Transcript GSM system

GSM system



Global System for Mobile Communications
Introduced in 1991. Settings of standards
under ETSI (European Telecommunication
Standards Institute)
Services



Telephone services
Data services
Short message paging
GSM system
System Architecture : three major subsystems
Network and Switching Subsystem (NSS)



MSCs, Visitor Location Register (VLR), Home Location Register
(HLR), Authentication Center (AUC) and Equipment Identity
Register (EIR).
Switching of GSM calls between external networks and the BSCs.
Managing and providing external access to several customer
databases, such as
 HLR : contains subscriber information (International Mobile
Subscriber Identity -IMSI) and location information for each user
who resides in the same city as the MSC.
 VLR : temporarily stores the IMSI and customer information for
each roaming subscriber who is visiting the coverage area of a
particular MSC. Once a roaming mobile is logged in the VLR, the
MSC sends the necessary information to the visiting subscriber’s
HLR so that calls to the roaming mobile can be appropriately
routed over the PSTN by the roaming user’s HLR.
 AUC : Strongly protected database which handles the
authentication and encryption keys for every single subscriber in
the HLR and VLR.
Radio Subsystem (Base Station Subsystem
BSS):




Mobile stations (MS), Base Transceiver
Station (BTS) and the Base Station Controller
(BSC)
Provides and manages radio transmission
paths between the MS and MSC.
One BSC controls up to several hundred
BTSs.
BSC performs handover for MS under the
control of same BSC.
Operation Support Subsystem (OSS)



Support the operation and maintenance of
GSM and allows system engineers to monitor,
diagnose and troubleshoot all aspects of the
GSM system.
Interacts with the other GSM subsystems.
Charging and billing.
Interface
TDMA/FDMA/FDD


Uses both TDMA and FDMA to transmit and
recover information.
Systems are FDD.
Location Management




In mobile networks, location management is an important
mechanism that enables the network to discover the current
attachment point of a MS so as to facilitate successful
information delivery.
For GSM networks, location information about MSs is maintained
by registration, whereby MSs update their registration area(s)
information with HLR and VLR, in the event of changes in the
registration areas(s).
Radio bandwidth normally needs to be reserved for carrying
location management traffic, which comprises of two major
components: paging and location update. Paging is the process
of searching for a MS in the vicinity of its last-known location,
typically in an area of several cell sizes which is also known as a
location area (LA), so as to connect an incoming call.
Location update is the process undertaken by a MS to inform the
network of any changes in its current location. Location updates
typically occur each time a MS crosses an LA boundary.
Location Management
Current GSM Location Management Scheme. A service area comprises of 9
cells are partitioned into 3 static LA, each having 4, 2 and 3 cells, respectively.
Location Management



The location management scheme of GSM Mobile is
given in IS-41. It is based on partitioning the cells
into static registration areas known as location areas
(LAs).
Location updates are to be performed when MSs
cross the partitioning of LA so that up-to-date
location information for each MS on is stored in the
respective HLR and VLR.
Since the location information of each MS is tracked
on a resolution that is dependent on the size of the
LA, to facilitate a successful data delivery, all the
cells within the LA have to be paged concurrently.
Frequency domain



The frequency band for uplink (reverse) is 890-915MHz,
downlink (forward) is 935-960MHz.
The bandwidth for the GSM system is 25MHz, which provides
125 carriers uplink/downlink each having a bandwidth of 200 kHz.
The ARFCN (Absolute radio frequency channel numbers)
denotes a forward and reverse channel pair which is separated in
frequency by 45 MHz.
 Base-to-mobile : Fu (n) = 890.2 + 0.2(n −1) MHz
 Mobile-to-base : Fd (n) = Fu (n) + 45 MHz
In practical implementations, a guard band of 100kHz is provided
at the upper and lower end of the GSM spectrum, and only 124
(duplex) channels are implemented.
Frequency domain




There are a total of eight channels per carrier. Every eighth
timeslot on a TDMA channel, the user transmits or receives his
information.
A second frequency band from 1710-1785 MHz and 1805-1880
MHz (three times as much as primary 900MHz) are also
specified in 1990, a total of 374 duplex channels – DCS 1800
GSM has chosen the four-cell repeat pattern for the frequency
reuse cell sets. In most cases, each cell is divided into 120-deg
sectors, with three base transceiver subsystems in each cell.
Each base transceiver has a 120-deg antenna.
These 12 sectors (called cells in GSM system) share the 124
channels.
Time domain




RF carrier channel is time division multiple accessed
by users at different locations within a cell site.
Frame duration is 4.615ms, and each frame consists
of 8 time-slots.
Each of the time-slot is a traffic channel having time
duration 0.577ms (3/5200s).
The start of an uplink TDMA frame is delayed with
respect to downlink by three timeslots. Staggering
TDMA frames allows the same timeslot number (TN)
to be used in both directions.
Time domain
Multiframe




26 frames (traffic or speech ~): Traffic CHannel
(TCH), Slow Associated Control CHannel (SACCH),
Fast Associated Control CHannel (FACCH).
51 frames (control ~) : Broadcast Common Control
(BCC), Stand Alone Dedicated Control Channels,..
Superframe : 51 traffic multiframes or 26 control
multiframes.
Hyperframe : 2048 superframes (3 hrs 28 min 52.76
s), to support encryption with high security and
frequency hopping.
Timeslot and Frame structure
1 super high frame = 2048 super frame = 2715648 TDMA frame
0
SACCH/TCH
FACCH
1
2
3
2044
2045
2046
1 super frame = 1326 TDMA frame（6.12s）
0
1
2
0
3
47
1
48
24
49
50
2047
BCCH
CCCH
SDCH
25
1 multiplex frame = 26 TDMA frames（120ms） 1 multiplex frame = 51 TDMA frame
0
1
24
25
0
1
1 TDMA frame = 8 timeslot（120/26 = 4.615ms）
0
1
2
3
4
5
6
7
49
50
Physical Channel & Logical Channel


Physical Channel : specified by ARFCN and
TN.
Logical Channel : is mapped onto the
physical channel. E.g, TCHs and control
channels.
Channel Type
14.4Kbit/s FR TCH (TCH/F14.4)
9.6Kbit/s FR TCH(TCH/F9.6)
Data CH
TCH
Voice CH
4.8Kbit/s FR TCH (TCH/F4.8)
4.8Kbit/s HR TCH (TCH/H4.8)
FR Voice Traffic Channel (TCH/FS)
Enhanced FR Traffic Channel (TCH/EFR)
HR Traffic Channel (TCH/HS)
channel
BCH
CCH
CCCH
DCCH
FCCH (down)
SCH (down)
BCCH (down)
RACH (up)
AGCH (down)
PCH (down)
SDCCH
FACCH
SACCH
Traffic Channel (TCH)


Traffic channels carry digitally encoded user speech
or user data. Have identical functions and formats
on both the forward and reverse link.
Full rate : user data is contained within one TS per
frame. Half rate : user data is mapped onto the
same time slot, but is sent in alternate frames.





TCH/FS : Full rate speech, raw data sent at 13kbps, with
GSM channel coding 22.8kbps.
TCH/HS : Half rate speech, raw data sent at 6.5kbps, with
GSM channel coding 11.4kbps.
TCH/F9.6 : Full raw data rate 9.6kbps, send at 22.8kbps.
TCH/F4.8, TCH/F2.4
TCH/H4.8, TCH/H2.4
Traffic or speech multiframe
Control multiframe
Control (Signaling) Channels



Broadcast CHannel (BCH)
Common Control CHannel (CCCH)
Dedicated Control CHannel (DCCH)
BCH

Broadcast channel (BCH) -- Only on downlink
 Broadcast control channel (BCCH)




Frequency correction channel (FCCH)




Broadcast cell and network information
Cell and network identity
List of channels in use
Occupies TS0 of first frame
Repeated every 10th frame within a control channel multiframe
Synchronization of local oscillator (radio frequency) to base station
oscillator.
Synchronization channel (SCH)



Broadcast in TS0 immediately following a FCCH frame.
Allows for frame synchronization
Base station issues timing advancement commands.
Common control channel (CCCH)




Occupies TS0 of every control frame not used by BCH or the Idle
Frame.
Paging channel (PCH)
 Provides paging signals from base to mobiles.
 Notifies specific mobile of incoming call
Random access channel (RACH)
 Uplink channel
 Used by mobiles to acknowledge page from PCH
 Used by mobiles to originate a call
Access grant channel (AGCH)
 Provides forward link communication to mobile.
 Specifies time slot, radio channel and dedicated control channel.
 AGCH is final CCCH message before mobile is moved off the
control channel.
Dedicated control channel (DCCH)



Bi-directional channels with same format and
function on uplink and downlink.
May exist in any time slot and on any radio channel
except TS0 of the control radio channel.
Stand-alone dedicated control channel (SDCCH)




Carries signaling data following the connection of the
mobile with BS.
Intermediate and temporary channel for mobiles while
waiting for the BS to allocate a TCH channel.
Ensures that mobile and base remains connected during
authentication and resource allocation.
Maybe assigned their own physical channel or may occupy
TS0 of the BCH if there is low demand for BCH or CCCH
traffic.
Dedicated control channel (DCCH)

Slow associated control channel (SACCH)





Always associated with a traffic channel
On downlink the SACCH carries power control and timing
advance instruction
On uplink the SACCH carriers signal strength and quality
information
SACCH is allocated every 13th frame of a traffic channel.
Fast associated control channel (FACCH)


1. Carries urgent messages to the mobile, for example
handover.
2. FACCH gains access by stealing frames from TCH (e.g.
data transmission slot are stolen).
Time Slot Bursts






Time slot data bursts take on one of the 5
formats according to the logical channel.
A normal burst consists of 148 bits
Guard time of 8.25 bits to avoid frame
overlap.
Two batched of 57 bits are information bits
26 training bits for equalization.
Two stealing bits for FACCH
Time Slot Bursts
Mobile-Assisted handover

Four purposes for handover





Rescue low-quality channel
Recovering cochannel interference
Traffic balancing among cells (avoid congestion or load
balancing) – directed handover.
Recovering in the event of failure of a control channel
Three cases of handover,
From one radio channel to another of the same BSC.
 Between channel of different BSCs under the control of the
same MSC.
 Between different MSCs in the same licensed operator.
Between different licensed operators there are no procedure.

Two modes of handover


Synchronous: the old and new cells are
synchronized so that their TDMA timeslots
start at exactly the same time.
Asynchronous: this may lead to a longer
interruption of communication during
handover since MS has to re-initialize timing
advance at the new cell.
Speech coding





The GSM speech coder is based on the Residually
Excited Linear Predictor (RELP)
Enhanced by a long term predictor (LTP)
The coder provides 260 speech codec bits for each
20ms, ie. The speech codec bit rate is 13 kbps.
40% average voice activity exploited by a
discontinuous transmission mode. A voice activity
detector (VAD) is used in the speech coder – off the
transmitter for power saving.
Half rate codec works at 6.5 kbps.
Speech coding
Channel coding – data channels

Full rate 22.8kbps :





The output bits of the speech coder are ordered into groups
for error protection, based upon their significance in
contributing to speech quality. Out of the total 260 bits in a
frame,
The most important 50 bits, called type Ia bits, have 3 parity
check (CRC) bits added to them.
The next 132 bits along with the first 53 are reordered and
appended by 4 trailing zero bits, and then encoded for error
protection using a rate ½ convolution encoder with
constraint length K=5.
The least important 78 bits do not have any error protection.
For TCH/F.9.6,
Modulation & Interleaving

Modulation



0.3 GMSK.
The channel data rate of GSM is 270.833333 kbps
Interleaving


To minimize the effect of sudden fades on the received
data, the total of 456 encoded bits within each 20 ms
speech frame or control message frame are broken into
eight 57 bit sub-blocks. These 8 sub-blocks which make up
a single speech frame are spread over eight consecutive
TCH time slots.
If a burst is lost due to interference or fading, interleaved
data will help to spread the effect over a few errorcorrection-frames. Hopefully channel coding ensures that
enough bits will still be received correctly.
Frequency hopping



Under normal conditions, each data burst belonging
to a particular physical channel is transmitted using
the same carrier frequency.
If users in a particular cell have severe multipath
problems, the cell may be defined as a hopping cell
by the network operator.
Frequency hopping is carried out on a frame-byframe basis, thus hopping occurs at a maximum rate
of 216.7 hops per second (1/0.004615 – frame rate).
As many as 64 different channels may be used
before a hopping sequence is repeated.
Others






– Apparent bandwidth efficiency
 GSM bit rate = 270.83 kbps, bandwidth = 200kHz
 Bandwidth efficiency = 1.354 bs/Hz
– The speech codec rate for each time slot = 456b/20ms (=22.8kbps).
– Each voice channel actually allocated for 270.83/8 =33.854kbps.
– Number of bits/slot = 33.854x4.615 = 156.25 bits (148+8.25 guard
time)
– For each TDMA slot in each frame, 114 bits are transmitted, and
only 24 data frames per 26 frames are transmitting, therefore the
vocoder output rate = 114/0.004615 x 24/26 = 22.8kbps
– However, of the 114 data bits in a slot, only 65 are raw speech
codec bits
 Raw data rate = 22.8*65/114=13 kbps
 65 bits in 20ms = 13 kbps