Wireless Communication Technology Chapter 6 Global System for Mobile (GSM) Communication Technology Asst. Prof. Bijaya Shrestha Department of Electronics & Communication Engineering nec

Global System for Mobile Communications (GSM) GSM is a second generation digital cellular system standard. It is the world’s most popular 2G technology. Features and Services: Support for international roaming Distinction between user and device identification Excellent speech quality Wide range of services Interworking (e.g., with ISDN, DECT) By Asst. Prof. Bijaya Shrestha, nec, 2015

Global System for Mobile Communications (GSM) Extensive security features Asynchronous and synchronous data services (2.4/4.8/9.6 kbps) Access to packet data networks (X.25) Telematic services (SMS, fax, videotext, etc.) Many value-added features (call forwarding, caller ID, voice mailbox) E-mail and Internet connections By Asst. Prof. Bijaya Shrestha, nec, 2015

GSM System Architecture By Asst. Prof. Bijaya Shrestha, nec, 2015

GSM System Architecture GSM system architecture consists of Mobile Station (MS) Base Station Subsystem (BSS) Network and Switching Subsystem (NSS) Operation and Support Subsystem (OSS) By Asst. Prof. Bijaya Shrestha, nec, 2015

Mobile Station (MS) The mobile station (MS) consists of the mobile equipment (the terminal) and a smart card called the Subscriber Identity Module (SIM). The SIM provides personal mobility, so that the user can have access to subscribed services irrespective of a specific terminal. By inserting the SIM card into another GSM terminal, the user is able to receive calls at that terminal, make calls from the terminal, and receive other subscribed services By Asst. Prof. Bijaya Shrestha, nec, 2015

Mobile Station (MS) The mobile equipment is uniquely identified by the International Mobile Equipment Identity (IMEI). The SIM card contains the International Mobile Subscriber Identity (IMSI) used to identify the subscriber to the system, a secret key for authentication, and other information. The IMEI and the IMSI are independent, thereby allowing personal mobility. The SIM card may be protected against unauthorized use by a password or personal identity number (PIN). By Asst. Prof. Bijaya Shrestha, nec, 2015

Base Station Subsystem (BSS) The BSS is composed of two parts, the Base Transceiver Station (BTS) and the Base Station Controller (BSC). The BTS houses the radio transceivers that define a cell and handles the radio-link protocols with the MS. The BSC manages the radio resources for one or more BTSs. The BSC handles radio-channel setup, frequency hopping, and handovers. The BSC is the connection between the MS and the Mobile services Switching Center (MSC) By Asst. Prof. Bijaya Shrestha, nec, 2015

Network and Switching Subsystem (NSS) The central component of the NSS or Network Subsystem (NS) is the Mobile services Switching Center (MSC). It acts like a normal switching node of the PSTN or ISDN, and additionally provides all the functionality needed to handle a mobile subscriber, such as registration, authentication, location updating, handovers, and call routing to a roaming subscriber. These services are provided in conjunction with several functional entities, which together form the Network Subsystem. By Asst. Prof. Bijaya Shrestha, nec, 2015

Network and Switching Subsystem (NSS) The MSC provides the connection to the fixed networks (such as the PSTN or ISDN). Signaling between functional entities in the NS uses Signaling System Number 7 (SS7) The Home Location Register (HLR) and the Visitor Location Register (VLR), together with the MSC, provide call-routing and roaming capabilities of GSM. The HLR contains all the administrative information of each subscriber registered in the corresponding GSM network, along with the current location of the mobile. By Asst. Prof. Bijaya Shrestha, nec, 2015

Network and Switching Subsystem (NSS) There is logically one HLR per GSM network. The VLR contains selected administrative information from the HLR, necessary for call control and provision of the subscribed services, for each mobile currently located in the geographical area controlled by the VLR. Note that the MSC contains no information about particular mobile stations; this information is stored in the location registers. The other two registers are used for authentication and security purposes. By Asst. Prof. Bijaya Shrestha, nec, 2015

Network and Switching Subsystem (NSS) The Equipment Identity Register (EIR) is a database that contains a list of all valid mobile equipment on the network, where each MS is identified by its IMEI. An IMEI is marked invalid if it has been reported stolen or is not type approved. The Authentication Center (AuC) is a protected database that stores a copy of the secret key stored in each subscriber’s SIM card, which is used for authentication and encryption over the radio channel. By Asst. Prof. Bijaya Shrestha, nec, 2015

Operation Support Subsystem (OSS) The OSS supports one or several Operation Maintenance Centers (OMCs) which are used to monitor and maintain the performance of each MS, BTS, BSC, and MSC within a GSM system. The main three functions of the OSS are To maintain all telecommunications hardware and network operations with a particular market. Manage all charging and billing procedures. Manage all mobile equipment in the system. By Asst. Prof. Bijaya Shrestha, nec, 2015

GSM Interfaces By Asst. Prof. Bijaya Shrestha, nec, 2015

GSM Radio Subsystem The 890 MHz – 915 MHz band is used for subscriber to base station transmssions (reverse link). The 935 MHz – 960 MHz band is used for base station to subscriber transmissions (forward link). GSM uses FDD and a combination of FDMA and TDMA schemes to provide multiple access to mobile users. The available forward and reverse frequency bands are divided into 200 KHz wide channels called ARFCNs (Absolute Radio Frequency Channel Numbers). The ARFCN denotes a forward and reverse channel pair which is separeted in frequency by 45 MHz and each channel is time shared between as many as eight subscribers using TDMA. By Asst. Prof. Bijaya Shrestha, nec, 2015

GSM Radio Subsystem Each of the eight subscribers uses the same ARFCN and occupies a unique timeslot (TS) per frame. Radio transmissions on both the forward and reverse link are made at a channel data rate of 270.833 kbps using binary BT = 0.3 GMSK modulation. Thus, the signaling bit duration is 3.692 μs, and the effective channel transmission rate per user is 33.854 kbps (270.833 kbps/8 users). Each TS has an equivalent time allocation of 156.25 channel bits, out of this, 8.25 bits of guard time and six total start and stop bits are provided to prevent overlap with adjacent time slots. By Asst. Prof. Bijaya Shrestha, nec, 2015

GSM Radio Subsystem Each TS has a time duration of 576.92 μs and a single GSM TDMA frame spans 4.615 ms. Each specific time slot or frame may be dedicated to either traffic data or control data. By Asst. Prof. Bijaya Shrestha, nec, 2015

GSM Logical Channels GSM divides up each ARFCN into 8 time slots. These 8 time slots are further broken into logical channels. Logical channels can be thought of as just different types of data that is transmitted only on certain frames in a certain time slot. Different time slots will carry different logical channels, depending on the structure the BSS uses There are two main categories of logical channels in GSM. By Asst. Prof. Bijaya Shrestha, nec, 2015

GSM Logical Channels 1. Traffic Channels (TCH) 2. Control/Signaling Channels (CCH) Traffic channels carry digitally encoded user speech or user data and have identical functions and formats on both the forward and reverse link. Control channels carry signaling and synchronizing commands between the base station and the mobile station. By Asst. Prof. Bijaya Shrestha, nec, 2015

GSM Traffic Channels (TCHs) GSM traffic channels may be either full-rate or half-rate and may carry either digitized speech or user data. When transmitted as full-rate, user data is contained within one TS per frame. When transmitted as half-rate, user data is mapped onto the same time slot, but is sent in alternate frames. That is, two half-rate channel users would share the same time slot, but would alternately transmit during every other frame. By Asst. Prof. Bijaya Shrestha, nec, 2015

GSM Traffic Channels (TCHs) In the GSM standard, TCH data may not be sent in TS 0 within a TDMA frame on certain ARFCNs which serve as the broadcast station for each cell. Furthermore, frames of TCH data are broken up every thirteenth frame by either slow associated control channel (SACCH) data or idle frame. Each group of twenty-six consecutive TDMA frames is called a multiframe or speech multiframe. The twenty-sixth frame contains idle bits for the case when full-rate TCHs are used, and contains SACCH data when half-rate TCHs are used. By Asst. Prof. Bijaya Shrestha, nec, 2015

GSM Traffic Channels (TCHs) By Asst. Prof. Bijaya Shrestha, nec, 2015

GSM Control Channels (CCHs) There are three main control channels in the GSM system: Broadcast Channel (BCH) Common Control Channel (CCCH) Dedicated Control Channel (DCCH) By Asst. Prof. Bijaya Shrestha, nec, 2015

GSM Control Channels (CCHs) By Asst. Prof. Bijaya Shrestha, nec, 2015

Broadcast Channels (BCHs) The broadcast channel (BCH) operates on the forward link of a specific ARFCN within each cell, and transmits data only in the TS 0. There are three types of broadcast channels Broadcast Control Channel (BCCH) The BCCH is used to broadcast information such as cell and network identity, and operating characteristics of the cell (current control channel structure, channel availability, and congestion). The BCCH also broadcasts a list of channels that are currently in use within the cell. By Asst. Prof. Bijaya Shrestha, nec, 2015

Broadcast Channels (BCHs) Frequency Correction Channel (FCCH) The FCCH allows each subscriber unit to synchronize its internal frequency standard (local oscillator) to the exact frequency of the base station. Synchronization Channel (SCH) The SCH burst helps a MS to identify the serving base station and to synchronize in time and frame with the base station. By Asst. Prof. Bijaya Shrestha, nec, 2015

Common Control Channels (CCCHs) The CCCHs are used for signaling between the BTS and the MS and to request and grant access to the network. The CCCHs are of three types: Paging Channel (PCH) This channel is used to inform the MS that it has incoming traffic. The traffic could be a voice call, SMS, or some other form of traffic. By Asst. Prof. Bijaya Shrestha, nec, 2015

Common Control Channels (CCCHs) Random Access Channel (RACH) This channel is used by a MS to request an initial dedicated channel from the BTS. This would be the first transmission made by a MS to access the network and request radio resources. The MS sends an Access Burst on this channel Access Grant Channel (AGCH) This channel is used by a BTS to notify the MS of the assignment of an initial SDCCH for initial signaling. By Asst. Prof. Bijaya Shrestha, nec, 2015

Dedicated Control Channels (DCCHs) The DCCCHs are bidirectional and have the same format and function on both the forward and reverse links. Like TCHs, DCCHs may exist in any time slot and on any ARFCN except TS 0 of the BCH ARFCN. There are three types of DCCHs in GSM Stand-alone Dedicated Control Channels (SDCCHs) The SDCCH is used for signaling and call setup between the mobile and base station unless a traffic channel is assigned to the mobile. By Asst. Prof. Bijaya Shrestha, nec, 2015

Dedicated Control Channels (DCCHs) Slow Associated Control Channel (SACCH) On the forward link, the SACCH is used to send slow but regularly changing control information to the mobile, such as transmit power level instructions and specific timing advance instructions for each user on the ARFCN. The reverse SACCH carries information about the received signal strength and quality of the TCH, as well as BCH measurement results from neighboring cells. Fast Associated Control Channel (FACCH) FACCH carries urgent messages, and contains essentially the same type of information as the SDCCH. A FACCH is assigned whenever a SDCCH has not been dedicated for a particular user and there is an urgent message (such as a handoff request). By Asst. Prof. Bijaya Shrestha, nec, 2015

Dedicated Control Channels (DCCHs) The FACCH gains access to a time slot by “stealing “frames from the traffic channel to which it is assigned. This is done by setting two special bits, called stealing bits, in a TCH forward channel burst. If the stealing bits are set, the time slot is known to contain FACCH data, not a TCH, for that frame. By Asst. Prof. Bijaya Shrestha, nec, 2015

A GSM Call Originated from a Mobile Consider the case of a mobile call origination in GSM. By receiving BCCH, FCCH, and SCH messages, the mobile station is locked on to the system. To originate a call, the user first dials the intented user number and presses the “send” button on the GSM phone. The mobile transmits a burst of RACH data, using the same ARFCN as the base station to which it is locked. The base station then responds with an AGCH message which assigns the mobile unit to a new channel for SDCCH connection. By Asst. Prof. Bijaya Shrestha, nec, 2015

A GSM Call Originated from a Mobile Once tuned to the SDCCH, the subscriber unit first waits for the SACCH frame to be transmitted, which informs the mobile of any required timing advance and transmitter power command. The SDCCH sends messages between the mobile unit and the base station, taking care of authentication and user validation, while the PSTN connects the dialed party to the MSC, and the MSC switches the speech path to the serving base station By Asst. Prof. Bijaya Shrestha, nec, 2015

A GSM Call Originated from a Mobile After a few seconds, the mobile unit is commanded by the base station via the SDCCH to retune to a new ARFCN and new TS for the TCH assignment. Once retuned to the TCH, speech data is transferred on both the forward and reverse links, the call is successfully underway, and the SDCCH is vacated. By Asst. Prof. Bijaya Shrestha, nec, 2015

A GSM Call Originated from the PSTN The base station broadcasts a PCH message during TS 0 within an appropriate frame on the BCH. The mobile station, locked on to that same ARFCN, detects its page and replies with an RACH message acknowledging receipt of the page. The base station then uses the AGCH on the CCCH to assign the mobile unit to a new physical channel for connection to the SDCCH and SACCH while the network and the serving base station are connected. Once the subscriber establishes timing advance and authentication on the SDCCH, the base station issues a new physical channel assignment over the SDCCH, and the TCH assignment is made. By Asst. Prof. Bijaya Shrestha, nec, 2015

GSM Burst Types Each user transmits a burst of data during the time slot assigned to it. There are five types of data bursts Normal Bursts: for TCH and DCCH transmissions on both the forward and reverse link. FCCH Burst: to broadcast frequency synchronization control message on the forward link. SCH Burst: to broadcast time synchronization control message on the forward link. RACH Burst: is used by all mobiles to access service from any base station. Dummy Burst: is used as filler information for unused time slots on the forward link. By Asst. Prof. Bijaya Shrestha, nec, 2015

GSM Burst Types By Asst. Prof. Bijaya Shrestha, nec, 2015

Frame Structure for GSM By Asst. Prof. Bijaya Shrestha, nec, 2015

Frame Structure for GSM A normal burst consists of 148 bits data transmitted at a rate of 270.833 kbps and unused guard time of 8.25 bits. Out of the total 148 bits per TS, 114 are information-bearing bits which are transmitted as two 57 bit sequences. The midamble consists of a 26 bit training sequence for adaptive equalization. The two stealing flags are used to distinguish whether the TS contains voice(TCH) or control (FACCH) data. By Asst. Prof. Bijaya Shrestha, nec, 2015

Frame Structure for GSM One frame consists of eight time slots. One multiframe consists of 26 frames. One superframe consists of 51 multiframes. One hyperframe consists of 2048 superframes or 2715648 frames. A complete hyperframe is sent about every 3 hours, 28 minutes, and 54 seconds, and is important to GSM since the encryption algorithms rely on the particular frame number, and sufficient security can only be obtained by using a large number of frames as provided by the hyperframe. By Asst. Prof. Bijaya Shrestha, nec, 2015

Signal Processing in GSM By Asst. Prof. Bijaya Shrestha, nec, 2015

Signal Processing in GSM Speech Coding The GSM speech coder is based on the Residually Excited Linear Predictive Coder (RELP), which is enhanced by including a Long-Term Predictor (LTP). The coder provides 260 bits for each 20 ms blocks of speech, which yields a bit rate of 13 kbps. Channel Coding Out of the total 260 bits in a frame, the most important 50 bits, called type Ia bits, have 3 parity check bits added to them. By Asst. Prof. Bijaya Shrestha, nec, 2015

Signal Processing in GSM The next 132 bits along with the first 53 (50 type Ia bits + 3 parity bits) are reordered and appended by four trailing zero bits, thus providing a data block of 189 bits. This block is then encoded for error protection using a rate ½ convolutional encoder with constraint length K = 5, thus providing a sequence of 378 bits. The least important 78 bits do not have any error protection and are concatenated to the existing sequence to form a block of 456 bits in a 20 ms frame. With channel coding, the data rate of the GSM speech signal is 22.8 kbps. By Asst. Prof. Bijaya Shrestha, nec, 2015

Signal Processing in GSM By Asst. Prof. Bijaya Shrestha, nec, 2015

Signal Processing in GSM Interleaving In order to minimize the effect of sudden fades on the received data, the total of 456 encoded bits within each 20 ms speech frame or control message frame are broken into eight 57 bit sub-blocks. These eight sub-blocks which make up a single speech frame are spread over eight consecutive frames for a specific TS. If a burst is lost due to interference or fading, channel ensures that enough bits will still be received correctly to allow the error correction to work. By Asst. Prof. Bijaya Shrestha, nec, 2015

Signal Processing in GSM Each TCH time slot carries two 57 bit blocks of data from two different 20 ms (456 bit) speech (or control) segments. Ciphering Ciphering modifies the cotents of the eight interleaved blocks through the use of encryption techniques known only to the particular mobile station and base transceiver station. Security is further enhanced by the fact that the encryption algorithm is changed from call to call. By Asst. Prof. Bijaya Shrestha, nec, 2015

Signal Processing in GSM Two types of ciphering algorithms, called A3 and A5, are used in GSM to prevent unauthorized network access and privacy for the radio transmission respectively. The A3 algorithm is used to authenticate each mobile by verifying the users passcode within the SIM with the cryptographic key at the MSC. The A5 algorithm provides the scrambling for the 114 coded data bits sent in each TS. By Asst. Prof. Bijaya Shrestha, nec, 2015

Signal Processing in GSM Burst Formatting Burst formatting adds binary data to the ciphered blocks, in order to help synchronization and equalization of the received signal. Modulation The modulation scheme used by GSM is 0.3 GMSK. This modulation technique minimizes the bandwidth occupied by the modulation spectrum and hence improves channel capacity. By Asst. Prof. Bijaya Shrestha, nec, 2015

Signal Processing in GSM Frequency Hopping Under normal conditions, each data burst belonging to a particular physical channel is transmitted using the same carrier frequency. However, if users in a particular cell have severe multipath problems, the cell may be defined as a hopping cell by the network operator, in which case slow frequency hopping may be implemented to combat the multipath or interference effects in that cell. Frequency hopping is carried out on a frame-by-frame basis, thus hopping occurs at a maximum rate of 217.6 hops per second. By Asst. Prof. Bijaya Shrestha, nec, 2015

Signal Processing in GSM Equalization Equalization is performed at the receiver with the help of the training sequences transmitted in the midamble of every time slot. The type of equalizer for GSM is not specified and is left up to the manufacturer. Demodulation The portion of the transmitted forward channel signal which is of interest to a particular user is determined by the assigned TS and ARFCN. By Asst. Prof. Bijaya Shrestha, nec, 2015

Signal Processing in GSM The appropriate TS is demodulated with the aid of synchronization data provided by the burst formatting. After demodulation, the binary information is deciphered, de-interleaved, channel decoded, and speech decoded. By Asst. Prof. Bijaya Shrestha, nec, 2015

References Theodore S. Rappaport, Wireless Communications, second edition, Prentice Hall, 2012. By Asst. Prof. Bijaya Shrestha, nec, 2015