Mobile Positioning based on Existing Signalling Messages in GSM Networks

Research Area: Telecommunications & Computer Networks (Wireless Cellular Networks)

Nikos Deligiannis
Postgraduate Student Wireless Telecommunication Laboratory, Department of Electrical and Computer Engineering, University of Patras, Rion 26500, Patras Hellas. Email: ndelhgiann@upnet.gr Tel: +306972729772,

Spiros Louvros
Department of Telecommunications Systems & Networks, Technological Educational Institution of Messologi, Hellas. Email: slouvros@teimes.gr, Tel: +306977277076,

Stavros Kotsopoulos
Professor Wireless Telecommunication Laboratory, Department of Electrical and Computer Engineering, University of Patras, Rion 26500, Patras Hellas. Email: kotsop@ece.upatras.gr Tel: +302610997301.
Abstract. 3rd Generation Partnership Project (3GPP) has released a series of technical specifications for GSM location services (LCS) proposing new network architectures and protocol stack. This means that a whole new network (like IN nodes) and major software upgrades have to be implemented in the existing GSM networks, increasing the investments cost. On the other hand in this paper, a novel GSM procedure for the implementation of Time Of Arrivals (TOA) and Angle Of Arrivals (AOA) technique is introduced, using the existing GSM Phase 2+ infrastructure and protocol stack while introducing the least modifications in already existing signalling messages. Thus, minimum modifications in signalling messages are required, easily loaded as a simple software patch delivery in any GSM node of the system, increasing the upgrade flexibility and minimizing the implementation and investment cost. These modifications include a general paging signalling, utilized in combination to the introduced single paging, forced cell reselection and measurement signal reports. Keywords: GSM Networks, Paging Signalling, Single Paging Message, Time of Arrival, Angle of Arrival, Access Delay

I. INTRODUCTION Solutions for implementing a mobile location positioning system are classified into handset based and network based positioning. The former techniques require that the existing handsets have to be redesigned in order to meet new requirements, while the latter need adjustments only at the Base Stations (BSs) or switching centres. As for handset based techniques, several proposals have been introduced in the literature including Enhanced Observed Time Difference (E-OTD) and its update Observed Time Difference of Arrivals (OTDOA) specified for Universal Terrestrial Radio Access Network (URAN) [1,2], Global Positioning System (GPS) [3], Global Positioning System (GPS) [3], Assisted GPS (AGPS) [1] and Differencial GPS (DGPS). On the contrary, network based technologies require changes in the infrastructure of the BS, the Base Station Controller (BSC) or the Mobile Switching Centre (MSC). In addition, they are less expensive and more easily implemented than handset based solutions but less precise. Because of the poor implementation complexity, the limited cost and the satisfactory performance, network based techniques are usually preferred for mobile positioning. Typical representatives are Power of Arrivals (POA) [4-6], Cell of Origin (COO) [1], Time Difference of Arrivals (TDOA) [7-9] and Time of Arrivals (TOA) [10-12] and Angle of Arrivals (AOA) [13]. Recently, hybrid methods have been proposed [14,15] which mitigate the location error even more. Both TOA and AOA positioning techniques make use of triangulation methods which require at least three BSs. However, there have been solutions which require less than three BSs [14], diminishing the complexity of the system and the signal overhead. Time based methods rely on calculating accurate time estimates while angle based methods use BS antenna arrays to measure the angle of the received signal. Conventional methods for obtaining time estimates use correlation techniques [16], code acquisition and tracking [17-19], timing acquisition [20,21], etc. In the GSM EDGE Radio Access Network (GERAN) COO, TDOA and A-GPS has been specified while COO is the most common used. COO accuracy (cell radius) is improved by utilising the TA parameter especially in macrocells but still the location error is comparatible high (550 m). In this paper, we introduce a procedure, designed for rural environments, to obtain more accurate time estimates together with AOA estimates and supply them to a BSC for positioning processing. The time estimates may be computed utilising conventional methods such as correlation techniques [16], code acquisition and tracking [17-19], timing acquisition [20,21]. Measurements from at least three BSs are carried to the BSC using the existing GSM parameter called Access Delay. Furthermore, we assume that antenna arrays are installed in the BSs making the measurement of the AOA doable. The acquired AOA measurements are supplied to the BSC using modified Measurement Report message and thus, making possible the implementation of AOA method. The remainder of this paper is organised as follows: Section II summarises the GSM infrastructure for the support of location services and applications, as specified by 3GPP. In Section III the proposed GSM procedure for the acquisition of location measurements is analysed. The required modifications in existing signalling messages based on NOKIA Nethawk Protocol Analyser are given in Section IV. Finally, conclusions of our work are drawn in section V.

II. GSM INFRASTRUCTURE FOR LOCATION POSITIONING IMPLEMENTATION According to 3GPP technical specifications [22-27] the GSM architecture for the support of LoCation Services (LCS) is modified as shown in fig. 1. External LCS Client is an entity setting a request for location information on a specific MS. The gathered information is processed to provide location services and applications. It may lie either in the PLMN, or outside or in the mobile handset. The Gateway Mobile Location Centre

(GMLC) is the first node an external LCS client accesses in a GSM PLMN. The GMLC may request routing information from the HLR via the Lh interface. After performing registration
LMUA

IAir

EIR GMSC BS
IAbis IAir
LMU

External Network

IF

IA

ILg

ILe

BSC

SMLC

MSC
VLR

GMLC

External Client

ID

ILh

HLR

IH

AuC

Figure 1: Specified GSM infrastructure for LCS support

authorization, it sends positioning requests to and receives final location estimates from the GMSC via the Lg interface. The Service Mobile Location Centre (SMLC) which is responsible for the calculation of the final position estimate is an update of the BSC. The SMLC controls a number of Location Measurements Units (LMU) for the collection of the radio interface measurements to locate the MS subscriber in the area it serves. The estimated position of the subscriber is sent back to the corresponding MSC/VLR. The LMU contacts both location and assistance measurements which are supplied to the SMLC. An LMU can be defined either as type A which is accessed over the normal GSM air interface or type B which is accessed over the Abis interface. In this approach, we make use of LMUs type B, only. The MSC contains functionality responsible for MS subscription authorization and managing call-related and non-call related positioning requests of GSM LCS. The MSC is accessible to the GMLC via the Lg interface and the SMLC via the Ls interface. The HLR contains LCS subscription data and routing information. The GSM positioning procedure that we introduce deals with the modifications needed in Base Station Sub-System (BSS) and Network and Switching Sub-System (NSS). This means that in this work we investigate the least necessary modifications in the signalling between the MSC/VLR and the MS, or otherwise after the location positioning request sent from GMSC to MSC.

III. PROPOSED GSM PROCEDURE In this section, we introduce a novel GSM procedure for the implementation of the TOA, AOA positioning techniques using the GSM Phase 2+ infrastructure and protocol stack. This means that the proposed procedure requires the minimum modifications in the existing networks. In order to be located, the target handset is required to be in idle mode. A MS shall be considered in idle mode when it is attached to a Public Land Mobile Network (PLMN) and a TCH is not at its disposal. The analytical signalling message flow of the positioning procedure is demonstrated on figure 2. In GSM, the VLR stores the Location Area Code (LAC) where the subscriber lies so to page the handset in case of a incoming call. According to our procedure, in order to update the Location Area Code (LAC) in VLR, the MSC initiates a periodic Location Update signalling for the MS. The timing parameter is sent to the MS by using the MML-Command ZEQJ through Broadcast Control channel (BCCH) [28]. As a result, the VLR has refreshed the LAC of the

target MS before the more precise positioning process occurs. Note that the signalling message flow of Periodic Location Update as given by NOKIA Nethawk Protocol Analyser can be found in [28]. Immediately after the periodic Location Update, a paging signalling procedure follows in order to obtain the time estimate from the serving BS. The time measurement is similar to the computation of TA at the BS in the case of initial assignment or handover between not synchronized cells. In GSM, it is necessary that BS and MS do not transmit simultaneously therefore, the MS transmit three TimeSolts (TS) after the BS. In fact, a transmission delay called Timing Advance is taken into account obliging the MS to transmit a little earlier. TA parameter is in accordance to the distance between BS and MS and it is dynamic, meaning that it can change value during a connection. The TA can take values from 0 to 233 s, which is enough to cope with macrocells having radius of up to 35km, given the speed of light. In our approach, the BS using existing conventional techniques [16-21] can measure the propagation delay between PCH and RACH, divide that time by two and return that time estimate by the Access Delay value to the BSC via the Channel Request message. In addition a BS equipped with antenna arrays can measure the angle of the received signal. In case of Idle Mode condition, the MS keeps for itself measurements about the received signal power from the nearest and the 6 adjacent BSs. In order to acquire the measurements from the MS a Link Access Protocol D-channel (LAPD) MEASUREMENT REQUEST message is introduced. The message is transmitted to the MS from the serving BS through the established Stand alone Dedicated Control Channel (SDCCH). The MS responds through the SDCCH and the measurement report is forwarded to the BSC through LAPD DCM L3 MEASUREMENT RESULTS (IDhex=36) message. Not to mention that the serving BS includes the AOA measurements in the previous message. Out of the 6 BSs in the list, BSC chooses those two which represent to the greater signal power which are controlled by itself. By this, additional signalling through the MSC is avoided. Furthermore, to obtain the time estimate and the AOA measurements from the other 2 BSs a new LAPD Paging Command message is introduced. The proposed signalling resembles to paging signalling but with a change: The single paging message contains the Cell Global Identity (CGI) and the Temporary Mobile Subscriber Identity (TMSI) of the MS, while the paging signal contains the LAC and the TMSI. By using this message, a paging signalling is exchanged between just one BS and the MS, while a common paging signal is forwarded from all BSs of a LAC to the target MS. Thus, useless signalling overhead is avoided. After the BSCs decision, the MS is sequentially coordinated to each of the 2 selected BSs by utilizing a novel Forced Cell Reselection signalling procedure. The BSC activates a new SDCCH to the second BS, forces the MS to coordinate with the new SDCCH channel (through the first BS) and deactivates the previous. Then, the BSC/BS2 sends a Single Paging Request message to the MS through Paging Channel (PCH) and the MS transmits a Channel Request message through Random Access Channel (RACH). When the paging signalling from BS2 is terminated, the BSC obtains the AOA measurements using the novel BTSM AOA MEASUREMENTS RESULTS message. Then it activates a SDCCH in BS3, forces the MS to coordinate with this (through BS2) and releases the previous SDCCH channel in BS2. Again, the single paging procedure through BS3 takes place the AOA measurements are obtained and the SDCCH is released. Finally, the required data (time estimates, AOA measurements) have been acquired by the BSC where the position estimation of the MS according to the proposed techniques takes place. The estimated subscribers position is sent to the network via the BSSMAP UDT LOCATE SUBSCRIBER RESPONSE message which is transmitted from the BSC to the MSC.

VLR
IC cell info

MSC
UDT Locate Subscrib er Comman

BSC

BS3

BS2

BS1

MS

Page MT

Paging Command Paging Request (PCH)

Channel Request (RACH) Channel Required

Paging signaling from BS1

Channel Activation

Channel Activation ACK.

Immediate Assignment Command

Immediate Assignment (AGCH)

Paging Response Establish Indication

Paging Response (SDCCH)

UA (SDCCH) Measurements request Measurements req (SDCCH) Measurement acquisition Measurements results

Meas. res. (SDCCH)

Channel Activation (SDCCH TS in BS2)

Channel Activation ACK. Forced cell reselection to BS2

Immediate Assignment Command Imm. Assign. Cmd (AGCH)

RF release (SDCCH TS in BS1)

RF release Acknowledgment

Single Paging Command Single Paging Request (PCH)

Channel Request (RACH) Channel Required

Channel Activation Single Paging signaling from BS2

Channel Activation Ack.

Immediate Assignment Command Immediate Assignment (AGCH)

Single Paging Response (SDCCH) SAMB Single Paging Response Establish indication

UA (SDCCH) AOA measurement results

VLR

MSC

BSC
Channel Activation (SDCCH TS in BS3)

BS3

BS2

MS

Channel Activation Ack. Forced cell reselection to BS3

Immediate Assignment Command Imm. Assign. Cmd (AGCH)

RF release (SDCCH TS in BS2)

RF release Acknowledgment

Single Paging Command Single Paging Request (PCH)

Channel Request (RACH) Channel Required

Channel Activation Single Paging signaling from BS2

Channel Activation Ack.

Immediate Assignment Cmd Immediate Assignment (AGCH)

Single Paging Response (SDCCH) SAMB Single Paging Response

UDT Locate Subscrib er Respons

UA (SDCCH) AOA measurement results

RF Channel release TOA, E-TOA or AOA positioning algorithm takes place

RF Channel release Ack.

Figure 2: Proposed GSM Signalling Procedure for the Acquisition of Positioning

IV. REQUIRED MODIFICATIONS IN SIGNALLING MESSAGES The introduced GSM procedure rely on the NOKIA Nethawk Protocol Analyser [28] and the required signalling modifications are demonstrated in this section. Paging for Positioning Command (MSC to BSC, BSSMAP) This message created by the BSSMAP layer and supplied to all the BSCs of the Location Area (LA), consists of the necessary data for positioning such as IMSI, TMSI, LAC, CIs of the LA, etc. It also contains a request for the subscribers position (longitude, latitude). This message is formed when the location request is sent from the External Client to the MSC (where the target MS lies) via the GMSC. As a Location Update procedure precedes the VLR is aware of the LAC where the subscriber belongs.

BSSMAP (length: 52, 34h) PAGING FOR POSITIONING Info IMSI -length: 8 (08h) MS target IMSI -identity contains an IMSI -mobile country code: 202 -mobile network code: 01 -MSIN: 0000000002 MS target TMSI TMSI -length: 4 (04h) -TMSI value: CA2A0100h Cell Identifier - length: 29 (1Dh) -cell identified with LAC+CI -location area code: 1369 (0559h) -cell identifier: 171 (00ABh) -location area code: 1369 (0559h) -cell identifier: 172 (00ACh) Cells where paging -location area code: 1369 (0559h) takes place -cell identifier: 173 (00ADh) -location area code: 1369 (0559h) -cell identifier: 174 (00A h) -location area code: 1369 (0559h) -cell identifier: 175 (00AFh) -location area code: 1369 (0559h) -cell identifier: 176 (0060h) -location area code: 1369 (0559h) -cell identifier: 177 (0061h) POSITIONING REQUEST RESULTS -length: 2 (02h) -provide latitude -provide longitude

Idle Measurement Request (BSC to BS1, BTSM L3) The BSC sending the following LAPD DCM L3 message via the Abis interface requests to the serving BS, requests the latter to provide AOA and signal power measurements. A potential identity of the proposed message in the GSM infrastructure could be IDhex=35, while its context is given below.
IDLE_MEAS_REQ (DCh) T=0 Channel Nr. -SDCCH/8 subchannel 6 -timeslot: 1 Idle_Meas_Req Nr -value: 10 (0ah) Uplink Measurements -length: 1 (1h) -provide meas. AOA Downlink Measurements -serving cell rxlev_full -serving cell rxlev_sub -number of neigh cells meas request: 6 -rxlev[1] -neighbor BA index[1] -BSIC[1] -rxlev[2] -neighbor BA index[2] -BSIC[2] -rxlev[3] -neighbor BA index[3] -BSIC[3] -rxlev[4] -neighbor BA index[4] -BSIC[4] -rxlev[5] -neighbor BA index[5] -BSIC[5] -rxlev[6] -neighbor BA index[6] -BSIC[6] SDCCH between BS and MS AOA measurements request

Power Level Measurements request

The BS transfers the request for signal power measurements to the MS via the established SDCCH. Single Paging Command (BSC to BS2, BTSM) The novelty this message introduces is that it contains the CGI of the BS target rather than the LAC of the whole area, preventing useless signalling overhead.

PAGING CMD (CCh) T=0 Channel Nr -downlink CCCH (PCH+AGCH) Paging group and -timeslot: 0 channel declaration Paging Group -value: 2 (02h) MT identity -TMSI: CA2A0100 TMSI declaration

Channel Required (BS to BSC, BTSM) The BS supplies the BSC with the computed time estimates using the access delay parameter.
CHAN RQD (CCh) T=0 Channel Nr -uplink CCCH (RACH) -timeslot: 0 Req. Ref -answer to paging -random reference: 25 (19h) -N32: 10 (ah) -N26: 23 (17h) -N51: 34 (22h) -Access Delay -value: 0 (00h)

TDMA frame number

AOA Measurement Results (BS to BSC, BTSM) This message includes the SDCCH and CCCH channel number whose AOA was measured, the measurements and their mean value.
AOA MEAS. REP. (DCh) T=0 Channel Nr 1 -uplink CCCH (RACH) -timeslot: 0 Channel Nr 2 -SDCCH/8 subchannel 3 -timeslot: 1 Meas. Res. Nr -value: 3 (03h) -Uplink Meas. -length: 6 (06h) AOA -Channel 1 AOA: measurements -Channel 2 AOA: and mean value -mean AOA:

Paging for Positioning Response (BSC to MSC, BSSMAP) As the answer of the Paging for Positioning Command message, this messages consists of the IMSI, the TMSI, the LAC, the CI and the coordinates of the subscribers position.
BSSMAP (length: 30, 1Eh) Mobile Terminal Info IMSI -length: 8 (08h) -identity contains an IMSI IMSI -mobile country code: 202 -mobile network code: 01 -MSIN: 0000000002 TMSI TMSI -length: 4 (04h) -TMSI value: CA2A0100h Cell Identifier - length: 5 (05h) -cell identified with LAC+CI -location area code: 1369 (0559h) -cell identifier: 173 (00ADh) POSITIONING REQUEST RESULTS -length: 4 (04h) -latitude: 38.2476 (26.3Fh) -longitude: 21.7377 (15.2Fh)

Location Area and Cell Identifier where the subscriber lies Subscribers position coordinates: Ag. Nikolaou & Korinthou, Patras

V. CONCLUSION In this paper, we introduce a novel GSM procedure for the acquisition of three BSs measurements related to the TOA and AOA of the received signal. Neither TOA nor AOA have been specified for GERAN, as far. Our proposal is compatible with 3GPP technical specifications for GSM location services (LCS) while based on the GSM Phase 2+ infrastructure and protocol stack. Therefore, minimum modifications in existing signalling messages are required, making the procedure easily implemented as a simple software patch delivery in any GSM node of the system. Our procedure requires neither modified handsets or satellite availability (A-GPS) nor synchronisation between BSs (TDOA). On the contrary, the implementation is as simple as COOs and the accuracy improvement is secured.

REFERENCES
[1] Yilin Zhao, Motorola, Inc., Standardization of Mobile Phone Positioning for 3G Systems, IEEE Communications Magazine, July 2002. [2] 3GPP TS 25.305, Stage 2 Functional Specification of UE Positioning, Mar. 2002. [3] Abhijit Chatterjee, Role of GPS in navigation, Fleet Management and other Location Based Services [4] W. Figel, N. Shepherd and W. Trammell, Vehicle Location by a Signal Attenuation Method IEEE Trans., Vehic., Tech , vol. VT-18, Nov. 1969, pp. 105-10 [5] M. Hata and T. Nagatsu, Mobile Location Using Signal Strength Measurements in a Cellular System IEEE Trans., Vehic., Tech., vol. VT-29, May 1980, pp. 245-51 [6] W Smith, Jr., Passive Location of Mobile Cellular Telephone Terminals Proc IEEE lnt'l. Carnahan Conf. Security Tech. , 1991, pp. 221-25 [7] B. Fang, "Simple Solutions for Hyperbolic and Related Position Fixes," IEEE Trans Aerospace and Elect Sys , Sept 1990, pp 734-53. [8] K. Ho and Y. Chan, "Solution and Performance Analysis of Geolocation by TDOA," IEEE Trans Aerospace and Elect Sys , vol 29, Oct 1993, pp 131 1-22. [9] W. Foy, "Position-Location Solutions by Taylor-Series Estimation," IEEE Trans Aerospace and Elect Sys. , vol. AES-12, Mar 1976, pp. 187-93. [10] M. Feuerstein and T. Pratt, A local area position location system, in Proc. 5th Int. Conf. Mobile Radio Personal Communications, 1989, pp. 7983. [11] James J. Caffery, Jr. and Gordon L. Stuber, Overview of Radiolocation in CDMA Cellular Systems, IEEE Communications Magazine, April 1998. [12] G. Turin, W. Jewell, and T. Johnston, "Simulation of Urban Vehicle-Monitoring Systems," IEEE Trans. Vehic. Tech. , vol. VT-21, Feb. 1972, pp. 9-16 [13] S. Sakagami et al., Vehicle position estimates by multi-beam antennas in multipath environments, IEEE Trans. Veh. Technol., vol. 41, pp. 6367, Feb. 1992. [14] Marco Porretta, Paolo Nepa, Giuliano Manara, Filippo Giannetti, Mischa Dohler,Ben Alle, and A. Hamid Aghvami, A Novel Single Base Station Location Technique for Microcellular Wireless Networks: Description and Validation by a Deterministic Propagation Model IEEE Trans. Vehic. Techn., vol. 53, No. 5, Sep. 2004 [15] N. Deligiannis, S. Louvros, K. Ioannou, S. Kotsopoulos: Location Positioning Techniques Investigation in GSM Networks, kluwer Academics, journal of Wireless Personal Communications, submitted, under review. [16] C Knapp and G Carter, "The Generalized Correlation Method for Estimation of Time Delay," IEEE Trans Acoustics, Speech, and Signal Processing vol ASSP-24 Aug 1976 pp 320-27 [17] Simon et all, Spread Spectrum Communications, vol 111, Computer Science Press, 1985 [18] J Holmes, Coherent Spread Spectrum Systems Wiley, 1982 [19] R Ziemer and R Peterson, Digital Communications and Spread Spectrum Systems, Macmillan, 1985 [20] P Goud, A Sesay, and M Fattouche, "A Spread Spectrum Radiolocation Technique and Its Application to Cellular Radio," Proc IEE Pacific Rim Conf Comrnun , Comp and Signal Processing, 1991, pp 661-64

[21] J Caffery, Jr and G Stuber, "Vehicle Location and Tracking for IVHS in CDMA Microcells," Proc IEEE PIMRC, 1994, pp 1227-31 [22] 3Gpp TS 03.71 v7.11.0 Digital cellular telecommunications system (Phase 2+), Location Services (LCS), Functional Description, 2004 [23] 3Gpp TS 02.71, v7.3.0 Digital cellular telecommunications system (Phase 2+), Location Services (LCS), Service description, Stage 1" [24] 3Gpp TS 04.31, v8.17.0 "Digital cellular telecommunications system (Phase 2+); Location Services (LCS); Mobile Station (MS) Serving Mobile Location Center (SMLC); Radio Resource LCS Protocol (RRLP)", 2005. [25] 3Gpp TS 04.71, v8.4.0 "Digital cellular telecommunications system (Phase 2+); Mobile radio interface layer 3 Location Services (LCS) specification", 2002. [26] 3Gpp TS 08.31, v8.1.1 "Digital cellular telecommunications system (Phase 2+); Location Services (LCS); Serving Mobile Location Center (SMLC) Serving Mobile Location Center (SMLC); SMLC Peer Protocol (SMLCPP)", 2002. [27] 3Gpp TS 09.31, v8.7.1: "Digital cellular telecommunications system (Phase 2+); Location Services (LCS); Base Station System Application Part LCS Extension (BSSAP-LE)", 2004. [28] GSM 900/1800 BSS Signaling Training Document, Nokia Telecommunications Oy 1198 [29] GSM Networks: Protocols, Terminology, And Implementation, Gunnar Heine, Artech House Publishers, 1998 [30] The GSM System for Mobile Communications, Michel Mouly, Marie-Bernadette Pautet, 1992