Signalling Um Air interface signalling Abis Radio management A BSS management, connection control & mobility management B Subscriber data, location information, supplementary service settings C Routing information requests D Exchange of location-dependent subscriber data & subscriber management E Inter-MSC handover signalling F Subscriber & equipment identity check G Inter-MSC handover, transfer of subscriber data ©2001 - 2005 Erick O’Connor GSM Specific Signalling Interfaces (Mobile Application Part) MSC EIR MSC F E BSC C A BTS B Abis D HLR VLR BTS G VLR Um MS + SIM 19 A ITU-T Common Channel Signalling System Number 7 Application Parts GSM interfaces B, C, D, E & G carried as Mobile Application Part Most basic CSS7 signalling MAP Transaction Control Application Part – component responsible for “carrying” higher level Application Parts to their correct destinations INAP TCAP OMAP ISUP TUP SCCP Signalling Connection Control Part Functionally equivalent to TCP layer, carries “Connectionless” messages between Network elements Standard Telephone User Part (TUP) ISDN User Part MTP Layers 1/2/3 Add functionality to permit ISDN signalling (i.e. fully digital) between networks ISO Layers 1 thro 7 Actually carry the specific messages for Mobile (MAP), Intelligent Network (INAP) or Operations & Maintenance (OMAP) Signalling 101 • Line signalling – “tell the other end you want to make call” • Register signalling – “tell the other end the destination of the call” ©2001 - 2005 Erick O’Connor Message Transfer Part Lowest level, permits interconnection with underlying physical transmission medium 20 PDH transmission …composition of 32 channel E1 bearer TS 0 Synchronisation Header TS16 Signalling ITU-T G.703 E1 link 2048 kbps 32 x 64 kbps Timeslots 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 140 Mbps Plesiochronous Digital Hierarchy (PDH) 34 Mbps Voice / Data Timeslot 2 Mbps Abis - Voice GSM Codec 4 x 13 kbps Timeslots STM-16 STM-4 Synchronous Digital Hierarchy (SDH) (SONET - USA) STM-1 ©2001 - 2005 Erick O’Connor 21 Circuit-switched network architecture A (Transmission & Signalling planes) BSS CCS7 CO HLR MSC SDH SSP STP Basestation Subsystem Common Channel Signalling #7 Central Office Home Location Register Mobile Switching Centre Synchronous Digital Hierarchy Service Switching Point Signalling Transfer Point CSS7 Signalling Plane SSP HLR CCS7 Links CO Switch STP MSC SDH Fibre Optic Network Synchronisation Other Networks Drop & Insert Multiplexers BSS ©2001 - 2005 Erick O’Connor Transmission Plane 22 A Call setup Data held in HLR: • Subscriber & Subscription Data – – – – – – – International Mobile Subscriber Identity (IMSI) Mobile Station ISDN (MS-ISDN) Bearer & teleservice subscriptions Service restrictions Parameters for additional services Information on subscriber equipment Authentication data Using When The HLR MSC handset returns directs is MS-ISDN MSRN MSC assigned acknowledges receives the the the the BSC MSRN at MSC registration the toroutes –interrogates the page incoming a subscriber “virtual” incoming theand subscriber call call number the iscall to itby another queries HLR the and and telling serving to the “virtual” find its inform call VLR the MSC. status isto the CallTMSI isthe placed to aGMSC mobile dialling the 18765432 handset established and GMSC obtain number location how the used of to TMSI an between of for route incoming mobile for security the the subscriber. call subscriber. call. two purposes. toparties. the serving Together The handset MSC. with cell mayIDalso mobile number (MS-ISDN). signal theinformation location BSC / MSC stored during in thethe call VLR to the set up MSCsupplementary now has sufficientsuch services information as Call Hold, to be3-way able to calling routeetc. the call. MS-ISDN MSRN – – – – Mobile Station Roaming Number (MSRN) Temporary Mobile Subscriber Identity (TMSI) Current VLR address Current MSC address Local Mobile Subscriber Identity ©2001 - 2005 Erick O’Connor PSTN 4 BTS BSC XCDR GMSC 7 BTS 3 MSRN 5 MSRN BSC HLR 7 TMSI BTS MS + SIM 2 MS-ISDN MSC 7 • Tracking & Routing Information – 1 6 VLR TMSI 8 TMSI Principle of routing call to mobile subscribers 23 GPRS Design A GPRS network elements Other GPRS PLMN SM-SC BTS BSC GGSN PCU BG SGSN PDN GGSN BTS BSC VLR BTS GPRS MS + SIM ©2001 - 2005 Erick O’Connor HLR BG BSC BTS GGSN HLR PCU PDN PLMN SM-SC SGSN VLR Border Gateway Basestation Controller Basestation Transceiver Gateway GPRS Support Node Home Location Register Packet Control Unit Packet Data Network (X25) Public Land Mobile Network Short Message Service Centre Serving GPRS Support Node Visitor Location Register 25 A How GSM & GPRS co-exist X.25 / IP / PDN PSTN Internet De facto interfaces G.703 E1 64kbps DHCP Radius Firewall DNS Gi (IP) SMSC OSS GMSC MAP C MAP E VLR GSM MAP Gr SGSN A (G.703 E1 16kbps) BTS Cells PCU Gb (Frame Relay) Abis (G.703 E1) Voice or Data link Signalling & Name of Interface ©2001 - 2005 Erick O’Connor DNS MAP Ga GPRS XCDR BSC LIAN Gn (IP) HLR MAP D SMSC CG GGSN IWF BSC BTS CCS7 CG DHCP DNS GSN HLR IWF LIAN MAP MSC OSS PCU PSTN VLR XCDR Basestation Controller Basestation Transceiver Common Channel Signalling #7 Charging Gateway Dynamic Host Configuration Protocol Domain Name Server GPRS Serving Node (Serving / Gateway) Home Location Register Interworking Function (Circuit / Packet) Legal Intercept Attendance Node Mobile Application Part (CCS7) Mobile Switching Centre (Serving / Gateway) Operational Support System Packet Control Unit Public Switched Telephony Network Visitor Location Register Transcoder (16 / 64kbps coding) 26 GPRS key information • Four Coding Schemes defined – CS1 9.05 kbit / second per timeslot – CS2 13.40 – CS3 15.60 – CS4 21.40 – Higher speed = Trade off of Forward Error Correction & hence quality • Three Handset Types defined – Class A – simultaneous voice & data – Class B – voice or data only at one time – Class C – data only • GSM offsets uplink timeslots (Ts) from downlink by 3 to save on radio transmit / receive hardware – Therefore today’s handsets are typically: • 1 Ts downlink • 2 to 3 Ts uplink • Class B • CS1 & CS2 capable • Equals 3 x 13.40 = 40.20 kbit/s maximum – Handsets can exceed this limit • But cost more… • Use more power etc, GPRS 0 1 2 3 4 5 6 7 8 Downlink Signalling Uplink GPRS ©2001 - 2005 Erick O’Connor 27 Protocol layers in GPRS Application Protocol (http / ftp) Transmission Control Protocol (TCP) TCP IP Laptop / PDA IP TCP TCP IP IP SNDCP SNDCP GTP GTP LLC LLC UDP / TCP UDP / TCP IP IP RLC RLC BSSGP BSSGP MAC MAC Network Service Network Service L2 L2 GSM RF GSM RF L1 bis L1 Bis L1 L1 GPRS MS ©2001 - 2005 Erick O’Connor BSS SGSN GGSN BSSGP GSM RF GTP LLC MAC RLC SNDCP Basestation System GPRS Protocol Radio Frequency Gateway Tunnelling Protocol Logical Link Control Medium Access Control Radio Link Control Subnetwork Dependent Convergence Protocol 28 Mobility management • Mobility management – – – Attach • Know who is the MS • Know what the user is allowed to do Detach • Leave the system Location updates • Know location of MS • Route mobile terminated (MT) packets to MS • Packet Data Protocol (PDP) Contexts – – – – Every mobile must have an address for each PDP Context in use Addresses are statically or dynamically assigned Context information includes: • PDP Type • PDP address (optional) • Quality of Service (5 classes – Service Precedence / Reliability / Delay / Throughput Maximum & Mean) SGSN has main control of QoS • GPRS Service Descriptions – – – Point-to-Point • Connection-orientated (X25) • Connection-less (IPv4 / IPv6) Point-to-Multipoint (Release 2) • Multicast • Groupcast Short Message Service (SMS) ©2001 - 2005 Erick O’Connor 29 GPRS dimensioning • 900MHz UK Network • Dimensioning – 7 Timeslots per Carrier – 8 million subscribers – 1 to 6 RF carriers / cell – 10% GPRS handset penetration – 1 to 3 cells / BTS – 800,000 users – 5,000 BTS – 10:1 Activity factor – 250 BSC – 10:1 x 800,000 = 80,000 simultaneous users – 50 MSC – 8 SGSN / 2 GGSN – 10 GMSC • Exact dimensioning depends on: • GPRS – Number of users – SGSN c.10,000 simultaneous users – Geography – GGSN c.45,000 simultaneous users – Population density – 10 to 1 contention ratio – Data profile & activity – GPRS growth ©2001 - 2005 Erick O’Connor 30 Evolution towards UMTS – All IP core Internet GSM & GPRS PSTN Packet Data Packet Gateway HLR Circuit Gateway CAMEL All IP Packet Network Call Control Server BTS RNC Server BTS BSC UMTS Node B BTS 3rd Generation UMTS ©2001 - 2005 Erick O’Connor 31 Further Reading • ‘GSM Switching, Services and Protocols’ – Jörg Eberspöcher & Hans-Jörg Vögel, John Wiley & Sons, 2000 • ‘GPRS General Packet Radio Service’ – Regis J. “Bud” Bates, McGraw-Hill Telecom Professional, 2002 • ‘GPRS Networks’ – Geoff Sanders, Lionel Thorens, Manfred Reisky, Oliver Rulik, Stefan Deylitz, John Wiley & Sons, 2003 ©2001 - 2005 Erick O’Connor 32