Цитата(SOLTEK2006 @ Пятница, 22 Декабря 2006, 12:40)
Кото-нибудь знает для чего они и можно ли из них извлечь что-то полезное?
The "Eng Field Options" menu is supported in the 8200/6200 ver. 1.7 (37.62.39), 7500 ver. 2.1 (58.62.15) and all later revisions - The software on the 3200 / 5200 / 7200 does not include the menu but it is present in all the newer models like d460, 8700, 8900, StarTAC (70, 85, 130), SlimLite, cd160/920/930 & d520 (The models mentioned here are the European / Asian GSM-900/1800 digital units). Unfortunately the menu is never enabled from the factory but with some special tools, it is possible to activate it. What follows here is the description of the menu, look at the menu customization page for instructions on how to enable it.
The Engineering menu will provide you with detailed information about the connection between the MS and the network. This is all information that the MS can meassure by itself or decode from the BCCH which is transmitted from the BTS. The menu only gives readout of parameters, you are not able to change a thing with it, and consequently you can't do any harm to your phone - it's perfectly safe to use the menu. On the latest software revisions, the menu is available in several languages. In german it will show as "Eng Felder Optionen", "Aktive Zelle", "Nachbar-zellen" and "System-Parameter"
It is easier to understand these terms if you have an idea about what the BCCH actually is: When powering on your GSM phone, it doesn't know what frequency to tune into in order to communicate with the cell, therefore it will start scanning all 125 GSM frequencies (GSM-900), looking for a Frequency Correction Burst. Once this is found and the frequency has been adjusted, it will "stay tuned" and listen for a Synchronization burst and decode it in order to synchronize (timewise) to the network. After sucessfully synchronizing frequency and time, the BCCH channel can be received and decoded, providing network identification and information about how the mobile should "behave" on the net. The BCCH is on timeslot 0 - the remaining 7 timeslots are used for traffic. The BCCH never frequency-hops - it stays put all the time, like a beacon, transmitting information to the mobiles. The mobile will continue to search for BCCH's and keep a list of the 6 strongest BCCH in the area.
The "Eng Field Options" menu appears in the top level of the menus and consists of three sub-menus:
Active Cell:
Displays what Channel the BCCH (Broadcast Control CHannel) is received on (If available).
During idle you can view the parameters : RxLev, RxLevAM, NCC, BCC, MSTxPwr, C1. Dualbanders will also provide: CRO, TO, C2, 2ter, 2bis & ECSC
During dedicated mode you can view the parameters : RxLev, RxLevFull, RxLevSub, RxQualFul, RxQualSub, Timeslot, TimeAdv and PwrLev. Dualbanders will also provide: Vocoder, 5bis, BSIC, MBReport, MeasValid.
The ActCh (Active Channel) may read "Hopping" during a call. The GSM system can use slow frequency hopping where the mobile station and the base station transmit each TDMA (Time Division Multiple Access) frame on a different carrier frequency (The hopping rate is 217 hops/second which corresponds to one hop per. TDMA frame). The frequency hopping algorithm is decoded from the Broadcast Control Channel which the mobile station continuously decodes. Since multipath fading is dependent on carrier frequency, slow frequency hopping help mitigate the problem. Frequency hopping is operator optional down to the individual cell.
When communicating with the BTS (for the reasons below) you can see how the SDCCH (Standalone Dedicated Control CHannel) is mapped. The DCCH (Dedicated Control CHannels) are used for registration, location updating, authentication and call set-up. This channel can be mapped in two different ways: SDCCH8 ( 1/8 rate channel) if combined is off and SDCCH4 ( 1/4 rate channel) if combined is on. See also Combined, below.
Adjacent Cells:
Lets you scroll through the 6 nearby cells with the highest C1 criterion and view the information transmitted on their corresponding BCCH carriers (If they can be decoded). Pressing (OK) Will let you view the data transmitted on the selected BCCH (some of thse are only available on dualband units): RxLev, BCCH decode status, RxLevAM, CRO, TO, NCC, BCC, MSTxPwr, C1, C2, CBA & CBQ.
System Parameters:
During idle you can view the parameters :Combined, AcsClas, MCC, MNC, LAC, CellID, T3212, BS-PA-MFRM and XZQTY.
During dedicated mode you can view the parameters :Combined, DTX, MCC, MNC, LAC, CellID
Pressing (OK) while in the Eng Field Opt menu, will toggle refresh on and off. When refresh is enabled, the phone will continuously measure and display the strength of the signal and try to decode the BCCH. If you disable the refresh the phone will remember and show the last set of values until the refresh is enabled again. If you are driving around and the info changes real fast, you can "freeze" the values so you can examine them before they change again.
KEY TO THE READOUTS:
ActCh: Displays the Active Channel on which the BCCH is received. GSM-900 has 124 (001-124) channels and GSM-1800 has 374 (512-885). The channels are split between the operators - HERE is how it is done in Denmark (GSM-900)
Combined: Describes the channel organization in the 51-frame multiframe : off uses SDCCH/8 and on uses SDCCH/4. The logical channels can be mapped differently : Off: BCCH+CCCH and SDCCH are on different channels. On: BCCH, CCCH and SDCCH are combined on the same channel - confused about all the channels ? Take a look at the GSM channel structure section below
AcsClas: Access Control Class . The Access Control class is a parameter to control the RACH (Random Access CHannel) utilization. 15 classes are split into 10 classes randomly allocated to normal subscribers and 5 classes allocated to specific high priority users. This way, the operator can cut out users when the net is getting clogged-up. Denied classes can by cycled so that in extreme loading you may be denied for 10 minutes or so, but then you'll have service. Other classes are reserved for the emergency services/operators so they can be excluded and have priority calling. What networks does use this RACH regulation ???
RxLev:(7bits) The strength of the received BCCH signal (000 to 127 dBm), normally between -55 to -90 - the MS will look for another BCCH carrier when the signal drops to RxLevAm* ( RxLev and RxQual are sent regularly to the BSC during a call - )
RxLevAm: Rx Level Access minimum - Minimum Rx signal strength threshold (usually around -100 dBm to -110 dBm). This is related to the minimum signal that the operator wants the network to receive when being initially accessed by an MS.
CRO:(6 bits) Cell Reselect Offset. Applies an offset to the C2 reselection criterion. 0 - 126 dB in 2 dB steps, i.e. 0=0dB, 1=2 dB, etc.
TO:(3 bits) Temporary Offset. Applies a negative offset to C2 for the duration of PENALTY_TIME. 0 - 60 dB, 10 dB steps i.e. 0=0dB, 1=10 dB, etc. and 7 = infinity
BCC:(3 bits) Base-station Color Code (0-7)- This is used to distinguish neighboring cells of the same operator broadcasting BCCH on the same FDMA (Frequency Division Multiple Access) channel from each other (Different channel "sets" are used by GSM operators in the same country, so their BCCH will always be on different FDMA channels). A set of cells that covers all the channels available for a specific operator is called a "cluster". BCC has the same value in all the cells of a cluster, because of each cell, in the cluster, transmits on different channels. NCC+BCC is called BSID (Base Station Identity)
NCC:(3 bits) Network Color Code (0-7) - this is used to distinguish neighboring cells between operators of different countries broadcasting BCCH on the same FDMA channel from each other. The NCC is equal within a PLMN (Public Land Mobile Network). It's a 3 bit value.
MSTxPwr: The maximum power level that the MS (Mobile Station) is allowed to access the RACH - this means that even though you have a 8W unit, you are not always allowed to blast away at full power. Generally MSTxPwr is low in urban areas (small cells) and high in rural areas (large cells) - See notes on power control below
C1: The path loss criterion parameter C1 (defined as C1=(RxLev-RxLevAm-MAX((MSTxPwr-MSMaxTxPwr),0)) ) used for cell selection and reselection. This is calculated by the MS and used for deciding which cell to camp to (selection and reselection). C1 is more useful than just RxLev, since it takes the MSTxPwr & MSMaxTxPwr into account. MSMaxTxPwr is the phones maximum output in dBm (for GSM normally 33 but 39 with carkit). The reason Tx power is factored into C1 is so that an MS only camps to a cell where it has a reasonable chance to be heard by the base station if it transmitted.
C2: Cell reselection criterion. Identical to C1 when camped in 900 band. You will notice that the dual band units do have a preference for the 1800 band. The C1 can be much higher than C2 but it doesn't result in the phone switching back to the 900 band. The reason C2 is included is to handle small cells, where an MS may select and camp to a cell but not have long enough to do anything before loosing it completely. C2 is time varying so it can get bigger after a certain period. If the MS can still see it then it will camp to it.
CBA:(1 bit)Control parameter Cell Bar Access. If enabled and CBQ=0 then cell selection and reselection will be barred.
CBQ:(1 bit)Control parameter Cell Bar Qualify. If enabled, then cell selection priority will be low, but cell reselection status (barred/normal)will be normal.
2ter: This message is sent optionally on the BCCH by the network to all mobile stations within the cell giving information on the extension of the BCCH allocation in the neighbour cells.. Based on this information the mobile station is able to decide whether and how it may gain access to the system via the current cell. The 2ter message shall be sent if and only if this is indicated in TYPE 3 message. Can be ignored by units only capable of GSM900.
2bis: This message is sent optionally on the BCCH by the network to all mobile stations within the cell giving information on control of the RACH and of the extension of the BCCH allocation in the neighbour cells. Based on this information the mobile station is able to decide whether and how it may gain access to the system via the current cell. The 2bis message shall be sent if and only if the EXT-IND bit in the Neighbour Cells Description IE in both the TYPE 2 and TYPE 2bis messages indicates that each IE only carries part of the BA. Can be ignored by units only capable of GSM900.
ECSC:(1 bit) Early Classmark Sending Control. This bit controls the early sending of the classmark by the Mobile Stations implementing the Controlled Early Classmark Sending option: 1= Early Sending is explicitly accepted 0= Early Sending is explicitly forbidden.
RxLevFull:(6 bits) C1 value with continuous transmission from tower (calculated from all the timeslots of one 51-multiframe)#
RxLevSub:(6 bits) C1 value with discontinuous transmission from tower (subset of the timeslots in the 51-multiframe - usually from the SACCH timeslot)#
RxQualFull:(3 bits) Received signal quality is derived from the BER (Bit Error Rate) with continuous transmission from tower (calculated from all the timeslots of one 51-multiframe) - see notes on BER
RxQualSub:(3 bits) Received signal quality is derived from the BER (Bit Error Rate) with discontinuous transmission from tower (subset of the timeslots in the 51-multiframe - usually from the SACCH timeslot) - see notes on BER
Timeslot:(4 bits) The current Ts (Timeslot) (0 through 7 - TDMA allows eight channels to be accommodated on a single RF (Radio Frequency) carrier)
TimeAdv:(7 bits) TA (Timing Advance) (0 through 63 ) - see notes on timing advance below
PwrLev: Reports which power step/level the phone is transmitting at - (See section below on power control)
Vocoder: EFR (Enhanced FullRate) / FR (FullRate) / HR (HalfRate) / NA (NotApplicable) - (How many of these are actually implemented ?)
5bis: This system information message is sent optionally on the SACCH just after handover by the network to mobile stations within the cell giving information on the extension of the BCCH allocation in the neighbour cells. When received (and not ignored) this information must be used as the list of neighbouring cells to be reported on. Any change in the neighbour cells description must overwrite any old data held by the mobile station. The mobile station must, with the exception stated above, analyse all correctly received system information type 5 messages. Can be ignored by units only capable of GSM900.
BSIC:(6 bits) Control parameter Base Station Identity Code = |NCC (3 bits) BCC (3 bits)|
MBReport:(2 bits) MultiBand report. The number of neighbour cells (with known and allowed NCC part of the BSID) for each frequency band supported is included in this parameter. Possible values are: 6-0, 5-1, 4-2 & 3-3
MeasValid:(1bit) This bit indicates if the measurement results for the dedicated channel are valid or not: 0=The measurement results are valid, 1=the measurement results are not valid.
DTX:(1 bit) Discontinuous transmission, a feature used to save battery and reduce network traffic by powering down the mobile station transmitter when there isn't any speech to transmit.
MCC: Mobile Country Code - This is the X.121 code for the country ( 238 = Denmark etc.)
MNC: Mobile Network Code 1 = Tele Denmark, 2 = Sonofon, 10 = TDM GSM-1800 (These are the ones for MCC 238 )
LAC: Local Area Code, Several cells are contained in a LA(Local Area). The size is operator definable and may vary. A LU (Location Update) must take place if the MS leaves the LA. The LAC is 2 bytes long and hence the value between 0 and 65535. Together with MCC & MNC this gives the LAI (Local Area Information)
CellID: A number that identifies the active cell. The CID (CellID) is unique to the LA. For a truly unique description of a cell, the CGI (Cell Global Identity) should be used. The CGI consists of the CID, MCC, MNC & LAC
T3212: Time between periodic LU's (0-255). The value of the T3212 timer has to be multiplied with 6 minutes to get the LU-period : 010=1 Hour, 050=5 hours the theoretical maximum is 25.5 hours - It can be configured independently for each cell. The Location Update Timer is much more a HLR (Home Locaton Register) time-out. If a phone leaves the coverage area and has no chance to send a "IMSI Detach" (to log off - please note that not all cells allow IMSI detach/attach), then the phone would be paged in the last known LA, which may force a lot of traffic a) on the radio channels and B) between the BTS, the BSC (Base Station Controller) and the HLR. The LU timer is reset if a call or SMS is sent / received.
BS-PA-MFRM: Number (2...9) of MFRMs (MultiFRaMe) between two transmissions of the same PAging message to MSs of the same paging group. I assume, that when we are talking about paging, the channel at issue here is the paging channel, which is a CCH (Control CHannel)- here the length of a multiframe is 234 ms - see note on TDMA frame structure & duration. The value for my operator 238-01 is 9 which corresponds to 234 ms x 9 = 2.1 seconds between paging messages. The BS-PA-MFRM shows the Discontinuous Receive (DRX) parameter of the network. DRX allows the mobile to synchronize its listening period to a known paging cycle of the network. This can typically reduce the standby power requirements by 90%. The paging procedure has been designed to facilitate significant battery-saving potential in the hand portable - the larger the period between listening periods the lower battery consumption. Unless a hand portable is used excessively the biggest drain on its battery comes not from the time spent using it, but from the standby cycle as it monitors the paging channel, in case it is being called. In the GSM system the DRX allows the mobile, once it has located the paging signal, to synchronize a clock knowing that it will not get another signal until a specified time has elapsed. It can thus power down its circuits for most of the time during standby. On a 8700 with a 600 mAh battery motorola specifies 60 hours of standby with DRX=2 and 75 hours with DRX=9
XZQTY : From disassembling the firmware, it appears as if XZQTY is not variable at all, but simply fixed at 14.3 all the time.
* When comparing RxLev's, remember the logarithmic nature of the dB scale and that the signal intensity decays by a factor 4 when the distance from the BST is doubled ; Assuming line of sight to the BST, the signal will drop 6 dB when the distance is doubled.
Comtinue here to read my description of the technical basis for the codes, BCCH decoding status, powerlevels, bit error rate. timing advance, and TDMA channel structure.
I would like to thank Marcello Scata, Norbert Huttisch, Patrick Zandl and Thomas Kochanek for their help in the making of this page.
© 1998 Janus Christian Krarup
Explanation Of GSM Channel Structures
BCCH DECODE STATUS
BCCH Decode Status Explanation
Not Synced The Mobile Station (MS) is neither synchronized to the network with respect to time or frequency. If the MS is out of sync, only the RxLev can be viewed and all other parameters will read ???
No FCB The Frequency Correction Burst (FCB or FB) which is used for frequency synchronization of the mobile is not detected. The FCB defines the Frequency Control Channel (FCCH) which is assigned to every other Ts. The FCB is 142 bits long, but carries no information (It is equivalent to an unmodulated carrier, shifted in frequency, with the same guard time as the normal burst), it identifies the FCCH and allows the synchronization Channel (SCH) to be found on at Ts 0 of the following 51-multiframe.
FCB Detect The FCB was detected on the FCCH - now the MS is frequency synced. and the SCH can be found at Ts 0 of the following 51-multiframe.
SCH Decode SCH decode means that the synchronization channel (SCH) was decoded and the MS now is time synced. with the network. The Synchronization Burst (SB) has a long (64 bits) training sequence. It also carries a 78 bit payload consisting of the TDMA frame number (FN) and the Base Station Identity Code (BSIC) which consists of the Network (PLMN) Color Code (NCC) & Base station Color Code (BCC). RxLevAm, MSTxPwr & C1 will still read ???
BCCH Decode All information on the Broadcast Control Channel was decoded. This includes the SCH & FCCH, CellID, LAC, MCC, MNC, frequency hopping & more that describes the current control channel structure.
Sync State ? The Synchronization state can not be determined.
GSM CHANNEL STRUCTURE
GSM distinguishes between physical channels and logical channels (the information carried by the physical channels). Several recurring timeslots on a carrier constitute a physical channel (GSM-900 : 124 RF carriers x 8 timeslots = 992 physical channels), which are used by different logical channels to transfer information - both user data and signaling.
Frequency Correction CHannel BTS->MS: MS frequency correction
Broadcast Control CHannel Synchronization CHannel BTS->MS: MS synchronization to the BTS
| |
|
| Paging CHannel BTS->MS: MS terminating call announcement
Signaling Channel Common Control CHannel Access Grant CHannel BTS->MS: Acknowledge channel requests from MS and allocate a SDCCH
| Random Access CHannel BTS->MS: MS access requests, response to call announcement, location update, etc.
|
| Fast Associated Control CHannel Time critical signaling: Handovers
Dedicated Control CHannel Slow Associated Control CHannel Link monitoring
Standalone Dedicated Control CHannel For signaling exchanges (during call setup, registration / LU).
Common channels. The forward common channels are used for broadcasting bulletin board information, paging and response to channel requests. The return common channel is a slotted Aloha type random access channel used by the MS to request channel resources before timing information is conveyed by the BSS, and uses a burst with an extended guard period.
Dedicated point-to-point channels. The dedicated point-to-point channels are divided into two main groups, the dedicated signaling channels and the traffic channels. The dedicated signaling channels are used to set-up the connection, and the traffic channel of a variety of rates is used to convey the user information once the session is established. Both channel types have in-band signaling: SACCH for e.g. link monitoring, and FACCH for time-critical signaling during e.g. a handover. The FACCH "steals" the entire traffic burst for signaling.
POWER CONTROL
To minimize co-channel interference and to conserve power, both the mobiles and the Base Transceiver Stations operate at the lowest power level that will maintain an acceptable signal quality. Power levels can be stepped up or down in steps of 2 dB from the peak power for the class down to a minimum of 13 dBm (20 miliwatts) on GSM-900 and 10 dBm (10 miliwatts). Use this table to translate between dBm, PwrLev and Power. Green indicates the range for a 2 W GSM-900 hand portable (Class 4) - the bottom 2 rows indicate the range for a 1800/1900 1 W unit.
Power level 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
900-dBm 43 41 39 37 35 33 31 29 27 25 23 21 19 17 15 13
900-Watts 20.0 12.6 8.0 5.0 3.2 2.0 1.30 0.80 0.50 0.32 0.20 0.13 0.08 0.05 0.03 0.02
1800-dBm 30 28 26 24 22 20 18 16 14 12 10
1800-mW 1000 631 398 251 158 100 63 40 25 16 10
BIT ERROR RATE
The Bit Error Rate (BER) is the percentage of received bits on a digital link that are in error relative to the number of bits received, usually expressed using a logarithmic scale: The RxQual is a 3 bit value, which means that it has a 0 to 7 value. Use the table below to convert the RxQual to a BER percentage:
RxQual 0 1 2 3 4 5 6 7
Percentage of bits failed (BER) < 0.2 0.2-0.4 0.4-0.8 0.8-1. 6 1.6-3.2 3.2-6.4 6.4-12.8 >12.8 %
TIMING ADVANCE
The Timing Advance is used to compensate for the time it takes a RF signal to go at the speed of light between the BTS and MS. The maximum BTS radius of 35 Km is divided into 64 TA steps ( This means 547 meters / TA step - As a simplification 550 meters will be used) .TA multiplied with 550 meters will give the minimum distance to the BTS. The maximum distance will be (TA +1). A TA value will pinpoint a BTS to a circular band 550 meters wide, with an inner radius of (TA x 550) meters. This can be used to triangulate the position of a BTS by having 2 -3 readings at different positions.
Timing Advance 0 1 2 3 4 5 ....... 63
Distance to BTS < 550 m 550 m-1100 m 1100 m-1650 m 1650 m-2200 m 2200 m-2750 m 2750 m-3300 m ....... 35 Km
TDMA FRAME STRUCTURE & DURATION
The TDMA technique means that the data are interleaved several times and collected in frames. Each TDMA frame has a 22 bit identifier so it can be told apart from the 2.7 million other TDMA frames any given hyperframe. You can also see a graphic representation by Thomas Kochanek here
Traffic Channel (TCH) Consists of: . Control Channel (CCH) Consists of:
TDMA frame 4,6 ms 8 Timeslots . 4.6 ms 8 Timeslots
Multiframe 120 ms 26 TDMA frames . 234 ms 51 TDMA frames
Superframe 6 s 120 ms 51 Multiframes . 6 s 120 ms 26 Multiframes
Hyperframe 3 h 28 m 53 s 760 ms 2048 Superframes . 3 h 28 m 53 s 760 ms 2048 Superframes
30.3.2006, 9:14 Закрепленное сообщение!
