Using TEMS Pocket

Johan Montelius
Introduction
In this laboration you will get acquainted with the TEMS Pocket tool. You
will examine both the Monaco network and a commercial network. Since
this is your rst laboration and we have not talked about the details during
lectures yet, much of the information will look like Greek (unless you master
Greek in which case it will look like some other incomprehensible language).
Dont worry, we will go through the details during lectures as we proceed.
1 Getting started
TEMS is a tool used to examine the performance of a mobile network from
the mobile stations point of view. There are of course allot of statistics
that can be gathered form the network it self but some information is only
available or best collected using a mobile terminal. TEMS can be operated in
two modes: either using Pocket which is operated using only the mobile or,
connecting the mobile to a PC and logging all trac for later examination.
In this laboration you will use the Pocket tool and examine the Monaco
network.
To start the laboration you should have a T68 TEMS phone with a SIM
card for the Monaco network. The IMSI number of the cards is written on
the card and from this you can derive your MSISDN which is +4917299100xx
where xx is the two last digits on your SIM card. Turn the phone on and
try to call another group. If you see a lot of strange gures when you turn
on the phone press the options key (below the YES button) and select
Pocket View O.
You should also make sure that GPRS is properly congured. Create a
data GPRS account called Monaco using the APN apn01.ericsson.com, no
user name nor password. Also create a WAP prole that used the created
account and the WAP gateway 192.168.186.100. Try to access a WAP site
(wap.svd.se for example).
You could also, from the options menu, choose Pocket View Help. This
will give you a hint of what the gures in each display means.
2 A rst look
Youre now ready to turn on Pocket. Press the options key and select
Pocket View On. You should now see the rst screen Serving Cell 1
with the basic information about the mobile network that youre connected
1
to. If you use the navigation button you can switch to dierent pages (twelve
in total) even more cryptic names and content but we will start by looking
at the Serving Cell.
2.1 Serving Cell
The B in the beginning of the rst row means that the row is the informa-
tion of the broadcast control channel (BCCH). This is logical channel that
the mobile is currently listening to for information of the network or paging
messages. The numbers to the right of the B are carrier number (or the
Absolute Radio Frequency Channel Number - ARFCN), the Base Station
Identity Code (BSIC) and, the received signal strength in dBm.
All carriers in the GSM spectrum are numbered by the ARFCN. The
numbers 1 - 124 are used in the 900-band, 512 - 885 in the 1800-band. If
you know the ARFCN you can calculate exactly which frequency that is
used. One interesting thing to observe is if the frequency used is in the
900-band or the 1800-band.
The BSIC consist of a 3-bit Network Color Code (NCC) and a 3-bit
Base Transceiver Station Color Code (BCC). These codes are only internal
to a mobile operator and a BSIC does not uniquely identify a base station.
However base stations in range of each other that uses the same frequencies
must have dierent color codes. This means that operators need to synchro-
nize their BSIC values close to national borders where they are in range of
another operator using the same frequencies.
The received signal strength should between -60dBm and -90dBm. If its
above -70dBm the signal strength is very good while below -90dBm is poor.
The network can set a limit on how weak a signal could be while still allow
a mobile to attach to the system but this limit is normally set to less than
-100dBm. When you later take a walk you will check this gure to examine
how the signal strength varies depending on your location.
The third line shows the Carrier to Interference ratio (C/I) of the current
active channel in dB. In idle mode this mean that it shows the value for the
channel indicated by the rst row. If we set up a call the value will pertain to
the trac channel that we are using. We will get back to this row later since
it will show more information once we have a trac channel in operation.
On the fourth line we have a two gures 10/10 or similar. This is the
Downlink Signaling Failure Counter (DSC), the current value and the max
value. When a signaling packet is successfully received on the broadcasting
channel the counter is incremented by one (but never above the max value).
When a signaling packet is lost the current value is decremented with four.
If the current value reaches 0 its high time to perform a cell re-selection.
You could check this value later when you take a walk.
2
2.2 Mobile Network Codes
In the two last rows on the screen you will see the Mobile Country Code
(MCC) which is 240 for Sweden and the Mobile Network Code (MNC) which
we have chosen to be 98. The last gure on the row is the Location Area
Code (LAC).
The last row shows the Routing Area Code (RA) and the Cell Identity
(CI). The routing area code is used for GPRS and divides the location area
into smaller sections. The cell identity is used by the Serving GPRS Support
Node (SGSN) to identify the cell used by a GPRS terminal.
2.3 The Neighborhood
Switching to the second page we will take a look at the Neighbor List. This
page is for our network utterly boring since we do not have any neighbors.
There is only one dummy neighbor dened and since this neighbor is only
in our minds it does not transmit with very high power.
If you have your own SIM card you can switch cards and look at a real
network. A real network will list six neighbors giving their frequency num-
bers (ARFCN), Base Station Identity Codes (BSIC) and, receiving signal
strength. Note that the mobile is probably listening to the strongest signal
(the rst row) but that is probably has several base stations to select from.
The following page, the Cell Selection page is the same set of neighbors
but now ranked according to the Path Loss Criterion and Cell Reselection
Criterion. The path loss criterion is a better value to watch when doing a
cell selection, the reason is that is take into account not only the receiving
signal strength but also the required signal strength to connect to the cell
and the maximal transmitting power allowed.
To complicate matters even further the Cell Reselection Criterion is
the value that is actually used when the cells are compared. The re-selection
criterion is very similar and often identical to the cell selection value. The
re-selection criteria however also weigh in a time factor to avoid selecting
string cells that have only been visible for a short time. A penalty could
also be given by the network to prevent mobiles from selecting certain cells
such as macro cells that should be reserved for fast moving terminals. If you
want to learn the details study TS 23.022.
2.4 The current channel
Page number four show similar selection criteria using GPRS information
and page ve is a collection of the six strongest neighbors. The sixth page,
Current Channel gives us a little bit more information about the broad-
casting channel. The two rst rows are only shown when the phone is idle.
The rst row shows:
3
the Common Control Channel (CCCH) conguration, a 0 means that
we have one CCCH that is not combined with any Stand-alone Dedi-
cated Control Channel (SDCCH), a 1 means that the CCCH is com-
bined with a SDCCH
BS-PA-MFRMS, the numbers of multiframes between paging groups
(2 - 9), this is for how long the mobile has to wait in between paging
messages from the network
BS-AG-BLKS-RES, the number of Common Control Channel (CCCH)
blocks (0-7) that are reserved for the Access Grant Channel (AGCH)
if attach and detach is enabled (0/1)
The second row shows:
MT-TXPWR-MAX-CCH, the maximum power (in dBm) the mobile
is allowed to use when performing a random access
RXLEV-ACESS-MIN, the minimum required signal strength required
for accessing the cell
T3212, a timer, current/max, that denes when the mobile has to do
a location update (not set in the Monaco network)
The lower three rows shows the current channel type, which is BCCH if
the phone is idle. Set up a call between two phones and see how the phones
rst switch over to a Stand-alone Dedicated Control Channel (SDCCH) and
then over to a Trac Channel (TCH). The trac channel will be one of:
FR, full-rate voice mode
HR, half-rate voice mode
EFR, enhanced full-rate voice mode
D24, ... dierent kinds of data modes
The number after the channel mode is a sub-channel number which is for
example needed for half-rate voice mode. Notice that the two phones can
have dierent voice modes, one can be in full-rate and the other in half-rate.
The voice mode is only valid between the mobile phone and the Transceiver
Rate Adaption Unit (TRAU) which will recode the voice into a 64kps voice
stream.
The two lowest low show information for frequency hopping or ciphering.
This is not used in the Monaco network at the moment but if you insert an
operator SIM card you will be able to discover which frequency hopping
patter and ciphering algorithms that are used.
4
2.5 Paging and random access
Moving on to the next page we nd information about the paging and ran-
dom access channels. The rst row shows:
the Common Control Channel (CCCH) group
the paging multiframe group
the paging block index
These entries will become clear once we learn about paging of mobiles
for incoming call. The next two lines show the Temporary Mobile Sub-
scriber Identity (TMSI) and Packet Temporary Mobile Subscriber Identity
(PTMSI). These are temporary addresses used by the network when identi-
fying a subscriber. These numbers can change and are partly there to hide
the true identity of subscribers.
The ve gures in the middle shows information that is related to the
random access channel, how many retransmissions are allowed (third g-
ure) and number of re-transmissions performed in the last attempt (fourth
gure).
2.6 More on the current cell
Pages eight and nine show more information about which frequencies are
used by the current cell, the CA List, and which are used by neighboring
cells, the BA list. In the Monaco network the CA list should show two
entries since we have a base station with one cell that uses two frequencies
(1 and 4). In a large network you would typically see more entries especially
in urban environment.
2.7 GPRS information
The following two pages are related to GPRS trac and we will not go in to
them on this laboration. But if you do some waping you will see that your
are allocated a IP number.
2.8 The last page
The last page shows some Channel/Interference numbers for the carriers
that are currently used. In idle mode this is only the value of the carrier of
Broadcasting Control Channel but in dedicated mode it could show several
carriers that are used in a frequency hopping scheme.
5
3 Take a walk
Ok, so lets take a walk. Remember to be back well in time for the next
group. Also before you go make a phone call to another group so you have
their phone number stored in the mobile.
3.1 The Monaco network
You use a Monaco SIM card, walk through the building and toward Kista
IP. Since we only have one base station the mobile will be forced to talk to
this station and can not switch over to any alternative stations (you could
force the TEMS phone to lock on station if you want).
Observe the signals strength on page one and how it changes in the
building. The base station is on the roof so try go down in the garage to
observe some low values. If values get low check the Downlink Signaling
Failure Counter (page one fourth row). Does it move?
Now set up a call to the other group and observe the information on the
rst page. You will see how a signaling channel is rst allocated and then
how a trac channel is set up once the call is connected.
If you keep the call open the second row shows information about the
trac channel. The third gure is the time slot that you are using (if we all
make calls it will get crowded but it should work). The last gure in that
row shows the transmit power in dBm. The power level should change as
conditions changes but I dont know if this is turned on properly.
The third row shows the channel to interference ratio, it should show
good values since we do not have any other base station transmitting in the
same frequency band anywhere near Kista.
When you walk toward Kista IP you will notice how the signal gets
weaker but you have to walk very far to get our of range of the base station.
One gure to keep track on is the Timing Advance information that is shown
on the rst page during a call. Its the rst gure on the fourth row, inside
the Forum building it will show 0 but as you get close to Kista IP it will
turn to 1. Can you walk far enough to get a timing advance of 2?
3.2 A commercial network
If you have SIM card from one of the real operators you can plug it in and
examine their network. You will see a lot more base stations and if you
set up a call you will see how they use frequency hopping to provide better
signal quality.
If you walk through Kista you can keep your eyes on the broadcast
control channel shown on the rst page. As the signal strength of the carrier
get lower the terminal will choose another carrier to camp on. If you take
6
the terminal on a sub-way ride you will see how it does locations updates
but there is no time for this today.
7