Wireless Basics With Focus On FT PDF

Wireless Basics
With Focus on Field Testing
31st Jan- 11th Feb 2011

Training Agenda
1 2 3 4 5 6
AT Command CDMA Basics GSM Basics UMTS Basics FT Concepts Agilent 8960
know-how & Tools Hands-On
1
AT Commands
Know How
Training Agenda
1 4 7
What is AT Types of AT Sample
Command commands Command
3 6 9
Tasks from AT Command Q&A

AT Operation
2 Commands
2 5 8
Microsoft
HyperTerminal Result Codes References
as an AT
Interface
What are AT Commands
 AT commands are instructions used to control a modem.

• AT means ATTENTION.
• AT is the abbreviation of ATtention.
• Every command line starts with "AT" or "at". That's why modem commands are
called AT commands.
• Many of the commands that are used to control wired dial-up modems, such as ATD
(Dial), ATA (Answer), ATH (Hook control) and ATO (Return to online data state),.
• These commands are also supported by GSM/GPRS modems and mobile phones.
• Besides this common AT command set, GSM/GPRS modems and mobile phones
support an AT command set that is specific to the GSM technology, which includes
SMS-related commands like AT+CMGS (Send SMS message),
• Any command starting with "AT" is the prefix that informs the modem about the
start of a command line.
Confidential | Copyright © Larsen

Attributes
 Useful during the phase of development when the keypad & display features are
not integrated
 Even post development for maintenance
 Specific to OEMs
 No Authoritative body for standardized set of commands supported by all phones

What is Microsoft HyperTerminal?
 Microsoft HyperTerminal is a small program that comes with Microsoft Windows.

You can use it to send AT commands to your mobile phone or GSM/GPRS modem. It
can be found at Start -> Programs -> Accessories -> Communications ->
HyperTerminal.
 If using Windows version that does not have hyperterminal installed by default then
the exe has to placed in the Windows system32 folder from where it can accessed.

The Procedure for Sending AT Commands to
a Mobile Phone or GSM/GPRS Modem Using
MS HyperTerminal
 Run MS HyperTerminal by selecting Start -> Programs -> Accessories -> Communications ->
HyperTerminal.
 In the Connection Description dialog box, enter a name and choose an icon you like for the
connection. Then click the OK button.

MS HyperTerminal Contd….
 In the Connect To dialog box, choose the COM port that your mobile phone or
GSM/GPRS modem is connecting to in the Connect using combo box. For example,
choose COM1 if your mobile phone or GSM/GPRS modem is connecting to the COM1
port. Then click the OK button.


 The Properties dialog box comes out. Enter the correct port settings for your
mobile phone or GSM/GPRS modem. Then click the OK button.


 Type "AT" in the main window. A response "OK" should be returned from the mobile
phone or GSM/GPRS modem.
 If you get the responses above, your mobile phone or GSM/GPRS modem is working
properly. You can start typing your own AT commands to control the mobile phone
or GSM/GPRS modem.

Some of the tasks that can be done using AT
commands
 Get basic information about the mobile phone or GSM/GPRS modem. For example,
name of manufacturer (AT+CGMI), model number (AT+CGMM), IMEI number
(International Mobile Equipment Identity) (AT+CGSN) and software version
(AT+CGMR).
 Get basic information about the subscriber. For example, MSISDN (AT+CNUM) and
IMSI number (International Mobile Subscriber Identity) (AT+CIMI).
 Get the current status of the mobile phone or GSM/GPRS modem. For example,
mobile phone activity status (AT+CPAS), mobile network registration status
(AT+CREG), radio signal strength (AT+CSQ), battery charge level and battery
charging status (AT+CBC).
 Establish a data connection or voice connection to a remote modem (ATD, ATA,

etc).
 Send and receive fax (ATD, ATA, AT+F*).

Some more tasks that can be done using AT
commands
 Send (AT+CMGS, AT+CMSS), read (AT+CMGR, AT+CMGL), write (AT+CMGW) or delete

(AT+CMGD) SMS messages and obtain notifications of newly received SMS messages
(AT+CNMI).
 Read (AT+CPBR), write (AT+CPBW) or search (AT+CPBF) phonebook entries.
 Perform security-related tasks, such as opening or closing facility locks (AT+CLCK),

checking whether a facility is locked (AT+CLCK) and changing passwords
(AT+CPWD).
 Control the presentation of result codes / error messages of AT commands. For

example, you can control whether to enable certain error messages (AT+CMEE) and
whether error messages should be displayed in numeric format or verbose format
(AT+CMEE=1 or AT+CMEE=2).
 Get or change the configurations of the mobile phone or GSM/GPRS modem. For
example, change the GSM network (AT+COPS), bearer service type (AT+CBST),
radio link protocol parameters (AT+CRLP), SMS center address (AT+CSCA) and
storage of SMS messages (AT+CPMS).
Basic Commands and Extended Commands
 There are two types of AT commands: basic commands and extended commands.
 Basic commands are AT commands that do not start with "+". For example, D (Dial),
A (Answer), H (Hook control) and O (Return to online data state) are basic
commands.
 Extended commands are AT commands that start with "+". All GSM AT commands
are extended commands. For example, +CMGS (Send SMS message), +CMSS (Send
SMS message from storage), +CMGL (List SMS messages) and +CMGR (Read SMS
messages) are extended commands.

Result Codes of AT Commands
 Result codes are messages sent from the GSM/GPRS modem or

mobile phone to provide you information about the execution of an
AT command and the occurrence of an event. Two types of result
codes are useful to you when dealing with AT commands for SMS
messaging:
» Final result codes
» Unsolicited result codes

Final Result Codes of AT Commands
 A final result code marks the end of an AT command response. It is an indication

that the GSM/GPRS modem or mobile phone has finished the execution of a
command line. Two frequently used final result codes are OK and ERROR. Only one
final result code will be returned for each command line. Thus, you will not see
both OK and ERROR in the response of a command line.
 The OK Final Result Code indicates that a command line has been executed
successfully by the GSM/GPRS modem or mobile phone. It always starts and ends
with a carriage return character and a linefeed character.
 Eg: “Suppose you send a AT command to list SMS messages stored in the message storage area
and another AT command to get the manufacturer name of the GSM/GPRS modem. If everything
works properly without any errors, the command line, together with the response returned,
should be something similar to this
AT+CMGL;+CGMI
+CMGL: 1,"REC UNREAD","+85291234567",,"06/11/11,00:30:29+32"
Welcome to our SMS tutorial.
Nokia
OK

Final Result Codes of AT Commands
 The ERROR Final Result Code indicates that an error occurs when the GSM/GPRS
modem or mobile phone tries to execute a command line. After the occurrence of
an error, the GSM/GPRS modem or mobile phone will not process the remaining AT
commands in the command-line string.
 Below are some common causes of error:

• The syntax of the command line is incorrect.
• The value specified to a certain parameter is invalid.
• The name of the AT command is spelt incorrectly.
• The GSM/GPRS modem or mobile phone does not support one or more of the AT
commands, command parameters or parameter values in the command-line string.
 Eg: Suppose you want to instruct your GSM/GPRS modem to list SMS messages from
the message storage area and get the manufacturer name of the GSM/GPRS
modem. You intend to type the command line "AT+CMGL;+CGMI<CR>" but make a
careless mistake by typing "+CMFL" instead of "+CMGL". The GSM/GPRS modem will
return the ERROR final result code, as shown below:
AT+CMFL;+CGMI<CR>
<CR><LF>ERROR<CR><LF>

AT Command Operations: Test, Set, Read
and Execution
 There are four types of AT command operations:
 Test operation. A test operation is used to check whether a certain AT

command is supported by the GSM/GPRS modem or mobile phone. Test
commands are with ‘=?’ attribute
 Set operation. A set operation is used to change the settings used by the
GSM/GPRS modem or mobile phone for certain tasks. Set commands will be
with ‘=‘ attribute
 Read operation. A read operation is used to retrieve the current settings used
by the GSM/GPRS modem or mobile phone for certain tasks. Read commands
can be with ‘?’ or some ‘=‘ attribute
 Execution operation. An execution operation is used to perform an action or

retrieve information/status about the GSM/GPRS modem or mobile phone.
General commands.

Test Command
 Test Command -- Checks Whether a Certain AT Command is Supported

A test operation is used to check whether a certain AT command is supported by the
GSM/GPRS modem or mobile phone. All extended AT commands support the test
operation. The syntax is:
command=?
where command is an AT command. When an AT command is used in the above
syntax to perform a test operation, it is called a test command.
 Eg: The AT command +CGMI (command name in text: Request Manufacturer
Identification) is used to get the manufacturer name of the GSM/GPRS modem or
mobile phone. To test whether +CGMI is supported, you can make use of the test
command "+CGMI=?".
AT+CGMI=?
If the GSM/GPRS modem or mobile phone supports the AT command +CGMI, the result code "OK" will be returned,
like this:
AT+CGMI=?
OK
If the GSM/GPRS modem or mobile phone does not support the AT command +CGMI, the result code "ERROR" will
be returned, like this:
AT+CGMI=?
ERROR

Test Command Contd…..
 In the above example, the AT command +CGMI does not have any parameters. If
the AT command to be tested has parameter(s), the parameter value(s) supported
by the GSM/GPRS modem or mobile phone may be printed additionally. Below is an
example that illustrates the format of the response. +COMMAND1 is a fictitious AT
command that has four parameters.
AT+COMMAND1=?
+COMMAND1: (0,1),(0-10),(0,1,5-10),("GSM","UCS2")
OK
 The supported values of each of the four parameters are enclosed in parentheses.
Commas are used to delimit the parentheses and the values inside parentheses. A
hyphen is used to indicate a range of values. The values inside parentheses can be
of the string type.
 In the above example, the response of the test command "+COMMAND1=?" provides
us the following information:
 (0,1). The first parameter accepts either 0 or 1.
 (0-10). The second parameter accepts any integer between 0 and 10.
 (0,1,5-10). The third parameter accepts 0, 1 or any integer between 5 and
10.
 ("GSM","UCS2"). The fourth parameter accepts either the string "GSM" or
"UCS2".

Test Command Contd…..
 To a few AT commands, the test operation does not return the parameter values supported. Instead, it returns
the values that are allowed to appear in the information response of the AT command. An example is the +CBC
AT command (command name in text: Battery Charge). The +CBC command is used to retrieve the connection
status and charge level of the battery of the mobile device. Two values are returned in the information
response of the +CBC AT command. The format is:
+CBC: connection_status,charge_level
 For example, if the battery is placed in the mobile device with no charger connected and the charge level is
80%, the result of the execution of the +CBC AT command will be:
AT+CBC
+CBC: 0,80
OK
 If you run the test command "+CBC=?", all the supported values that are allowed to appear in the connection
status field and charge level field will be provided. With my Nokia 6021, the result is:
 AT+CBC=?
+CBC: (0,1),(0-100)
OK
"(0,1)" means the connection status field in the information response of the +CBC AT command can contain
either 0 or 1, while "(0-100)" means the charge level field can contain any integer between 0 and 100.

Testing the Communication between the PC
and GSM/GPRS Modem or Mobile Phone
 Suppose you have connected your GSM/GPRS modem or mobile phone to your PC /
computer and started a terminal program (such as HyperTerminal on Microsoft
Windows). Now you are ready to enter your first command. The first thing that is
usually done is to test the communication between the PC and GSM/GPRS
modem/mobile phone to confirm that everything is working properly so far. Simply
enter "AT" in the terminal program to perform the test. When the GSM/GPRS
modem or mobile phone receives "AT", it will send back the final result code "OK"
to indicate that it has received your command successfully, like this:
AT
OK

Sample Command
 Lets take example of Motorola AT command for Registration

Management +MNRR
+MNRR Set Command
Usage AT+MNRR=<mode>
Output format
+MNRR <mode> values
<mode> Description
0 Disable unsolicited reporting of registration attempts.
1 Enable unsolicited reporting of registration attempts.
Permanence: No permanence. The <mode> parameter is maintained until device
power cycle. Default is disabled at power up.

Sample Command Contd….
+MNRR Read Command

Usage AT+MNRR?
Output format
+MNRR: <mode>
+MNRR Unsolicited Message

Output format MNRR: <status>
+MNRR <status> values
<status> Description 00 Registration attempt started
01 Registration attempt passed.
02 Registration attempt failed.
03 Power down registration passed
04 Power down registration failed
05 Mobile IP registration started
06 Mobile IP registration passed
07 Mobile IP registration failed

Some More…………..
AT Command Response from Description of command

Phone
+GMM: Motorola
AT+GMM Display phone model information
CDMA V3c Rev2 Phone
AT+MODE? +MODE: 0 Display current phone mode
AT+MODE=0 OK Put phone in Modem Mode
Put phone in Phonebook Mode. On some

+MBAN: Copyright
models, for instance the ROKR Z6m,
AT+MODE=2 2000-2004 Motorola,
this allows voice dialing and SMS
Inc.
messages to be sent.

References
• 3gpp.org
• http://res.trilha21.com/001000340/doc/0707-780.pdf
• http://www.developershome.com
• http://en.wikipedia.org/wiki/AT_commands
• http://en.wikipedia.org/wiki/Motorola_phone_AT_commands

2
CDMA Basics
Training Agenda
1 4 7
Multiple CDMA CDMA Call
Access Handoffs. Processing.
Techniques.
3 6
CDMA Power CDMA Mobile
Control. Station
2
2 states.
5 8
CDMA
CDMA Registration. Q&A
System.
Introduction to MULTIPLE-ACCESS
TECHNIQUES
Early Mobile Telephone System Architecture

 Traditional mobile service was structured in a
fashion similar to television broadcasting.
 One very powerful transmitter located at the

highest spot in an area would broadcast in a
radius of up to 50 kilometers.
Mobile Telephone System - Cellular Architecture
 Instead of using one powerful transmitter,

many low-power transmitters were
placed throughout a coverage area.
 Advantages
– Efficient use of radio frequency.
– Higher Capacity.
What is MULTIPLE-ACCESS?
 What is Multiple Access?

– Multiple users want to
communicate in a common
geographic area
– Cellular Example: Many people
want to talk on their cell phones.
Each phone must communicate
with a base station.
– Imagine if only one person could
talk on their cell phone at a time!
 Problem: How should we share

our resources so that as many
users as possible can
communicate simultaneously?
MULTIPLE-ACCESS TECHNIQUES
 Goal in the design of cellular systems is to be able to handle as many calls as possible in a
given bandwidth with some reliability.
 Multiple Access Techniques helps to achieve the same

• random access
• frequency division multiple-access (FDMA)
• time division multiple-access (TDMA)
• code division multiple-access (CDMA)
– frequency-hop CDMA
– direct-sequence CDMA
– multi-carrier CDMA (FH or DS)
Frequency division multiple-access (FDMA)
 AMPS (analog), the First

Generation (1G) used 30KHz
for each user.
 Pros
– Very Simple to design
– Narrowband (no ISI)
– Synchronization is easy
– No interference among
users in a cell
 Cons
– Static spectrum allocation
– Freq. reuse is a problem
– High Q analog filters or
large guard band required
Time Division Multiple Access (TDMA)
 Can also partition time: users

take turns using the channel
– IS-54 (2G) used same 30 KHz
channels, but with three users
sharing them (3 slots)
– GSM has 8 slots/270 KHz
 Pros
– Better suited for digital
– Often gets higher capacity (3
times higher here)
– Relaxes need for high Q filters
– Bandwidth is supplied on demand
 Cons
– Strict synchronization and
guard time needed
– Still susceptible to jamming,
other-cell interference
– Often requires equalizer
CDMA System
Code Division Multiple Access (CDMA)
 All CDMA users occupy the same frequency at the same time! Frequency and time are
not used as discriminators.
 CDMA operates by using CODING to discriminate between users.
 Receiver detects only desired code word.
 Each user is a small voice in a roaring crowd -- but with a uniquely recoverable code.
CDMA operating frequency
 AMPS: FM modulation, Cellular band

channel bandwidth =30KHz
824.0 – 849.0 MHz (uplink)
869.0 – 893.0 MHz (downlink)
 Cellular CDMA: Band Class 0

Channel bandwidth=1.23MHz
824.0 – 849.0 MHz (uplink)
869.0 – 893.0 MHz (downlink)
 PCS CDMA: Band Class 1

Channel bandwidth=1.23MHz
1850.0 – 1910.0 MHz (uplink)
1930.0 – 1990.0 MHz (downlink)
CDMA architecture
PN codes in CDMA systems
 In IS-95 systems, two types of PN codes are used:
– The Short PN code with a length of 32, 768 chips, a speed of 1.2288 million chips per
second and a cyclic period of 26.67 ms.
– The Long PN code with a length of approximately 4.4 trillion chips, a speed of 1.2288
million chips per second and a period of 41-42 days.
Forward/Reverse Link Channels
 Forward channel is identified by

– Its RF carrier frequency
– The unique short PN offset code of the sector
– The unique WALSH code of the user
 A Reverse Channel is identified by:

– Its CDMA RF carrier Frequency
– The unique Long Code PN Offset of the individual handset
Forward/Reverse Link Channels
Forward Link Channels
 PILOT: WALSH CODE 0

– The Pilot is a “structural beacon” which does not contain a character stream. It is a
timing source used in system acquisition and as a measurement device during handoffs.
 SYNC: WALSH CODE 32

– This carries a data stream of system identification and parameter information used by
mobiles during system acquisition
 PAGING: WALSH CODES 1 up to 7

– There can be from one to seven paging channels as determined by capacity needs. They
carry pages, system parameters information, and call setup orders.
 TRAFFIC: any remaining WALSH codes

– The traffic channels are assigned to individual users to carry call traffic. All remaining
Walsh codes are available, subject to overall capacity limited by noise.
Reverse Link Channels
 TRAFFIC CHANNELS are used by individual users during their actual calls to transmit traffic to
the BTS.
– a reverse traffic channel is really just a user-specific public or private Long Code mask.
– there are as many reverse Traffic Channels as there are CDMA phones in the world!
 ACCESS CHANNELS are used by mobiles not yet in a call to transmit registration requests, call
setup requests, page responses, order responses, and other signaling information.
– an access channel is really just a public long code offset unique to the BTS sector.
Claude Shannon: The Einstein of Information
Theory
 The core idea that makes CDMA possible was first explained by Claude Shannon, a Bell Labs
research mathematicia
 SHANNON’S CAPACITY EQUATION.
 An elegant interpretation of this equation says that one can maintain or even increase
communication performance (high C) by allowing or injecting more bandwidth (high B), even
when signal power is below the noise floor.
Spread Spectrum Communication
 Spread Spectrum communications is distinguished by three key elements:

– The signal occupies a bandwidth much greater than that which is necessary to send the
information.
– The bandwidth is spread by means of a code which is independent of the data.
– The receiver synchronizes to the code to recover the data.
Spread Spectrum Communication
Frequency Hopping SS
 The signal is rapidly switched between different frequencies within the hopping bandwidth
pseudo-randomly, and the receiver knows before hand where to find the signal at any given
time.
Direct Sequence SS
 The digital data is directly coded at a much higher frequency. The code is generated pseudo-
randomly, the receiver knows how to generate the same code, and correlates the received
signal with that code to extract the data.
Direct Sequence SS - Example

Orthogonal Codes
 Codes must have high auto-correlation!

– If two Orthogonal codes are correlated, the result is intelligible only if these two codes
are the same.
 Codes should have zero cross-correlation!
– Codes should not correlate to other codes or time shifted version of itself.
 CDMA used Walsh code as orthogonal codes.
 Walsh codes are generated by applying Hadamard transform.
Orthogonal code -example
Frequency Reuse
 Because only a small number of radio

channel frequencies, engineers had to
find a way to reuse radio channels.
 The solution the industry adopted was

called frequency planning or frequency
reuse.
 The concept of frequency reuse is based

on assigning to each cell a group of radio
channels used within a small geographic
area.
 Cells are assigned a group of channels that

is completely different from neighboring
cells
Universal frequency reuse
 The major benefit of noise-like carriers is that the system sensitivity to interference is
fundamentally altered.
 Use of noise-like carriers, with all users occupying the same spectrum, makes the effective
noise the sum of all other-user signals.
 The enhancement at receiver overcomes the summed noise enough to provide an adequate
SNR at the detector.
 Since system is no longer sensitive to interference, frequency reuse is universal.

Near-Far Problem
 CDMA (and spread spectrum in general) was always dismissed as unworkable in the mobile
radio environment because of what was called the "near-far problem.“
 The near-far problem arises from the fact that signals closer to the receiver of interest are
received with smaller attenuation than are signals located further away.
 In order to minimize the near-far problem, the goal in CDMA systems is to assure that all
mobiles achieve the same received power levels (meet user-defined performance objectives)
at the Base Station.
 In order to implement such a strategy, mobiles that are closer to the Base Station must
transmit less power than mobiles that are further away from the Base Station.
CDMA Power Control
 CDMA is interference limited multiple access system.
 The transmit power for each user must be reduced to limit interference, but enough to
maintain the required signal to noise ratio for a satisfactory call quality.
 The aim of the dynamic power control is to limit transmitted power on both the links while
maintaining link quality under all conditions.
 Additional advantages are longer mobile battery life and longer life span of BTS power
amplifiers.
Power Control
Power Control (Reverse Link)
 The MS transmit power control is adjusted by two reverse link mechanism:

– Open Loop power control
– Closed Loop power control
• The closed Loop power control consists of

– Inner Loop power control
– outer Loop power control
 Open Loop power control: The transmit power decreases when receiver signal strength
increases, and vice versa, so that the sum of the transmit power strength and received
power strength remains constant.
 Open loop power control is only valid when the propagation losses in the forward link are
same.
 Inner loop power control (every 1.25 ms) compensate the discrepancy of power leveling.
 If the received power level from MS is less than the preset at BTS, the BTS directs the
MS to increase the transmit power.
 The preset of BTS is adjusted by the outer loop power control.
 This is performed every 20ms by the BSC selector according to frame quality of Veterbi
decoded packets.
Power Control (Forward Link)
 Forward link power control is performed by the direction from BSC.
 The selector of the BSC receives the FER information from its corresponding MS.
 If the FER is too high, the selector directs the responsible BTS to increase the power
transmitted.
CDMA Handoff
 The obstacle in the development of the

cellular network involved the problem
created when a mobile subscriber
traveled from one cell to another during a
call.
 A call must either be dropped or

transferred from one radio channel to
another when a user crosses the line
between adjacent cells.
 Because dropping the call is unacceptable,

the process of handoff was created where
network automatically transfers a call
from radio channel to radio channel as a
mobile crosses adjacent cells.
Types of Handoff
 Inter-sector or softer handoff: The mobile communicates with two sectors of the same cell.
 Inter-cell or soft handoff: The mobile communicates with two or three sectors of different
cells.
 Soft-softer handoff: The mobile communicates with two sectors of one cell and one sector of
another cell.
 Hard handoff: Hard handoffs are characterized by the break-before-make strategy.

– Handoff between different carriers/frequency.
– Handoff between CDMA and Analog.
– Change of frame offset assignment.
Pilot Sets
 Active set: It contains the pilots associated with the forward traffic channels (Walsh codes)
assigned to the mobile. An active pilot is a pilot whose paging or traffic channels are actually
being monitored or used.
 Candidate set: Pilots that have been received with sufficient signal strength to indicate that
the associated forward traffic channels could be successfully demodulated.
 Neighbor set: This set contains neighbor pilots that are not currently in the active or the
candidate set and are likely candidates for handoff.
 Remaining set: This set contains all possible pilots in the current system, excluding pilots in
the active, candidate, or neighbor sets.
Hard Handoff
 With hard handoff, the link to the prior base station is terminated before or as the user is
transferred to the new cell’s base station.
 Initiation of the handoff may begin when the signal levels averaged over a chosen amount of
time from base station 2 is greater than that of base station 1.
Soft Handoff
 "Soft" handoff are different from "hard" handoff in that soft handoff allows both the original
and new cell to temporarily service a call during the handoff transition.
 Not only soft handoff minimize the probability of a dropped call, but also makes the handoff
virtually undetectable to the user.
 Soft handoff is mobile directed handoff.
 A key benefit of soft handoff is the path diversity on the forward and reverse traffic channels.
Soft Handoff Setup
End of Soft Handoff
CDMA Registration
 Registration is the process by which an idle mobile lets the system know it’s awake and
available for incoming calls.
– this allows the system to inform the mobile’s home switch of the mobile’s current
location, so that incoming calls can be delivered.
– registration also allows the system to intelligently page the mobile only in the area
where the mobile is currently located, thereby eliminating useless congestion on the
paging channels in other areas of the system.
 There are many different conditions that could trigger an obligation for the mobile to
register.
– There are flags in the System Parameters Message which tell the mobile when it must
register on the current system
Types of registration
 The CDMA system supports eleven different forms of registration:
 1. Power-up registration: The mobile station registers when it powers on, switches from
using a different frequency block, switches from using a different band class, switches from
using an alternative operating mode, or switches from using the analog system.
 2. Power-down registration: The mobile station registers when it powers off if previously
registered in the current serving system.
 3. Timer-based registration: The mobile station registers when a timer expires.

Types of registration
 4. Distance-based registration: The mobile station registers when the distance between the
current base station and the base station in which it last registered exceeds a threshold.
 5. Zone-based registration: The mobile station registers when it enters a new zone.
 6. Parameter-change registration: The mobile station registers when certain of its stored
parameters change or when it enters a new system.
 7. Implicit registration: When a mobile station successfully sends an Origination Message or

Page Response Message, the base station can infer the mobile station’s location. This is
considered an implicit registration.
CDMA Mobile Station States
MS Initialization State
How does mobile acquire the system?
 Idle mobiles use proprietary algorithms to find the initial CDMA carrier intended for them to
use.
 Mobile scans forward link frequencies (Cellular or PCS, depending on model) in Preferred
Roaming List until a CDMA signal is found.
Taken from Scott Baxter course# 132

Slot Cycle Mode
 Slot Cycle Index: MS constantly turns parts of itself ON and OFF, ON to perform vital
functions and OFF to save power, so that battery last longer.
 MS can operate in slotted mode only in the idle state.
 Base station controls the period of slot cycle.
 Slot cycle index are numbers from 0 to 7 and the period is 1.28 seconds multiplied by
2^index.
 Advantage of longer slot cycle is phone spends lower percentage of timer with its receiver
and the advantage of shorter slot cycle is MS will receive page sooner.
CDMA Call Processing
 Call processing is the complete process of routing, originating, terminating cellular telephone
calls, along with the necessary billings.
 CDMA mobile goes through 4 stated from power-on to getting call.

Call origination procedure
 All idle mobiles monitor the paging channel to receive incoming calls.
 When an incoming call appears, the paging channel notifies the mobile in a General Page
Message.
 A mobile which has been paged sends a Page Response Message on the access channel.
 The base station confirms that the mobile’s page response was received. Now the mobile is
waiting for channel assignment, expecting a response within 12 seconds.
 The system sets up a traffic channel for the call, then notifies the mobile to use it with a
Channel Assignment Message.
 The mobile and the base station notice each other’s traffic channel signals and confirm their
presence by exchanging acknowledgment messages and preambles.
 Service negotiation is completed.
 Call notification is issued and the traffic flow begins on the acceptance of the call.
Message flow for call origination
BSC MSC
MS
Paging Ch. Overhead Info

Access Ch.Origination Msg
Paging Ch. BS Ack Order
CM Service Request
Fwd Traffic Null Frames
Ch. SCCP Connection Cfm
Paging Ch. Channel Assign Msg
Rev Traffic Ch. Preamble
Fwd Traffic BS Ack Order

Ch. Assignment Request
Rev Traffic Ch.MS Ack Order
Fwd Traffic Ch. Service Connect
Rev Traffic Ch.Service Conn Cmplt
3
GSM Basics
Training Agenda
1 4 7
Introductio
GSM GPRS & EDGE
n to GSM
Channels
3 6 9
GSM GSM Call
Network Flow Q&A
2
2 Architectur 5 8
e
GSM
GSM GSM Testing
Features
Handoff Scenarios
Introduction to GSM – History of GSM
• Early 80’s Europe was experiencing rapid growth in the analog cellular telephone systems.
• 1982 Conference of European Posts and Telegraphs (CEPT) GSM (Group Special Mobile)
group was formed to study and develop a pan-European public land mobile system.
• GSM mandate was to develop a standard to be common for the countries that created it –
provide service to the entire European continent.
• 1987 ETSI oversees the creation of GSM MoU (Memorandum of Understanding)

Association
• Formal objective of the GSM MoU Association is the promotion and evolution of the GSM
systems and GSM platforms
79
History of GSM
• Late 1989’s GSM work was transferred to the European Telecommunication Standards
Institute (ETSI) and SGM (Special Mobile Group) was created
• Phase I of GSM specifications was published in 1990
• Commercial service started in mid-1991
• 1992 first paying customers were signed up for service
80
History of GSM
• By 1993 there were 36 GSM networks in 22 countries
• Early 1994 there were 1.3 million subscribers worldwide
• By 1996 there were more than 25 million subscribers worldwide
• By October 1997 it had grown to more than 55 million subscribers worldwide
• By 2010 it had grown to more than 130 million subscribers worldwide
81
History of GSM
CELLULAR TELEPHONY
 A cellular telephone system links mobile subscribers into the public telephone system or
to another cellular subscriber.
 Information between the mobile unit and the cellular network uses radio communication.
Hence the subscriber is able to move around and become fully mobile.
 The service area in which mobile communication is to be provided is divided into regions
called cells.
 Each cell has the equipment to transmit and receive calls from any subscriber located
within the borders of its radio coverage area.
Cell Radio
Mobile subscriber
82
Modulation Techniques
 Multiple Access Technique allows many subscribers to

use the same communication medium.
 There are three kinds of basic Multiple Access
Technique :
 1) FDMA
 2) TDMA and
 3) CDMA.
 GSM system adopt FDD-TDMA (FDMA and TDMA
together).
83
FDMA
Frequency  FDMA uses different frequency channels

to accomplish communication.
 The whole frequency spectrum available

is divided into many individual channels
(for transmitting and receiving)，every
channel can support the traffic for one
subscriber or some control information.
Time
84
TDMA
Frequency  TDMA accomplishes the

communication in different
timeslot.
 A carrier is divided into channels
based on time. Different signals
occupy different timeslots in
certain sequence , that is , many
signals are transmitted on the
same frequency in different time.
Time
85
CDMA
Frequency  CDMA accomplishes the

communication in
different code sequences.
 Special coding is adopted

before transmission,
then different
information will lose
nothing after being
mixed and transmitted
together on the same
frequency and at the
same time.
Time
86
Frequency Spectrum
GSM 900
 GSM systems use radio frequencies between 890-915 MHz for receive and between 935-960
MHz for transmit.
 RF carriers are spaced every 200 kHz, allowing a total of 124 carriers for use.
 An RF carrier is a pair of radio frequencies, one used in each direction.
 Transmit and receive frequencies are always separated by 45 MHz
Uplink Downlink
890 915 935 960MHz

Frequency Spectrum
DCS 1800
 DCS1800 systems use radio frequencies between 1710-1785 MHz for receive and
between 1805-1880 MHz for transmit.
 RF carriers are spaced every 200 kHz, allowing a total of 373 carriers.
 Transmit and receive frequencies are always separated by 95 MHz
Base Station Receive Base Station Transmit
1710 1785 1805 1880MHz

GSM Features
INCREASED CAPACITY
 The GSM system provides a greater subscriber capacity than analogue systems.
 GSM allows 25 kHz per user, that is, eight conversations per 200 kHz channel pair (a
pair comprising one transmit channel and one receive channel).
 Digital channel coding and the modulation used makes the signal resistant to
interference from cells where the same frequencies are re-used (co-channel
interference).
 This allows increased geographic reuse by permitting a reduction in the number of
cells in the reuse pattern.
89
GSM Features
AUDIO QUALITY
 Digital transmission of speech and high performance digital signal processors provide good
quality speech transmission.
 Since GSM is a digital technology, the signals passed over a digital air interface can be
protected against errors by using better error detection and correction techniques.
 In regions of interference or noise-limited operation the speech quality is noticeably better
than analogue.
 USE OF STANDARDISED OPEN INTERFACES
 Standard interfaces such as C7 and X25 are used throughout the system. Hence different
manufacturers can be selected for different parts of the PLMN.
 There is a high flexibility in where the Network components are situated.
90
GSM Features
IMPROVED SECURITY AND CONFIDENTIALITY
 GSM offers high speech and data confidentiality.

 Subscriber authentication can be performed by the system to check if a
subscriber is a valid subscriber or not.
 The GSM system provides for high degree of confidentiality for the subscriber.
Calls are encoded and ciphered when sent over air.
 The mobile equipipment can be identified independently from the mobile
subscriber. The mobile has a identity number hard coded into it when it is
manufactured. This number is stored in a standard database and whenever a
call is made the equipment can be checked to see if it has been reported stolen.
91
GSM Features
 CLEANER HANDOVERS
 GSM uses Mobile assisted handover technique.

 The mobile itself carries out the signal strength and quality
measurement of its server and signal strength measurement of its
neighbors.
 This data is passed on the Network which then uses sophisticated
algorithms to determine the need of handover.
 SUBSCRIBER IDENTIFICATION
 In a GSM system the mobile station and the subscriber are identified
separately.
 The subscriber is identified by means of a smart card known as a SIM.
 This enables the subscriber to use different mobile equipment while
retaining the same subscriber number.
92
GSM Features
ENHANCED RANGE OF SERVICES
 Speech services for normal telephony.

 Short Message Service for point to point transmission of text
message.
 Cell broadcast for transmission of text message from the cell to all
MS in its coverage area. Message like traffic information or
advertising can be transmitted.
 Fax and data services are provided. Data rates available are 2.4
Kb/s, 4.8 Kb/s and 9.6 Kb/s.
 Supplementary services like number identification , call barring, call
forwarding, charging display etc can be provided.
93
GSM Features
FREQUENCY REUSE
 There are total 124 carriers in GSM900 (additional 50 carriers are available in EGSM band).
 Each carrier has 8 timeslots and if 7 can be used for traffic then a maximum of 868 ( 124 X 7 )
calls can be made. This is not enough and hence frequencies have to be reused.
 The same RF carrier can be used for many conversations in several different cells at the same
time.
 The radio carriers available are allocated according to a regular

pattern which repeats over the whole coverage area.
2
 The pattern to be used depends on traffic requirement and
1 3
spectrum availability.
4
 Some typical repeat patterns are 4*3,3*3, 7*3 etc. 5 7
 The different Subscribers can use the same frequency in different 6 2
places. 1
 The quality of communication must be ensured.
94
GSM Network Architecture
PSTN
MSC/VLR GMSC ISDN
GSM /GPRS BSS
BSC
MS HLR/AUC
BTS
PCU
SS7
BSC SMS system
MS
BTS
GPRS Backbone Internet,
SGSN Intranet
GGSN
OMC CG BG
Other PLMN
95
Mobile Station—MS
An MS is used by a mobile subscriber to communicate with the mobile

network. Several types of MSs exist, each allowing the subscriber to make
and receive calls.
The range or coverage area of an MS depends on the output power of the
output. Different types of MSs have different output power capabilities and
consequently different ranges.
GSM MSs consist of
–A mobile terminal
–A Subscriber Identity Module (SIM)
In GSM the subscriber is separated from the mobile terminal. Each
subscriber’s information is stored as a “smart card” SIM. The SIM can be
plugged into any GSM mobile terminal. This brings the advantages of security
and portability of subscribers.
96
Mobile Station - MS
Mobiles are classified into five classes

according to their power rating.
SIM
CLASS POWER OUTPUT
1 20W
2 8W
3 5W
4 2W
5 0.8W
97
Base Station Sub System
MSC
 The Base Transceiver Station – BTS

BSS
 The Base Station Controller – BSC
 The Trans-coder – TC and Sub
TC/SM
multiplexer (SM)
BSC
BTS
98
 The BSS is the fixed end of the radio interface that provides control and radio coverage
functions for one or more cells and their associated MSs.
 It is the interface between the MS and the MSC.
 The BSS comprises one or more Base Transceiver Stations (BTSs), each containing the radio
components that communicate with MSs in a given area, and a Base Site Controller (BSC)
which supports call processing functions and the interfaces to the MSC.
 Digital radio techniques are used for the radio communications link, known as the Air
Interface, between the BSS and the MS.
 The BSS consists of three basic Network Elements (NEs).
 Base Transceiver Stations (BTSs) assigned to the BSC.
 Base Station Controller (BSC).
 Transcoder (XCDR) or Remote transcoder (RXCDR) .
99
Base Tran receiver Station-BTS
 The BTS network element consists of the hardware

components, such as radios, interface modules and antenna
systems that provide the Air Interface between the BSS and
the MSs.
 The BTS provides radio channels (RF carriers) for a specific RF
coverage area.
 The radio channel is the communication link between the
MSs within an RF coverage area and the BSS.
 The BTS also has a limited amount of control functionality
which reduces the amount of traffic between the BTS and
BSC.
100
 The BSC network element provides the control for the BSS.
 It controls and manages the associated BTSs, and interfaces with the Operations
and Maintenance Centre (OMC).
 The purpose of the BSC is to perform a variety of functions. The following
comprise the functions provided by the BSC:
 Controls the BTS components.-
 Performs Call Processing.
 Performs Operations and Maintenance (O & M).
 Provides the O & M link (OML) between the BSS and the OMC.
 Provides the A Interface between the BSS and the MSC.
 Manages the radio channels.
 Transfers signaling information to and from MSs.
101
Transcoder
 The speech transcoder is the interface between the 64 Kbit/s PCM channel in the land
network and the 13 Kbits/s channel used on the Air Interface.
 This reduces the amount of information carried on the Air Interface and hence, its
bandwidth.
 If the 64 Kbits/s PCM is transmitted on the air interface without occupation, it would
occupy an excessive amount of radio bandwidth. This would use the available radio
spectrum inefficiently.
 The required bandwidth is therefore reduced by processing the 64 Kbits/s PCM data so that
the amount of information required to transmit digitized voice falls to 13kb/s.
 The XCDR can multiplex 4 traffic channels into a single 64 Kbit/s timeslot. Thus a E1/T1
serial link can carry 4 times as many channels.
 When the transcoder is between the MSC and the BSC it is called a remote transcoder
(RXCDR).
102
Packet Control Unit - PCU
MSC
 Packet data switching
 Bridge between SGSN
and BSC
 Provide Pb and Gb BSS
interface
TC/SM GPRS
Backbone
BSC PCU SGSN
BTS
103
Mobile-service Switching Center - MSC
 The Mobile services Switching Centre (MSC) co-ordinates the setting up of calls to
and from GSM users.
 It is the telephone switching office for MS originated or terminated traffic and
provides the appropriate bearer services, teleservices and supplementary services.
 It controls a number of Base Station Sites (BSSs) within a specified geographical
coverage area and gives the radio subsystem access to the subscriber and
equipment databases.
 The MSC carries out several different functions depending on its position in the
network.
 When the MSC provides the interface between PSTN and the BSS in the GSM
network it is called the Gateway MSC.
 Some important functions carried out by MSC are Call processing including
control of data/voice call setup, inter BSS & inter MSC handovers, control of
mobility management, Operation & maintenance support including database
management, traffic metering and man machine interface & managing the
interface between GSM & PSTN N/W.
Home Location Register - HLR
 The HLR contains the master database of all subscribers in the PLMN.
 This data is remotely accessed by the MSC´s and VLRs in the network. The data can also
be accessed by an MSC or a VLR in a different PLMN to allow inter-system and inter-
country roaming.
 A PLMN may contain more than one HLR, in which case each HLR contains a portion of
the total subscriber database. There is only one database record per subscriber.
 The subscribers data may be accessed by the IMSI or the MSISDN.
 The parameters stored in HLR are
 Subscribers ID (IMSI and MSISDN )
 Current subscriber VLR.
 Supplementary services subscribed to.
 Supplementary services information (eg. Current forwarding address ).
 Authentication key and AUC functionality.
 TMSI and MSRN
Visitor Location Register -VLR
 The Visited Location Register (VLR) is a local subscriber database, holding

details on those subscribers who enter the area of the network that it
covers.
 The details are held in the VLR until the subscriber moves into the area
serviced by another VLR.
 The data includes most of the information stored at the HLR, as well as
more precise location and status information.
 The additional data stored in VLR are
 Mobile status ( Busy / Free / No answer etc. )
 Location Area Identity ( LAI )
 Temporary Mobile Subscribers Identity ( TMSI )
 Mobile Station Roaming Number ( MSRN )
 The VLR provides the system elements local to the subscriber, with basic
information on that subscriber, thus removing the need to access the HLR
every time subscriber information is required.
Authentication Centre - AUC
 The AUC is a processor system that

perform authentication function.
 It is normally co-located with the
HLR.
 The authentication process usually
takes place each time the
subscriber initializes on the
system.
 Each subscriber is assigned an
authentication key (Ki) which is
stored in the SIM and at the AUC.
Equipment Identity Register - EIR
 White List: All Valid

assigned ID’s
 Black List: Service
allowed but noted
IMEI is Checked In White List
 Grey List: Service
denied
If NOT found
EIR focus on the IMEI is Checked in Black/Grey List

equipment , not the
subscriber!!
Operation and maintenance Centre for Radio – OMC-R
 The OMC controls and monitors the Network elements within a region.
 The OMC also monitors the quality of service being provided by the Network.
 The following are the main functions performed by the OMC-R
 The OMC allows network devices to be manually removed for or restored to
service. The status of network devices can be checked from the OMC and
tests and diagnostics invoked.
 The alarms generated by the Network elements are reported and logged at
the OMC. The OMC-R Engineer can monitor and analyze these alarms and
take appropriate action like informing the maintenance personal.
 The OMC keeps on collecting and accumulating traffic statistics from the
network elements for analysis.
 Software loads can be downloaded to network elements or uploaded to the
OMC.
Interface Between Different Entities
PSTN
MSC/VLR GMSC ISDN
GSM /GPRS BSS
A
Abis BSC
MS HLR/AUC
BTS C/D/Gs
PCU
SS7
BSC Gb SMS system
MS Um Gr/Gs/Gd/Ge Gc
BTS
GPRS backbone Internet,
SGSN Gi Intranet
Ga GGSN
OMC CG BG
Gp Other PLMN
Interface Names
 Each interface specified in GSM has a name associated with it.
NAME INTERFACE
Um MS ----- BTS
Abis BTS ----- BSC
Ater BSC ----- TRC
A MSC ------ BSC
B MSC ------ VLR
C MSC ------ HLR
D VLR ----- HLR
E MSC ------ MSC
F MSC ------ EIR
G VLR ------ VLR
H HLR ------ AUC
GSM Channels- Channel Concepts
Downlink
Uplink
Physical channel - Each timeslot on a carrier is referred to as a physical channel. Per carrier
there are 8 physical channels.
Logical channel - Variety of information is transmitted between the MS and BTS. There are
different logical channels depending on the information sent. The logical channels are of
two types
• Traffic channel
• Control channel
Page112
Physical and Logical Channel
The physical channel is the medium over which

the information is carried: 200KHz and 0.577ms
The logical channel consists of the information

carried over the physical channels
0 1 2 3 4 5 6 7 0 1 2 3
Timeslot The information carried in one time
slot is called a “burst”
TDMA TDMA
FRAME FRAME
Two types of Logical Channel
Traffic Channel (TCH) :

Transmits traffic information, include data and
speech.
Control Channel (CCH) :

Or Signaling Channel, transmits all kinds of
control information.
Traffic Channel (TCH)
TCH
Traffic Channels
Speech Data
TCH/FS TCH/HS
TCH/9.6 TCH/2.4
TCH Traffic Channel
TCH/FS Full rate Speech Channel
TCH/HS Half rate Speech Channel
TCH/9.6 Data Channel 9.6kb/s
TCH/4.8 Data Channel 4.8kb/s TCH/4.8
TCH/2.4 Data Channel 2.4Kb/s
Traffic Channel (TCH)
User Data Transmission:

 Speech and data (not SMS) are transmitted using traffic
channel (TCH).
 Full Rate (TCH): Transmits full rate speech
(13Kbits/sec). A full rate TCH occupies one physical
channel.
 Half Rate (TCH/2): Transmits half rate speech
(6.5Kbits/sec). Two half rate TCH’s can share one
physical channel, thus doubling the capacity of a cell.
Control Channel (CCH)
CCH (Control Channels)
DCCH BCH
SDCCH ACCH
BCCH Synch. CH.
FACCH SACCH CCCH

SCH FCCH
Broadcast Control Channel – BCCH RACH CBCH

Common Control Channel – CCCH
Dedicated Control Channel – DCCH
Associated Control Channel – ACCH PCH/AGCH
BCH Channels
BCCH( Broadcast Control Channel )

 Downlink only
 Broadcasts general information of the serving cell called System
Information
 BCCH is transmitted on timeslot zero of BCCH carrier
 Read only by idle mobile at least once every 30 sec.
SCH( Synchronization Channel )
 Downlink only
 Carries information for frame synchronization. Contains TDMA frame
number and BSIC.
FCCH( Frequency Correction Channel )
 Downlink only.
 Enables MS to synchronies to the frequency.
 Also helps mobiles of the n cells to locate TS 0 of BCCH carrier.
CCCH Channels
RACH( Random Access Channel )
 Uplink only
 Used by the MS to access the Network.
AGCH( Access Grant Channel )
 Downlink only
 Used by the network to assign a signaling channel upon
successful decoding of access bursts.
PCH( Paging Channel )
 Downlink only.
 Used by the Network to contact the MS.
DCCH Channels
SDCCH( Standalone Dedicated Control Channel )

 Uplink and Downlink
 Used for call setup, location update and SMS.
SACCH( Slow Associated Control Channel )

 Used on Uplink and Downlink only in dedicated mode.
 Uplink SACCH messages - Measurement reports.
 Downlink SACCH messages - control info.
FACCH( Fast Associated Control Channel )

 Uplink and Downlink.
 Associated with TCH only.
 Is used to send fast messages like handover messages.
 Works by stealing traffic bursts.
Uplink Logical channel
CCH
RACH CCCH
SDCCH
SACCH DCCH DCH
FACCH
TCH/F
TCH
TCH/H
Downlink Logical channel
FCCH
BCCH SCH
CCH BCCH
PCH
CCCH
AGCH
SDCCH
DCCH SACCH
DCH FACCH
TCH/F
TCH
TCH/H
Handover
 The GSM handover process uses a mobile assisted technique for accurate
and fast handovers, in order to:
 Maintain the user connection link quality.
 Manage traffic distribution

 The overall handover process is implemented in the MS,BSS & MSC.
 Measurement of radio subsystem downlink performance and signal
strengths received from surrounding cells, is made in the MS.
 These measurements are sent to the BSS for assessment.
 The BSS measures the uplink performance for the MS being served and also
assesses the signal strength of interference on its idle traffic channels.
 Initial assessment of the measurements in conjunction with defined
thresholds and handover strategy may be performed in the BSS.
Assessment requiring measurement results from other BSS or other
information resident in the MSC, may be perform. in the MSC.
Handover
 The MS assists the handover decision process by

performing certain measurements.
 When the MS is engaged in a speech conversation, a

portion of the TDMA frame is idle while the rest of the
frame is used for uplink (BTS receive) and downlink (BTS
transmit) timeslots.
 During the idle time period of the frame, the MS changes

radio channel frequency and monitors and measures the
signal level of the six best neighbor cells.
 Measurements which feed the handover decision

algorithm are made at both ends of the radio link.
Handover
MS END
 At the MS end, measurements are continuously signaled, via the

associated control channel, to the BSS where the decision for
handover is ultimately made.
 MS measurements include:
Serving cell downlink quality (bit error rate (BER) estimate.
Serving cell downlink received signal level, and six best neighbor
cells downlink received signal level.
 The MS also decodes the Base Station ID Code (BSIC) from the six
best neighbor cells, and reports the BSICs and the measurement
information to the BSS.
Handover
BTS END
 The BTS measures the uplink link quality, received signal level, and MS
to BTS site distance.
 The MS RF transmit output power budget is also considered in the

handover decision.
 If the MS can be served by a neighbor cell at a lower power, the

handover is recommended.
 From a system perspective, handover may be considered due to

loading or congestion conditions. In this case, the MSC or BSC tries to
balance channel usage among cells.
Handover Types
Intra-Cell Handover
BSC
0 1 2 3 4 5 6 7
Call is handed
BTS from timeslot 3 to timeslot 5
 Handover takes place in the same cell from one timeslot to another timeslot of the same
carrier or different carriers( but the same cell).
 Intra-cell handover is triggered only if the cause is interference.
 Intra-cell handover can be enabled or disabled in a cell.
Handover Types
Intra-BSC Handover
BSC1
0 1 2 3 4 5 6 7
BTS1
Call is handed from timeslot 3
of cell1 to timeslot 1 of cell2 .
Both the cells are controlled
by the same BSC.
0 1 2 3 4 5 6 7
 Handover takes place between different cell which are controlled by the same BSC.
Handover Types
Inter-BSC Handover
BSC1
0 1 2 3 4 5 6 7
BTS1
MSC of cell1 to timeslot 1 of cell2 .
by the different BSC.
BSC2
0 1 2 3 4 5 6 7
BTS2
 Handover takes place between different cell which are controlled by the different BSC.
Handover Types
Inter-MSC Handover
MSC1 BSS1
BTS1
0 1 2 3 4 5 6 7

of cell1 to timeslot 1 of cell2 .
by the different BSC, each BSC
being controlled by different MSC
MSC2 BSS2
0 1 2 3 4 5 6 7
BTS

2
Handover takes place between different cell which are controlled by the different BSC and
each BSC is controlled by different MSC.
GSM Call Flow
131
Channel Usage During Call Flow
Power-off
Search for frequency correction burst FCCH
Search for synchronous burst SCH
Extract system information BCCH
Idle mode
Send access burst RACH
Allocate signaling channel AGCH
Monitor paging message PCH
Dedicated mode
Set up the call SDCCH
Allocate voice channel SDCCH

Conversation TCH
Release the call FACCH
Idle mode
GPRS & EDGE
 GPRS:
 The first phase of GSM network architecture enhancements that
allow mobiles to connect to IP or X.25 networks.
 Characteristics of GPRS:
 Packet-switched
 Data rate: 14.4Kbps ~ 115Kbps
 New functionalities: point-to-point data transferring,
routing, logical link management, radio resource
management
 Modulation: GMSK
GPRS N/W architecture
134
GPRS Network Elements
Packet control unit (PCU):

 Is a logical entity that manages the radio
interface for the GPRS network
 Managing RR functions including broadcast
channel handling and power control.
 Handling of channel request on access channel
and granting the requests on access grant
channel.
 Handling of uplink messages and sending
Ack/Nack
 PCU are responsible of fragmentation and
reassembly of packets to make them fit into the
classic RLC/MAC blocks of GSM, which allows
them to be sent over the air interface. When the
packets are fragmented, a temporary block flow
identifier (TBFI) is associated to each of them in
order to allow the correct reassembly of the
packets at the other end.
135
136
137
GPRS Architecture with interfaces
138
GPRS Interfaces
 Gb – Connects BSC with SGSN
 Gn – SGSN – SGSN/GGSN (in the same network)
 Gp – SGSN –GGSN (in different networks)
 Gf – For equipment querying at registering time
 Gi – Connects PLMN with external Packet Data Networks (PDNs)
 Gr – To exchange User profile between HLR & SGSN
 Gs – To exchange Database between SGSN & MSC
 Gd – Interface between SMS & GPRS
139
Enhanced Data Rates for GSM Evolution
EDGE Characteristics
 Uses 200kHz carrier/multi-slot operation, time slot
structure
 Modulation: 8PSK(8-phase Shift Keying)
modulation(3bits per modulated symbol) <-> apposed to
the 1-bit per symbol GMSK in GSM/GPRS
 Data rates: 384Kbps
GSM Development Evolution
3G
2Mbps
2.5G IMT-2000
384kbps
EDGE
115 kbps
2G
57.6 kbps GPRS
9.6 kbps HSCSD
GSM
GSM Testing Scenarios
 Network Selection  Supplementary Services

– Manual – Call Forwarding
– Automatic – Call Holding
 Cell Selection / Reselection – Call Barring
 Emergency Camping – Call Waiting
 Location Updation – USSD Code Idle / Dedicated
 Authentication  SIM Functions
 Ciphering – PIN 1, PIN 2
 IMSI Attach / Detach – SIM Phone Book
 RA Updation – FDN
 Speed dialing
GSM Testing Scenarios
 Short Message Services  Handovers

– MO SMS – Intra cell HO
– MT SMS – Inter BTS HO
 Multi Media Message Services – Inter BSC HO
– MO MMS – Inter MSC HO
– MT MMS – Inter RAT HO
– MMS in Diff Format ( MIDI, AMR,  GPRS
.MP3, .MP4, Vcard, GIF, JPEG) – Network Attach / Detach
 Voice Call Services – PDP Activation / Deactivation
– MO Call – Throughput Uplink / Downlink
– MT Call  EDGE
– Short Call
– Long Call
4
UMTS Basics
Training Agenda
1 4 7
Introduction UMTS Call
to UMTS Flows UMTS Releases
3 6 9
UMTS Q&A
Channels HSUPA
2
2 5 8
UMTS
Network HSDPA UMTS
Architecture Testing
Introduction to UMTS
3G (Third Generation Wireless Telephone technology)

 International Mobile Telecommunications-2000 (IMT-2000), better known as 3G, is a family of
standards for mobile telecommunications defined by the International Telecommunication Union
 3G was mainly developed to improve the “DATA” capability of the networks with greater quality – min
384kbps to max 14Mbps (up to 84Mbps in HSPA+)
 Both voice and data can be used simultaneously (while in 2G it depends on the type of handset used,
Class A, Class B, Class C)
 Global roaming - introduced VHE (virtual Home Environment)
 For the consumer
 Video streaming, TV broadcast
 Video calls, video clips – news, music, sports
 Enhanced gaming, chat, location services…
 For business
 High speed teleworking / VPN access
 Sales force automation
 Video conferencing
 Real-time financial information
146
IMT-2000 in GSM & CDMA
GSM
 EDGE (Enhanced Data rates for GSM Evolution)
 DECT (Digital Enhance Cordless Telecommunications)
 UMTS (Universal Mobile Telecommunication System)
 HSPA (High Speed Packet Access)
– HSDPA (High Speed Download Packet Access)
– HSUPA (High Speed Uplink Packet Access)
 HSPA+
 LTE (Long Term Evolution)
 WiMAX
CDMA
 CDMA 2000
 EVDO (Evolution-Data Optimized)
 UMB (Ultra Mobile Broadband)
147
UMTS (Universal Mobile Telecommunication System)
 Also known as WCDMA – as it uses Wideband CDMA to carry the radio transmission
operations (UTRAN air interface).
 Frequency Division Duplex (FDD) and Time Division Duplex (TDD) variants are supported.
 Supports both packet-switched (PS) and circuit switched (CS) data transmission.
 UMTS uses a core network derived from that of GSM, ensuring backward compatibility of
services and allowing seamless handover between GSM access technology and W-CDMA.
 UMTS Specification:
Parameter Specification
Data rate 384 kbps to 2048 kbps
RF Channel Bandwidth 5 MHz
Duplex schemes FDD, TDD
Multiple access technique - CDMA, OVSF (Orthogonal
Channelization Coding technique Variable Spreading Factor) -
spreading through Scrambling
technique
Spreading Factor 4 – 512 (256 UL / 512 DL)
Modulation QPSK
Chip rate 3.84 Mcps (38400 chips/10 148
UMTS Key Features
 Global and Inter-network roaming – Consistent Service and Coverage - VHE (Virtual Home
Environment)
 UMTS is designed to offer “data rate on demand”
 Backward compatible with GSM/GPRS Core Network
 Common RAN-CS & RAN-PS interface
 ATM (Asynchronous Transfer Mode) or IP based transport
 Introduced new Service called as IMS – IP Multimedia Subsystem (for SIP & VoIP enabled)
 Offers different QoS (Quality of Service) parameters for maximum transfer delay, delay
variation and bit error rate
 Bit Rate:
– Rural outdoor 144 kbps (500 km/h) {Macro cell}
– Suburban outdoor 384 kbps (120 km/h) {Micro cell}
– Indoor 2 Mbps (10 km/h) {Pico cell}
ATM (Asynchronous Transfer Mode)
 ATM is a cell-based switching technique that uses asynchronous time division multiplexing. It
encodes data into small fixed-sized cells (cell relay) and provides data link layer services over the
physical links.
 Data is organized in a fixed length of 53-octet cells and transmitted accordingly.
 Three types of interfaces:

- User-to-Network Interface (UNI)
- Network-to-Network Interface (NNI)
- Inter-Carrier Interface (ICI)
 ATM is connection-oriented model and establishes a ‘Virtual Channel’ between two endpoints
before the actual data exchange begins. A 5 byte header with a unique Virtual Path Identifier
(VPI) and Virtual Channel Identifier (VCI) are established for the transmission.
 ATM is the standardized transmission technique for assuring QoS.

QoS (Quality of Service)
 UE’s ability to negotiate the QoS parameters for a radio bearer (RB).
 Renegotiate these parameters while the connection is active if the requirements of the
application changes (UE-initiated renegotiation) or if the network resource status changes
(NW-initiated renegotiation).
 QoS requirements can be divided into four classes:
1. Conversational real-time services
2. Interactive services
3. Streaming services
4. Background services
 These classes are characterized by e.g.:
– Guaranteed / max. Bit rate
– max packet size
– transfer delay
– traffic handling priority
UMTS QoS Classes
UMTS Network Architecture
Base Station
Network Subsystem
Mobile Station Subsystem Other Networks
MSC/ GMSC
BSC VLR PSTN
BTS
ME
SIM
EIR HLR AUC PLMN
RNS
GGSN
SGSN
Node RNC Internet
ME B
USIM
UTRAN
+
SD
Note: Interfaces have been omitted for clarity purposes.
153
UMTS Network
 UMTS network architecture consists of three interacting domains:

– Core Network (CN) : Basic of the Core Network is based on the GMS/GPRS. It provides
switching, routing and transit for user traffic.
– UMTS Terrestrial Radio Access Network (UTRAN) : Provides the air interface access method
for User Equipment. Base Station is referred as Node-B and control equipment for Node-B’s is
called as Radio Network Controller (RNC).
• User Equipment (UE) : Terminals work as air interface counterpart for Node B. The various
identities are: IMSI, TMSI, P-TMSI, TLLI, MSISDN, IMEI, IMEISV.
 List of system required from largest to smallest network
- UMTS systems (including satellite)
- Public Land Mobile Network (PLMN)
- MSC/VLR or SGSN
- Location Area
- Routing Area
- UTRAN Registration Area
- Cell
- Sub cell
154
Core Network (CN)
 The Core Network is divided in circuit switched and packet switched domains.
– Circuit Switch elements:
- Mobile services Switching Centre (MSC), Visitor location register (VLR) and Gateway
MSC.
– Packet Switch elements:
- Packet switched elements are Serving GPRS Support Node (SGSN) and Gateway GPRS
Support Node (GGSN).
– Some network elements, like EIR, HLR, VLR and AUC are shared by both domains.
 The Asynchronous Transfer Mode (ATM) is defined for UMTS core transmission. ATM
Adaptation Layer type 2 (AAL2) handles circuit switched connection and packet connection
protocol AAL5 is designed for data delivery.
155
UTRAN (UMTS Terrestrial Radio Access Network)
 Functions of Node-B
– Air interface Transmission / Reception
– Modulation / Demodulation
– CDMA Physical Channel coding
– Micro Diversity
– Error Handing
– Closed loop power control
 Functions of RNC
– Radio Resource Control
– Channel Allocation
– Power Control Settings
– Handover Control
– Macro Diversity
– Ciphering
– Segmentation / Reassembly
– Broadcast Signaling
– Open Loop Power Control
156
UE (User Equipment)
 UE is responsible for:
– International Mobile Subscriber Identity (IMSI)
– Temporary Mobile Subscriber Identity (TMSI)
– Packet Temporary Mobile Subscriber Identity (P-TMSI)
– Temporary Logical Link Identity (TLLI)
– Mobile station ISDN (MSISDN)
– International Mobile Station Equipment Identity (IMEI)
– International Mobile Station Equipment Identity and Software Number (IMEISV)
157
UMTS Interfaces
158
UMTS Interfaces
 UMTS defines four new open interfaces

– Uu interface – UE to Node-B (the UMTS WCDMA air interface)
– Iu interface – RNC to GSM/GPRS (MSC/VLR or SGSN)
• Iu-CS – Interface for circuit-switched data
• Iu-PS – Interface for packet-switched data
– Iub interface – RNC to Node-B interface
– Iur interface – RNC to RNC interface
The Iu, Iub and Iur interfaces are based on the transmission principles of asynchronous
transfer mode (ATM).
159
UMTS Protocol Structure & Channels
160
Channel classification
 logical channels between RLC and MAC

– specific to type of information
• logical control channels for control plane signaling
• logical transport channels for user plane data
 transport channels between MAC and PHY

– specific to how information is transferred (quality level)
 physical channels used by PHY

– actual transmission on physical layer
161
Logical Channels
 BCCH Broadcast Control Channel (DL)

• distributes information that allows UE’s to attach to network, i.e. broadcasting system
information.
– information about radio environment; power levels, network identity..
 PCCH Paging Control Channel (DL)
• for paging UE’s
– when a UE receives a call it needs to be located
 DCCH Dedicated Control Channel (UL/DL)
• for exchange of control information with attached UE
• transfer control information between N/W and UE
– e.g. power control
162
Logical Channels
 CCCH Common Control Channel (UL/DL)

• for exchange of first messages with attaching UE
• transfer control information between UE and N/W
 DTCH Dedicated Traffic Channel (UL/DL)
• dedicated to one UE only
• exchange of user data
 CTCH Common Traffic Channel
• unidirectional downlink channel (one to many)
• for broadcasting information to all, or a group of UE’s
163
Transport Channels
 DCH Dedicated Channel (UL/DL)

• uplink and downlink, dedicated to a particular UE
• mapped to DCCH and DTCH
 BCH Broadcast Channel (DL)
• broadcast of system information into an entire cell
• fixed bit rate, high power level (needs to be audible to all)
• mapped to BCCH
 FACH Forward Access Channel (DL)
• used for transmission of relatively small amount of data
• mapped onto BCCH, CCCH, CTCH, DCCH and DTCH
 PCH Paging Channel (DL)
• broadcast control information into an entire cell allowing efficient UE sleep-mode operation
• information types are paging and notification
• mapped to PCCH
164
Transport Channels
 RACH Random Access Channel (UL)

• transmission of relatively small amount of data, e.g. initial access or non real-time dedicated
control or traffic data
• mapped to CCCH, DCCH and DTCH
 CPCH Common Packet Channel (UL)
• random access channel used for transmission of busty data traffic
• mapped to DCCH and DTCH
 DSCH Downlink Shared Channel
• dedicated control/traffic data but shared by several users
• mapped to DCCH and DTDH
165
Physical Channels
 DPDCH - Dedicated Physical Data Channel (UL/DL)

- A dedicated physical channel used to carry user or control information to User Equipment
(UE) over an entire cell or part of the cell.
- mapped to the DCH
 PRACH - Physical Random Access Channel (UL)
- A common uplink physical channel used to carry control information or short user packets
from the UE.
- mapped to RACH
 PCPCH - Physical Common Packet Channel (UL)
- A common uplink physical channel used to carry short and medium-sized user packets. It’s
always associated with a downlink channel for power control
- mapped to CPCH
 CPICH - Common Pilot Channel (DL)
- A fixed-rate downlink physical channel that carries a predefined bit/symbol sequence.
166
Physical Channels
 P-CCPCH Primary Common Control Physical Channel (DL)

- A fixed-rate downlink channel used to broadcast system and cell-specific information.
- mapped to BCH
 S-CCPCH Secondary Common Control Physical Channel (DL)
- A downlink physical channel used to carry the FACH and PCH transport channel
 SCH Synchronization Channel
- A downlink signal used for cell search
- The SCH consists of two sub-channels, the primary and secondary SCH, which are transmitted
during the P-CCPCH idle period
 PDSCH Physical Downlink Synchronization Channel (DL)
- A downlink channel used to carry the DSCH transport channel
167
Physical Channels
 AICH Acquisition Indicator Channel

- A fixed-rate downlink physical channel used to carry access preamble acquisition indicators for
the random access procedure.
 AP-AICH Access Preamble Acquisition Indicator Channel
- A fixed-rate downlink physical channel used to carry access preamble acquisition indicators of
CPCH
 PICH Paging Indicator Channel
- A fixed-rate downlink physical channel used to carry the paging indicators which disclose the
presence of a page message on the PCH
 CSICH - CPCH Status Indicator Channel
- A fixed-rate downlink channel used to carry CPCH status information
- A CSICH is always associated with a physical channel used for transmission of CPCH AP-AICH,
and uses the same channelization and scrambling codes
168
UMTS Call flow: Attach Procedure
UE RNC SGSN
RRC Connection
Establishment
Attach Request
Authentication
Security
(Ciphering)
Attach
completion
Iu Release
RR Release
169
UMTS Call flow: Combined Attach procedure
170
UMTS Call flow: Voice Call setup
UE RNC SGSN
Paging
RRC Connection
Establishment
Paging Response Iu Connection
Establishment
Authentication
Security
Call Negotiation
Radio Bearer Setup RAB

Assignment
Call Completion
171
UMTS Call flows: Data Call setup
UE Node B RNC SGSN GGSN

RRC Connection Establishment
Service Request
Security Procedure
PDP Context Activation Request
RAB Assignment
RL Setup
Bearer Sync
Radio Bearer Setup
PDP Context Act. Accept
172
HSPA Overview
HSPA:
 3G HSPA High Speed Packet Access is the combination of two technologies, one for the
downlink (HSDPA) and the other for the uplink (HSUPA) that can be built onto the existing 3G
UMTS or W-CDMA technology to provide increased data transfer speeds.
HSDPA:
 High Speed Downlink Packet Access (HSDPA) is a packet-based data service in W-CDMA
downlink with data transmission up to 8-14 Mbps (and 20 Mbps for MIMO systems) over a
5MHz bandwidth in WCDMA downlink.
 High Speed Uplink Packet Access (HSUPA) is a packet-based data service in W-CDMA uplink
with data transmission up to 5.76 Mbps over a 5MHz bandwidth in WCDMA uplink.
173
HSDPA (High Speed Downlink Packet Access
 HSDPA stands for High Speed Downlink Packet Access

 it is a Release 5 feature of 3GPP/UTRAN
 A major upgrade to 3G system capabilities
 HSDPA shortens round-trip time between network and terminals
 HSDPA reduces variance in downlink transmission delay
 new user devices are needed for HSDPA
 does not improve uplink data rates
174
Need for HSDPA?
175
HSDPA comparison with UMTS data call
176
UMTS Network Architecture
177
UMTS to HSDPA Network Upgrade
178
HSDPA UE Categories
179
HSDPA Protocol Architecture
RLC RLC
UE UTRAN
MAC MAC-d
MAC
HS-DSCH HS-DSCH
(add DSCH DSCH
FP FP FP FP
MAC-hs)
MAC-hs
L2 L2
PHYPHY PHYPHY L1 L1
(add (add 3
process) channels)
Uu Iub/ Iur
RNC, Node B: add HS-DSCH FP protocol process, involve Iub/Iur
Node B: add MAC-hs, responsible for AMC, HARQ, etc.
Node B: add 3 physical channels: HS-PDSCH,HS-SCCH,HS-DPCCH
UE: add MAC-hs, physical channels and process, modulation
180
Functions of Mac-hs & New physical channel
Functions of Mac-hs:
 A new entity has been added to the MAC layer –MAC-hs
On the UE side, the MAC-hs is responsible for
 H-ARQ–Reordering
On the Node B side, the MAC-hs is responsible for
 Flow Control
 Scheduling/Priority Handling
 HARQ–TFRI selection
Functions of New physical layer:

I. High speed downlink shared channel (HS-DSCH)
 Carries information in the downlink direction
 Maximum peak rate is up to 10 Mbps
 Shorter frame of about 2ms
181
Functions of Mac-hs & New physical channel
II. High speed Shared Control Channel (HS-SCCH)

 Used to carry the important information about the physical layer controls to enable decoding
of the data on HSDSCH
 Also used for combining the data which is sent over HSDSCH in the case of retransmission of
the corrupted packet.
III. Uplink High-Speed Dedicated Physical Control Channel (HS-DPCCH)

 Different from the above two channels
 Carries data in the uplink namely ARQ acknowledgement (both positive and negative ones)
182
HSDPA Basic Principles
183
Shared Channel Transmission
184
Fast Link Adaptation
185
Fast Channel-dependent Scheduling
186
Fast Hybrid ARQ with Soft Combining
187
Dynamic Power allocation
188
HSDPA Download comparison
189
HSUPA overview
The main aim of HSUPA is to increase the uplink data transfer speed in the UMTS environment and offer
data speeds of up to 5.76 Mbps in the uplink.
 Increase Capacity
• HSUPA aims to increase capacity by frequently modifying the power used by the UEs in a
cell – only assigning as much resource as necessary. This will allow more efficient
management of the cell resource.
 Throughput
• HSUPA allows a UE to transmit on up to 4 physical channels, use spreading factors as low
as 2 and lower the level of coding protection.
 Reduce delay
• HSUPA introduces a shorter TTI. It also introduces new entities into the MAC layer to
perform Hybrid ARQ. The scheduling mechanism is also modified
190
Need for HSUPA?
191
HSUPA Key Features
 Enhanced dedicated channel
- Dual-channel QPSK modulation

- Shorter Transmission Time Interval (TTI of 2ms or 10ms)
 Fast Node-B(base-station) packet scheduling
-Minimize Uplink interference.

-Multicode Transmission
 HARQ (Hybrid Automatic Repeat Request)
-SAW Protocol
-Chase combining or Incremental redundancy
192
HSUPA Channels
E-DCH (Enhanced Dedicated Control Channel):

– Carries one Block of data per TTI
– UE determines Max block size, Max Power
– ACK or NACK sent in downlink
– One Block of data can be as small as 18bits or as large as 11478 bits per TTI
 E-DPDCH (Enhanced Dedicated Physical Data Channel)
– carries the data sent on the E-DCH
 E-DPCCH (Enhanced Dedicated Physical Control Channel):
– carries control information associated with the E-DPDCH data.
 The E-RGCH and the E-AGCH (Enhanced Relative/Absolute Grant Channel)
– control the maximum power that the UE can use to transmit
 E-HICH (Enhanced Hybrid Indicator Channel)
– carries the ACK/NACK’s from the Node B to the UE. It is very similar to the HS-
DPCCH in HSDPA, but it does not carry a CQI
 F-DPCH (Fractional Dedicated Physical Channel) was not added specifically for HSUPA,
but using it is necessary to achieve the highest data rates .
193
New MAC-layer protocols
– MAC-e
- Between UE and Node B
- Controls HARQ processes and scheduling
– MAC-es
- Between UE and SRNC
- Reorders MAC-es Protocol Data Units (PDUs) in case of soft handover
- Disassembles dedicated channels in RNC
194
How Uplink is achieved
195
HSUPA UE Categories
196
HSUPA –Benefits
197
UMTS - Releases
 UMTS Rel 99
– 2 Mbps theoretical peak packet data rates
– 384 kbps (practical)
• UMTS Rel 4
• MSC Server-based architecture
– Bearer Independent Call Control (CS)
• UMTS Rel 5
– HSDPA (14 Mbps downlink theoretical)
– IMS (IP Multimedia Subsystem for multimedia)
 UMTS Rel 6
– HSUPA (up to 5.76 Mbps uplink)
– MBMS (Multimedia Broadcast Multicast Service)
• UMTS Rel 7
– MIMO Antenna systems with OFDM (Orthogonal Frequency Division Multiplexing)
– Functionality of HSPA+ defined
• UMTS Rel 8
– LTE (Long Term Evolution) introduced with radical changes in air interface and network architecture
• UMTS Rel 9
– SAES Enhancements, WiMAX and LTE/UMTS Interoperability. Dual-Cell HSDPA with MIMO, Dual-Cell
HSUPA.
• UMTS Rel 10
– LTE Advanced fulfilling IMT Advanced 4G requirements. Backwards compatible with release 8 (LTE). Multi-
Cell HSDPA (4 carriers).
• UMTS Rel 11
– Advanced IP Interconnection of Services. Service layer interconnection between national
operators/carriers as well as third party application providers
UMTS Testing
 PTCRB Testing:
• PTCRB is a global organization created by Mobile Network Operators to provide an
independent evaluation process where GSM / UMTS Type Certification can take place.
• The technical evaluation is based on standards as well the needs of the Operators, who
determine the requirements for the Type Certification Process. The PTCRB authorizes
third party laboratories to conduct testing.
 GCF Testing
• Global Certification Forum (GCF) maintains an independent certification scheme for
mobile phones and wireless devices that are based on 3GPP standards.
GCF Certification helps ensure that a mobile device works effectively on mobile networks
anywhere in the world.
199
Advantages of Certifications
Network operators are assured that GCF-certified mobile devices will:

• deliver a seamless roaming service
• perform correctly on their network infrastructure
• associate the operator's brand with high quality service delivery
Manufacturers who certify their mobile devices to GCF rules and procedures are assured that:
• time-to-market for new products is reduced using this respected 'one-stop' verification
process
• expensive and time-consuming duplication of testing effort can be avoided
• their products will benefit from a high degree of interoperability
200
5
FT Concepts &
Tools
Training Agenda
1 4
7 10
Introduction Field Testing Bug Reporting Mobile FT
to Field Scenarios Format Requirements
Testing
3 6
9
Roles & Release
Responsibilit Testing Tools
2 ies Description
2
5 8
Field Testing Field Test 11
Overview Product
Activities Challenges &
Testing
Report Advantages
Introduction to Field Testing
 Field Testing is the testing of a product in the actual context in which it will be used
as opposed to laboratory testing or testing the product in its development environments.
 Field testing can be useful for spotting a wide range of interaction problems such as
problems with software being incompatible with other software on the target system, and also a
wide range of network interaction problems.
 Field testing covers all the real time scenarios that an advanced device uses.
 Field testing performs handset-network success in a real live network

environment and also correct roaming handoff coverage. The tester can walk, stand
still, sit and drive etc while performing such tests.
203
Introduction to Field Testing
 In FT role, tester will identify issues arising in the field and perform first level trouble-
shooting where appropriate, accurately describing the issues, and be responsible for
submitting them internally for further analysis and resolution. Tester will also assist in
writing/updating test cases and procedures to facilitate the test efforts as well as
contributing to process improvement to develop and maintain a consistent test strategy.
Tester will be required to submit detailed reports and keeping records of testing activities for
later review and analysis.
 FT teams travels across the globe using proven methodologies and best practices to test,
measure and document the functionality and performance of mobile devices in a real-world
environment across different network infrastructures.
 Field Testing can be basically categorized under:

Stationary or Static testing: The testing is done at a particular location which is exposed to
the live networks.
Mobility Testing: The testing is carried out while on the move.
• Drive Testing: The DUT is tested during driving (Higher speed)
• Walk Testing: The DUT is tested during walking (Lower speed)
Confidential | Copyright © Larsen & Toubro Infotech Ltd. 204

objective of Field Testing
Primary Objective
 The primary objective of Field testing is to make sure that the mobile device meets the full
requirements, including quality requirements (Non-functional requirements) and fit metrics
for each quality requirement and satisfies the use case scenarios and maintain the quality of
the product in a real network environment. At the end of the Mobile development life cycle,
the user should find that the project has met or exceeded all of their expectations as detailed
in the requirements
Confidential | Copyright © Larsen & Toubro InfoTech Ltd. 205

objective of Field Testing
Secondary Objective
 The secondary objective of Field testing will be to identify and expose all issues and
associated risks, communicate all known issues to the project team, and ensure that all
issues are addressed in an appropriate matter before release. As an objective, this requires
careful and methodical testing of the device to first ensure all areas of the system are
scrutinized and, consequently, all issues (bugs) found are dealt with appropriately.

Field Testing overview
GCF (Global •The test cases run for GCF certification involve RF transmission/reception, Protocol
conformance, Video Telephony (VT) etc. A handset is deemed certified if it has passed
Certification an agreed set of conformance tests and field trials. Once certified, their phones should
operate on any network.3GPP has overall control of the test cases for GSM & UMTS. The
Forum) validation and approval of the implemented test cases then handled by the GCF.
IOT • Interoperability testing is performed to test the interoperability of the

mobile device with different network operators. Interoperability of different
(Interoperability applications as Voice/VT Calls, Web browser, MMS/SMS could be tested with
Testing) different IOT laboratories.
• This Regression testing is carried throughout the entire Field testing cycle to
Regression Testing test the functionality and performance of mobile devices in a real-world
environment
Performance and • Performance and Stability testing is done for a number of scenarios on both
Stability Testing DUT & Reference handset and results are compared for a final conclusion.
Operator • Operator acceptance testing is performed to Verify the mobile device meet
the Operator’s original requirements and the needs of the end users. Primary
Acceptance emphasis is verification from the end users perspective. Performance testing
(including stress, load, and response time) has to be conducted again. There
Testing may be non-testable requirement which needs to be tested at this phase.

Roles and Responsibilities
 Identification of major service providers for each individual cities and prioritizing the test
networks.
 Most of the operators are serving for the whole country either via
I. Their own PLMN
II. National roaming partners.
 Arranging drive routes for different service providers in major cities.

 Design the Field Testing test cases and scenarios for testing after gathering all the network
information, features supported in the DUT, services, parameters etc.
 Test phones performance in live network and benchmarking according to chipset reference
phones.
 Error reporting, filing bugs in defect management systems and following up with developers.
 Drive test to check phone performance in mobility for different scenarios for operator
specific drive route.
208
Roles and Responsibilities
 Analyzing Tools for capturing Logs on Live commercial networks.

 Analyzing, coordinating and tracking issues of the product by executing test cases.
 Performing basic Sanity check of all available product functionalities on final software.
 Preparing and reviewing the testing reports, Analysis of the execution details
 Operators meeting for Product approvals and resolving issues and new requirements from
operators.
 Verification of the failures found by other team members.
 Communicate with developer to resolve the defects.
 Technical assistance to other team members in resolving any issues.
 Working with Marketing unit to resolve issues reported by customers on priority basis.
 Technical assistance to team members regarding Tools information
 Documentation of the important setup procedures and tool usage.
209
View of Board Used for FT

Field Test scenarios
 Camping and Registration scenarios

 MO/MT Voice calls, both in static and drive conditions.
 MO/MT Video calls, both in static and drive conditions.
 PS calls (WAP, Dial-up) both in static and drive conditions
 SMS/MMS/Email test cases.
 Handovers, Cell reselections.
 PLMN and Network Mode change scenarios.
 Low signal test cases.
 Emergency call scenarios
 Video streaming both in static and drive
 Application interactions with Voice/Video calls
 Roaming Scenarios
 Supplementary services
 3G-2G-3G Handovers
 Multi RAB scenarios
 HSDPA throughput

Field Testing Activities
DUT-Live Network Testing
Static Test (Stationary) Dynamic Test (Drive)

Covers functionality, stability in static The DUT is in dynamic condition
conditions
Together with all the scenarios of static
- Network registration & camping condition, the below scenarios are also
- CS (Voice) calls testing in both GSM & added when the DUT is in motion.
UMTS networks. - Idle mode test.
- Data calls & Video telephony (VT) - Handover/Cell reselections
calls testing.
- Camping scenarios.
- Multi RAB calls testing.
- Multi RAB calls.
- Supplementary services testing.
- CS/PS calls, Video streaming testing.
- Emergency Call scenarios.
- Roaming scenarios
- Testing selected list of AT commands.

Performance and Stability Test
 Performance and Stability testing is done for a number of scenarios on both DUT &
Reference handset and results are compared for a final conclusion.
 MO/MT( 3 min call/ 10 min call ) with 50 iterations

In this test parameters captured are a. Call connecting time b. Voice quality c. Connection
status (to check if any call drop occurs)
 MO/MT VT call
In this test together with above parameters for voice call, video quality of VT call is also
captured.
 2G WAP connection/2G Internet connection

In this test parameters captured are a. Connection time b. Connection status
213
Performance and Stability Test
 3G WAP connection/3G Internet connection

n this test parameters captured are a. Connection time b. Connection status
 3G UL throughput/3G DL throughput
In this test parameters captured are a. Throughput b. Connection status
 2G UL throughput/2G DL throughput
In this test parameters captured are a. Throughput b. Connection status
 HSDPA Throughput
 MultiRAB call
In this test parameters captured are a. Call status b. Data connection
214
Sample Test cases
 A sample document for test cases from DG-11 and KPI test cases has been attached.
 There are data related test cases, which are being tested for throughput in benchmark to
reference phone.

Release Testing
Release Testing
Sanity Test Regression Testing Functional Testing

Test Phases
Release Testing:
Release Testing has to be carried out with different software build releases
periodically.
Sanity Test:
Sanity testing is carried out with each new software released. It would be
a basic static testing to ensure that all major functionalities are working
fine in GSM & UMTS environment.
Typical test cases for Sanity test.

1. Network Camping and Registration
2. MO/MT Voice calls
3. PS calls (WAP, Dial-up connection)
4. SMS/MMS/Email
5. Emergency calls

Test Phases
Regression Testing:
Regression test is performed to test the field test scenarios

with the new release.
Regression test basically covers the following main test areas.

1. Voice Call stability
2. Camping & Registration scenarios
3. PLNM and Network mode change scenarios
4. Data calls (Both 2G & 3G)
5. MMS/SMS/Email
6. HSDPA throughput.
7. Multi RAB calls
8. Handovers/Cell Re-selection
9. Supplementary services
10. Emergency call

Test Phases
Functional Testing:
Functional testing of some of the applications could also be performed in Field

testing activities. The applications those could be tested are:
Video Telephony
Web Browser
Messaging
Streaming & Multimedia
Third party applications

Bug Reporting Format
 All defects found during test execution should be logged immediately into the defect logging
system with all necessary information about the defect and all possible logs captured during
testing.
 Many times it’s necessary to work together with Developers in order to help them in finding
out the issue in a proper way. Need to provide developer with proper logs collected during
testing to make debugging easier. Always should keep track of the issues which are not
always in nature and update the developers with updated logs as and when they are
reproduced.

Bug Reporting Format
Below is a general bug reporting format.
 Software Version:
 Hardware Version:
 Identifier: One liner to describe the issue.
 Pre Conditions:
 Bug Description:
 Actual Result:
 Expected Result:
 Other Information:
 Severity: Critical/High/Medium/Minor
 Frequency: Always/Frequent/Rare
 Network name: Vodafone/T-mobile etc
 Infra: ZTE,Huwaei,Ericsson etc.
 Battery level: High/Medium/Low
 Location: Mumbai , Bangalore etc.
 Nature of testing: Static/Drive
 Attachments: Log file name
221
Product Testing Report
 Testing status reports
– A daily & Weekly/Bi-Weekly status report will be provided by the Test Lead to project
management. These reports will summarize daily/weekly testing activities, issues, risks,
bug counts, test case coverage, and other relevant metrics.
 Phase Completion Reports
– Total Test Cases, Number Executed, Number Passes / Fails, Number Yet to Execute
– Number of Bugs Found to Date, Number Resolved, and Number still Open
– Breakdown of Bugs by Severity / Priority Matrix
– Discussion of Unresolved Risks
– Discussion of Schedule Progress (are we where we are supposed to be?)

Tools description
• Advance tools were used for traces for 3G/HSDPA Leading European chipset vendor chipset, i.e.
Artemis ,Mobile analyzer.
• QXDM,QCAT are FT tools used for QUALCOMM chipsets.
• Windows-7 is the compatible version OS for Leading European chipset vendor tools. On
windows-XP these tools create problem with USB ports and connectivity.
• For Qualcomm chipsets Windows-XP is correct OS.
• Flash tool is used for flashing board. For different platforms, we may require different flash
tools, for QUALCOMM chipsets Flashing is done using memory cards.
• Separate Phone tool is used to read/write the IMEI and other security parameters.
• AT console window from Mobile analyzer is connected to specific port and will be used for
testing.
• Install the Comodo firewall & enable it whenever there is a need for packet data testing with
limited packet access. Test cases have a reference to enabling the firewall wherever required.

Requirements for Mobile FT
 Laptops .
 Extra Laptop batteries as a Power-backup during drive test.
 Car charger for charging Laptops and Proto-types.
 Extension cord for multiple power supply.
 Travelers adaptor.
 5 GB/location FTP server for uploading Logs and Test results.
 Post-paid SIM cards at each Onsite locations.
 Shield box at each location .
 USB stick at each location.

Challenges & Benefits of Field Testing
Challenges
 Improvement of test quality by updating test suite from time to time.

 Constant reduction in testing time.
 Physical fitness of the individuals, as Field test would involve a lot of work on travel.
 Collecting different types of permit/visas for Field testing activities for different locations.
 Local language proficiency as this may help in field travel.
Advantages of Field Testing
 Field testing would reduce the time to market the product.

 Field testing would minimize customer complains once the product is launched.


6
Agilent 8960
Hands-on
Thank You
Our Business Knowledge,

Your Winning Edge.

Wireless Basics With Focus On FT PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Wireless Basics With Focus On FT PDF

Uploaded by

Copyright:

Available Formats

Wireless Basics

With Focus on Field Testing

31st Jan- 11th Feb 2011

Tasks from AT Command Q&A

 AT commands are instructions used to control a modem.

Confidential | Copyright © Larsen

 Even post development for maintenance

 No Authoritative body for standardized set of commands supported by all phones

Confidential | Copyright © Larsen

 Microsoft HyperTerminal is a small program that comes with Microsoft Windows.

Confidential | Copyright © Larsen

Confidential | Copyright © Larsen

Confidential | Copyright © Larsen

Confidential | Copyright © Larsen

Confidential | Copyright © Larsen

 Establish a data connection or voice connection to a remote modem (ATD, ATA,

 Send and receive fax (ATD, ATA, AT+F*).

Confidential | Copyright © Larsen

 Send (AT+CMGS, AT+CMSS), read (AT+CMGR, AT+CMGL), write (AT+CMGW) or delete

 Read (AT+CPBR), write (AT+CPBW) or search (AT+CPBF) phonebook entries.

 Perform security-related tasks, such as opening or closing facility locks (AT+CLCK),

 Control the presentation of result codes / error messages of AT commands. For

Confidential | Copyright © Larsen

 Result codes are messages sent from the GSM/GPRS modem or

» Final result codes

» Unsolicited result codes

Confidential | Copyright © Larsen

 A final result code marks the end of an AT command response. It is an indication

Confidential | Copyright © Larsen

 Below are some common causes of error:

Confidential | Copyright © Larsen

 There are four types of AT command operations:

 Test operation. A test operation is used to check whether a certain AT

 Execution operation. An execution operation is used to perform an action or

Confidential | Copyright © Larsen

 Test Command -- Checks Whether a Certain AT Command is Supported

Confidential | Copyright © Larsen

Confidential | Copyright © Larsen

Confidential | Copyright © Larsen

Confidential | Copyright © Larsen

 Lets take example of Motorola AT command for Registration

Confidential | Copyright © Larsen

+MNRR Read Command

+MNRR Unsolicited Message

Confidential | Copyright © Larsen

AT Command Response from Description of command

AT+MODE? +MODE: 0 Display current phone mode

AT+MODE=0 OK Put phone in Modem Mode

Put phone in Phonebook Mode. On some

Confidential | Copyright © Larsen

Confidential | Copyright © Larsen

Early Mobile Telephone System Architecture

 One very powerful transmitter located at the

 Instead of using one powerful transmitter,

 What is Multiple Access?

 Problem: How should we share

 Multiple Access Techniques helps to achieve the same

 AMPS (analog), the First

 Can also partition time: users

Code Division Multiple Access (CDMA)

 AMPS: FM modulation, Cellular band

 Cellular CDMA: Band Class 0

 PCS CDMA: Band Class 1