Nokia TCSM2¶

Nokia is one of the major historical manufacturers of GSM infrastructure equipment. They made BTSes, they made BSCs and MSCs, and they had several generations of Transcoder and Submultiplexer (TCSM) equipment that sits between the BSC and the MSC. (Nokia used the term TRAU to refer only to individual channels, handling a single voice or data call, while the big rack full of TRAUs was called TCSM.)

According to the available docs, Nokia had 3 generations of TCSM: the original TCSME, followed by TCSM2, followed by TCSM3i. Out of these 3 Nokia TRAU generations, plus other vendors besides Nokia, TCSM2 is our lucky winner: we were able to find enough documentation to figure out which components to buy and how to put them together, we were then able to actually buy the set of parts needed for a minimal configuration, and the module that holds all of the on-board software (TRCO card) came loaded with everything we need. Very lucky indeed!

The project to put together a working TCSM2 system in Themyscira lab is still ongoing as of this writing, tracked in #6464.

Documentation¶

The body of documentation we've collected for TCSM2 (and some for TCSM3i) is gathered here:

https://www.freecalypso.org/pub/GSM/Nokia_TCSM/

Some of the most interesting docs are:

• This document (a slide presentation from Huawei - how they did get involved?) focuses mostly on TCSM3i, but it begins by covering the full evolutionary line and includes some useful tidbits about TCSM2.
• This document (tcsm2.pdf) contains a lot of technical details about the internal architecture of TCSM2 and interconnection between modules - invaluable for reconstructing a working system from pieces!
• This document (tcsm2-command.pdf) thoroughly describes the management interface that is accessible via the RS-232 port on the TRCO card - essential for configuration!

Architecture¶

In Nokia's overall architecture, TCSM (any of the 3 generations) sits between the BSC and the MSC. The interface toward the MSC is the standard A interface, while the interface between the TCSM (bank of TRAUs) and the BSC was named Ater (third after A and Abis) by Nokia. The A interface is made up of one or more E1 circuits, and so is Ater - but in a large system the A interface will need many more E1 circuits than Ater. The newly introduced Ater interface uses 16 kbit/s or 8 kbit/s sub-timeslot channels like Abis, but because it is located on the MSC-interfacing side of BSC switch fabric, each voice/data channel on Ater has a 1:1 correspondence to a Circuit Identity Code on A. Thus Ater is like A, but compressed, requiring fewer E1 circuits for transport.

Each unit of TCSM2 (a single entity for configuration management purposes) handles a single E1 line on the Ater interface toward the BSC, expanded to a minimum of 1 and a maximum of 7 E1 circuits toward the MSC. In a lab setup, just one E1 circuit on A plus one E1 circuit on Ater is sufficient; in a real deployment where each TCSM2 unit is utilized to its full capacity, there will be 4 A-side E1 circuits per TCSM2 when full-rate channels are used, or 7 A-side E1 circuits per TCSM2 with HR voice channels. (The expansion factor from Ater to A is 4x with FR or 8x with HR - but there is a maximum of 7 A-side E1 circuits per TCSM2, hence there is a slight under-utilization of Ater capacity with HR.)

Each TCSM2 unit as just described consists of the following modules, not counting mechanical support (racks and chassis), passive interconnects (backplanes, cables) and power supplies:

• One TRCO card - it is the central brain for the TCSM2 system;
• Minimum 2, maximum 14 transcoder DSP cards: TR16 for E1 systems or TR12 for T1 systems;
• Minimum 1, maximum 4 Exchange Terminal modules: ET2E for E1 systems, ET2A for T1 systems.

Transcoder cards (TR16 or TR12) host the DSPs that do the actual transcoding. The single TRCO card and all transcoder DSP cards sit in a chassis called TC1C. The backplane interconnect between cards in this chassis consists of 4 PCM highway interfaces, each such interface covering a pair of E1 (or T1) circuits, plus a microprocessor bus interface for supervision and control. The TRCO connects each of these 4 PCM highway interfaces to an Exchange Terminal module; each ET module handles 2xE1 or 2xT1 circuits.

E1 interface 0 of the first ET2E module (or T1 interface 0 of the first ET2A module) is always Ater, while all other E1/T1 circuits belong to the A interface. For each E1/T1 circuit that isn't Ater, there need to be two corresponding transcoder cards (TR16 or TR12) in the TC1C chassis, covering that A-interface PCM circuit. If only one ET module is present, the system has a single E1/T1 circuit on A and a single E1/T1 circuit on Ater - the minimal configuration for lab use - and only two transcoder DSP cards are needed.

Physical setup for lab use¶

If someone happens to acquire a Nokia TCSM2 setup by hauling away a full rack from a decommissioned site, they will presumably acquire a complete working system. However, the TCSM2 setup in Themyscira lab was put together by buying every needed component as a separate part from the surplus market, hence a bottom-up approach was needed.

A minimal system for lab use consists of one TC1C chassis and one ET1TC chassis. The ET1TC chassis holds the single ET2E or ET2A module that is needed, while TC1C holds the other required components:

• One TRCO card;
• 2 TR16 cards, or TR12 if ET2A is used;
• One power supply module (PSC1 or PSC1-S).

In this bottom-up approach where no full rack from a decommissioned site is given, the hacker will need to construct her own cable that interconnects the two backplanes, and the wiring for -48VDC power will likewise have to be custom-made.

Management interface¶

As already explained, each unit of TCSM2 handles a single Ater E1 toward the BSC. This interface includes a dedicated timeslot for a LAPD-based proprietary protocol by which the BSC controls the TCSM - this management method is the official one for real networks, matching the vendor-neutral general architecture for TDM-based GSM in which TRAU functions logically belong to the BSC. However, in a move that turned out extremely fortunate for us, Nokia also implemented an escape hatch for operating a TCSM2 unit with neither BSC nor MSC present. There is a physical RS-232 port on the TRCO card (DB25F wired as DCE), and this interface can be used to fully configure and manage the unit in the absence of in-band management from the BSC.

• TCSM2 ET modules
• TCSM2 ET1TC chassis
• TCSM2 firmware
• TCSM2 interchassis cable
• TCSM2 PCM circuit types
• TCSM2 power supply
• TCSM2 TC1C chassis
• TCSM2 timing
• TCSM2 transcoder cards
• TCSM2 TRCO card