HRv1 error flags¶

On TCH/F channels for FR and EFR, the channel decoder produces only one Boolean error flag: BFI, Bad Frame Indicator. It indicates whether the decoded frame should be regarded as good or bad - see BFI criteria page. For TCH/HS there are two officially defined error flags per frame: BFI and UFI, the latter being Unreliable Frame Indicator. The TRAU-UL frame format of GSM 08.61 carries both BFI and UFI. However, a more thorough review of the available evidence from ETSI and from one concrete vendor implementation (TI Calypso DSP) indicates that the original design for TCH/HS channel decoding exhibits a total of three error flags: BFI, UFI and BCI. The meaning of the latter acronym is unknown; one possible meaning might be Bad Channel Indicator.

Evidence for BCI in ETSI reference code¶

The venerable GSM 06.06 code drop includes a utility named REID, which stands for Residual Error Insertion Device. This program is not a part of the speech codec proper (neither encoder nor decoder), hence the functions implemented therein will not be found in a TRAU, for example. Instead this program simulates the radio leg from the output of the speech encoder on the Tx end to Rx DTX handler input on the receiving end; in the context of codec testing, the input to REID is the output of the encoder process and the output from REID serves as decoder input test sequences. The published version simulates only error-free transmission, but the code is structured to facilitate true simulation of channel errors. (This situation makes one wonder if perhaps the original developers of GSM-HR codec started out with a REID program that included error simulation, but then it was sanitized for publication.)

This REID source includes a function (swSidDetection) that implements ternary SID classification of GSM 06.41 section 6.1.1 - the latter spec also refers to this C code, but declares it to be an example, rather than normative. However, if we look at the body of this function, we see an interesting oddity: one of the bit-counting thresholds for SID classification depends on a mystery error flag from the channel decoder. As we take a closer look at the interface to this function and the code comments in two different places (see lines 154-156 and 808-809), we see that the channel decoder puts out 3 error flags: BFI, UFI and BCI. We know BFI and UFI - they are defined in GSM 06.41 spec and included in the TRAU-UL interface of GSM 08.61 - but what is BCI?

It appears that BCI flag was omitted from the interoperable interface of GSM 08.61 (and from chapter 6 of GSM 06.41, which defines an equivalent interface in more abstract terms, also applicable to MS implementations) because it has no effect on the Rx DTX handler: its only effect is on the swSidDetection function or its equivalent in hardware/DSP implementations.

TI Calypso DSP¶

This article describes a nifty feature of this DSP whereby we can see all TCH DL frames passing across the interface depicted at the top of chapter 6 (Rx functions) of GSM 06.31, 06.41 and 06.81 specs. The status word in a_dd_0[0] (or a_dd_1[0] for TCH/H subchannel 1) is particularly interesting in that it carries all of the various metadata flags, similar to control flags of GSM 08.60/08.61 on the network side, but adapted by TI for their MS implementation. Of course there is no documentation, and the meaning of each bit had to be reverse-engineered by empirical observation - but this reverse eng has been done, and we know this bit meaning now.

In the case of TCH/FS and TCH/EFS, bit 2 is BFI, while bits 1 and 0 are unused (always seen as 0). However, in the case of TCH/HS, all 3 error flags are present:

• bit 2 is BFI
• bit 1 is BCI
• bit 0 is UFI

Bits [4:3] encode the ternary SID flag (just like bits C13 & C14 in 16 kbit/s TRAU-UL frames) for all 3 codecs. For FR and EFR the bit counting rules are those prescribed in GSM 06.31 and 06.81 specs, but in the case of TCH/HS, experiments reveal that TI's DSP implements exactly the same logic as in ETSI's non-normative example code. Furthermore, the threshold of 11 or 16 not-matching bits changes per the BCI flag exactly like in ETSI's version! (The latter observation is a key piece of evidence for bit 1 indeed being BCI.)

Error severity hierarchy¶

The definition of BFI and UFI in GSM 06.41 makes it clear that BFI is a more severe error condition than UFI - but where does BCI fit in?

In order to observe all possible TCH/HS error conditions in TI Calypso DSP output, I (falconia) used a test setup with R&S CMU200 instrument simulating a GSM network, with a coaxial cable connecting it to the SMA antenna connector on an FCDEV3B. I configured the CMU200 for TCH/HS, made a test call from the CMU to the FreeCalypso MS (with tch record running in fc-shell to capture the DSP output for TCH DL Rx), and then I turned the knob to slowly reduce the downlink power level put out by the instrument. As the Rx input level to the MS dropped, decoding errors increased, and I was able to capture the behavior of TCH/HS Rx in TI's DSP over the full range from perfectly good reception to radio link failure.

With decreasing C/I, the error progression seen in the DSP output for TCH/HS is as follows:

• Perfectly good frames: no error flags set
• BCI flag set, but no others
• BCI and UFI flags set, but not BFI
• All 3 error flags set

We can thus make the following observations:

1. BCI is the mildest error condition of the 3, UFI is intermediate, and BFI is most severe.
2. TI's DSP always sets the bits for less-severe errors in addition to the most severe error bit, i.e., if BFI is asserted, all 3 error bits will be set, and if UFI is asserted, BCI will be set too.

Unfortunately though, the actual criteria used by the DSP to set each of the 3 error severity levels remain elusive. There is no apparent correlation with the convolutional decoder bit error count, which the DSP reports in its third status word. It is a problem similar to that described in the BFI criteria article, but now on steroids as there are 3 different error levels involved.

It would of course be possible to unearth all of this logic by undertaking a thorough static reversing job on the DSP ROM code, reversing C54x DSP machine code. But the gargantuan labor resource allocation that would be required for such a task does not exist yet.

BCI "upgrade" to BFI¶

GSM 06.41 spec (or rather its current incarnation as 3GPP TS 46.041) section 6.1.1 contains this wording:

NOTE: That the BFI flag, which is generated by the channel error correction scheme, will in some cases be modified by the SID frame detection unit.

This note clearly refers to the curious logic on lines 978-979 of REID swSidDetection code; this logic sets BFI flag (the highest error severity) if BCI was set and the number of set bits in the partially-matching SID field falls into a specific range. In effect, this logic "upgrades" BCI (lowest error severity) to BFI (highest error severity) if the decoded bit pattern matches a set criterion.

The rationale for such error severity "upgrade" is difficult to understand - however, it should be noted that TI's DSP implementation omits this quirk: in the attached hr-test2.dl capture, there are lines where BCI is set, the bit pattern matches the criterion for the logic in question, yet neither BFI nor UFI is asserted.