Wireless Communications

Technologies
1

JAMEL HATTAY
2017
 Wireless Network Panorama
2

Outdoor
Satellites
TFTS, GPS
LEOS

Mobile Network
Wi-max
Cognitive 2G – EDGE- 3G
LTE
Public Using Wireless Applications
Home-RF, Bluetooth, Li-Fi LANs

Indoor
Wireless networks
3
Wireless WANs
Cellular Networks: GSM, GPRS, EDGE, UMTS, HSPA
and LTE
Mobile Packet Core Modernization
Wireless LANs
Wi-Fi Networks: 802.11
Personal Area Networks: Bluetooth
Li-Fi
Wireless MANs
WiMaX Networks: 802.16
Hotspots and Adhoc
Cognitive Radio
 4

Cellular Networks and

Mobile Packet Core
Modernization
Global System for Mobile Communication GSM
5

I. GSM Network Architecture

II.Radio Access network RAN
III.
Interfaces and protocols
IV.Some procedures
a) Network registration
b) Location Update
c) Mobile originating call MOC
d) Mobile terminating call MTC
e) Handover procedure
f) Roaming
V. Packet services for GSM: GPRS and EDGE
 Classical network Prepaid System and IN
6 PPS
PPS

OMC
OSS

GRAN : GSM Radio Access network

Mobile or BSS : Base Sub System Core network : CN
Station Or NSS: Network Sub System
GSM Network Architecture
7

Mobile Station (MS)

Mobile Equipment (ME)
Subscriber Identity Module (SIM)
Base Station Subsystem (BSS) or GRAN
Base Transceiver Station (BTS)
Base Station Controller (BSC)
Network Switching Subsystem(NSS) or CN
Mobile Switching Center (MSC)
Home Location Register (HLR)
Visitor Location Register (VLR)
Authentication Center (AUC)
Equipment Identity Register (EIR)
Mobile Station : Terminal Equipment (TE)
8

The Terminal Equipment (TE) is the computer terminal

that the end-user works on.
Radio equipment
User interface
Voice and data transmission
Call signaling
SMS

Identified by an IMEI (International Mobile Equipment

Identity): It is a serial number, allocated by equipment
manufacturer, registered by network, and stored in EIR.

Power level : 0.8W – 20 W

Mobile Station : Subscriber Identity Module(SIM)
9

Mobile Subscriber ISDN number MSISDN: The “real

telephone number”: assigned to the SIM.
Note that: The SIM can have several MSISDN numbers
for selection of different services like voice, data, fax (like
mobirif services)

+216 98 316 733

CC NDC SN

CC: Country Code

NDC: National Destination Code (NDC identifies operator)
SN: Subscriber Number;
Mobile Station : Subscriber Identity Module(SIM)
10

International Mobile Subscriber Identity IMSI

When subscribing for service with a network, subscriber
receives (IMSI) and stores it in the SIM (Subscriber
Identity Module) card. The HLR can be identified by a
VLR/MSC from the IMSI.
605 02 07 01288932
MCC MNC HLR MSIN

MCC: Mobile Country Code (Three digits)

MNC: Mobile Network Code (Two digits)
MSIN: Mobile Subscriber Identification Number (Two digits
for HLR and eight digits for MSIN)
Mobile Station : Subscriber Identity Module(SIM)
11

Mobile Station Roaming Number MSRN

It is temporary location dependent ISDN number
It is assigned by local VLR to each MS in its area.

Temporary Mobile Subscriber Identity (TMSI)

It is an alias of the IMSI and is used in its place for
privacy.
It is used to avoid sending IMSI on the radio path.
It is an temporary identity that is allocated to an
MS by the VLR at inter-VLR registration, and can
be changed by the VLR
TMSI is stored in MS SIM card and in VLR.
Base Transceiver Station BTS
12
Base Transceiver Station BTS
13

Set of modules to encode, encrypt,

multiplex, modulate and feed the RF
signals to the antenna.
Communication with MS and BSC
Consists of Transceivers (TRX) units
denoted by the TRUs or RUSs
BTS contains two, three or four cells
where each cell represents the basic
geographic unit of a cellular system
A cluster denotes a group of cells
where no channels are reused.
Indoor or outdoor BTSs:
Pico BTS
Micro BTS
Macro BTS
Umbrella BTS
Base Station Controller BSC
14

Manages Radio
resources for BTS

Assigns Frequency
and time slots for all
MS’s in its area

Handles call set up

Handover for each
MS
Radio Power control
It communicates with
MSC and BTS
BTS vs BSC in GRAN
15
Tasks distribution in GRAN over BSC and BTS
BTS comprises radio specific functions
BSC is the switching center for radio channels
Functions BTS BSC
Management of radio channels X
Frequency hopping (FH) X X
Management of terrestrial channels X
Mapping of terrestrial onto radio channels X
Channel coding and decoding X
Rate adaptation X
Encryption and decryption X X
Paging X X
Uplink signal measurements X
Traffic measurement X
Authentication X
Location registry, location update X
Handover management X
Transcoding Rate and Adaptation Unit (TRAU)
16

Performs coding between

the 64kbps
PCM coding used in the
backbone network and the
13 kbps coding used for
the Mobile Station (MS)
Mobile Switching Center MSC
17

controls all connections

via a separated network
to/from a mobile terminal
within the domain of the
MSC
several BSC can
belong to a MSC
MSC functionalities
18

Switching functions
Additional functions for mobility support (HO)
Management of network resources
Interworking functions via Gateway MSC (GMSC)
Specific functions for paging and call forwarding
Termination of SS7 (signaling system no. 7) to NGN and IN
Mobility specific signaling
Location registration and forwarding of location information
Provision of new services (fax, data calls)
Support of short message service (SMS) via the SMSC
Home Location Registers (HLR)
19

Stores information about each subscriber that belongs to it

MSC in permanent and temporary fashion.
As soon as mobile subscriber leaves its current local
area, the information in the HLR is updated.
database contains IMSI, MSISDN, prepaid/ postpaid,
roaming restrictions, supplementary services.

MSISDN:IMSI:VLR:OPTIONS
21698367709:605020701288932:6050204:deviation, call OK,….
21698316733:605027702516097:6050306:deviation, call OK,….
21698367393:605025705097638:2080109:deviation, call OK,….
Visitor Location Registers (VLR)
20

Temporary database which updates whenever new MS

enters its area, by HLR database
Controls those mobiles roaming in its area
Reduces number of queries to HLR
Database contains IMSI,TMSI,MSRN,LAC, key Ki

IMSI:TMSI:STATUS:LAC
605020701288932:7898236384232:ON: 154 (active in Monastir)
605027702516097:7528916431559:Off: 140 (not active in Mahdia)
208010956241893:7658432197478:ON: 132 (French visitor in Sousse)
Authentication Center (AUC)
21

Contains the algorithms for authentication as

well as the keys for encryption.
Protects network operators from fraud.
Situated in special protected part of the HLR.
Equipment Identity Register (EIR)
22

Stores all devices identifications registered for this

network.
Database that is used to track handsets using the IMEI
(International Mobile Equipment Identity)
Prevents calls from stolen, unauthorised or defective
mobile devices
Operation and maintenance center (OMC)
23

The centralized operation of the various units in the

system and functions needed to maintain the
subsystems.
Dynamic monitoring and controlling of the network.
Functions :
- configuration management
- fault report and alarm handling
- performance supervision/management
- storage of system software and data
Radio interface : FDMA
24

Uplink Downlink

200 kHz

1 2 3 … 124 1 2 3 … 124

890 MHz 915 MHz 935 MHz 960 MHz

Radio interface : TDMA
25
935-960 MHz
124 channels (200 kHz)
downlink
890-915 MHz
124 channels (200 kHz) higher GSM
uplink frame structures
(TRX)
time

GSM TDMA frame (TRX)

1 2 3 4 5 6 7 8
4.615 ms

GSM time-slot (normal burst)

guard guard
tail user data S TrainingS user data tail
space space
3 bits 57 bits 1 26 bits 1 57 bits 3
546.5 µs
577 µs
Radio interface : Speech Processing
26
300 Hz – 3.4kHz Speech Speech
12bit 96kbps
8kHz Speech coding 1920bit / 20ms Speech decoding
13 Kbps: 260bit / 20ms
Channel Coding Channel decoding
22.8 Kbps : 456bit / 20ms
Interleaving De-interleaving
22.8 Kbps
Burst Formatting Burst Formatting
33.6 Kbps
Ciphering De-ciphering
33.6 Kbps
Radio Interface
Modulation Demodulation
270.83 Kbps
Modulation GMSK
27

Gaussian Minimum
Shift Keying
Phase and
frequency modulation

Bandwidth = 200 kHz

Modulation rate
270.833 kbps

1 digit = 3.7 µs
Logical Channels
28
Logical Channels
29

I. Traffic channels: They are further categorized as Half

Rate (6.5kbps), Full Rate (13kbps)
II. Control channels:
1. Broadcast channels (BCH) are one to many down
link channels used by the network to transmit various
types of information in the down link to all users in the
cell.
2. Common Control Channels (CCCH) are the channels
used by all/for all mobiles
3. Dedicated Control Channels (DCCH), as the name
suggests are point to point bi directional channels used
to carry dedicated signaling between mobile station
(MS) and the network.
Logical Channels: BCH
30

Frequency Correction Channel (FCCH): This channel is

used by the Mobile to tune on to the frequency. This an all
zero channel transmitted by the network and mobile uses this
information to tune in and correct frequency errors if any.
Synchronization Channel (SCH): This channel is used by
the mobile to synchronize with the network contains the Base
Station Identity Code (BSIC) and TDMA frame number.
Broadcast Control Channel (BCCH): Used by the network
to transmit various information necessary for the UE to avail
services (frequencies used in the NW, hopping
sequence, neighbor cell information, Location Code etc).
These are the information needed for the mobile for its
operation (like camping on to the cell, MO and MT call)
Logical Channels: CCCH
31

Random Access Channel (RACH): This is an uplink only

channel used by the mobile station when it has to access the
network and there is no dedicated channel allocated. This is
used for ex during the paging procedure or during an MO call
setup procedure for requesting dedicated resources.
Access Grant Channel (AGCH): This is a downlink only
channel used by the network to grant the access request
made by the mobile station. Network may assign SDCCH on
which further transaction will be performed.
Paging Channel (PCH): Paging channel is a downlink only
channel used by the network for performing paging.
Logical Channels: DCCH
32

Standalone Dedicated Control Channel (SDCCH): This

channel is used to carry all the call setup signaling
information including message from Layer3 procedures (for
ex, authentication, ciphering). A TCH will be
allocated depending on the scenario.
Fast Associated Control Channel (FACCH): Used when
fast signaling needs to be performed such as in handover
scenarios.
Slow Associated Control Channel (SACCH): Used to
transmit call related and radio link related control data
during speech connection. Used also to transmit
measurement related parameters and reports.
Interfaces
33
Interfaces
34

The A interface connects the Mobile Services Switching

Center (MSC) with the TranscoderTC

The A-ter interface connects the Transcoder with the Base

Station Controller (BSC)

The A-bis interface connects the BSC with the Base

Transceiver Station (BTS)

Finally, the data is transmitted to the mobile station via the

air interface
 Protocols
CM CM
35
MM
MM
BSSMAP BSSMAP

RRM RRM BTSM BTSM SCCP SCCP

LAPDm LAPDm LAPD LAPD MTP MTP

Radio Radio 64 Kbps 64 Kbps 64 Kbps
64Kbps

Mobile Base Station

Base Transceiver Mobile Service
Station Controller
Station Switching Center

BSSMAP = BSS Mobile Application part MM = Mobility Management

BTSM = BTS management MTP = Message Transfer Part
CM = Connection Management RRM = Radio Resources Management
LAPD = Link Access Protocol, D Channel SCCP = Signal Connection Control Point
36
37
Network registration 1/3
38

After the subscriber has switched on his mobile station and

typed in his PIN code, the mobile station searches for a
network
But how does it log on to the network the subscriber is
registered with?
For this purpose, the BTS sends out the Frequency
Correction Channel (FCCH) at short regular intervals, to
help the mobile station find a frequency for downlink
reception and adjust its frequency oscillator for the uplink
transmission
To do so, it picks out the strongest received signal
Network registration 2/3
39
The Synchronization Channel (SCH) then helps the mobile
station to synchronize itself to timeslot 0 sent out by the
BTS
This means the mobile station must adjust to the rhythm
given by the BTS
The SCH contains the TDMA frame number as well as the
Base Station Identity Code, containing basic information
about the network operator that can be compared with the
info stored on the SIM card
After this step, the mobile is able to decide whether it has
chosen the proper network. If not, it starts the same
procedure again trying with the second strongest FCCH
received
Network registration 3/3
40

While the mobile station uses the FCCH to adjust its

frequency, and the SCH for synchronization and network
identification, the Broadcast Control Channel (BCCH),
which is also sent by the BTS, supplies the mobile station
with additional information about the selected cell.
For some Value Added Services, for example location-
dependent services, additional information has to be
transmitted from the BTS to the mobile
The Cell Broadcast Channel CBCH is used for this purpose
to transmit geographical parameters.
•The FCCH, SCH, BCCH and CBCH are Broadcast
Channels, and exist only in the downlink
Location Update
41
MOC & MTC procedures 1/2
42
Mobile BTS BSC MSC
RACH Channel Request Channel Required

Channel activation

Chan activation ack

Immediate assignement CMD

AGCH
Immediate assignment

SDCCH CM Service Request

Establishment indication
CON. REQUEST
UA (CM Service Request)

Authentification Request

Authentification response

Ciphering Mode Command

Ciphering Mode Complete

SETUP (N°Demandé)

Call proceeding
MOC & MTC procedures 2/2
43
Assignement Request
Channel activate

Channel activate ack

Assignement Command
Assignement Command

TCH
Establishment indication

Assignement Complete

Assignement Complete

Assignement Complete

ALERTING

Connect

Connect Ack

RF Channel Release

Relâchement du canal SDCCH RF Channel Release

MTC = MOC + PCH

Handover Procedure
44

Measurement Measurement Report

Report Uplink & Downlink

BSC1
1 2

3 HO Required
3

4
BTS HO command BSC2
7

HO command
6 Ack
HO Request 4 5
&
HO command
jusqu'au mobile
MSC
GPRS Architecture
45

BTS MSC/VLR HLR

BSC Serving GPRS support node:

SGSN - packet routing, mobilty management,
- authentication, ciphering

IP
network
Notebook+GPRS Mobile
Mobile GGSN
backbone
network Gateway GPRS
support node Other DATA
network
GGSN = Gateway GPRS Support Node
SGSN = Service GPRS Support Node

IP Terminal
GPRS Protocols and interfaces
46

MS Um GRAN Gb SGSN Gn GGSN Gi

apps.

IP IP

SNDCP GTP
SNDCP GTP
LLC LLC UDP/TCP UDP/TCP

RLC BSSGP IP IP
RLC BSSGP

MAC MAC
FR FR L1/L2 L1/L2
radio radio
GPRS, EDGE… almost 3G
47

Based on specifications in Release 97, GPRS typically reached

speeds of 40Kbps in the downlink and 14Kbps in the uplink by
aggregating GSM time slots into one bearer. Enhancements in
Releases R’98 and R’99 meant that GPRS could theoretically
reach downlink speeds of up to 171Kbps.
The next advance in GSM radio access technology was EDGE
(Enhanced Data rates for Global Evolution), or Enhanced GRPS.
With a new modulation technique yielding a three-fold increase
in bit rate (8PSK replacing GMSK) and new channel coding for
spectral efficiency, EDGE was successfully introduced without
disrupting the frequency re-use plans of existing GSM
deployments.
GPRS & EDGE modulation
48

In project, requires the replacement of TRUs and UEs

Compatible with other equipment

GMSK EDGE Modulation

Modulation (0,1,0) Q
(0,0,0) (0,1,1)

1 0
I I
(0,0,1) (1,1,1)

(1,0,1) (1,1,0)
1 bit par symbols (1,0,0)

3 bits per symbols

 49

Mobile Packet Core

Modernization
2G 3G
Mobile Softswitch Solution
50
Classic MSC Solution Mobile Softswitch Solution

MSC Server
Classic MSC MSC-S (Control)
MSC
(Control and Switching)
Mobile Media Gateway
MGw
(Switching)

Classic circuit-switched network Layered Architecture network

MSC-S Control Layer

MSC
Connectivity Layer
MGw

MSC
TDM MSC MGw IP MGw

MSC MSC MGw MGw

 MSC-S Blade Cluster
51
MSC Server Blade Cluster
MSC-S
Cluster
application on
Generic MSC-S MSC-S MSC-S Pool MSC-S MSC-S
blade blade blade blade blade
Processor
Blades for
traffic handling
Input/output
1+1 1+1 1+1
(I/O) is the
Signaling Signaling proxy
O&M interface
Proxy (SPX)
for
hides the SIS I/O
MSC blades
blade
and Signaling
structure from
Proxy
outside
networks M-MGW Site Infrastructure
OSS
Support (SIS) is the
O&M interface for the
RAN CN
site infrastructure
Mobile MGW node
52
Single cabinet,
0.48 m2
Connects the Mobile Core
Network with other networks, e.g.
3300 W
Radio Access (WCDMA, GSM),
PSTN Up to 30 kE
Bridges different transmission
technologies
Signaling Gateway & Signaling
Transfer Point
Virtual Media Gateway 800 mm

600 mm
Serving GPRS Support Node: SGSN
53

› The SGSN provides packet data

switching in GSM and WCDMA
Systems, including routing, mobility and
session management, and charging
functions.
› Capacity:
– 2000 kSAU
– 3000 kPDP
› Features:
– Dual Access (GSM & WCDMA)
– Gb over IP
– HSDPA up to 48 Mbps
SGSN functionalities
54

Provides the number of Simultaneously Attached Users

(SAU), and indicates the probable load on the SGSN. The
higher the number of SAU, the more the load.
Lists all the Mobility management KPIs, such as RAU
failures and Paging Failures.
Lists all the Traffic management KPIs, such as instance
Total Uplink, Total Downlink, and Number of PDP.
Lists all the Accessibility management KPIs, such as
instance Attach failure, RAB establishment failure, and PDP
Context Activation Failure.
Gateway GPRS Support Node GGSN
55

Acts as a gateway between mobile packet core networks

and other packet data networks (i.e Internet)
Responsible for session management within the mobile
network, as well as for encapsulation and de-
encapsulation of bearer traffic sent to and from the SGSN.
Capacity:
up to 6000 kPPS
up to 6000 kPDP
20 Gbps
Features:
HSDPA up to 48 Mbps
3G Direct Tunnel
Direct Tunnel Feature
56

Direct Tunnel is an optional feature in Iu mode that allows

the SGSN to establish a direct user plane tunnel between
RAN and GGSN within the PS domain.
PDP context Management
57

A Packet Data Protocol PDP context provides access to an external

packet-switching network .

The data associated with the PDP context is as follows:

Access point name (APN). This is the reference to a GGSN.
PDP Type
PDP address type
QoS profile request
Authentication type (PAP or CHAP)
DNS type (Dynamic DNS or Static DNS)

PDP Context is designed to allocate a PDP address, either IP v.4

or IP v.6 type of address, to the mobile terminal.
It is used to make a logical connection with QoS profiles, the set
of QoS attributes utilized by one PDP context
PDP context Management
58

In a UMTS network the data session is established with a

PDP Context Activation procedure. But, before the PDP
context can be established the UE must do an Attach
procedure.
Several PDP contexts can be activated at the same time in
the MS. Each of the Multiple PDP Contexts can at the
same time have different QoS profiles.
PDP context procedures have been defined in order to
create, activate modify, and delete PDP contexts within the
MS, SGSN, and GGSN entities. The SM protocol is used
between the MS and the SGSN and the GTP protocol is
used in the controlling plane between the SGSN and the
GGSN for PDP context procedures.
PDP context Management
59

Primary PDP context activation: This procedure is used to

establish a logical connection with the Quality of Service
(QoS) functionality through the network from the UE to the
GGSN. PDP context activation is initiated by the UE and
changes the session management state to active, creates
the PDP context, receives the IP address and reserves radio
resources. After a PDP context activation the UE is able to
send IP packets over the air interface. The UE can have up
to 11 PDP contexts active concurrently.
PDP context Management
60

Secondary PDP context activation: A secondary PDP

context activation allows the subscriber to establish a second
PDP context with the same IP address as the primary PDP
context. The two contexts may have different QoS profiles,
which makes the feature useful for applications that have
different QoS requirements (e.g., IP multimedia). The access
point name, though, will be the same for the primary and
secondary PDP contexts.
PDP context Management
61

PDP context modification: The UE, the SGSN or the

GGSN initiate this procedure for updating the
corresponding PDP context. Additionally, the radio access
network is able to request a PDP context modification from
the SGSN (e.g., when coverage to the UE has been lost).
The procedures modify parameters that were negotiated
during an activation procedure for one or several PDP
contexts.
PDP context deactivation: This procedure is used to
delete a particular logical connection between the UE and
the GGSN. The initiative to deactivate a PDP context can
come from the UE, the SGSN, the Home Location Register
(HLR) or the GGSN.
PDP context Management
62
PDP context Management
63
3GPP Network Architecture
64
Network Architecture
65

The RAN includes RNC, Node B and UE. RNC are

connected to Node B using the Iub interface.
Neighboring RNC are connected using the Iur interface. UE
are connected to Node B using the Uu interface.
The RAN is connected to the CN using the Iu interface.
Each Node B has a controlling RNC and each UE
connection has a serving RNC.
The serving RNC provides the Iu connection to the CN.
Drift RNC can be used by UE connections in addition to the
serving RNC.
More details
66
UTRAN in UMTS: Node B
67

Node B - Similar in function as BTS in GSM

Node B is responsible for transmitting both control and

user traffic destined to the UE over the radio interface,
and for receiving traffic from the UE. To this end it is
responsible for (de)spreading and (de)modulation as well
as for generation of CDMA codes.
UTRAN in UMTS: Node B
68

Furthermore, Node B is involved in radio resource

control: It measures the quality of the received signals
and makes this information available to the RNC. Based
on these measurements, the RNC may decide to attach
the UE to another cell.

Node B is involved in power control in order to counter

the near-far effect, The further away from the antenna,
the stronger the signal the UE must emit. Node B
measures the power of the incoming signal and tells the
UE whether it needs to adjust.
UTRAN in UMTS: RNC
69

The RNC is the main control node in the UTRAN. It is the

UE’s first contact point in the network. When a UE powers
up, it contacts the RNC responsible for its cell, establishes
radio connectivity, and only then attaches to the SGSN or
MSC.
The RNC performs the Radio Resource Control and
provisioning since it has an overview of all radio resources
attached to it (control, set-up, maintenance and release of
radio connections).
These radio connections are also called Radio Bearers
RABs
 Power Control schematically
70
The RNC and UE use Outer
Loop power control to calculate
The RBS and UE use Inner
UL and DL quality targets to
Loop to send UL and DL TPC’s
which the UE and RNC shall
(transmit power commands). P(SIR-Target,UL)
adjust its transmitted power.

1500 Hz! Inner loop

UL-
DL-TPC TPC
UL-Outer loop RNC
SIR-Target,UL
P(SIR-Target, DL)
CRC-Error,UL
DL-Outer loop
UE specific
Open loop
P(Start value)

Initial Power Setting in UL and DL uses Open

CRC = Cyclic Redundancy Check Loop. It ensures reliable connection setup,
SIR = Signal to Interference Ratio minimal impact on existing connections (UL) and
TPC = Transmit Power Commands avoids excessive power (DL).
Power Control overview
71

Inner loop PC
Fast PC included in every timeslot
1500 Hz
Measure the actual SIR & Compare with SIR-target
SIR ≥ SIR-target ⇒ Decrease power
SIR < SIR-target ⇒ Increase power
Outer loop PC
Adjust SIR-target based on BLER performance
Slower, per TTI basis updates
UL: Jump algorithm
Open loop PC: Initial power setting
RNC (continued )
72

Furthermore, the RNC is involved in power control.

Power control actually has two stages:
The “inner loop” performed by Node B
The “outer loop” performed by the RNC.

The Node B inner loop. This means that the RNC

determines the target power level the UE should
achieve based on the overall radio resource picture,
and Node B is responsible for enforcing this power
level.
RNC (continued)
73
The RNC, the Serving RNC to be precise, controls the
small-scale mobility of the UE, i.e. mobility across a small
number of cells, whereas the SGSN/MSC controls large
scale mobility, including roaming.
The Serving RNC decides, based on measurement reports
received from both UE and UTRAN, whether a handover is
necessary and then initiates this handover.
User data transport and routing: The RNC transports IP-
based traffic in the same way as an ordinary router.
Additionally, the RNC must protect the traffic by means of
encryption and integrity protection.
Broadcasting system information (identifier of the network,
location information, synchronization signals…)
Comparison of GSM and UMTS air-interfaces
74
UMTS FDD operating band I
75
 Radio Interface Protocol
76

The control plane protocol stack is used to transfer

signaling information whereas the user plane protocol stack
is used to transfer application data.
The control plane protocol stack includes RRC, RLC, MAC,
Frame Protocol and Physical layers.
The control plane can be used to transfer signaling
messages belonging to the higher layer Non-Access
Stratum, e.g. call control and mobility management
messages.
The user plane protocol stack includes BMC, PDCP, RLC,
MAC, Frame Protocol and Physical layers. The PDCP layer
is particularly important for applications like VoIP where the
overhead generated by the higher layers is relatively large.
Interfaces between protocol stack layers
77
Concept of Signaling Radio Bearer SRB
78
Radio interface user plane protocol stack
79

The radio interface user plane protocol stack is used to

transfer application data between an RNC and a UE.
In addition, some types of data may pass through the
Broadcast/Multicast Control (BMC) layer or the Packet
Data Convergence Protocol (PDCP) layer.
User plane protocol stack for the CS speech service
80

The RAB represents the logical connection between the UE

and the core network. RAB are service specific and so a
UE which is simultaneously using multiple services can
have multiple RAB, e.g. a UE which has a CS speech
connection while completing a PS file transfer has one RAB
to the MSC and a second RAB to the SGSN.
Logical, transport and physical channels for CS
81

An AMR speech connection makes use of one RAB with

three RAB subflows, three logical channels, three transport
channels and a single physical channel. The SRB are
configured in parallel to the speech connection and make
use of a further four logical channels and one transport
channel.
82
User plane protocol stack for Voice over IP (VoIP)
83

In the case of the 12.2 kbps AMR speech codec, the payload
is 244 bits per 20 ms speech frame. The IP header is 160 bits
when using IP version 4 (IPv4) or 320 bits when using IP
version 6 (IPv6). The UDP header is 64 bits and the RTP
header is 96 bits. This results in a total RTP/UDP/IP header
size of 320 bits (40 bytes) when IPv4 is used or 480 bits (60
bytes) when IPv6 is used.
 User plane protocol stack for PS
84

The FTP application makes use of the TCP/IP protocol

stack. A similar protocol stack can be used for internet
browsing by swapping the FTP application layer with the
HTTP application layer.
85
 HSDPA protocol stack
86

The release 5 version of the specifications introduces the use

of High Speed Downlink Packet Access (HSDPA). HSDPA is
able to offer high bit rate PS data connections in the downlink
direction. The HS-DSCH transport channel and HS-PDSCH
physical channel are introduced for this purpose.
The use of HSDPA does not change the RLC layer, but
introduces an additional MAC sublayer known as the MAC-hs.
The MAC-hs layer is located within the Node B and the UE.
 HSUPA protocol Stack
87

The release 6 version of the 3GPP specifications

introduces the use of High Speed Uplink Packet Access
(HSUPA). HSUPA is able to offer high bit rate PS data
connections in the uplink direction. The E-DCH transport
channel and E-DPCH physical channel are introduced for
this purpose.
 RRC layer
88

The RRC layer represents layer 3 of the control plane and

is located within the RNC and UE. It is responsible for all
signalling messages transferred between the RNC and UE.
RRC messages are used to establish, release and maintain
connections.
The RRC layer uses a state machine which includes RRC
Idle mode and RRC Connected mode. RRC Connected
mode includes CELL_DCH, CELL_FACH, CELL_PCH and
URA_PCH.
UE in RRC Idle mode have minimal resource requirements.
Their main tasks are cell selection and cell reselection,
reading system information and paging type 1 messages.
RRC states
89
 CELL_DCH and CELL_FACH
90

UE in CELL_DCH have the greatest resource requirement,

but have the potential to transfer large quantities of data.
Dedicated channels, HSDPA and HSUPA can be used in
CELL_DCH. Dedicated channels are applicable to both CS
and PS connections whereas HSDPA and HSUPA are
applicable to PS connections. Soft handover, inter-frequency
handover and inter-system handover are possible.
UE in CELL_FACH have a lower resource requirement than
UE in CELL_DCH. UE are required to receive continuously,
but not transmit continuously. UE have the potential to
transfer small quantities of PS data. The release 7 version of
the 3GPP specifications introduces HSDPA in CELL_FACH.
UE complete cell reselection and both inter-frequency and
inter-system handover are possible.
 CELL_PCH and URA_PCH
91

UE in CELL_PCH have a lower resource requirement than

UE in CELL_FACH, but cannot transfer uplink data. Only
downlink CBS and MBMS services are possible. The RNC
tracks the location of the UE on a per cell basis and paging
type 1 messages can be forwarded to individual cells using
a DRX cycle. UE complete cell reselection for intra-
frequency, inter-frequency and inter-system mobility. UE
are identified by their U-RNTI.
URA_PCH is similar to CELL_PCH except the RNC tracks
the location of the UE on a per URA basis rather than on a
per cell basis.
 RLC Layer
92

The RLC layer can be used in three different modes:

Transparent Mode (TM), Unacknowledged Mode (UM) and
Acknowledged Mode (AM).
TM is suitable for real time services, e.g. the speech and
video call services.
 Unacknowledged Mode (UM)
93

Unacknowledged Mode (UM) RLC is suitable for real time

services which have unpredictable higher layer packet
sizes, e.g. it can be used for the voice over IP (VoIP)
service.
 Acknowledged Mode (AM).
94

Acknowledged Mode (AM) RLC is suitable for non-real

time services which require reliable data transfer, e.g. it can
be used for file transfers, email and internet browsing.

Combination of RLC and TCP acknowledgments (downlink

data transfer)
95
 MAC Layer
96

The MAC layer is responsible for providing traffic volume

measurements from the RLC layer. These measurements
can be used to trigger capacity requests and capacity
releases.
The MAC layer is responsible for the determining the
Adjacent Channel Selectivity ASC from the MAC logical
channel priorities when in RRC connected mode. It also
controls RACH transmissions in terms of monitoring the
number of PRACH preamble cycles, running a back-off
timer after receiving an AICH negative acknowledgement
and completing persistency checks.
 Sub-layers
97

The RNC includes MAC-d, MAC-c/sh/m and MAC-es entities.

The Node B includes MAC-hs, MAC-e and MAC-b entities.
The UE includes MAC-d, MAC-c/sh/m, MAC-hs, MAC-e/es,
MAC-m and MAC-b entities.
MAC-d entities are responsible for the DCCH and DTCH
logical channels. These may be mapped directly onto DCH
transport channels or they may be forwarded to either the
MAC-c/sh/m, MAC-hs or MAC-e/es.
MAC-c/sh/m entities are able to multiplex different logical
channel types onto the same transport channel.
MAC-hs entities are used for HSDPA and MAC-e/es entities
are used for HSUPA
98
 Physical layer
99

The physical layer is responsible for processing the

transport blocks generated by the MAC layer and
subsequently using them to modulate the RF carrier.
The MAC layer within the UE can forward an uplink
transport block set to the physical layer once every
Transmission Time Interval (TTI).
A Node B can receive a downlink transport block set from
the RNC once every TTI. Transport block sets are
transferred across the Iub using dedicated channel Frame
Protocol data frames.
 Logical Channels
100

Logical channels are used to transfer data between the

RLC and MAC layers. The MAC layer provides the mapping
between logical channels and transport channels.
Logical channels define the type of information being
transferred. They are categorized as either control or trafic.
Control channels include the BCCH, PCCH, CCCH, DCCH,
MCCH and MSCH. These logical channels are responsible
for transferring RRC signaling messages.
Traffic channels include the CTCH, DTCH and MTCH.
These logical channels are responsible for transferring
application data. The DTCH is the only logical channel able
to transfer application data in the uplink/downlink directions.
 RRC Messages
101

BCCH: System Information, System Information Change

Indication
CCCH RRC Connection Request, RRC Connection Setup, RRC
Connection Reject, Cell Update, URA Update
 RRC Messages
102

DCCH: Active Set Update, Cell Change Order From

UTRAN, Downlink Direct Transfer, Handover from UTRAN
Command, Measurement Control, Measurement Control
Failure, Measurement Report, Physical Channel
Reconfiguration, Physical Channel Reconfiguration
Complete, Physical Channel Reconfiguration Failure, Radio
Bearer Reconfiguration, RRC Connection Release, RRC
Status, Security Mode Command,Transport Channel
Reconfiguration, Transport Channel Reconfiguration
Complete, UTRAN Mobility Information.
CCCH or DCCH RRC Connection Release, Cell Update
Confirm, URA Update Confirm
Logical channels mapped onto transport channels
103
 Transport Channels
104

Transport channels are used to transfer data between the

MAC and Physical layers. The physical layer provides the
mapping between transport channels and physical
channels.
Transport channels define how information is transferred.
They are categorised as either common or dedicated.
Common channels include the BCH, PCH, RACH, FACH
and HS-DSCH. These transport channels are mapped onto
common physical channels.
Dedicated channels include the DCH and E-DCH. These
transport channels are mapped onto dedicated physical
channels.
 Transport Channels
105

The BCH transport channel is used to broadcast system

information messages. The BCH is broadcast across the
entire area of a cell. A UE accesses the BCH whenever it
selects or re-selects a new cell. This could be in RRC Idle
mode or CELL_FACH, CELL_PCH or URA_PCH.
The PCH transport channel is used to broadcast paging
messages to UE which are in either RRC Idle mode or
CELL_FACH, CELL_PCH or URA_PCH.
The RACH transport channel is used when establishing a
connection from RRC Idle mode in CELL_FACH.. A single
RACH transport channel is used for both control plane
signalling and user plane data.
 Transport Channels
106

The FACH transport channel is the downlink equivalent of

the RACH.
The HS-DSCH transport channel is used for HSDPA. It is
used to UE in CELL_DCH or in CELL_FACH. The HS-
DSCH can be used to transfer both control plane signaling
and user plane data.
The DCH transport channel is used in both the uplink and
downlink directions. The DCH can only be used when a UE
is in CELL_DCH. DCH transport channels can be used to
transfer both control plane signalling and user plane data.
The E-DCH transport channel is used for HSUPA when a
UE is in CELL_DCH.
Transport channels mapped onto physical channels
107

The physical layer is responsible for mapping transport

channels onto physical channels at the transmitter.
Physical channels are then used to transfer the data across
the air-interface.
 Physical Channels
108

They are categorized as either common or dedicated.

Common channels can be used by more than a single UE.
Common channels include the SCH, CPICH, P-CCPCH, S-
CCPCH, PICH, AICH, PRACH, HS-PDSCH, HS-SCCH, E-
AGCH and MICH.
Dedicated channels include the DPDCH, DPCCH, F-DPCH,
HS-DPCCH, E-DPDCH, E-DPCCH, E-RGCH and E-HICH.
Physical Channels
109
 CPICH
110

The Primary CPICH allows the UE to identify the primary

scrambling code belonging to a cell. CPICH measurements
are used for cell selection and cell reselection. Soft
handover is also based upon CPICH measurements.
Likewise, inter-system and inter-frequency handover can
be based upon CPICH measurements. CPICH RSCP can
be measured directly whereas CPICH Ec/Io and path loss
are calculated. CPICH Ec/Io measurements are based
upon RSSI and exclude the benefit of downlink
orthogonality. the Primary CPICH is always spread using
channelisation code (SF256,0) and always scrambled
using the primary scrambling code assigned to the cell.
 SCH and P-CCPCH
111

The Primary and Secondary SCH are used during initial

cell synchronization. The Primary SCH is a sequence of
256 chips. It is repeated at the start of every time slot and is
used to achieve slot synchronization. The Secondary SCH
is a series of 15 sequences of 256 chips which repeat
every radio frame. Identifying three consecutive chip
sequences allows the UE to deduce radio frame timing and
the primary scrambling code group.
The Primary Common Control Physical Channel (P-
CCPCH) is responsible for broadcasting system
information messages using the BCCH logical channel and
BCH transport channel. P-CCPCH is always scrambled
using the primary scrambling code assigned to the cell.
 S-CCPCH and PICH
112

The Secondary Common Control Physical Channel (S-

CCPCH) is responsible for broadcasting information sent
on the PCH and FACH transport channels. The PCH is only
used for paging messages, i.e. control plane signaling,
whereas the FACH can be used for both control plane
signaling and user plane data.
The Paging Indicator Channel (PICH) is used to broadcast
Paging Indicators (PI) across the entire coverage area of a
cell. A positive PI is used to trigger a group of UE to decode
a paging message from within the S-CCPCH. The PICH is
always scrambled using the primary scrambling code and
is always spread using a fixed spreading factor of 256.
 Dedicated Physical Channel (DPCH)
113

The Dedicated Physical Channel (DPCH) can be used to

transfer user plane data and control plane signalling in both
the uplink and downlink directions. The DTCH and DCCH
logical channels are mapped onto the DCH transport
channel when using the DPCH physical channel. The
DPCH and DCH can only be used when a UE is in
CELL_DCH.
 HSDPA
114

HSDPA is introduced within the release 5 version of the

3GPP specifications. It provides a solution for achieving
increased individual connection throughputs, increased
total cell throughputs and reduced round trip times. HSDPA
is associated with packet switched services which can be
either real time or non-real time.
HSDPA connections use a fixed TTI of 2 ms. The
modulation scheme can be either QPSK (2 bits per symbol)
or 16-QAM (4 bits per symbol). The option of 64-QAM (6
bits per symbol) is introduced within the release 7 version
of the 3GPP specifications.
 Higher Order Modulation
115

16 QAM to be used when radio quality is good

E.g., close to base stations
Enables higher rates

2 bits/symbol 4 bits/symbol

QPSK
16QAM

To 64 QAM
 Shared Channel Transmission
116

HSDPA data channel is called HS-DSCH

A set of radio resources dynamically shared among
multiple users: in the time domain and in the code
domain
SF=1

SF=2

SF=4
Channelization codes
SF=8
allocated
SF=16
for HS-DSCH transmission
TTI 8 codes (example)

Shared
channelization
codes
User #1 User #2 User #3 User #4 User #5 (CODE MUX!)
 Dynamic Power Allocation
117

3GPP Release 99 3GPP Release 5

Power Power

Unused power
HS-DSCH (rate controlled)
Total cell power

Total cell power

Dedicated channels (power controlled) Dedicated channels (power controlled)

Common channels Common channels

t t
Power usage with dedicated channels HS-DSCH with dynamic power allocation
General HSDPA concepts for a single HSDPA UE
118
HSDPA throughput capability
119
Code tree occupancy with 15 HS-PDSCH, 3 HS-
SCCH and common channels
120
 HSUPA
121

HSUPA is introduced within release 6 of the 3GPP

specifications. It allows increased individual connection
throughputs, increased total cell throughputs and reduced
round trip times. HSUPA can support both real time and non-
real time packet switched services.
Uplink logical, transport and physical channels for HSUPA
HSUPA throughput capability
122
 Long Term Evolution (LTE) 4G
123

LTE stands for Long Term Evolution

Next Generation mobile broadband technology
Promises data transfer rates of 100 Mbps
Based on UMTS 3G technology
Optimized for All-IP traffic
Advantages of LTE
124
 Major LTE Radio Technogies
125

Uses Orthogonal Frequency Division Multiplexing (OFDM)

for downlink

Uses Single Carrier Frequency Division Multiple Access

(SC-FDMA) for uplink

Uses Multi-input Multi-output(MIMO) for enhanced

throughput

Reduced power consumption

Higher RF power amplifier efficiency (less battery power
used by handsets)
 OFDM (Orthogonal Frequency Division)
126
c
Parallel data transmission on k3
f
several orthogonal subcarriers
with lower rate
t
Maximum of one subcarrier frequency appears exactly at a
frequency where all other subcarriers equal zero
superposition of frequencies in the same frequency range
Amplitude subcarrier: sin(x)
SI function= x

f
 OFDM
127
Properties
Lower data rate on each subcarrier less ISI
interference on one frequency results in interference of
one subcarrier only
no guard space necessary
orthogonality allows for signal separation via inverse
FFT on receiver side
precise synchronization necessary (sender/receiver)

Advantages
no equalizer necessary
no expensive filters with sharp edges necessary
better spectral efficiency (compared to CDMA)
 LTE Architecture
128

Functional changes compared to WCDMA

Home subscriber server (HSS)
129
 HSS Solution
130

Key features
Maintain and provide subscription data
User Identification handling
Access Authorization
Supporting USIM based Authentication and Encryption
User Registration management
Maintain knowledge of used PDN GW
Handles IRAT mobility between 2G/3G==LTE accesses
Platform Highlights
Scalable from 2 to 30 blades
>15 Million subscribers
1+1 hot standby geographic redundancy
High availability 99.9999 %
 Voices services
131

LTE is a packet only architecture and LTE has no built in

voice and SMS service engine.
As soon as mobile terminals start using LTE access we
need a solution for Voice, we need to charge online for it
and we need to apply a Quality of Service ensuring the
voice experience.
 The CS Fallback Concept
132

CSFB subscribers roam with preference on LTE access,

no CS-voice service available (only PS based services).
Fallback triggered to overlapping CS domain (GSM /
WCDMA) whenever voice services are requested.
Resumed LTE access for PS services after call completion
LTE Attach high level flow
133
LTE Attach high level flow MT Call
134
LTE Attach high level flow MO Call
135
UE Return back to E-UTRAN
136
 SGS interface
137

The protocol used on the SGs-Interface is called SGsAP

The SGsAP protocol provides procedures：
Mobility Management
Paging
tunneling of NAS messages
 138

802.11 (WiFi) Overview

 IEEE 802.11
139

Wireless LAN standard defined in the unlicensed spectrum

(2.4 GHz and 5 GHz U-NII bands)
λ 33cm 12cm 5cm

26 MHz 83.5 MHz 200 MHz

902 MHz 2.4 GHz 5.15 GHz

928 MHz 2.4835 GHz 5.35 GHz

Standards covers the MAC sublayer and PHY layers

Three different physical layers in the 2.4 GHz band
FHSS, DSSS and IR
OFDM based Phys layer in the 5 GHz band (802.11a)
 Infrastructure network -WiFi
802.11 LAN
802.x LAN Station (STA)
terminal with access
mechanisms to the wireless
medium and radio contact to the
STA1 access point
BSS1
Portal Basic Service Set (BSS)
Access
group of stations using the same
Point radio frequency
Distribution System Access Point
station integrated into the
Access wireless LAN and the
ESS Point distribution system
Portal
BSS2
bridge to other (wired) networks
Distribution System
interconnection network to form
one logical network (EES:
STA2 802.11 LAN STA3 Extended Service Set) based
on several BSS

140
 Distribution System (DS) concepts
141

The Distribution system interconnects multiple BSSs

802.11 standard logically separates the wireless medium
from the distribution system – it does not preclude, nor
demand, that the multiple media be same or different
An Access Point (AP) is a STA that provides access to
the DS by providing DS services in addition to acting as
a STA.
Data moves between BSS and the DS via an AP
The DS and BSSs allow 802.11 to create a wireless
network of arbitrary size and complexity called the
Extended Service Set network (ESS)
 WiFi - TCP/IP Protocol stack
142
server
fixed terminal
mobile terminal

infrastructure network

access point

application application
TCP TCP
IP IP
LLC LLC LLC
802.11 MAC 802.11 MAC 802.3 MAC 802.3 MAC
802.11 PHY 802.11 PHY 802.3 PHY 802.3 PHY
Functional Diagram
143
 802.11 - Layers and functions
144
MAC PLCP Physical Layer
access mechanisms, Convergence Protocol
fragmentation, encryption clear channel
MAC Management assessment signal
synchronization, roaming, (carrier sense)
power management PMD Physical Medium
Dependent
modulation, coding
Station Management
LLC
PHY Management
DLC

MAC MAC Management

channel selection
PLCP Station Management
PHY

PHY Management
PMD coordination of all
management functions
 802.11 - Physical layer
145

3 versions of spread spectrum: 2 radio (typ. 2.4 GHz), 1 IR

data rates 1 or 2 Mbps
FHSS (Frequency Hopping Spread Spectrum)
spreading, despreading, signal strength, typically 1 Mbps
min. 2.5 frequency hops/s (USA), two-level GFSK modulation
DSSS (Direct Sequence Spread Spectrum)
DBPSK modulation for 1 Mbps (Differential Binary Phase Shift
Keying), DQPSK for 2 Mbps (Differential Quadrature PSK)
preamble and header of a frame is always transmitted with 1 Mbps,
rest of transmission 1 or 2 Mbps
chipping sequence: +1, -1, +1, +1, -1, +1, +1, +1, -1, -1, -1 (Barker
code)
max. radiated power 1 W (USA), 100 mW (EU), min. 1mW
Infrared
850-950 nm, diffuse light, typ. 10 m range
carrier detection, energy detection, synchronization
 802.11 - Frame format
146

Types
control frames, management frames, data frames
Sequence numbers
important against duplicated frames due to lost ACKs
Addresses
receiver, transmitter (physical), BSS identifier, sender (logical)
Miscellaneous
sending time, checksum, frame control, data
bytes 2 2 6 6 6 2 6 0-2312 4
Frame Duration Address Address Address Sequence Address
Data CRC
Control ID 1 2 3 Control 4

version, type, fragmentation, security, ...

 802.11 frame: addressing
147

2 2 6 6 6 2 6 0 - 2312 4
frame address address address seq address
duration payload CRC
control 1 2 3 control 4

Address 3: used only

in ad hoc mode
Address 1: MAC address
of wireless host or AP Address 3: MAC address
to receive this frame of router interface to which AP is
attached
Address 2: MAC address
of wireless host or AP
transmitting this frame
802.11 frame: addressing

Internet
H1 R1 router
AP

R1 MAC addr AP MAC addr

dest. address source address

802.3 frame

AP MAC addr H1 MAC addr R1 MAC addr

address 1 address 2 address 3

802.11 frame
 Types of Frames
149

Control Frames
RTS/CTS/ACK
CF-Poll/CF-End
Management Frames
Beacons
Probe Request/Response
Association Request/Response
Dissociation/Reassociation
Authentication/Deauthentication
ATIM
Data Frames
 WLAN: IEEE 802.11b
150
Data rate
Connection set-up time
1, 2, 5.5, 11 Mbit/s, depending
on SNR Connectionless/always on
User data rate max. approx. 6 Quality of Service
Mbit/s Typ. Best effort, no guarantees
(unless polling is used, limited
Transmission range support in products)
300m outdoor, 30m indoor Manageability
Max. data rate ~10m indoor Limited (no automated key
Frequency distribution, sym. Encryption)
Free 2.4 GHz ISM-band Special
Security Advantage: many installed
systems, lot of experience,
Limited, WEP insecure, SSID available worldwide, free ISM-
Cost band, many vendors, integrated
100$ adapter, 250$ base in laptops, simple system
station, dropping Disadvantage: heavy interference
on ISM-band, no service
Availability guarantees, slow relative speed
Many products, many vendors only
 WLAN: IEEE 802.11a
151
Data rate
6, 9, 12, 18, 24, 36, 48, 54 Mbit/s, Connection set-up time
depending on SNR
Connectionless/always on
User throughput (1500 byte packets):
5.3 (6), 18 (24), 24 (36), 32 (54) Quality of Service
6, 12, 24 Mbit/s mandatory
Typ. best effort, no guarantees
Transmission range (same as all 802.11 products)
100m outdoor, 10m indoor
E.g., 54 Mbit/s up to 5 m, 48 up to 12 m, Manageability
36 up to 25 m, 24 up to 30m, 18 up to
40 m, 12 up to 60 m Limited (no automated key
Frequency distribution, sym. Encryption)
Free 5.15-5.25, 5.25-5.35, 5.725- Special
5.825 GHz ISM-band
Advantages/Disadvantages
Security
Limited, WEP insecure, SSID Advantage: fits into 802.x
Cost standards, free ISM-band,
280$ adapter, 500$ base station available, simple system, uses less
Availability crowded 5 GHz band
Some products, some vendors Disadvantage: stronger shading due
to higher frequency, no QoS
 OFDM in IEEE 802.11a
152

OFDM with 52 used subcarriers (64 in total), 48 data + 4

pilot, 312.5 kHz spacing
pilot 312.5 kHz

-26 -21 -7 -1 1 7 21 26 subcarrier

channel center frequency number
 Operating channels for 802.11a
153
36 40 44 48 52 56 60 64 channel

5150 5180 5200 5220 5240 5260 5280 5300 5320 5350 [MHz]
16.6 MHz

center frequency =
5000 + 5*channel number [MHz]
149 153 157 161 channel

5725 5745 5765 5785 5805 5825 [MHz]

16.6 MHz
 WLAN: IEEE 802.11e
154

802.11e: MAC Enhancements – QoS

Enhance the current 802.11 MAC to expand support for
applications with Quality of Service requirements, and in the
capabilities and efficiency of the protocol.

EDCF
Contention Window based prioritization
Real-time
Best effort
Virtual collision resolved in favor of higher priority
 155

802.16 (WiMaX) Overview

 Motivation for 802.16
156

Broadband:
A transmission facility having a bandwidth sufficient to
carry multiple voice, video or data, simultaneously.
High-capacity fiber to every user is expensive.

Broadband Wireless Access:

provides “First-mile” network access to buildings.
Cost effective and easy deployment.
 IEEE 802.16
157

WirelessMAN air interface

for fixed point to multi-point BWA

Broad bandwidth: 10-66 GHz

Channel as wide as 28 MHz and
Data rate upto 134 Mbps

MAC designed for efficient use of spectrum

Bandwidth on demand
QoS Support
802.16 Architecture
158
 Channel model
159

Two Channels: Downlink and Uplink

Supports both Time Division Duplexing and Frequency
Division Duplexing

Base station maps downstream traffic onto time slots with

individual subscriber stations allocated time slot serially
Uplink is shared between a number of subscriber stations
by Time Division Multiple Access
 802.16: Summary
160

Higher throughput at longer ranges (up to 50 km)

Scalable system capacity
Easy addition of channels maximizes cell capacity
Flexible channel bandwidths accommodate allocations for
both licensed and license-exempt spectrums
Coverage
Standards-based mesh and smart antenna support
Adaptive modulation
Quality of Service
Grant / request MAC supports voice and video
Differentiated service levels: E1/T1 for business, best effort
for residential
 IEEE 802.16 Standard
161

802.16 802.16a/REVd 802.16e

Completed Dec 2001 802.16a: Jan 2003 Estimate 2006

802.16REVd: Q3’04
Spectrum 10 - 66 GHz < 11 GHz < 6 GHz

Channel Line of sight only Non line of sight Non line of sight
Conditions
Bit Rate 32 – 134 Mbps at Up to 75 Mbps at 20MHz Up to 15 Mbps at 5MHz
28MHz channelization channelization
channelization
Modulation QPSK, 16QAM and OFDM 256 sub-carriersQPSK, Same as 802.16a
64QAM 16QAM, 64QAM
Mobility Fixed Fixed Pedestrian mobility –
regional roaming
Channel 20, 25 and 28 MHz Selectable channel Same as 802.16a with
Bandwidths bandwidths between 1.25 uplink sub-channels
and 20 MHz to conserve power
Typical Cell 1-3 miles 3 to 5 miles; max range 30 1-3 miles
Radius miles based on tower height,
antenna gain and power
transmit