BSC Basic Functions

M900/M1800 Base Station Controller Feature Description
Contents
Contents
1 Basic Functions............................................................................1
1.1 Overview.................................................................................................................................................................2 1.2 Channel....................................................................................................................................................................3 1.2.1 Types of Radio Channels...................................................................................................................................3 1.2.2 Radio Channel Management..............................................................................................................................6 1.3 System Information.................................................................................................................................................9 1.4 Idle Mode Behavior...............................................................................................................................................14 1.5 PLMN Selection....................................................................................................................................................16 1.6 Cell Selection and Reselection..............................................................................................................................17 1.7 Location Updating.................................................................................................................................................21 1.7.1 Location Area..................................................................................................................................................21 1.7.2 Location Updating...........................................................................................................................................22 1.7.3 Generic Location Updating..............................................................................................................................22 1.7.4 IMSI Attach and Detach Process.....................................................................................................................24 1.7.5 Periodic Location Updating.............................................................................................................................24 1.7.6 Generic Location Updating (Specification).....................................................................................................26 1.8 Access....................................................................................................................................................................28 1.9 Paging....................................................................................................................................................................29 1.9.1 Packet Service Paging.....................................................................................................................................29 1.9.2 Circuit Service Paging.....................................................................................................................................29 1.10 Immediate Assignment........................................................................................................................................31 1.10.1 Overview.......................................................................................................................................................31 1.10.2 Technology Description.................................................................................................................................31 1.10.3 Parameter.......................................................................................................................................................38 1.11 Assignment...........................................................................................................................................................38 1.12 Authentication......................................................................................................................................................39 1.12.1 Authentication Process..................................................................................................................................40 1.12.2 Abnormality handling during authentication process....................................................................................42 1.13 Ciphering.............................................................................................................................................................42 1.13.1 Overview.......................................................................................................................................................42 1.13.2 Technical Description....................................................................................................................................42 1.13.3 Parameter.......................................................................................................................................................44
Issue 01 (2006-09-20)
Huawei Technologies Proprietary
Contents
1.14 DTX.....................................................................................................................................................................45 1.14.1 Overview.......................................................................................................................................................45 1.14.2 Technologies Description..............................................................................................................................45 1.14.3 Parameter.......................................................................................................................................................47 1.15 Frequency Hopping.............................................................................................................................................47 1.15.1 Overview.......................................................................................................................................................47 1.15.2 Technology Description.................................................................................................................................48 1.15.3 Parameter.......................................................................................................................................................51
ii
Issue 01 (2006-09-20)
Contents
Figures
GSM protocol stack..........................................................................2 GSM/GPRS channel classification......................................................3 Overall idle mode processes...........................................................16 Cell selection.................................................................................19 Cell Reselection.............................................................................20 Interfaces and process of inter-VLR location updating......................23 Immediate assignment...................................................................34 Immediate assignment...................................................................35 Kc calculation................................................................................40 Authentication algorithm................................................................41 Process of ciphering and deciphering..............................................43 Generation of Kc............................................................................44 Principle of DTX.............................................................................46 FH algorithm.................................................................................50
Issue 01 (2006-09-20)
iii
Contents
Tables
Voice coding comparison..................................................................8 CCCH code meaning.......................................................................13 Name of powers............................................................................. 19 Value of Parameter S......................................................................32 Parameter related to Immediate Assignment..................................38 Parameter related to Assignment....................................................39 Parameters related to Ciphering.....................................................45 Parameters related to DTX.............................................................47 "Table" meaning table....................................................................50 Parameters related to Frequency Hopping.......................................51
Issue 01 (2006-09-20)
1 Basic Functions
1
About This Chapter
Title 1.1Overview 1.2Channel 1.3System Information 1.4Idle Mode Behavior 1.5PLMN Selection 1.6Cell Selection and Reselection 1.7Location Updating 1.8Access 1.9Paging 1.10Immediate Assignment 1.11Assignment 1.12Authentication 1.13Ciphering 1.14DTX 1.15Frequency Hopping
Basic Functions
The following table lists the contents of this chapter. Description Introduces the BSS. Describes the BSS channels. Describes the system information of the BSS. Describes the idle mode behaviors. Describes the PLMN selection. Describes the cell selection and reselection. Describes the location updating. Describes the characteristics of access. Describes the characteristics of paging. Describes the immediate assignment. Describes the characteristics of assignment. Describes the characteristics of authentication. Describes the characteristics of ciphering. Describes the DTX characteristics. Describes the characteristics of frequency hopping.
Issue 01 (2006-09-20)
1 Basic Functions
1.1 Overview
Figure 1.1 illustrates the GSM Protocol. Figure 1.1 GSM protocol stack
MS CM MM L3 L2 L1 RR LAPDm Sign. Layer1 RR LAPDm Sign. Layer1 BTSM LAPD Sign. Layer1 RR BTSM LAPD Sign. Layer1 B BSSMAP SCCP MTP BTS BSC MSC CM MM BSSMAP
SCCP MTP
Um
Abis
MS: Mobile Station BTS: Base Transceiver Station BSC: Base Station Controller RR: Radio Resource Management MSC: Mobile services Switching Centre, Mobile Switching Centre MTP: Message Transfer Part (MTP) SCCP: Signaling Connection Control Part LAPD: Link Access Procedure on the D channel MM: Mobility Management LAPDm: Link Access Procedure on the Dm channel CM: Connection Management BSSMAP: Base Station Subsystem Management Application Part BTSM: Base Transceiver Station Site Management
According to GSM 04.07, the functions of BSS on layer 3 and related sub-layers on the radio interface (Um) are classified into:

RR: Radio Resource Management MM: Mobility Management CM: Communication Management
Where the functions on the MM and CM sub-layers are supported by the DTAP between A interface and Um interface. The functions of RR sub-layer that include the maintenance and release of radio resources are mainly carried out by BSS. There are corresponding communication management protocols for A interface and Abis interface to realize the air interface between GSM network and MS. The other functions of BSS are also essential for establishing communication between the GSM network and MS. The functions (RR) that BSS involves are mainly as follows:

Radio channel management Channel coding/decoding Transcoding & Rate Adaptation
Issue 01 (2006-09-20)

1 Basic Functions
Full-rate & half-rate coding of speech and enhanced full-rate coding Encryption/Decryption Frequency hopping Antenna Diversity RF Power control and handover management
1.2 Channel
1.2.1 Types of Radio Channels
According to GSM/GPRS specifications, the radio channels fall into two major categories, which are Traffic Channel and Control Channel. A traffic channel is further divided into Speech Traffic Channel, Circuit Data Traffic Channel and Packet Data Traffic Channel, while the Control Channel is subdivided into Broadcast Channel, Common Control Channel and Dedicated Control Channel. Figure 1.1 GSM/GPRS channel classification
Logical channel
CCH
DCCH BCCH CCCH SDCCH Downlink Uplink ACCH
TCH
SCH FCCH BCCH (BCCH1) (BCCH2) (BCCH3)
PCH
AGCH
RACH
SACCH
FACCH
Downlink Downlink/Uplink
Figure 1.1 illustrates the logical channels. Below is the introduction.
Traffic Channel
Step 2 Speech traffic channels In the latest GSM 05.02, the speech traffic channels are divided into:

TCH/FS, full rate traffic channel for speech. TCH/HS, half rate traffic channel for speech.
Issue 01 (2006-09-20)
1 Basic Functions

TCH/EFS, enhanced full rate traffic channel for speech. TCH/AFS, adaptive full rate traffic channel for speech. TCH/AHS, adaptive half rate traffic channel for speech.
Huawei BSS currently supports three types of traffic channels for speech: TCH/FS, TCH/HS and TCH/EFS. Step 3 Circuit data traffic channel In the most updated GSM 05. 02, the circuit data traffic channels are divided into:

TCH/F9.6, full rate traffic channel for 9.6 kbit/s user data. TCH/F4.8, full rate traffic channel for 4.8 kbit/s user data. TCH/H4.8, half rate traffic channel for 4.8 kbit/s user data. TCH/H2.4, half rate traffic channel for 2.4 kbit/s user data. TCH/F2.4, full rate traffic channel for 2.4 kbit/s user data. TCH/F14.4, full rate traffic channel for 14. 4 kbit/s user data. E-TCH/F28.8, enhanced circuit switched full rate traffic channel for 28.8 kbit/s user data. E-TCH/F32.0, enhanced circuit switched full rate traffic channel for 32.0 kbit/s user data. E-TCH/F43.2, enhanced circuit switched full rate traffic channel for 43.2 kbit/s user data.
Huawei BSS currently supportsTCH/F9.6, TCH/F4.8 and TCH/F2.4. Step 4 Packet Data Traffic Channel There are two rates for the PDTCH: Full-rate PDTCH with GMSK modulation, it can carry packet data whose momentary rates are 022.8 kbit/s, while PDTCH with an 8PSK modulation system can carry packet data whose momentary rates are 059.6 kbit/s. PDTCH is a one-way channel and categorized by the direction as:

PDTCH/D: downlink PDTCH, for MS terminated packet transmission. PDTCH/U: uplink PDTCH, for MS originated packet transmission.
----End
Broadcast Channel (BCH)

BCH is used to transmit broadcast messages to the MS in down link direction. It includes the following logical channels:
FCCH (Frequency Correction Channel) This channel is responsible for transferring the frequency correction signals to the MS so that the MS can be adjusted to the corresponding frequency.
SCH (Synchronization Channel) This channel is responsible for transmission of the frame synchronization number (TDMA frame number) and the Base Station Identity Code (BSIC) to the MS.
BCCH (Broadcast Control Channel)
Issue 01 (2006-09-20)
1 Basic Functions
This channel transmits the information common to all cells, such as Location Area Identity (LAI), cell maximum allowable output power, BCCH carrier frequency of the adjacent cells, and packet service system parameters.
PBCCH (Packet Broadcast Control Channel) This channel transfers the messages related to packet services. Cell Broadcast Channel (CBCH) This channel is used for the cell broadcast short message services. It uses the same physical channels as SDCCH. The channels introduced above are downlink channels.
Common Control Channel (CCCH)

CCCH are classified into the following four channels: Step 5 Paging Channel (PCH): Downlink channel. MS tunes to and receives the information from this channel to check for any call from MSC at regular intervals. Step 6 Random Access Channel (RACH): Uplink channel, through which an MS accesses the network and requests for allocating SDCCH. Step 7 Access Grant Channel (AGCH): Through which the network notifies the MS about the allocation of the dedicated channel. Step 8 NCH (Notification Channel): Downlink channel used for Voice Group Call Service (VGCS) and Voice Broadcast Service (VBS). ----End
Packet Common Control Channel (PCCCH)

PCCH includes the following four channels:
PPCH (Packet Paging Channel) Downlink packet paging channel. MS tunes to the PPCH channel at a regular interval to check if there is any call from SGSN.
PRACH (Packet Random Access Channel) Uplink packet random access channel. MS requests to access the network through the PRACH channel.
PAGCH (Packet Access Grant Channel) Downlink channel. The network notifies the MS of the allocation of the packet data traffic channels through the PAGCH channel.
PNCH (Packet Notification Channel) Downlink channel, designed for point-to-multipoint multicast call. Huawei BSS supports PPCH, PRACH and PAGCH.
Dedicated Control Channel (DCCH)

DCCH consists of the following channels: Step 9 SACCH (Slow Associated Control Channel) Associated with the SDCCH or TCH. This channel is designed for MS to send received signal
Issue 01 (2006-09-20)
1 Basic Functions
quality and signal intensity of adjacent BTSs to the network, and meanwhile receives the system information including transmission power, power adjustment and timing advance. SACCH can be further divided into:

SACCH/TF: SACCH associated with TCH/F. SACCH/TH: SACCH associated with TCH/H. SACCH/C8: SACCH associated with SDCCH/8. SACCH/C4: SACCH associated with SDCCH/4. SACCH/M: SACCH associated with TCH/F for multi-TS configuration.
Step 10 FACCH (Fast Associated Control Channel) FACCH implements transmission by occupying a part on TCH, mostly for transmitting handover command. FACCH can be further divided into:

FACCH/F: FACCH associated with TCH/F; FACCH/H: FACCH associated with TCH/H.
Step 11 SDCCH (Standalone Dedicated Control Channel) It serves to transmit the signaling such as short message information, location updating information, etc. between the MS and the network, prior to the call setup.

SDCCH/8SDCCH/8 SDCCH/4SDCCH/4
----End
Packet Dedicated Control Channel

Step 12 PACCH (Packet Associated Control Channel) Downlink channel serving to transmit the signaling, including response messages and power control messages, to the MS. PACCH can also transmit the resources allocation and reallocation messages. PACCH shares the resource with the PDTCH currently allocated to MS. When MS is in transmission mode, SGSN can page the MS through PACCH to initiate CS service. Step 13 PTCCH/U (Packet Timing Advance Control Channel Uplink) PTCCH/U sends the timing advance by way of random access burst when the MS operates in a transmission mode. Step 14 PTCCH/D (Packet Timing Advance Control Channel Downlink) PTCCH/D is designed to send transmission timing advance to several MSs. One PTCCH/D corresponds to several PTCCH/Us. ----End
1.2.2 Radio Channel Management

Radio channel management involves the management of diverse radio channels in the GSM/GPRS. This process occurs in the phase of connection setup, maintenance, modification
Issue 01 (2006-09-20)
1 Basic Functions
and release.
Radio Channel Combination

As per the logical channel types as listed above, a user can configure the following channel combinations in the M900/M1800 BSS.

TCH/F+FACCH/F+SACCH/TF SDCCH/8+SACCH/C8 FCCH+SCCH+BCCH+CCCH FCCH+SCCH+BCCH+CCCH+SDCCH/4+SACCH/C4 BCCH+CCCH BCCH+CBCH SDCCH+CBCH PBCCH+PCCCH+PDTCH+PACCH+PTCCH PCCCH+PDTCH+PACCH+PTCCH PDTCH+PACCH+PTCCH
Traffic Channel Management

BSS is in charge of all the configured traffic channels. When a call is established, MSC sends the channel type, channel code and other parameters regarding the call to BSS, which chooses a traffic channel based on the messages. BSS also assumes the task for the measurement and release of these traffic channels.
Dedicated Control Channel Management

BSS manages all the available dedicated control channels. After MS has sends a random access request through RACH or PRACH, BSS will allocate a DCCH for the MS. Besides, BSS is also responsible for monitoring and releasing the link of DCCH.
Broadcast Channel And Common Control Channel Management

The management of the available broadcast channels and common control channels by the BSS involves DRX management, paging message dispatching, AGCH and PAGCH control, RACH and PRACH control, and BCCH message broadcast.
Terrestrial Channel Management

The management of terrestrial channels between BSS and MSC is to keep the terrestrial circuit states at BSS and MSC consistent so that an idle circuit can be available when MSC makes a call (assign circuit) and when MS performs handover (assign terrestrial circuit). This is to ensure the success for the call and the handover. Procedures included in the A-interface circuit resource management are Circuit Block/Unblock, Circuit Group Block/Unblock, Unequipped Circuit, and Reset Circuit. General principles of the circuit control includes:
Circuit management message is normally initiated by BSC. While resetting circuit can be initiated either by MSC or BSC, MSC can only block or unblock its circuits without affecting the circuits at the BSS side.
Issue 01 (2006-09-20)
1 Basic Functions
The BSS can not change the circuit state that has been changed at the local end of the MSC. For circuits blocked on the maintenance console at MSC side, the BSS has no authority to unblock or reset the circuit.
Channel Coding & Decoding

The messages are encoded/decoded before being transmitted on the radio channel to avoid radio channel interference. There are various coding and interleaving methods for different logical channels (speech, data and signaling). For a detailed description of the coding methods for various channels, please refer to the specifications GSM 05. 03.
Transcoding & Rate Adaptation

Transcoding (TC) and Rate Adaptation provides an interface between the standard 64 kbit/s transmission at NSS side and the lower rate transmission at BSS side. The conventional voice-coding mode is PCM with a rate of 64 kbit/s. It is widely applied to PSTN. Pulse Code Modulation (PCM) is used for normal speech in PLMN, at a rate of 64 kbit/s whereas in GSM, RPE-LTP or CELP coding with much lower rate (16 kbit/s) is used due to the limitation of radio channel resources. To further improve the voice quality, EFR (Enhanced Full Rate) is introduced. To implement EFR, newly designed algorithms are used but it does not affect the coding rate on the Um interface. When adopting EFR, the compression algorithm for the MS and Transcoder & Rate Adaptor Unit (TRAU) must be modified. Generally, 3.6 kbit/s and 6 kbit/s data rates on the Um interface are arranged for the 8 kbit/s or 16 kbit/s channel (for transmission either on the full-rate channel or the half-rate channel), while the 12 kbit/s rate is for the 16 kbit/s channel. If a PSTN subscriber wants to call an MS, rate adaptation must be performed for the voice. The TRAU is introduced to complete this function. When the BTS and the TRAU are physically detached, these conversions will be especially important. A detailed description of the conversions on the interfaces is given in the related GSM specifications. Since the rate of each channel of existing terrestrial lines is 64 kbit/s, it is a waste if one channel is used to carry one 16 kbit/s GSM channel. To save terrestrial line resources, submultiplexer (SMUX) is used between MSC and BSC to multiplex 4 16 kbit/s channels to transmit four speech channels over one terrestrial channel. In general, TRAU and SMUX are integrated in one unit called TCSM, i. e.; it handles both rate conversion and multiplexing. Figure 1.1 introduces the full-rate coding/decoding process and enhanced full-rate coding/decoding process. Figure 1.1 Voice coding comparison FR (Full Rate) Algorithm RPE-LTP algorithm (regular impulse excitation-long term prediction) EFR (Enhanced Full Rate) ACELP algorithm (arithmetic code book excitation linear prediction)
Issue 01 (2006-09-20)
1 Basic Functions
FR (Full Rate) Coding Process TRAU converts the voice signal received from MSC into frames in the format of 20 ms/fr. A frame of voice data contains 160 PCM sampling points, making up 1280 bit. The output parameters after encoding are 260 bit, making up the 320 bit TRAU frame together with the synchronous header and control parameter. Decoding is a reverse process of coding. After TRAU receives the TRAU frames sent from the BSC, it restores them into speech data by applying decoding algorithm before sending them to MSC.
EFR (Enhanced Full Rate) TRAU converts the voice signal received from MSC into frames in the format of 20 ms/fr. A frame of voice data contains 160 PCM sampling points, making up 1280 bit. The output parameters after encoding are 244 bit, making up the 320 bit TRAU frame together with the synchronous header and control parameter.
Decoding Process
Decoding is a reverse process of coding. After TRAU receives the TRAU frames sent from the BSC, it restores them into speech data by applying decoding algorithm before sending them to MSC.
1.3 System Information

Overview
System information contains the major wireless network parameter on the air interface, including network identifier parameter, cell selection parameter, system control parameter and network function parameter. By receiving system information, MS can be properly accessed and perform network selection so that it can make full use of the services and cooperate with network. There are two modes for the transmission of system information: broadcast message and channel associated message. In idle mode, MS communicates with the network through the broadcasting of system information. The network sends system information to MS so that MS knows its current position and the service type available. Some parameters can also control the cell reselection of MS. When MS is establishing calls, the communication between network equipment is realized with the channel associated system information. Network equipment sends some contents in the channel-associated message to MS so as to control the behaviors such as transmission, power control and handover of MS. The broadcast system information is closely related to the channel-associated message. The content in the broadcast system information can overlap with that in the channel associated message. While the content in the channel associated message can be inconsistent with that in the broadcast system information, because the channel associated message has the effect on only one MS, while the broadcast system information affects all MSs in idle mode.
Issue 01 (2006-09-20)
1 Basic Functions
Types and Content Of System Information

There are totally 13 types: 1, 2, 2bis, 2ter, 3, 4, 5, 5bis, 5ter, 6, 7, 8 and 9. Among them, 1, 2, 2bis, 2ter, 3, 4, 7, 8 and 9 are broadcast information transmitted through BCCH under idle mode; 5, 5bis, 5ter and 6 are channel associated information transmitted through SACCH in active mode. Type 1: Cell channel description + RACH control information (optional) Cell channel description: all frequencies used by this cell, including BCCH frequencies and FH frequency to provide the frequency reference for MS Frequency Hopping (FH). RACH control information: parameters such as maximum times of retransmission (MAX RETRANS), number of transmission timeslots (TX Integer), Cell Bar Access, bit allowed for call reestablishment (RE), bit allowed for emergency call (EC) and access restricted user level (AC). These parameters are used to control the behavior of MS in the initial access. Type 2: Adjacent cell BCCH frequency description + Network color code allowed + RACH control information (mandatory) Adjacent cell BCCH cell. frequency description: the BCCH frequency used by the adjacent
Network color code allowed: NCC allowed for the MS test on the BCCH carrier in the cell. Type 2bis: Adjacent extended cell BCCH frequencies description + RACH control information (optional) Extended adjacent cell BCCH frequency description: the number of frequencies described in the frequency allocation table in system information type 2 is limited, therefore system information type 2bis contains the information of other frequencies in BA1 which are in the same frequency segment as system information type 2. RACH control information: contains the maximum times of parameter retransmission (MAX RETRANS), number of retransmission timeslot (TX Integer), Cell Bar Access, bit allowed for call reestablishment (RE), Restricted user level, bit allowed for emergency call (EC) to control the MS behavior during initial access. Type 2ter: Attached multi-frequency information + extended cell BCCH frequency description 2 (optional) Attached multi-frequency information: Number of the multi-frame measurement needed. Extended adjacent cell BCCH frequency description 2: describes the extended frequency allocation table of the adjacent cell (part of BA1 table). The frequency contained in this information is located at the different frequency segment as the current cell. Therefore, only the multiband MS can read this information. The single-band GSM 900 of GSM 1800 MS will skip this information. Type 3: Cell ID + LAI + control channel description + cell option + cell selection parameter + RACH control information (mandatory) Cell ID: identifier of the current cell. LAI: location area identifier of the current cell. Control channel description: contains the MS attach/detach allowed indication (ATT, AttachDetach Allowed), number of blocks reserved for AGCH (BS AG BLKS RES), common control channel configuration (CCCH CONF), number of 51 TDMA multi-frames reserved for the same paging group in the paging information (BA PA MFRMS) and the interval of periodic location update.
10
Issue 01 (2006-09-20)
1 Basic Functions
Cell option: includes the power control indication (PWRC), discontinuous transmission (DTX) and radio link timeout value (Radio Link Timeout). Cell selection parameter: includes the cell reselection hysteresis value, maximum Tx power level allowed for MS access to the cell (MS TXPWR MAX CCH) and minimum access level allowed for MS to access system (RXLEV Access MIN). RACH control information: contains the maximum times of parameter retransmission (MAX RETRANS), number of retransmission timeslot (TX Integer), Cell Bar Access, bit allowed for call reestablishment (RE), Restricted user level, bit allowed for emergency call (EC) to control the MS behavior during initial access. System information type 3 rest bytes: cell reselection parameter information and type 3 MS control information. Type 4: LAI + cell selection parameter + RACH control information + CBCH description + CBCH dynamic allocation information (mandatory) LAI: the location area identifier of the current cell. Cell selection parameter: includes the cell reselection hysteresis value, maximum Tx power level allowed for MS access to the cell (MS TXPWR MAX CCH) and minimum access level allowed for MS to access system (RxLEV Access MIN). RACH control information: contains the maximum times of parameter retransmission (MAX RETRANS), number of retransmission timeslot (TX Integer), Cell Bar Access, bit allowed for call reestablishment (RE), Restricted user level, bit allowed for emergency call (EC) to control the MS behavior during initial access. CBCH description: includes the channel type and TDMA offset (which type of dedicated channel combination), timeslot No. (TN), training sequence code (TSC), FH channel indication (H), mobile allocation index offset (MAIO), FH serial No. (HSN) and absolute RF channel No. (ARFCN). CBCH mobile allocation information: the relation between the sequence of frequencies used for FH and cell channel description. System information types 4 rest bytes: cell reselection parameter. Type 5: Adjacent cell BCCH frequency description (mandatory) Adjacent cell BCCH frequency description: the BCCH frequency used by the adjacent cell. Comparing with system information type 2, the difference is that MS can get the frequencies described in system information type 5 in active mode, and report the related information of the adjacent cell in the measurement report as the reference of handover. Similarly, the GSM900 MS in Phase 1 recognizes only the adjacent cell frequencies described in system information type 5 and ignore those contained in 5bis and 5ter. Type 5bis: Extended adjacent cell BCCH frequency description (optional) Extended adjacent cell BCCH frequency description: the number of frequencies described in the frequency allocation table in system information type 5 is limited, therefore system information 5bis contains the information of other frequencies in BA2 which are in the same frequency segment as system information 5. Type 5ter: Attached multi-frequency information + extended cell BCCH frequency description 2 (optional) Attached multi-frequency information: Number of the multi-frame measurement needed. Extended adjacent cell BCCH frequency description 2: describes the extended frequency
Issue 01 (2006-09-20)
11
1 Basic Functions
allocation table of the adjacent cell (part of BA2 table). The frequency contained in this information is located at the different frequency segment as the current cell. Therefore, only the multiband MS can read this information. The single-band GSM 900 of GSM 1800 MS will skip this information. Type 6: Cell ID + LAI + cell option (mandatory) Cell ID: identifier of the current cell. LAI: the location area identifier of the current cell. Cell option: includes the power control indication (PWRC), discontinuous transmission (DTX) and radio link timeout value (Radio Link Timeout). Type 7: Cell reselection parameter Cell reselection parameter: includes cell reselection indication (PI), Cell Bar Qualify (CBQ), Cell Reselect Offset (CRO), Temporary Offset (TO) and Penalty Time (PT). Type 8: Cell reselection parameter Cell reselection parameter: includes cell reselection indication (PI), Cell Bar Qualify (CBQ), Cell Reselect Offset (CRO), Temporary Offset (TO) and Penalty Time (PT). Type 9: RACH control information + broadcast channel parameter RACH control information: contains the maximum times of parameter retransmission (MAX RETRANS), number of retransmission timeslot (Tx Integer), Cell Bar Access, bit allowed for call reestablishment (RE), Restricted user level, bit allowed for emergency call (EC) to control the MS behavior during initial access.
Meaning and Function Of Wireless Network Parameter

Step 1 Network identification parameters Network identification parameters include CGI and BSIC. CGI consists of LAI and CI. LAI is composed of MCC, MNC and LAC. System information type 3, 4 and 6 include all or part of CGI information. MS decodes the system information to get the CGI. MS decides whether to connect to the network in this cell according to the MCC and MNC indicated by CGI. It is also used to check whether the current location area has changed so as to initialize the location updating process. MCC, consisting of three decimal digits, is allocated worldwide in unified way. MNC, consisting of two decimal digits, is allocated by the country in unified way. LAC and CI, both consisting of 2 bytes, are arranged by GSM carrier in unified way. Note that the value range of CI is 0X00010XFFFE, while 0X0000 and 0XFFFF are reserved. BSIC identifies the local color code of each BTS in the GSM system. In GSM system, frequencies are multiplexed to different extents according to the different requirements in network plan. MS differentiates two cells' same frequency with their BSICs. Therefore, it is necessary to guarantee the uniqueness of BSICs of the cells using the same BCCH carrier frequency. BSIC is transmitted on the SCH of each cell. It consists of NCC (3 bits) and BCC (3 bits). Note that the TSC described in system information type 4 is the BCC of the current cell. Step 2 System control parameter System control parameter is transmitted to MS with system information through air interface by BTS. It serves to keep contact between MS and BTS. Besides, these parameters have the
12
Issue 01 (2006-09-20)
1 Basic Functions
direct effect on the service bearing and signaling flow of various part of system. Therefore, reasonable setting of these parameters is important in maintaining of the normal operation of GSM system. IMSI attach and detach allowed (ATT) is used to notify MS whether the local cell allows IMSI attach/detach process. It is transmitted in control channel description in the system information type 3. ATT has 1 bit. "0" stands for IMSI attach/detach process not allowed, and "1" stands for the process allowed. CCCH CONF decides the integration mode of the CCCH in the cell. It is transmitted in the control channel description in the system information type 3. CCCH CONF is a 3 bit code. For details, see Figure 1.1. Figure 1.1 CCCH code meaning CCCH CONF 000 001 010 100 110 Others Meaning Number of CCCH information blocks in BCCH multiframe 9 3 18 27 36
CCCH uses a basic physical channel which is not shared with SDCCH. CCCH uses a basic physical channel which is shared with SDCCH. CCCH uses two basic physical channels which are not shared with SDCCH. CCCH uses three basic physical channels which are not shared with SDCCH. CCCH uses four basic physical channels which are not shared with SDCCH. Reserved
The CCCH CONF setting of a cell should be in line with the actual setting of the cell's CCCH. It is decided by the traffic module of the cell.
BS AG BLKS RES is transmitted in the control channel of system information type 3. It is used together with CCCH CONF to decide the number of information blocks in each BCCH of the current cell. After setting CCCH CONF, BS AG BLKS RES will be used to arrange the occupancy ratio between AGCH and PCH on CCCH. It is possible to adjust this parameter to achieve the bearing balance between AGCH and PCH. BS PA MFRAMS is transmitted in the control channel description in system information type 3. It decides how many multiframes making up a cycle of a page sub-channel. This parameter actually decides how many sub-channels the PCH of a cell will be deviled into. BS PA MFRAMS is a 3 bit code. The value range is 07, respectively meaning that the number of multi-frame of a paging group cycled on the PCH is 29. Periodic location updating timer (T3212) decides the frequency of periodic location updating. It is transmitted in the control channel description in system information type 3. It is an 8-bit code. The value range is 0255, each unit of which is the duration of six minutes, and 0 means no location updating.
Issue 01 (2006-09-20)
13
1 Basic Functions
Cell Channel Description, transmitted in system information type 1, describes the RF channel No. of the local cell. It is used in frequency hopping. Note that the maximum number of channels configured in cell channel description is 64. Neighbor Cells Discretion, transmitted in system information type 2, 2bis, 2ter, 5, 5bis and 5ter, describes the absolute channel No. of the BCCH TRX of the cell adjacent to the current cell. Huawei BSS supports at most 32 adjacent cells. Extension Indication, transmitted in system information type 2 and 5, indicates whether there are still extended adjacent cells to be transmitted in system information type 2bis and 5bis. It is a 1-bit code. "0" means that system information type 2 and 5 contains the complete BA table, and "1" means that type 2 and 5 contains part of BA table. BA Indication transmitted in system information type 2 and 5. It is a 1-bit code, used for MS to select the data in BA 2 before or after modification. In another word, if the adjacent cell relation of the current cell and the BA2 table is changed during a session, the BA Indication in system information type 5 will be 1 instead of stead of 0. This indicate that MS perform decoding in the adjacent cell indicated in the system information type 5 again. Multiband Reporting (MBR), transmitted in system information type 2ter and 5ter. It is a 2bit code, indicating MS to report adjacent cell information on multiple frequency bands. It is applicable to multiband MS only.
1.4 Idle Mode Behavior

Overview
A powered on mobile station (MS) that does not have a dedicated channel allocated is defined as being in idle mode. The purpose of the tasks performed in the idle mode is to be able to access the system and be reached by the system from any location in the network. When a mobile is powered on, it immediately attempts to make contact with a GSM Public Land Mobile Network (PLMN). The particular PLMN contacted may be selected either automatically or manually. The MS will look for and select a suitable cell of the chosen PLMN. It will then tune to the control channel of the cell to receive information about the available services provided by the PLMN. This selecting is known as camping on a cell. When an MS is in idle mode it will always try to camp on the best cell according to a signal level based criterion. The idle mode behavior is managed by the MS. It can be controlled by parameters which the MS receives from the base station on the Broadcast Control Channel (BCCH). All the main controlling parameters for idle mode behavior are transmitted on the BCCH carrier in each cell. When the MS is powered on but neither making nor receiving any calls (idle mode) there has to be a mechanism that always selects the best cell on which to camp. Moreover, to be able to access the system from anywhere in the network, regardless of where the MS was powered off, it has to be able to select a specific GSM base station, tune to its frequency and listen to the system message informations transmitted in that cell. It must also be able to register its current location to the network so that the network knows where to route incoming calls. The PLMN selection mechanism, the cell selection and reselection algorithms in addition to the location updating procedure are the core of the idle mode behavior. The purpose is to always ensure that the mobile is camped on the cell where it has the highest probability of successful communication.
14
Issue 01 (2006-09-20)
1 Basic Functions
Usage
Step 1 High signal level when accessing the system The MS will at all times try to obtain the highest possible signal level when accessing the system. This is achieved by means of the idle mode cell selection and reselection algorithms. These algorithms will enable the MS to choose the most suitable cell to camp on, based on signal level. A cell is suitable if certain criteria are satisfied. Camping on the most suitable cell provides the MS with a high probability of good communication with the system. The cell selection and reselection algorithms are governed by parameter settings. Using these parameters an operator can, on a per cell basis, make a specific cell more or less attractive to camp on for the MS. This makes it possible for the operator to achieve similar behavior for MSs in idle mode as in active mode. Well-designed parameter settings for cell selection and reselection in idle mode, will make the MS to camp on the cell that would have been chosen if the MS had been in active mode. Step 2 Control of the paging load In idle mode the MS will notify the network whenever it changes location area by the location updating procedure. Thus, the network will be kept updated concerning which location area the MS is presently in. When the system receives an incoming call it knows in which location area it should page the MS, and does not need to page it throughout the whole MSC service area. This reduces the load on the system. If the MS does not respond to the first paging information, then the network can send a second paging information. The MS can also, periodically and when powered on or off, notify the network of its present status by the location updating procedure. This prevents the network from doing unnecessary paging of MSs that have been powered off or left the coverage area. This would otherwise cause unnecessary load on the system. Step 3 Low idle mode power consumption In idle mode, the MS only occasionally monitors the system information being transmitted in the current cell or does measurements on neighboring cells to see if a cell change should be initiated. However, most of the time it will be in sleep mode. Hence, the power consumption during idle mode will be low. This is also referred to as discontinuous reception (DRX). ----End
Technical Description
While the MS is in idle mode it will continuously make measurements on the BCCH-carriers of serving and neighboring cells to decide on which cell to camp on. It will also, if necessary, register its presence in the location area of the chosen cell by performing a location updating. The purpose of camping on a cell is threefold: Step 4 It enables the MS to receive system information from the PLMN Step 5 The MS can initiate a call by accessing the network on the Random Access Channel (RACH) of the cell on which it is camped, Step 6 The PLMN will know the location area of the cell in which the MS is camped (unless the MS has entered a limited service state) and can therefore page the MS when an incoming call is received.
Issue 01 (2006-09-20)
15
1 Basic Functions
The idle mode task can be subdivided into four processes:

PLMN selection Cell selection Cell reselection Location updating.
The relationship between these processes is illustrated in Figure 1.1. Figure 1.1 Overall idle mode processes
Service Indication to User Automatic/ Manual Mode Selection
User Selection of PLMN
Indication to User
PLMN Selection PLAN Selection Cell Selection New location Area Initial Cell Selected Cell Reselection Cell & Location Area Changes Location Updating Location Updating Responses PLAN Available
Periodic Registration
----End
1.5 PLMN Selection

Overview
The MS will select a PLMN when it is powered on or upon recovery from a lack of coverage. It will first try to select and register on the registered PLMN if one exists. If registration on a PLMN is successful, the MS indicates this PLMN (the registered PLMN) and is capable of making and receiving calls on it. If there is no registered PLMN, or if the registered PLMN is unavailable, the MS will try to select another PLMN either automatically or manually depending on its operating mode. The MS normally operates on its home PLMN.
16
Issue 01 (2006-09-20)
1 Basic Functions
However, another PLMN may be selected if, for example, the MS loses coverage. The MS will register on a PLMN if the MS finds a suitable cell to camp on and if a location-updating request is accepted. Registration has to be successful in order for the MS to be able to access that network. However, it does not need to perform location updating if it is in the same location area belonging to the same PLMN as it was before it entered the inactive state. The MS can select and register on another PLMN of its home country than its home PLMN if national roaming or international roaming is permitted. However, the MS will then do periodical attempts to return to its home PLMN. This is controlled by a timer. The interval between attempts is stored in the Subscriber Identity Module (SIM). Only the service provider is able to set the timer value for return to home PLMN. There are two modes for PLMN selection; automatic and manual. The automatic mode utilizes a list of PLMNs in an order of priority whereas the manual mode leaves the decision to the user and only indicates which PLMNs that are available.
Automatic Mode
In automatic mode, the MS will select PLMN if available and allowable, in the following order if no registered PLMN exists or is available: Home PLMN Step 1 Each PLMN that has been stored in the Subscriber Identity Module (SIM) in priority order Step 2 Other PLMNs with received signal level above -85 dBm in random order Step 3 All other PLMNs in order of decreasing signal level. ----End
Manual Mode
In manual mode, the MS will first try to select the registered PLMN or home PLMN (if no registered PLMN exist). If this registration fails or if the user has initiated a PLMN reselection the MS will indicate to the user all available PLMNs. The user can then select a desired PLMN which causes the MS to initiate a registration on this PLMN. If the selected PLMN is not allowable, an indication to the user to select another PLMN will be made. The user can at any time request the MS to initiate reselection and registration onto an alternative available PLMN. This is done either using automatic or manual mode, depending on the mode selected by the user.
1.6 Cell Selection and Reselection

Overview
The purpose of cell selection and reselection is to enable MS to find a most suitable cell on which MS can reliably decipher the downlink data and maintain a high communication rate on uplink (so as to realize various telecom services). Once MS has selected a cell as its serving cell, its communication with the network becomes possible on this cell.
Issue 01 (2006-09-20)
17
1 Basic Functions
MS will tune to the BCCH to receive the paging message and the system information broadcast on BCCH and use the RACH to send access request after it has selected this cell. MS implements cell reselection according to the message in BA table in the system broadcast information from the serving cell. There are two BA tables in GSM network. One is transmitted in the system information through BCCH. It includes the BCCH carrier used in a certain physical area for the MS in idle mode to implement cell selection and reselection. The other one is transmitted in the system information through SACCH. It is used to indicate the MS in active mode about the BCCH carrier for handover monitoring. In active mode, MS obtains the information of adjacent cell BCCH frequency through BA (BCCH). The process will not stop until MS receives the first BA (SACCH) information.
Cell Selection Procedure

When MS is powered on and move from blind spot of coverage to the serving area, it will search for all available frequencies in the PLMN and select the suitable cell to camp on. This is the procedure of "cell selection". Cell selection procedure in the case of no BCCH information in MS MS first searches the 124 RF channels of GSM 900(if the MS is a multiband one, MS searches 374 GSM 1800 RF channels), and compares the signal level on the channels to calculate the average level. The entire measurement procedure lasts 35 s, during which, at least five sampling points will be extracted from different RF channels. After MS has tuned to the maximum carriers of the receiving level, it will first judge which one is the BCCH carrier (by searching FCCH burst). If so, MS will attempt to decode SCH to obtain the BCCH system broadcast information synchronous with this carrier. If the MS can properly decode BCCH data, and make sure that this cell belongs to the selected PLMN, parameter C1>0, and this cell has no access barring, MS can camp on this cell. Otherwise, MS will keep tuning to the next highest carriers until it reaches the available cell. If no suitable cells are found after searching 30 RF channels with the highest level, MS will monitor the level of all channels and search for the BCCH of C>0 and no access barring. After finding this carrier, MS will camp on this cell without considering its PLMN ID. In this occasion, only emergency call can be implemented. Case 1: If the access level of the MS is barred at the cell, the cell selection algorithm will not be affected, i. e., when the cell satisfies the criterion, MS will still camp on it. Case 2: If the cell selected by MS belongs to PLMN, but access is barred (parameter CBA is set as "bar") or algorithm C1<0, MS will use the BA table obtained from this cell to search for these BCCH carriers. Cell selection procedure in the case of BCCH information already stored in MS If the BCCH carrier information has been stored in MS during the last powering off, MS will first search the stored BCCH carrier. If MS can decode the BCCH data of the cell, but cannot camp on it. MS will check the BA table of this cell. If no suitable cells found after all BCCH carriers have been searched, the previous procedure will be implemented. C1 is the path loss criterion as the reference of cell selection and reselection. C1 of the serving cell should be larger than 0. The formula is as follows:
C1 = RxLEV RxLEV _ Access _ MIN MAX ( ( MS _ TxPWR _ MAX _ CCH P ) ,0)

See Figure 1.1 for formula explanation.
18
Issue 01 (2006-09-20)
1 Basic Functions
Figure 1.1 Name of powers Name RxLEV RxLEV Access MIN MS TxPWR MAX CCH P Meaning (Unit d Bm) Average level MS received Maximum receiving level allowed for MS to access Maximum transmitting power level allowed for MS to access the system Maximum output power of MS
C1 algorithm is used during cell selection procedure, as shown in Figure 1.1. Figure 1.1 Cell selection
Cell1 Cell2
C1=15
C1=8
MS select the suitable cell to camp on according to the priority and C1. The selected cell is the main serving cell Figure 1.1, MS will select Cell 1 as the main serving cell to if the priorities are the same.
Cell Reselection Procedure

After MS has selected a serving cell, it will camp on this selected cell and continue the monitoring on all BCCH carriers configured in the adjacent cell frequency configuration table indicated in the BCCH system information of the serving cell if the conditions are not changed greatly. When monitoring these BCCH carriers, the measurement of their receiving level should base on at least the average of 5 sampling points, and the number of measured sampling points extracted from all BCCHs should be the same. The sampling points allocated to each carrier should be as even as possible in each measurement period. The six strongest BCCH carriers should be refreshed at least once per minute. To lower the power consumption of MS, MS should measure the receiving level of each carrier in BA table when performing decoding page group. It is possible to obtain some BCCH frequencies and sample values of receiving level on the BCCH frequency of the serving cell during the appearance of MS page group. The MS routine measurement program also includes the measurement of the BCCH carrier of the current serving cell. MS should attempt to decode all system informations broadcast on BCCH of the serving cell at least every 30 s. MS should implement decoding of BCCH data block to the BCCH carriers of the six strongest non-serving cells at least every 5 min. This data block contains the parameter concerning cell reselection. After MS has found a new
Issue 01 (2006-09-20)
19
1 Basic Functions
BCCH carrier as one of the strongest carriers, it will decode the BCCH data of the new carrier within at least 30 sums. MS should check the BSIC of one of the six strongest carriers within at least 30 s to verify that the monitored objective is the same cell. If BSIC is changed, MS will regard the carrier as a new one, and decode the BCCH data again. During the process above, MS tries not to interrupt the monitoring to PCH. Under the following occasions, the procedure of cell reselection will be initiated. (If C2 algorithm has not been activated, C2 = C1). Step 2 MS finds that the C2 value of a cell (in the same location area as the serving cell) has been larger than that of the serving cell for 5 seconds. Step 3 MS finds that the C1 value of a cell (not in the current location area) has been larger than the sum of the C2 value of the serving cell and the cell selection hysteresis for five seconds. Step 4 The current cell barred. Step 5 MS finds the downlink failure: the criterion of downlink signaling failure is based on the downlink signaling failure counter DSC. If MS has selected a cell, DSC is set as [90/BS PA MFRMS] round number. BS PA MFRMS is the number of multiframes of the 51 TDMA frame for the BTS transmission paging information for the MSs of the same paging level. Therefore, when MS is decoding on the PCH, if succeeded, add 1 to DSC; if failed, subtract 4 from DSC. When DSC = 0, there is downlink signaling failure. Step 6 The value of C1 has been smaller than 0 for 5 s. Step 7 During random access, MS fails to register at the retry after maximum retransmission. Note that after MS reselection and camping on the cell, MS should decode all of the BCCH data of the new cell to check whether the parameter concerning cell reselection has changed. If it is changed, MS will decide whether this change satisfies the criterion of cell reselection. If the criterion is satisfied, MS will camp on this cell. If MS finds that LAI has changed, it will initialize location updating. C2 algorithm is used in cell reselection, as shown in Figure 1.1 Figure 1.1 Cell Reselection
Cell1 Cell2
C2=4
C2=18
MS selects the cell to camp on according to the priority and C1 value. The camped-on cell becomes the main serving cell. See Figure 1.1. With the same priority, MS will select Cell 2 as the main serving cell if reselection hysteresis and the reselection time are both satisfied. ----End
Network Impact to the Ms in Idle Mode

Network side is responsible for completing system informations broadcast and paging task for
20
Issue 01 (2006-09-20)
1 Basic Functions
idle MSs in downlink. System information type 24 and the optional type 1, 2bis, 7 and 8 are broadcast periodically from the network through BCCH. The MSs in idle mode decides whether and how to access the network according to these information. MS of GSM 900 supports the band of GSM 900 only. It regards the EXT IND bit described in adjacent cell in system information type 2 as the standby bit. If the information sent from the multiband network is received, MS will regard that the information unit in system information type 2 contains the complete BA table and will ignore the system information type 2bis.
Definition of Discontinuous Receiving Mode (DRX) and PCH

If MS in idle mode has selected its serving cell, it is ready to monitor the paging information from this cell. To lower the power consumption of MS, the GSM specification adopts the discontinuous receiving mechanism, i. e., each subscriber (IMSI) corresponds to a dedicated paging group. Each group corresponds to a paging sub-channel of the cell. MS recognizes its paging group and the corresponding paging sub-channel according to the last three digits of the IMSI. MS in idle mode uses its own paging sub-channel to receive the paging information (or to monitor the receiving level of the BCCH carrier of the non-serving cell). MS ignores the information from other paging sub-channel or even shuts down the power of some hardware to lower its power consumption during the broadcasting of other paging sub-channels. But MS must measure the network information task periodically. The number of the paging sub-channels can be calculated according to the configuration type and BS AG BLKS RES (how many AGCH blocks for 51 multiframes), BS PA MFRMS (how many 51 multiframes to make up a cycle of the paging sub-channel). Common Control Channel (CCCH) includes AGCH and PCH. It is used to transmit the immediate assign information and paging information. CCCH can be bearded by a physical channel or shared by multiple physical channels. CCCH can share the same physical channel with SDCCH. The combination mode of CCCH is decided by the parameter CCCH CONF. The configuration of CCCH CONF should be consistent with that of CCCH. For the cell with one TRX, the recommended CCCH configuration is sharing one physical channel with SDCCH (3 CCCH information blocks in this case). For some location area with very heavy paging traffic, only one physical timeslot is insufficient to transmit the paging information. Therefore, the GSM specification allows configuring extra CCCHs on the TS0, TS2, TS4 and TS6 of the carrier.
1.7 Location Updating

Location updating is an important task of Mobile Management (MM).
1.7.1 Location Area

To locate MS, each GSM PLMN domain is divided into locations areas covering one or more cells. The location area of each MS is recorded by the network as the location reference for paging this MS. With the introduction of the concept of location area, the paging MS can be implemented with a location area instead of all cells controlled by MSC, thus lowering the paging load. Each location area is assigned with a Location Area Code (LAC), which is broadcast with the system information through BCCH.
Issue 01 (2006-09-20)
21
1 Basic Functions
The size of a location area has a great effect on the system. The design of location area is very important in network planning. If the coverage of a location area is too small, the location updating of MS will trigger frequently, which will increase the signaling flow of system. On the other hand, if the coverage of a location area is too large, the load of PCH and the signaling flow on Abis interface will increase since one single paging information will be broadcast in all cells of this location area. Therefore, optimization of location area is a very important task in network planning. When designing the location areas, it is necessary to lessen the frequency of location updating on the basis of no overweigh paging load, so as to avoid waste of network resource.
1.7.2 Location Updating

When MS roams from one location area to another, it is to be registered in the new location area. In other words, once driven by certain needs or finding that the LAI stored is different from that of the current cell, MS will notify the network to change the stored location area. The procedure is called location updating. If the MS in idle mode triggers cell reselection when moving within the same location area, MS will not notify the network about this change although the serving cell has changed. If the two cells before and after reselection are not in the same location area, MS will notify the network about this change. This is "forced register". According to the labels of location updating in the network, there are three types of location updating: generic location updating (i.e. inter-location area location updating), periodic location updating (T3212 timeout) and IMSI attach (MS powered on). Their specific differences are whether only one VLR is involved in the location updating process and whether IMSI is used in the process.
1.7.3 Generic Location Updating

Generic location updating is for the purpose of updating the actual MS's location registered in the network. The information unit of type of location updating in "location updating" should be indicated as generic location updating. If the network indicates that the status of MS in VLR is unknown, the generic location updating will also be initiated as a response to the request of MM connection setup.
Intra-VLR location updating

This is the simplest location updating process, in which, MS does not need to provide its IMSI. It is implemented within the current VLR, and HLR will not be notified about the process. During the initialization process, the access cause indicated in the initialization information contained in SABM frame sent from MS to the network is Location updating Request. This information also contains MSTMSI and LAI noted as for generic location updating. After receiving this information, MSC will send MAP Update Location Area to VLR. VLR, after receiving this information, will implement the location updating. It will update the location information of the MS and store the new LAI and then allocate a new TMSI for MS if necessary (TMSI can also be absent in the TMSI reallocation command. In this case, MS uses the former TMSI). After receiving TMSI Reallocation Complete from MS, VLR sends Location updating Accept to MS, and then release the channel to end the process.
22
Issue 01 (2006-09-20)
1 Basic Functions
Inter-VLR Location Updating

If MS roams to a cell whose LAI is different from the current one, it will send the old LAI and stored TMSI through MSC to VLR in the process of location updating If TMSI cannot be identified, MS can also be identified with its IMSI. See Figure 1.1. Figure 1.1 Interfaces and process of inter-VLR location updating
D A MS Location Update Request MSC MAP Update Location Area B VLR PVLR D HLR
MAP Update Location MAPCancel Location MAPCancel Location ACK MAP Insert Subscriber Data MAP Insert Subscriber Data ACK
Location Update Accept
MAP Update Location Area ACK
MAP Update Location ACK
Step 1 Update with TMSI If VLR finds that the TMSI is unknown after receiving MAP Update Location Area from MSC, it will label the "VLR Location Information Acknowledge" as "Unacknowledged" for the subsequent updating in HLR. If the subscriber has not registered in that VLR, "HLR Location Information Acknowledge" will be labeled as "Unacknowledged". And then, according to the address of the previous VLR (PVLR) indicated in TMSI and LAI, VLR will send MAP Send Identification to PVLR to request for IMSI and authentication parameter, and as a response PVLR will return the IMSI and authentication parameter to the new VLR. If the new VLR fails to get the IMSI, it will then send Identity Request to MS to request for its IMSI. After receiving IMSI, VLR will send the information of location updating of MS to HLR. This information contains the identification of MS and other related information for HLR the query the data and set up the path. If the new MSC/VLR has the normal service authority, HLR will store the new VLR No., and sends MAP Cancel Location to HLR. After receiving this information, PVLR will delete all information related to this MS, and sends MAP Cancel Location ACK to HLR. The new VLR continues to handle the processes of authentication, ciphering and TMSI reallocation. When these processes are done, HLR sends MAP Insert Subscriber Data to VLR to provide the subscriber information needed, including authentication information. After receiving the response from VLR, HLR will send Location updating Ark to that VLR. Step 2 Update with IMSI
Issue 01 (2006-09-20)
......
23
1 Basic Functions
If the identification of the subscriber is IMSI, VLR will check whether this subscriber is unknown. If so, it will be labeled the "HLR Acknowledge" as "Unacknowledged", and then initializes HLR updating. If the IMSI is a known one, VLR will check whether the previous LAI provided in the information from MSC belongs to this VLR. If not, it will label "HLR Acknowledge" as "Unacknowledged", and then initialize HLR updating. Authentication is needed in these two cases. ----End
1.7.4 IMSI Attach and Detach Process

IMSI attach and detach means to attach a binary mark to the subscriber record in MSC/VLR. The former one is marked as access granted, and the latter one is marked as access denied. IMSI attach and detach is an option of system. If the cell where MS is powered on supports this function, it will notify its power-on status to the network, i. e. sending the information of "IMSI Attach" to notify the network about the change of its current status. When the network receives this indication, it will note down the subscriber status in the system data so as to initialize the paging process when there is an paging information of this MS. If MS finds that the stored LAI is the same as the current LAI when powered on, it will initialized the process of IMSI attach. The process is almost the same as INTRA VLR Location Updating. The only difference is that the type of location updating marked in Location Updating Request is IMSI attach.
1.7.5 Periodic Location Updating

Periodic location updating is used to periodically notify the network about the accessibility of MS. MS sends Location Updating Request to the network, in which the information unit of the type of location updating is periodic location updating. In the following cases, network will lose contact with MS: Step 1 A powered on MS roams to the area beyond network coverage (blind spot). Since the network is not notified about the current status of MS, it still considers the MS in the status of IMSI attach. Step 2 When MS is transmitting "IMSI Detach", if there is interference to the radio uplink path, the network may not be able to decode this information. This means that system still regards this MS in the IMSI attach status. Step 3 In the case of MS power failure, MS cannot notify the network about its current status, resulting in the loss of contact with the network. If the above cases happen and the MS is paged, system will still sends the paging information to the location area where the subscriber registered. This paging will sure end up with paging timeout, and system resources are wasted. To tackle this problem, the corresponding measure is taken in GSM system to make the MS automatically reports its current location information to the network periodically. N this way, the network can have the timely information of the current location status of MS. This process is called periodic location updating. BSS sends the period of periodic location updating (T3212) to all subscribers in the cell with system broadcast system through the cell's BCCH, so that MS will automatically initialized location updating request to the network when the timer times out. After cell selection or cell reselection, MS will read T3212 from the system information of the serving cell, and then activate this timer and store it in SIM. After that, whenever T3212 times out, MS will
24
Issue 01 (2006-09-20)
1 Basic Functions
automatically initialize location updating. At NSS side, the network will periodically query the subscribers marked as IMSI attach in its VLR to mark those without any contact with it witting this period as implicit power-off in order to avoid paging these MSs and wasting system resources. Periodic location updating is an important measure to keep the contact between the network and MSs, therefore, the more frequent periodic location updating is, the better overall performance of network can be achieved. However, frequent periodic location updating has two drawbacks: Increase of signaling flow which may lower the processing power of MSC/BSC/BTS and the utilization of radio resources if the situation is serious; Increase of MS power consumption which will shorten the standby time of the MSs served by this system. Therefore, the setting of T3212 should be based on the actual situation. ----End In the following cases, T3212 will be reset to 0: Step 1 When receiving "Location Updating Request" or "Location Updating Refuse", Step 2 Ciphering mode complete when receiving the first MM message, or MM connection being established. Step 3 MS responds to its paging, and after which, it receives the first correct L3 message (excluding RR message). Step 4 T3212 timed out. Step 5 MS deactivated (equipment powered off or SIM removed). When T3212 times out, MS will initialize periodic location updating. If T3212 times out when MS is in the status of "no available cell", or "service restricted" or "searching for PLMN, MS will delay location updating will be delayed until these status changed. If BCCH information indicates periodic location updating not applied, this process will not be activated. T3212 timeout value is broadcast in the CCH description in "system information type 3". In the status of "no available cell", "service restricted" and "searching PLMN", T3212 cannot be changed. MS, after cell reselection, may find that the T3212 of the new cell is different from the previous one (sharing the same LAC) or the broadcast T3212 of the current cell is manually changed). In this case, assumed that "t1" is the new T3212 timeout value and "t" is the current value of T3212, the timer of MS will be restarted with the value of t mod t1. If MS is in the activated status, or it is necessary to change T3212 value, and the timer is not running, then the new timer will be started with a random number whose value range is 0t 1 ("t1" is new T3212 timeout value. The signaling flow of periodic location updating is the same as that of generic location updating. ----End
Issue 01 (2006-09-20)
25
1 Basic Functions
1.7.6 Generic Location Updating (Specification)

MS initialize location updating
If there is no RR connection available when initializing location updating, MM sub-layer of MS will request RR sub-layer to establish RR connection. MS sends "Location Updating Request" to the network, and start T3210. The information unit of location updating type in this message will indicate the type of this location updating. On this occasion, the network can initialize the type querying procedure (e. g. to get the ciphering capability of MS). If the network cannot obtain the IMSI according to TMSI and LAI, the network can initialize the identification process. After receiving "Location Updating Request" from MS, the network will initialize the authentication process. If it is necessary to reallocate TMSI, the network will initiate the process of ciphering mode setting.
Attempt counter
To restrict the frequency of location updating attempt, the attempt counter is recommended in the specification. It is used to count the number of consecutive unsuccessful location updating. When a location updating failure occurs, the counter will add one. The attempt counter will be reset in the following cases:

MS powered on. SIM inserted. Location update successfully completed, and the service statuses switch from Attempting to Update. MS roaming into a new location updating area. T3212 timeout. Location update initiated by CM sub-layer.
Attempt counter is used to decide whether to implement another attempt after T3212 timeout.
Location update accepted by the network

If the network accept location updating, it will send "Location Updating Accept" to MS. When authenticating the validity of security, TMSI reallocation is a part of location updating process. "Location Updating Accept" contains the TMSI allocated for MS and the current LAI. In this case the network will initialize T3250. If the network needs to prolong the RR connection so that MS can initialize MM connection (e.g. MS sends a request subsequent to "Location Updating Request"), the network will attach "Continue" to "Location Updating Accept" and initiate T3255. After receiving "Location Updating Accept", MS stores LAI, terminates T3210, restarts the attempt counter, and sets the status in SIM as Updated. If what contained in the message is IMSI, MS will delete the corresponding TMSI stored in SIM. If the message contains TMSI, MS will store it in the SIM and send "TMSI Reallocation Complete" to the network. If neither of them can be received, MS will delete the original TMSI stored in SIM. If the LAI or PLMN identifier in "Location Updating Accept" is one of "Barred series", all of original input will be deleted. After that, MS will use "Continue" to direct it action. If this unit exists, and MS has the underway CM service request, it will send "CM Service Request" to the network.
Location update denied by the network

If location updating is denied, the network will send "Location Updating Denied" to MS.
26
Issue 01 (2006-09-20)
1 Basic Functions
After receiving this message, MS will terminate T3210, store the reject cause, activate T3240, enter location denied status and wait for the network to trigger RR connection release. Step 1 If the reject cause is IMSI unknown to HLR, invalid MS, invalid ME. MS will set the location updating status as Roaming not Allowed, and store it in SIM. Delete TMSI, stored LAI and ciphering SN and regard the SIM as an invalid one until MS powered off or SIM removed. Step 2 If the reject cause is : PLMN not allow, location area not allow, international roaming not allowed in this location area. MS will delete any LAI, TMSI and ciphering serial key, reset the attempt counter, and set the update status as "Roaming not Allowed". If MS receives "domestic roaming not allowed in this location area", it will return to MM Idle and then implement PLMN selection instead of cell selection. Other situations will be treated as abnormal ones. ----End
RR connection release after location updating

After location updating, MS will set T3240, enter "wait for network command phase" and wait for the release of RR connection. If MS cannot receive RR connection release command from the network within a period of time (controlled by T3240), it will terminate RR connection. No matter RR connection is released by MS or the network, MS will enter "idle status".
Abnormality at MS side
Step 3 Access denial controlled by access level, unable to initiate location updating. MS camps on the current serving cell, and implements normal cell reselection. Try to initiate before denial status ends or cell changed. Step 4 Random access delayed (after receiving Immediate Allocation Denied): unable to initiate location updating. MS stays in the selected cell and initializes normal cell selection. When changing, initialize location updating before T3122 timeout. Step 5 Random access failed: activate T3213. Activate location updating after it times out. Step 6 RR connection failure: terminate location-updating process. Step 7 T3210 timeout: terminate location updating process and RR connection. Step 8 RR released before normal termination: terminate location-updating process. Step 9 Location update denied caused by other reasons: MS waits for RR connection release. For (4) (7) and random access occurring for many times, MS will terminate T3210. When T3210 times out, RR connection will be canceled, and attempt counter adds 1. The action afterwards is decided by LAI and the record of the attempt counter: Step 10 The update status is "Updated", the stored LAI equals to the one received from the previous cell, and the record of attempt counter is four. MS will maintain the "Updated" status. The MM idle status after RR connection release is "Normal Service". MS stores the type of location updating. After RR connection release, T3211 will be activated. After T3211 timeout, MS will reinitiate location-updating process (adopting the stored type).
Issue 01 (2006-09-20)
27
1 Basic Functions
Step 11 If the update status is not "Updated", or the stored LAI is different from the one received from BCCH, or the record in the attempt counter is larger than 4. After RR connection release, MS will delete LAI, TMSI, ciphering SN in SIM, set the update status as "Not updated", and enter MM idle sub-status "Attempt update". If the record in attempt counter is smaller than four, T3211 stored in MS will be initiated during RR connection release, otherwise the stored T3212 will be initiated. ----End
Abnormality at NSS side

Step 12 RR connection failure If the RR connection failure occurs successively when there is a common program, the network should implement according to the common program description. If the RR connection failure occurs successively and there is no common program, the location updating process should be terminated. Step 13 Protocol error If protocol error exits in "Location Updating Request", the network should return "Location Updating Denied". The reject cause is

Mandatory information unit incorrect Information unit not exist or unable to be realized Invalid information unit content Protocol error, not regulated
When these errors occur, the network will initialize the process of channel release. ----End
1.8 Access
Circuit Service Access
An MS can be either in "active" state or in "idle" state. In idle mode, MS is not allowed to implement any transmission. In the "dedicated/active" mode, the MS can make effective transmission to the network through an allocated channel. In idle mode, MS gives the access cause and analysis of the cause in the 8-bit information during access request, and gets the channel for access after channel allocation.
If the network cannot select the suitable channel type with limited cause analysis, it will allocate an SDCCH by default. If there is no available channel during channel allocation, the network will notify the MS to implement access attempt after a period of time with the command "Immediate Assign Denied".
After the channel activation through Abis interface, the network sends "Immediate Assign" to MS. After receiving "Immediate Assign", MS sets up a dedicated channel to the network with "Setup Indication" and enters active mode.
28
Issue 01 (2006-09-20)
1 Basic Functions
After receiving the setup indication reported by the MS, BSC analyzes the contents of the setup indication, including the processing of MS class mark, power control record, and encryption information. Then BSC transmits the setup indication reported by the MS to MSC.
Packet Service Access

When no PCCCH is configured in the serving cell, packet service is accessed on the CCCH. The BSC transfers the packet paging messages coming from the PCU to the MS on the PCH of the CCCH. The channel request message issued from the MS is transferred to the BTS through the RACH of the CCCH and then reported through the BTS to the BSC.
If the channel request message is for packet access (corresponding to the MOC), the BSC will not process it and will transfer it to the PCU. At the same time, the BSC receives the packet immediate allocation message from the PCU, transfers it to the MS and completes the packet call access. If mobile channel request message is for Paging Response (corresponding to the MTC), the BSC will first allocate the DCCH and enter the active mode. On the reception of EST_IND of RR_INITIALITION_REQ message, the BSC will transfer it to the PCU. And it will receive the PDCH message of the PCU, and transfer it to the MS, completing packet call access.
If the MS accesses packet service through the PCCCH, then the packet call process is transparent to the BSC. After receiving packet paging message, MS will initialize the process of uplink Temporary Block Flow setup, and then sends the paging response packet in data form to PCU through the air interface. PCU forwards the packet to SGSN. After receiving the paging response, SGSN is ready to transmit downlink data.
1.9 Paging
Paging means that when a call is routed to the destination office, GSM/GPRS network initializes the call at the current location area or routing area of the called MS. Packet paging is mainly implemented at routing area, but location area is available. This is decided by SGSN. There are two types of paging, i.e. packet paging and circuit paging, which will be examined respectively below.
1.9.1 Packet Service Paging

When there are downlink data that shall be sent to the MS, SGSN needs to initiate a packet paging call. The paging request message originated by the SGSN is sent through Gb interface to PCU, which converts it into the packet paging request of the air interface (Um interface) before sending. If the PCCCH channel is configured for the BSS system, the message will be sent on the PPCH directly. If PCCCH is not configured for the system, PCU will send the message through the Pb interface to the BSC, which sends it on the PCH. On receipt of the packet paging message, MS starts access procedure.
1.9.2 Circuit Service Paging

Overview
When a call reaches the MSC where the subscriber is located, the MSC sends a paging
Issue 01 (2006-09-20)
29
1 Basic Functions
message to all cells in that location area according to the registered location area of MS. In the GSM network, the concept of Location Area (LA) is introduced to reduce waste of resources. A LA contains a small group of cells. An MS belongs to a LA at specific time. The LA information is stored in VLR from which MSC can query them. A paging process is completed jointly by MSC, BSC and BTS as follows: When a call is routed to the serving MSC of the called MS, MSC first figures out the location area of MS, and then sends the paging message to all BSCs in this location area. The paging message contains the information that can be used to identify the subscriber (IMSI or TMSI). BSC determines which BTS to page according to the LA, and determines the paging channel of the MS according to the IMSI, and sends them to the BTS. BTS will transmit the paging message of the MS on the specified PCH. The configuration of the PCH can be changed as the traffic increases or decreases. The PCH configuration information of each cell must be notified to each MS in the cell. When the configuration changes, BSC must modify the broadcast messages accordingly so that the MS in the cell can wait on the specified PCH sub-channel to answer the paging message. To enhance the signaling efficiency, a group of paging request combinations, called paging group, can be sent together. A page is generally sent three times. When flow control is allowed, the BSC can automatically adjust the configuration of PAGCH. If the GPRS/GSM system runs in network operation mode 1 and there exists a Gs interface, the circuit paging of the GSM service can be sent on the GPRS channel. In other words, if an MS is GPRS-attached, its circuit paging shall go from MSC to SGSN and then to PCU through the Gs and Gb interfaces, and PCU will determine on which channel to transmit the paging. If the system is configured with PCCCH, the paging message of the circuit will be sent directly by PCU on the PPCH or PACCH channel. If the MS is already allocated to PDCH, it shall be sent by priority on the PCCH. If the MS is not allocated to the PDCH, it shall be sent on the PPCH. If the system is not configured with PCCCH, PCU transfers the paging message to BSC through Pb interface, which then transmit the paging message on the PCH. After receiving the circuit-paging message, MS accesses the RACH and starts the circuit connection setup process. MS will initiate the GPRS SUSPEND process to suspend the GPRS services and will not recover the GPRS service till the circuit is released.
Paging mode
The GSM network defines three commonly used paging modes:
Ordinary paging mode The paging messages are only transmitted on the channel defined by PCH configuration and IMSI.
Complete paging mode When a notice is given to an MS group in this mode, it indicates that the paging messages of this subscriber group might be transmitted on any PCH at the same time slot. When the PCH configuration is modified dynamically, this mode can be used to avoid the loss of paging messages.
Spaced paging mode BSS attaches a group of paging messages to another paging channel for transmission.
30
Issue 01 (2006-09-20)
1 Basic Functions
This is to avoid temporary overload. In other words, the MS that receives an ordinary paging on the paging channel N can receive the paging message on the paging channel N+2. M900/M1800 BSS supports all the three paging modes: "ordinary" paging mode, "complete" paging mode and spaced paging mode. Therefore, in PAGCH channel adjustment due to traffic flow, subscribers in the serving cell will not lose the paging message. Once a paging message is received by MS, the access allocation and allocation initialization process is started. If an MS is GPRS-attached in network operation mode 1, circuit paging to this MS will go through Gs interface, Gb interface, and Pb interface, and reach the BSC by way of MSC-SGSN-PCU. Then, there are three possibilities that the paging message will be transmitted to the MS, which are described according to their priorities.

If the MS has been allocated with a PDCH, the message is transmitted on the PACCH. If the serving cell has been allocated with a PCCCH, the message is transmitted on the PPCH. If the serving cell is not configured with the PCCCH, the message is transmitted on the PCH.
1.10 Immediate Assignment

1.10.1 Overview
Immediate assignment is for the purpose of establishing the wireless connection, i. e. RR connection with MS at Um interface. When MS needs to set up a connection, the immediate assignment process will allocate a channel necessary for the signaling interaction of establishing this connection. This channel can be either a SDCCH or a TCH. Huawei BSC supports the immediate assignment of SDCCH and immediate assignment of TCH at the level of cell.
1.10.2 Technology Description

Channel request
The process of initialization is actually the process of random access. Whenever MS needs to set up connection with the network, it has to send a message to the network through RACH to request for a signaling channel. The network will decide the type of the channel to be allocated according to the channel request. This message sent through RACH is called Channel Request. In this message, there is only 8 bits of meaningful signaling message. In which, 3 bits are used to the minimum indication of the access cause (in Phase 1, the cause occupies only 3 bits; in Phase 2, due to concept of half rate, the bit occupied by the cause is not a fixed, and the maximum one can be 6 bit). Such as emergency call, location updating, response to paging or caller request, etc. In the case of network congestion, system can implement different processing (which type of call will be accepted or denied) to the channel request of different access purposes according to this rough indication, and allocate the most suitable channels for them. In this indication, due to the capacity limit of the channel, it is impossible to transmit all information to be transmitted, such as the specific cause of channel request, subscriber identity and the feature of mobile equipment (all transmitted in SABM) to the network.
Issue 01 (2006-09-20)
31
1 Basic Functions
The other 5 bits is the identification code selected by MS at random (for Phase 1 standard). It is not used to notify the network about the MS's location but to enable the network to identify the request initialized by different MSs. After that, the network will send "Immediate Assign Command" (includes the information of the allocated channel) to MS. The identification code will be returned to MS in this message. MS judges whether the information is for it by comparing the identification code it sent and the one returned from the network. But it has only 5 bits, which can be used to differentiate 32 MSs simultaneously. Two MSs initializing calls simultaneously do not necessarily have the random identification codes different from each other. To further differentiate MSs initializing calls simultaneously, the response messages on Um interface are used as another reference. The channel request message is processed only within BSS. All MSs with SIMs belong to a level among Level 09. The access level is stored in SIM. MS can also belong to one of the 5 special access levels (Level 1115). Such level is also stored in SIM. In BCCH system information, the information, such as the access levels and special access levels allowed by the network, and whether all MS or only those of special levels is allowed to initiate emergency calls, will be broadcast. If the setup cause requested by MM is not emergency call, then only when MS belongs to the access level or special access level, can its access be grated. If the setup cause requested by MM is emergency call, then only when all MSs in the cell are allowed to initialize emergency call, or belongs to the allowed special access level, can their access be grated. Since the network cannot control the access time of MS, the event of two MSs contending for the same RACH timeslot will inevitably happen in the areas with heavy traffic. This is called the collision. The collision leads to two results: the network will receive a burst level from this timeslot obviously higher than the other. In this case, the network will process the random access request with higher level. The other one is that the network can receive neither of them due to their mutual interference. With the increase of traffic, the possibility of loss of message due to collision will become higher. This will become the major problem of network capacity. Therefore, it is necessary to introduce the mechanism of retranslating channel request. MS figures out that it allowed to transmit "Channel Request" through RACH for at most M + 1 times with the following methods:
The timeslot No. Between the assign process and a "Channel Request" (not including the timeslot containing the information itself) is selected at random from {0, 1 MAC (T, 8)-} with the same probability. The timeslot No. between the two consecutive "Information Request" of MS is selected at random from {S, S + 1, , S + T 1} with the same probability.
T is the parameter "Tx integer" broadcast on BCCH; M is "Max Retrans"; the value of S depends of the configuration of CCCH. See Figure 1.1. Figure 1.1 Value of Parameter S Tx 3, 8, 14, 50 4, 9, 6 5, 10, 20 Non-combined CCCH 55 76 109 Combined CCCH/SDCCH 41 52 58
32
Issue 01 (2006-09-20)
1 Basic Functions
6, 11, 25 7, 12, 32
163 217
86 115
If the immediate assign command is not received even after Max Retrans, MS will return to idle mode. After transmitting initial channel request, MS will activate T3120 and stay on the entire downlink CCCH (to receive answer) and BCCH. When T3120 times out while RACH retransmission times has not exceeded "Max Retrans", MS will retransmit the channel request message containing a new random reference, and activate T3120 with a new value. When T3120 times out, and the Max Retrans is reached, MS will activate T3126, and then wait for a period of time and allow network to give up. If no network response received after T3126 timeout, MS will give up request attempt and perform cell reselection.
The allocation of the initial channel

After correctly decoding the Channel Request of MS, BTS will send Channel Required to BSC through Abis interface. This message contains important attachment information and the estimation to TA that is important to activating timer advance control. After receiving this message, BSC will select a corresponding idle channel for MS according to the judgement to the existing radio resources. However, the availability of the allocated channel and the related terrestrial resources is to be acknowledged with the response from BT. This process is realized by sending "Channel Active" from BSC to BTS to query the availability of corresponding terrestrial resources (e. g. transmission circuit). This message indicates all properties needed in activating the channel, including channel type, working mode, physical feature and initial lead. When the corresponding resources are ready, BTS will return "Channel Active ACK" as a response to BSC. Step 1 Immediate assignment After BSC receive Channel Active ACK from BTS, will send Immediate Assignment or Extended Immediate Assignment to allocate dedicated signaling channel for MS in the nonacknowledge mode, through the CCCH for MS receiving Channel Request. Immediate Assignment contains the assignment information of only one MS, while Extended Immediate Assignment contains the assignment information of two MSs. BTS can send Immediate Assignment or Extended Immediate Assignment on any message block of downlink CCCH. Therefore it is necessary for MS to monitor all information block on CCCH. The allocated channel type (TCH or SDCCH, channel mode is set as signaling) is decided by the carrier. Normally, if there is an idle SDCCH available that can satisfy the access request, BSC will allocate SDCCH. The process of requesting for SDCCH connection includes location updating, IMSI detach, supplementary service, short message at non-session status and services only supported by SDCCH. MS initializes access request, and BSC allocates a SDCCH for this call. This channel seizes 1/8 sub-timeslots of a timeslot. The signaling interaction necessary for call establishment is implemented on that channel. The signaling flow of SDCCH immediate assignment is illustrated in Figure 1.1.
Issue 01 (2006-09-20)
33
1 Basic Functions
Figure 1.1 Immediate assignment

MS
Channel Request
BTS
Channel Required Channel Active Channel Active ACK Immediate Assignment Immediate Assignment SDCCH: SABM SDCCH: UA SDCCH: Authentication Request Establishment Indication
BSC
MSC
Complete Layer3 Informaiton
SDCCH: Authentication Response z zSDCCH: Ciphering Mode Command SDCCH: Ciphering Mode Complete SDCCH: Setup SDCCH: Call Proceed Channel Active Channel ACK Assignment Command Assignment Request Ciphering Mode Command Encryption Command
SDCCH: Assignment Command TCH: SABM TCH: UA TCH: Assignment Complete TCH: Alert TCH: Connect TCH: Connect ACK
Assignment Complete
If TCH has been allocated before immediate assignment, there is no need to reallocate TCH during the process of assignment. Mode conversion process can be used to change the function of TCH from signaling transfer to voice transmission. Signaling flow of TCH immediate assignment is illustrated in Figure 1.2.
34
Issue 01 (2006-09-20)
1 Basic Functions
Figure 1.2 Immediate assignment

MS
Channel Request
BTS
Channel Required Channel Active Channel Active ACK Immediate Assignment Immediate Assignment TCH: SABM TCH: UA TCH: Authentication Request TCH: Authentication Response Encryption Command Establishment Indication
BSC
MSC
Complete Layer3 Informaiton
Ciphering Mode Command
TCH: Ciphering Mode Command TCH: Ciphering Mode Complete TCH: Setup TCH: Call Proceed
TCH: TCH: TCH: Alert TCH: Connect TCH: Connect ACK
Mode Modify Mode Modify ACK Channel Mode Modify Channel Mode Modify ACK
Assignment Request
Assignment Complete
Messages of immediate assignment or extended immediate assignment contain:

Description of assigned channel. Information field of channel request and abbrethroughted frame No. of the received channel request frame (abbrethroughted frame No. is a frame No. with narrow value range calculated from the TDMA frame No. received by BTS during channel request.) Initial lead; Start time indication (optional).
The random reference and abbrethroughted frame No. are directly related to the MS channel request. They are used to reduce the conflict of request among MSs. TA is the initial lead calculated from equalizing the channel request information received by BTS on RACH. MS figures out the next initial lead for transmitting according to TA. After receiving immediate assignment or extended immediate assignment, MS switches to the channel assigned by the network, sets the channel modes as signaling only and sends the SABM with information field through the allocated channel to establish the main signaling link. Immediate assignment or extended immediate assignment message, containing the start time and description of possible alternative channel, can be used to indicate the frequency change in the process. If the received immediate assignment or extended immediate assignment message contains only the description of the channel used after start time, MS will access to the channel during the time waiting for start. If it misses the time, MS will immediately switch to this channel after receiving the message. If the message contains the description of the channel used after indication time as well as that before the indication time, MS will access the channel after receiving the message. If MS is
Issue 01 (2006-09-20)
35
1 Basic Functions
ready for access to the channel upon the indicated time, MS will first access to the channel used before the indication time, and switch to the one after the indication time when the time comes (new frequency series, MAIO and HSN). If MS is ready after the specified time it will access the channel after the indication time. If MS has already sent the channel requests for maximum allowed times RR entity will start T3126. After T3126 timeout, immediate assignment process will be terminated. If the random access program is initiated by MM, system indicates failure of random access to MM. After sending the first channel request message, MS starts to monitor the system message on BCCH as well as the CCCH timeslot corresponding to its paging group, i. e. immediate assignment command may appear in any CCCH message block in 51 multiframe. Therefore it is necessary for MS to monitor the entire CCCH block after sending channel request, i. e. decode the messages of the entire paging sub-channel for response from the network. If the network adopts FH, MS will decode MA with the CA got from BCCH system message. CA refers to all the frequencies used in the cell (including FH frequencies). MA refers to all FH frequencies used in the cell. Step 2 Immediate assignment denied If there is no available channel for BSC to allocate, the network can send the immediate assignment denied message in non-acknowledge mode to MS through CCCH. The reject cause can be MSC traffic closed, radio resources shortage, TA value exceeding limit, channel activation no response and BSC traffic overload. But system does not specify the part on downlink CCCH for immediate assignment denied transmission. The message of immediate assignment denied contains request reference and waiting indication. After receiving Immediate Assignment Denied, as the response to one of the last three channel requests, MS terminates T3120, activates T3122 with the specified value and returns CCCH idle mode. MS cannot start RR connection attempt until T3122 timeout. MS is not allowed to initialize another call attempt except for emergency calls until T3122 timeout. Emergency call attempt can be established in the same cell before T3122 timeout as long as no "Immediate Assignment Denied" of RR emergency attempt received. It corresponds to the immediate assignment extension. In order to improve AGCH efficiency, the format of extended immediate assignment denied is introduced. The message of extended immediate assignment denied can contain information of rejecting at most four MSs. The value of the wait indication information unit (T3122) depends on the cell receiving this message. After T3122 timeout, MS will not respond to paging but sends "Channel Request" instead till MS receives "Paging Request". Step 3 Signaling channel assignment overlap The system may have a slow response to the channel request of MS, which results in request retransmission. In this case, system do not know whether a channel request message is a retransmitted one, so it may send the immediate assignment command to the MS for multiple times. MS will use the channel in the first assignment message it decoded. The others are regarded invalid ones. But according to the specification, MS should receive the last three network response messages to the channel request. This is called allocation overlapping. It is possible to cope with CCCH congestion caused by to many overlapped allocations by reducing the retransmission of MS or shorten T3101. This measure can avoid the waste of system resources.
36
Issue 01 (2006-09-20)
1 Basic Functions
----End
Initialization message
After receiving immediate assignment command, MS will decode this message. If the random identification code and the abbrethroughted frame No. satisfy the requirement, MS will tune its transceiver equipment to the specified channel and start to transmit signaling according to TA specified by BSC and maximum transmitting power (defined in the parameter "MS TxPWR MAX CCH" in BCCH system broadcast message). The first task for MS on the allocated SDCCH/TCH is to send a SABM frame to establish asynchronous balance mode (service access point type: SAPI = 0) so as to establish signaling message link connection in acknowledge mode. In GSM specification, SABM has a signaling message, i. e. initialization message. On Um interface, SABM frame is a message requesting for the establishment of a multiframe response operation mode on LAPDm. This message contains the L3 service request message. The reason for different standards about standard HDLC is to guarantee the correctness of MS receiving. If two MSs send the channel requests with the same message content at the same (possible in the case of high load), BSS will repines to one of them only. While these two MSs can both be allocated with the same dedicated channel. To settle this problem, there should be a mechanism judging such contention. According to the specification, the cell will send a UA frame (no No. verification) with the content completely the same as that of SABM frame after the cell has received the SABM frame. MS compares it and the SABM information. If the content is completely the same, the access will proceed. Otherwise, it will give up this channel and repeat the immediate allocation process. Only when the consistency is guaranteed, will MS stay on the channel. According to different request causes, the initialization messages in SABM can be divided into four types: CM service request (call establishment, short message, and supplementary service management), location updating request (generic location updating, periodic location updating, IMSI attach), IMSI detach and paging response. All these messages contain the identity of MS, detailed access cause and Classmark of MS (used to indicate some key features of MS, such as transmission power level, ciphering algorithm, short message capability and frequency capability). Upon receiving SABM frame, BTS will send a message "Establishment Indication" to BSC. On Abis interface, this message is used to notify LAPDm that the connection has been established. It is a response to the immediate assignment message. After receiving the indication message of establishment, BSC will send a L3 service request message (Complete Layer3 INFO) to MSC. To be specific, this message is Location Updating Request, CM Service Request, Paging Response and IMSI Detach. This message contains the SCCP connection request (SCCP CR), cause of CM service request (e.g. MO call, emergency call, location updating and short message service), ciphering key sequence No., LAC, CI, physical information of this MS (e.g. transmitting power level, ciphering algorithm support, pseudosynchronous capability and short message capability) and the ID of MS. Although the MTP connection at An interface has been established before the session, there should still be a SCCP connection on L2 for each call. This establishment request message will be transmitted in the SCCP CR message through A interface. If the request is permitted, the first downlink message at An interface will be contained in the CC frame at SCCP layer. For SCCP layer, the exchange between CR and CC is the exchange between original reference address and destination reference addresses. For different calls, the same SPC may refer to different original addresses and destination addresses. If SCCP cannot be established, MSC will send the message SCCP Refused. The access ends at this step. The signaling link between
Issue 01 (2006-09-20)
37
1 Basic Functions
MS and MSC has been established, MSC at this phase is able to control the transmission feature of the RR management, and BSS is in the status of monitoring transmission quality and ready for handover.
Phase1 and Phase2 MS

BSC cannot differentiate whether a call is for voice, data or signaling completely according to MS establishment cause. In the case of Phase 2 MS, BSC can obtain the access request cause more detailed than that of Phase1 MS. For Phase 2 MS, BSC is able to recognize the information unit "Channel Needed" in the paging message. This information unit indicates whether the current channel is for voice/data or signaling. MS selects a suitable establishment cause to response according to its own capability. Huawei BSC supports the information unit "Channel Needed" in the paging message.
1.10.3 Parameter
Huawei BSC controls the function of immediate TCH assignment with the switch of "Immediate assign TCH. The detailed configuration process, the parameters involved is listed Figure 1.1. Figure 1.1 Parameter related to Immediate Assignment Name TCH immediate assignment Unit None Rang e Yes/ No Defau lt No Description Option "Yes" means that TCH channel can be immediately assigned as signaling and traffic channel when SDCCH has no available resource. The option "No" means that only SDCCH can be assigned.
1.11 Assignment
Overview
BSS switches MS to TCH by means of assignment. Normally, the assignment is finished at the cell where the call is initialized. Huawei BSC supports the function of direct retry, which can assign MS to other cells. Huawei BSC supports re-assignment process. When BSC receive ASSIGNMENT FAILURE from UM interface, BSC allocate a new radio channel and initiate the second assignment process.
Working Principle
After MS initializes service request, BSC will assign the MS to TCH by means of the assignment process. If BSC figures out that there is idle TCH in the cell where MS initialized the call, it will assign the MS to that TCH. Huawei BSC provides two algorithms of channel selection: "Huawei Channel Algorithm I" and "Huawei Channel Algorithm II". The channel allocation algorithms of Huawei guarantee that the currently allocated channel is the best one.
38
Issue 01 (2006-09-20)
1 Basic Functions
If BSC has already assigned the MS to TCH during immediate assignment, it will not assign the MS to a new TCH, but to the old one. If there is no idle TCH in the cell of the MS, the function of directed retry can be used to assign the MS to other cells with idle TCH and go on with the service. BSC can select the best cell among the adjacent cells with the measurement reports as the destination cell in directed retry. If BSC receive ASSIGNMENT FAILURE from UM interface, the re-assignment process is controlled by the parameter "Allow Reassign". Re-assignment process chooses different TRX preference. If there is no other idle TRX in the same cell, the re-assignment process is initiated at the same TRX.
Parameter
BSC decides whether to use the function of directed retry with the parameter "Directed retry permitted". The parameters involved are listed Figure 1.1. Figure 1.1 Parameter related to Assignment Name Direct retry Unit None Rang e Yes/ No Defau lt Yes Description TCH direct retry. It is realized in switching flow (switched to the neighboring cell). Correspondingly, signaling channel switching relative data must be set, but whether TCH direct retry is enabled is not important. Direct retry is not a measure to solve traffic congestion. Instead, it is only an emergency operation during traffic peak in local radio network. If direct retry takes place frequently in local radio network, it is necessary to adjust BTS cell TRX configuration and network layout. Indicates whether to allow Reassign TCH. When BSC receive the ASSIGNMENT FAILURE from UM, the BSC initiate the second ASSIGNMENT.
Allow Reassign
None
Yes/ No
No
1.12 Authentication
One of GSM system's advantages comparing with analog system is security system. It has the following improvements: on access network: AUC authenticates the subscriber; on radio path: communication information ciphering; EIR identifies the mobile equipment; IMSI is protected by TMSI; SIM is protected with PIN. The authentication process is one of the common processes of Mobility Management (MM) process. The common processes of MM includes authentication process, identification process, TMSI reallocation process and IMSI detach process initialized by MS. Other common processes will also be mentioned in this chapter.
Issue 01 (2006-09-20)
39
1 Basic Functions
1.12.1 Authentication Process

Authentication triplet
Authentication and ciphering process is realized with the triplet allocated by the system. The triplet is generated in the Authentication Center (AUC). After subscribing to GSM service, each MS will be allocated with a MSISDN and IMSI. IMSI is written to the SIM of the subscriber with SIM writer. Together with this IMSI, the authentication key Ki uniquely corresponding to the IMSI is also stored in the SIM and in AUC. In AUC, there is a pseudo-random code generator used to generate a unpredictable pseudo-random code RAND (randomly selected from 02128-1). The GSM specification also defines the algorithms of A3, A8 and A5 used in authentication and ciphering process. In AUC, SRES is generated by processing RAND and Ki with A3, and Kc is generated by processing RAND and Ki with A8. RAND, Kc and SRES make up the triplet, which will be transmitted to HLR and be saved in the database of that subscriber. Normally, AUC transmits five triplets at a time to HLR. HLR can store 10 triplets. When MSC/VLR requests HLR for triplet, HLR will transmit five triplets to it. MSC/VLR uses one triplet each time. When there is two triplets left, it will request HLR for triplets again. Below is the detailed introduction to the process of parameter transference.
Authentication process
There are two purposes for authentication: one is to check whether the identification provided by MS is effective, and the other is to allocate a new ciphering key for MS. After the establishment of RR layer between MSC and BSS, the network is able to decide whether to trigger the authentication process to verify the identification of the mobile subscriber. Whether to trigger the authentication process depends on Kc at network side (stored after the previous processing of the MS service) is the same as that stored in the MS accessing currently. If they are the same, system will skip authentication and go to ciphering process with Kc stored in MS. Otherwise, Kc has to be calculated with authentication process. To enable the ciphering in the case of initializing RR connection without authentication process, the concept of ciphering key sequence number is introduced. It is called CKSN in the specification. CKSN is stored in SIM as well as in MSC/VLR together with Kc and is processed by the network. In the first L3 message (e. g. location updating, CM service request, paging response, MS will indicate the CKSN to the network. CKSN = 0 means no Kc allocated. The calculation of Kc is illustrated in Figure 1.1. Figure 1.1 Kc calculation
Ki RAND
AS
Kc
40
Issue 01 (2006-09-20)
1 Basic Functions
After receiving Complete Layer3 INFO, MSC will send "Process Access Request" to VLR for authentication and ciphering. VLR will return the message of "Process Access Accepted". And then, MSC/VLR will send the message Authentication Request to MS to trigger the authentication process. At the same time, T3260 will be activated. "Authentication Request" contains a RAND and a CKSN. RAND is 128 bit. MS will send the message "Run GSM Algorithm" to SIM after receiving this message. A 32-bit SRES will be generated by processing Ki stored in SIM and this SRES with A3. Meanwhile, a 64-bit Kc is calculated by processing Ki and RAND with A8. MS will store it and CKSN to the suitable position SIM for the future activation of ciphering transmission. If RR connection exits, MS should respond to the authentication request message. MS will sends the SRES to the network with the message Authentication Response. After receiving "Authentication Response", the network will terminate T3260 and check the validity of the SRES. Since Ki is stored in VLR or HLR as a subscriber data, the A3 and A8 will also be carried out to generate a SRES and Kc and store them in VLR. System compares these two SRESs. If they are the same, the authentication will succeed and access to network will be grated, see Figure 1.2. And after that MSC proceeds ahead with the ciphering process. If they are different, authentication failed, and system will reject the access of the MS. The authentication process ends at this step. Figure 1.2 Authentication algorithm
AUC
Ki
RAND
Ki
RAND
A8
A8
Kc MS
Equal
Kc Network
Authentication succeeded
A3 and A8 can be executed either in MSC/VLR or in HLR/AUC. But it will be complicated for MSC/VLR, but simple for HLR/AUC for it stores Ki. Furthermore, it is a better way to achieve security and roaming. However, it causes the increase of signaling traffic between HLR and MSC, for each authentication, HLR/AUC will send RAND, SRES and Kc to MSC/VLR.
Unsuccessful authentication
If the authentication failed, the network can use the subscriber's identification. Step 2 MS uses TMSI If MS uses TMSI, the network can initiate the identification process. If the TMSI does not correspond to the IMSI, authentication will be restarted.
Issue 01 (2006-09-20)
41
1 Basic Functions
Step 3 MS uses IMSI If MS uses IMSI or the network decides not to initiate identification program, then "Authentication Denied" will be sent to MS. After sending this message, all MM connection in process will be released, and then the network will initialize the RR connection release process. After receiving "Authentication Denied", MS will set the status of SIM as "Roaming Denied", and delete the existing TMSI, LAI and CKSN, and regards SIM invalid until MS powered off or SIM removed. ----End
1.12.2 Abnormality handling during authentication process

RR connection failure
If RR connection is detected before receiving "Authentication Response", the network will release all MM connection and terminate all running MM special process.
T3260 timeout
If T3260 timeout, the network will release RR connection. In this case, the network will terminate the authentication process and all ongoing MM process, releases all MM connection and initializes RR connection process.
1.13 Ciphering
1.13.1 Overview
The feature of wireless transmission has a negative effect on the security and interest of the subscribers. The analog mobile communication has always been the victim of interception and misappropriation. The digital transmission of GSM guarantees excellent security. The encryption function deals with the security for information exchange between MS and BTS, including signaling information and user information. It is up to the radio resources management to decide whether to adopt the encryption mode or not. The encryption function is implemented in the BTS to encrypt user data. The related parameters must be sent to the encryption program. The ciphering key Kc, generated by AC and stored in the MSC/VLR, is sent to the BTS before encryption starts.
1.13.2 Technical Description

In order to achieve a general understanding of the encryption/decryption process of GSM, we will examine it here from three perspectives: TMSI, encryption process and Kc generation.
TMSI (Temporary Mobile Subscriber Identity)

IMSI is the identity for mobile subscriber. Due to the importance of IMSI it is not transmitted on the radio link repeatedly. VLR allocates a TMSI to the subscriber during the MS registration. Afterwards TMSI is used in place of IMSI to protect the IMSI for the sake of
42
Issue 01 (2006-09-20)
1 Basic Functions
subscriber security. The relation between TMSI and IMSI is not fixed. TMSI is valid only in a VLR area.
Ciphering and deciphering processes

Step 1 Initializing ciphering mode setting After authentication process, MSC will send "Ciphering Mode Command" to BSC. This message contains Kc. BSC sends Ciphering Mode Command to MS to indicate whether ciphering is necessary, and if needed, which type of dedicated resources are to be adopted. Step 2 Ciphering mode setting complete Once MS receives the valid "Ciphering Mode Command", it will send the Kc stored in SIM to the mobile equipment. The valid "Ciphering Mode Command" are as follows:

"Initialize Ciphering" is indicated when MS is in the status of "Non-ciphering". "Non-ciphering" is indicated when MS is in the status of "Non-ciphering". "Non-ciphering" is indicated when MS is in the status of "Ciphering".
MS will regard the "Ciphering Mode Command" of other type received as an incorrect one. It will respond with "RR Status", and the cause value is "Error: protocol not defined". After receiving the indication of "Ciphering Mode Command" and the ciphering process, MS should initiate the Tx and Rx in ciphering mode. After MS has activated the actions of "Ciphering Mode Command", it will returns "RR Ciphering Mode Complete" to the network. If the field "Ciphering Response" in the information unit of ciphering response message "IMEI shall be included", then MS will include its IMEI in "RR Ciphering Mode Complete". After receiving "Ciphering Mode Complete", the network will initialize the transmission in ciphering mode. BTS and MS carry out the encryption/decryption of the radio path. The process of encryption and decryption is shown in Figure 1.1. Figure 1.1 Process of ciphering and deciphering
Kc A5 Data flow (TDMA) Kc A5 Data flow (TDMA)
Mod2+1 RX Data not ciphered
Mod2+1
DX Data not ciphered
The algorithm for generating the ciphering code is called A5. Using the Kc consistent in MS and the network (64 bits) and the current pulse string frame number (22 bits), it calculates result is the 114-bit ciphering sequence (the data flow in ), which then performs "exclusive or" operation together with the burst 114 bit (the data not ciphered in ). The frame No. code
Issue 01 (2006-09-20)
43
1 Basic Functions
consists of three values (T1, T3 and T2). If the communication lasts as long as the period of hyper frame (about 3 and half hours), the ciphering sequence will appear repetitiously. On uplink and downlink, the network uses the same ciphering sequence. For each burst, one sequence is used for the ciphering in MS and the deciphering sequence of BTS, the other one is for the ciphering of BTS and deciphering of MS. According to the system configuration, MS can decide whether to report the processing power of MS after Authentication Request. The name of this message is Classmark Change. Its content is the same as that in the establishment indication, and is more detailed in the description of ciphering algorithm at MS side. The establishment indication states whether A5/1, A5/2 and A5/3 are supported, while the Classmark Change further states whether A5/4 A5/7 are supported. After receiving this message, the network first response with the message MS PWR CTRL to describe the power range available for MS and the transmitting power of the TRX corresponding to this MS. ----End
Generation of Kc
Ciphering key (Kc) is produced by A8 algorithm as shown in the 1.12.1 I. IStep 1Figure 1.1. Here Ki is a user authentication key. After registering in the network, a subscriber obtains the Ki, which is stored in the authentication centre and the SIM card. Figure 1.2 Generation of Kc
RAND generator Ki A8 Kc Storing KC RAND A8 Kc Storing KC Ki
MS
Network Side
The MS and the network use the same Ki and random number (which is generated by the network and transmitted to the MS) so that the same Kc can be obtained.
1.13.3 Parameter
MSC support ciphering, all kinds of ciphering algorithm and authentication in service access procedure. The parameters involved are listed Figure 1.1
44
Issue 01 (2006-09-20)
1 Basic Functions
Figure 1.1 Parameters related to Ciphering Name A-interface Phase flag Abis-interface Phase flag Um-interface Phase flag Encryption algorithm Unit None Range GSM_PHASE_1, GSM_PHASE_2, GSM_PHASE_2+ GSM_PHASE_1, GSM_PHASE_2, GSM_PHASE_2+ GSM_PHASE_1, GSM_PHASE_2, GSM_PHASE_2+ Not supporting encryption, A5/1~A5/7 Defaul t GSM_PH SAE_2+ GSM_PH SAE_2 GSM_PH SAE_2 10000000 Description Depends on the actual A interface. Depends on the actual Abis interface. Depends on the actual Um interface. Determines which encryption algorithm is used. This parameter should not be composed of all 0s. "1000000" indicates that the encryption is not used.
None
None
None
1.14 DTX
1.14.1 Overview
In the process of communication, only 40% of time of the mobile subscriber is engaged in session. Most of the time is not engaged in the transmission of voice message. If all information during the non-session period is sent to the network, not only the system resources are wasted, but also the intra-system interference will be worsened. To tackle the above problems, GSM adopts Discontinuous Transmission (DTX). When there is no session, the transmitting channel is closed to lower the interference level and improve the system efficiency. In addition, this function also saves the power consumption of MS. When transferring data, this function cannot be applied. DTX affects the transmission of TCH frame. There are two types of voice transmission in GSM system: one is normal mode, the voice stream is encoded as 13 kbit/s regardless of the MS's session status, and the other is DTX mode. Only one mode can be selected in one session. When both parties of the communication are GSM subscribers, DTX will have a negative effect on the communication quality. Therefore, DTX mode is not allowed on the occasion.
1.14.2 Technologies Description

If DTX mode is adopted, the voice coding of 13 kbit/s will be used in voice activation period, and that of 500 bit/s (for transmitting the feature parameter of comfort noise only) in nonvoice activation period.
Issue 01 (2006-09-20)
45
1 Basic Functions
Figure 1.1 Principle of DTX

IRAU Information BFI SID TAF MS Voice frame coding Voicing decoding CN
VAD MSC Voicing coding SID
DTX
SP
DTX Processing
Proce- Informa- BTS tion ssing
VAD: Voice Activity Detection TAF: Time Adjust Flag
SID: Silence Indicator BFI: Bad Frame Indication
CN: Comfort Noise SP: Speech Flag
Voice Activity Detection

Voice Activity Detection (VAD) indicated the time to use DTX. When DTX is activated, it is used to detect whether voice or noise is transmitted. VAD algorithm and voice coding/decoding algorithm is closely related. This algorithm judges whether voice or noise is contained in the output frame by comparing the filter signal and the configured threshold. It also indicates whether the auxiliary bit of this frame is transmitted. This judgement is based on the principle of the energy of noise being lower than that of voice. VAD generates a group of threshold values in each voice block of 20 ms for judging whether the next voice block of 20 ms is voice or noise. If the background noise is too loud, it will be transmitted as the voice signal.
Silence descriptor
The noise coding process is similar to that of voice coding process: after sampling and quantization, each 20 ms will be encoded as a noise block. The encoded noise block will also become a block of 260 bits like the voice block. This is a Silence Descriptor (SID). SID frame is applied to channel encoding, interleaving, ciphering and modulating like voice frame to become a field containing noise message and be transmitted in the 8 consecutive bursts. A complete SACCH message block on TCH has four 26-multiframe (480 ms). To enable the peer end to differentiate the voice frame and SID frame, these 8 consecutive bursts are fixedly arranged at the beginning of the third multiframe. Other frames (excluding SACCH) within the same period will not be used to transmit any message.
The SID frame generated from 20 ms noise block completes the process of interleaving together with the SID frames before and after it. The first SID frame completes the interleaving together with the voice frame before it and the SID frame after it.
The DTX functions are optional, independent in the direction of uplink/downlink and based
46
Issue 01 (2006-09-20)
1 Basic Functions
on the control unit of a cell. The uplink and downlink DTXs are two processes independent to each other, and are activated by system parameters respectively. There measurement methods in GSM system:
Global measurement: average the levels and quality of the 100 timeslots within the entire period (totally 4 TCHs of 26-multiframe, idle frame not included) Partial measurement: average the levels and quality of 12 timeslots, including 8 consecutive TCH bursts and 4 SACCH bursts containing measurement report. To ensure the consistency, no matter whether the uplink or downlink activates DTX, BTS and MS should both complete these two types of measurement. Since each SACCH measurement report of BTS and MS indicates whether DTX is used, BSC can select whether to use global measurement or partial measurement to judge according to according to the measurement report.
No matter whether DTX is used, the uplink and downlink will proceed with global and partial measurement.
DTX, which is applicable for voice and non-transparent data transmission, involves the operations of MS and TRAU. No matter whether DTX is used or not, the decision-maker is MSC and the executor is BSC.
1.14.3 Parameter
The parameters involved is listed Figure 1.1. Figure 1.1 Parameters related to DTX Name UL DTX Unit None Range Allowed, Mandatory, Forbidden Default Mandatory Description Uplink DTX, Indicates whether the discontinuous uplink transmission of MS is enabled in the last measuring period. See Protocol 0508.
1.15 Frequency Hopping

1.15.1 Overview
The purpose of frequency hopping (FH) is for obtaining better security and anti-interference capability. There are fast FH and slow FH. Fast FH means that the change rate of frequency is faster than modulation rate of signal. In GSM system, it is required that the frequency should remain unchanged within a burst period. Therefore, the FH in GSM system belongs to slow FH. It involves frequency diversity and interference diversity technologies. The frequency occupied by channel in the Um interface of GSM system is changed regularly. The frequency of changing frequency is about 217 times per second. The FH can avoid the attenuation caused by multi-path transmission and same frequency interference, and improve the average C/I of the interference restriction system (especially in cities), thus greatly improving the quality of session, strengthening the capability of highdensity multiplexing and increasing the system capacity. Adopting FH can improve the
Issue 01 (2006-09-20)
47
1 Basic Functions
transmission quality of the slowly moving MS by 6, 5 dB. Besides, FH can also improve the security of communication.
1.15.2 Technology Description

FH modes
FH means that the carrier containing meaningful information hops under the control of a sequence. This sequence is called frequency-hopping sequence (HSN). An HSN is an array of all frequencies in a frequency set uniquely defined with HSN, Mobile Allocation Index Offset (MAIO) and Frame No. (FN) by using certain algorithms. Channels on different timeslots (TN) can use the same HSN. Different channels on the same timeslot in the same cell should use different MAIOs. FH mode can be divided into frame FH and timeslot FH by the concept of time-domain. FH mode can be divided into RF FH and base band FH by carrier realization mode. Huawei BSS realizes the base band FH at timeslot level, RF FH at timeslot level, base band FH at frame level and RF FH at frame level.
Frame FH
Frequency changes for each TDMA frame. In the mode, each carrier can be regarded as a channel. The TRX which bears BCCH cannot be used for FH while other different TRXs should have their own MAIO. This is the expiation of timeslot FH.
Timeslot FH
Frequency changes for each timeslot of each TDMA frame. The non-BCCH of the TRX which bears BCCH can be used for FH. But currently it is realized only on the occasion of base band FH.
RH FH
Both Tx and Rx can be both used in FH. In a cell, the number of FH frequencies engaged in FH can be larger than the number of TRX. The RF FH of the M900/M1800 BTS is enabled through real-time switchover between two frequency synthesizers. There are two advantages for this implementation: first, lower speed requirements of the frequency synthesizer can be practical, i. e. the speed requirements are easier to implement; second, one of the two frequency synthesizers serves as the standby when there is no FH to enhance system reliability. Huawei BTS adopts dynamic loop bandwidth and Ping-Pong handover to solve the inconsistency between fast FH and signal quality, and realize the unrestricted FH in GSM 900 bandwidth of 25 MHz and DCS 1800 bandwidth of 75 MHz. All FH indices satisfy the requirements in GSM protocols. Dynamic loop band width technologies: local oscillation signal is mainly decided by reference clock (phase discrimination frequency), voltage controlled oscillator and loop bandwidth, etc. The phase noise of local oscillation within the loop bandwidth is decided by reference clock, and that beyond loop bandwidth is decided by collage controlled oscillator. During the operation of Huawei BTS, loop bandwidth needs to be dynamically adjusted along with the needs of system. If the system is not in the working status, loop bandwidth changes back to best bandwidth, so that the output signal can be the best, and the best performance of the
48
Issue 01 (2006-09-20)
1 Basic Functions
system can be guaranteed. Ping-Pong handover: Two identical oscillators are designed on the circuit. A switch is in charge of selecting between these two oscillators. When one oscillator is working, the other one locks on the next frequency quickly. Switching to another oscillator is realized with a switch between two timeslots. This avoids the instant performance worsening at the beginning and end of the timeslot.
Base band FH
Each transmitter works on a fixed frequency. Tx is not involved in FH. The transmitting FH is realized by switching the base band signal. Rx is involved in FH. Therefore the number of FH frequencies in a cell cannot be larger than number of the TRXs of the cell. When a TRX is faulty, the system will stop FH. For base band FH, the parameter TRX Aiding Function Control in the [cell configuration table] must be set to Allowed & Recover When Check Res.. When base band FH is opened, if some TRXs in the FH group are faulty, the serious voice disconnection, caused by frame lost, will appear during call. After TRX Aiding Function Control is set to Allowed & Recover When Check Res., the system will close base band FH function in this case. When those TRXs recover, system will activate FH on resource checking. If the base band FH must be opened, the faulty TRXs must be removed from the FH group. Huawei BTS adopts the technology of (FH_BUS), which implement FH on the basis of timeslot exchange. Each transmitter is tuned to a fixed frequency, and has a fixed ID. The coder of transmitter encodes the downlink signal to convert the data to burst format. It calculates the channel (i. e. TRX) to be modulated for the burst according to FH algorithm, and adds the attached information related to power control to generate a special data packet. The coder transmits the data packet periodically (sub-timeslot). Modulator checks the TRX ID of the data packet from each sub-timeslot. If the TRX ID is different from the local TRX, it will receive that from the next sub-timeslot. If the TRX IDs are the same, it will accept the data packet, and delay for a timeslot and then transmitted to the air interface. Base band FH has a very high requirement on the real-time identification of the ID of TRX. Huawei base band FH technology realizes fast and reliable TRX ID identification on the basis of the ASIC.
FH algorithm
Parameters involved:

CA: Cell allocation table, i. e. the collection of frequency ID used in the cells. FN: TDMA frame No., broadcast on the synchronous channel. BTS and MS achieve synchronous with FN (02715647). MA: the radio frequency ID collection for MS FH, a subset of CA. M contains N frequency Ids, 1 N 64. MAIO: Mobile Allocation Index Offset (0N-1). During communication, the radio frequency ID adopted on air interface is an element in MA. MAI (Mobile Allocation Index, 0N-1): indicating an element in MA, In other words, the frequency actually used is decided by MAI. MAIO is an initial offset of MAI. Its purpose is avoid multiple channels contends the same carrier. HSN: FH serial No. (generator) (063). If HSN = 0, it will be cycle FH, and if HSN 0, it will be random FH.
The process of calculating the actual working frequency on each FH timeslot is as shown in
Issue 01 (2006-09-20)
49
1 Basic Functions
Figure 1.1. Figure 1.1 FH algorithm

MAI (m0~mN-1) MAIO (0~N-1) FN T3(0~50) 6bit HSN (0~63) 6bit FN T1(0~2047) 11bit FN T2(0~25) 5bit
NBIN bit
T1R=T1 MOD 64 Represent in 7 bit 6bit Exclusive OR 6bit Addition 7bit Look-up table 7bit Addition 8bit T=T3 mod 2^NBIN NBIN bit N M'=M mod 2^NBIN NBIN bit M'<N Y 7bit
S=(M'+T) mod N NBIN bit MAI=(S+MAIO) mod N
S=M'
NBIN bit RFCN=MA(MAI)
In the figure above:

MAI = (S + MAIO) MOD N (S is the result after calculating the frame No.) RFCHN = MA (MAI) mod: MOD ^: power NBIN: INTEGER(log2N + 1) Table: see Figure 1.1.
Figure 1.1 "Table" meaning table Address 000009 010019 Content 48 0 98 64 63 25 1 81 36 76 95 59 78 124 102 23 94 104 73 100
50
Issue 01 (2006-09-20)
1 Basic Functions
020029 030039 040049 050059 060069 070079 080089 090099 100109 110113
101 80 55 87 82 77 117 16 91 129
47 34 111 19 58 108 114 49 15 99
118 127 75 3 40 122 4 7 21 17
85 13 38 68 107 37 90 79 24 123
18 6 109 110 32 60 43 119 46
56 89 71 26 5 66 52 61 39
96 57 112 33 106 121 53 22 93
86 103 29 31 92 42 113 84 105
54 12 11 8 62 51 120 9 65
2 74 88 45 67 126 72 97 70
Concept synchronous cell

The concept of synchronous cell plays an important role in planning FH strategy and lowering intra-network interference. BTS and MS achieve synchronization through their agreement on FN. In synchronous cell, since the FNs of all TRXs are completely the same, it is possible for different FH groups to use the same HSN. Adjust MAIO to avoid the collision between cells and the adjacent frequencies of the same cell.
1.15.3 Parameter
FH data configuration sequence: CAMAHSNMAIO Four parameters of FH algorithm: MA = {f1, f2,,fN}, HSN, MAIO, FN The parameters involved are listed Figure 1.1. Figure 1.1 Parameters related to Frequency Hopping Name FH mode Unit None Range Not FH, baseband FH, RF FH Defau lt None Description Determines whether the frequency hopping is used and which frequency hopping mode is used.
Issue 01 (2006-09-20)
51
1 Basic Functions
Valid carrier frequency 063
None
1-124 (900MHz band), 512-885 (1800MHz band), 955-974 (R-GSM extended band), 0 and 975-1023 (E-GSM extended band)
None
Used to configure the frequency to be occupied by the TRX. In the case of no frequency hopping, one frequency is configured; in the case of frequency hopping, at most 64 frequencies can be configured. The frequency to be configured should be a valid one and an interval of at least 6 frequencies between two configured frequencies is required. The logical number for frequency hopping data. TRX uses this parameter to index HSNs. Internal index number providing an association between the radio channel configuration table and the frequency hopping data table. 0 represents that the sequential frequency hopping and other values represent the pseudorandom frequency hopping. The [HSN] of all channels in a cell should be the same. MS can not access if HSN is greater than 63.Hopping sequence number, it should be consistent with the 64 types of FH sequence. Training sequence code. In cells that use FH, TSC must be set to be the same as the BCC in the cell. Otherwise, the TCH channels cannot be properly occupied.
FH index No.
None
0-65535
None
HSN
None
0-63
None
TSC
None
0-7
None
52
Issue 01 (2006-09-20)

BSC Basic Functions

Transféré par

Informations du document

Copyright

Formats disponibles

Partager ce document

Partager ou intégrer le document

Options de partage

Avez-vous trouvé ce document utile ?

Ce contenu est-il inapproprié ?

Droits d'auteur :

Formats disponibles

BSC Basic Functions

Transféré par

Droits d'auteur :

Formats disponibles

M900/M1800 Base Station Controller Feature Description

Huawei Technologies Proprietary

M900/M1800 Base Station Controller Feature Description

Huawei Technologies Proprietary

M900/M1800 Base Station Controller Feature Description

Huawei Technologies Proprietary

M900/M1800 Base Station Controller Feature Description

Huawei Technologies Proprietary

M900/M1800 Base Station Controller Feature Description

Huawei Technologies Proprietary

M900/M1800 Base Station Controller Feature Description

Radio channel management Channel coding/decoding Transcoding & Rate Adaptation

Huawei Technologies Proprietary

M900/M1800 Base Station Controller Feature Description

DCCH BCCH CCCH SDCCH Downlink Uplink ACCH

SCH FCCH BCCH (BCCH1) (BCCH2) (BCCH3)

Figure 1.1 illustrates the logical channels. Below is the introduction.

Huawei Technologies Proprietary

M900/M1800 Base Station Controller Feature Description

Broadcast Channel (BCH)

BCCH (Broadcast Control Channel)

Huawei Technologies Proprietary

M900/M1800 Base Station Controller Feature Description

Common Control Channel (CCCH)

Packet Common Control Channel (PCCCH)

Dedicated Control Channel (DCCH)

Huawei Technologies Proprietary

M900/M1800 Base Station Controller Feature Description

Packet Dedicated Control Channel

1.2.2 Radio Channel Management

Huawei Technologies Proprietary

M900/M1800 Base Station Controller Feature Description

Radio Channel Combination

Traffic Channel Management

Dedicated Control Channel Management

Broadcast Channel And Common Control Channel Management

Terrestrial Channel Management

Huawei Technologies Proprietary

M900/M1800 Base Station Controller Feature Description

Channel Coding & Decoding

Transcoding & Rate Adaptation

Huawei Technologies Proprietary

M900/M1800 Base Station Controller Feature Description

1.3 System Information

Huawei Technologies Proprietary

M900/M1800 Base Station Controller Feature Description

Types and Content Of System Information

Huawei Technologies Proprietary

M900/M1800 Base Station Controller Feature Description

Huawei Technologies Proprietary

M900/M1800 Base Station Controller Feature Description

Meaning and Function Of Wireless Network Parameter

Huawei Technologies Proprietary

M900/M1800 Base Station Controller Feature Description

Huawei Technologies Proprietary

M900/M1800 Base Station Controller Feature Description

1.4 Idle Mode Behavior

Huawei Technologies Proprietary

M900/M1800 Base Station Controller Feature Description

Huawei Technologies Proprietary

M900/M1800 Base Station Controller Feature Description

The idle mode task can be subdivided into four processes:

PLMN selection Cell selection Cell reselection Location updating.

User Selection of PLMN