a gat is KNOWN ONLY 10 the ogy oe = pond GSM equipment ment i q ot developing GSM eatin tier tou This key chan - Pca sos at eho eee ies ng of 8G user. Every countrie: i or 8) oo Sand carrier," YPORTAphic ww Ta naeernantng O80 and mernational 11.32, GSM System Archit ther proprietary informa- ure OSM oer and ane Consists of ems! an i tation Subspstm (Ben Users through oes MetConnected rt Subsystem (OSS) S), Network ie = interfi subsystems that interact . The Mobile Stati Witching Sub, faces, The subsystems are to be part of the BSS for architec tation (MS) ig system (NSS), and the Operation ‘ture € subs) , gov to SUpPOT ONE OF MOTE ofthese ee Equipment a but is ny ystems, vices are designed within The BSS, soo known as the radio sub; : between the mobile stati system, provi a radio interface ee the Mobile Switching and manages radio transmission . le mobile stati iter (MSC). The BSS also man- consists of many Base Station Controllers (BSCS) wh all other subsystems of GSM. Each BSS s ; Cs. The NSS mana; ca which cor 7 HS ewith othe ges the switching functions ofthe system a the MS to the NSS via the rricate-with other networks such asthe PSTN and ISDN. The OSS crests speation and . The OSS supports the operation and maintenance of GSM and allows sys' i aspects of the GSM system. This a wi ae diagnose, ond toubleshoot al provided solely for the staff ofthe GSM operating a a and is thenetwork. iy which provides service facilities for Figure 1 1.5 sco the block diagram of the GSM system architecture. The Mobile Stations (MSs) communicate with the Base Station Subsystem (BSS) over the radio air interface. The BSS consists of many BSCs which connect to a single MSC, and each BSC typically controls up to several hundred Base Transceiver Stations (BTSs). Some of the BTSs may be co-located at the BSC, and others may be remotely distributed ‘and physically connected to the BSC by microwave link or dedicated leased lines. Mobile handoffs (called handovers, or HO, in the GSM specifica- tion) between two BTSs under the control of the same BSC are handled by the BSC, and not the MSC. This greatly reduces the switching burden of the MSC. ects a BTS to a BSC is called the Abis interface which conn Caen «data and is specified by GSM to be As shown in Figure 1 : inter is i ve carries traffic and maintenanc Oe face. The Abis interface ¢ hee, howeveh the Abis for each GSM base station ” the same manufac- Standardized for all manufacturers. In prac . ‘ i iders to use Manufacturer has subtle differences, thereby forcing servi? providers tur forthe BTS and BSC eaviPmen -areateased lines oF microwave link to the The BSCs are physically connected via oe one ch is standardized Ms 5 da MSC is ion Control Part ingen oeiee 2 887 rad called the Signaling Correction ‘ont . e A inte!HI VLR || AUC = Lats 4 asc [ima] ven I Operation Support Subsystem ' | ' | MS BTS | } | | | PSTN BTS | 1 BTS BSC It MSC } ISDN | BTS | Data “a Networks | OMC ! | I | | MS Base Station Subsystem Network Switching Subsystem! Public Networks Figure 11.5 GSM system architecture. ’ | v7 [BES t MS [=] | t = | | | I | * ; [sts | 7-7 Bsc |] usc t PSIN | | ’ | \ | $s7 | [ars] ! + , A interface Abis Interface (standardized) (standardized) GSM Radio Air Interface (standardized) Figure 11.6 The various interfaces used in GSM. (SCCP) which supports communication between the MSC and the BSS, as well as network mes- sages between the individual subscribers and the MSC. The A interface. allows a service pro- vider to use base stations and switching equipment made by different manufacturers.(HLR), Visitor Location Register (VLR), and th ; which contains wens '¢ Authentication Center (AUC). The HLR is bs n formation and location information for each user who resides in the same city as the MSC. Each subscriber in a Particular GSM market is assigned a unigue International Mobile Subscriber Identity (IM: : SI), and thi gone wset.The VLR is adatabare which ems is number is used to identify each ig user in the area. roaming mobile i i the VLR, the MSC sends the necessary i ishing snes HLR oa ca to the roaming mobile can be appropri The Authentication Center is a strongh " z 'y protected database which handles the authentication and encryption keys for every single subscriber in the HLR and VLR. The Authentication Center contains a register called the Equipment Identity Register (EIR) which identifies stolen or fraud- ulently altered phones that transmit identity data that does not match with information contained in either the HLR or VLR. iately routed over the PSTN by the roaming user's HLR. The OSS supports one or several Operation Maintenance Centers (OMC) which are used to monitor and maintain the performance of each MS, BS, BSC, and MSC within a GSM sys- tem. The OSS has three main functions, which are 1) to maintain all telecommunications hard- ware and network operations with a particular market, 2) manage all charging and billing procedures, and 3) manage all mobile equipment in the system, Within each GSM system, an OMC is dedicated to each of these tasks and has provisions for adjusting all base station param- eters and billing procedures, as well as for providing system operators with the ability to deter- mine the performance and integrity of each piece of subscriber equipment in the system. 11.3.3 GSM Radio Subsystem GSM originally used two 25 MHz cellular bands set aside for all member countries, but now it is used globally in many bands. The 890-915 MHz band was for subscriber-to-base transmissions (reverse link), and the 935-960 MHz band was for base-to-subscriber transmissions (forward link), GSM uses FDD and a combination of TDMA and FHMA schemes to provide multiple access to mobile users. The available forward and reverse frequency bands are divided into 200 kHz wide channels called ARFCNs (Absolute Radio Frequency Channel Numbers). The ARFCN denotes a forward and reverse channel pair which is separated in frequency by 45 MHz and each channel is time shared between as many as eight subscribers using TDMA. sacs i il s the same ARFCN and occupies a unique timeslot (TS) per fram Rac won aa forward and reverse link are made at a channel data rate of 270833 Hope (1625:0160 bps) using binary B7'= 0.3 GMSK modulation. Thus, the signaling bitstation and the base station remain connected while the base station and the subscriber unit and allocate resources for the mobile. The SDCCH can be of as an intermediate and temporary channel which accepts a newly complereg .o™ from the BCH and holds the traffic while waiting for the base station to allocates Tey channel. The SDCCH is used to send authentication and alert messages (but noy speech) as the mobile synchronizes itself with the frame structure and waits foraToy SDCCHs may be assigned their own physical channel or may occupy TS0 Of the Boy, if there is low demand for BCH or CCCH traffic. a) Slow Associated Control Channel (SACCH) — The SACCH is always associated yy a traffic channel or a SDCCH and maps onto the same physical channel. Thus, eas ARFCN systematically carries SACCH data for all of its current users. As in the U standard, the SACCH carries general information between the MS and BTS. On the forward link, the SACCH is used to send slow but regularly changing control informa, tion to the mobile, such as transmit power level instructions and specific timing advance instructions for each user on the ARFCN. The reverse SACCH carries infor. mation about the received signal strength and quality of the TCH, as well as BCH me. surement results from neighboring cells. The SACCH is transmitted during the thirteenth frame (and the twenty-sixth frame when half-rate traffic is used) of every speech/dedicated control channel multiframe (Figure 11.7), and within this frame, the eight timeslots are dedicated to providing SACCH data to each of the eight full-rate (or sixteen half-rate) users on the ARECN. a) Fast Associated Control Channels (FACCHs) — FACCH carries urgent messages, and contains essentially the same type of information as the SDCCH. A FACCH is assigned whenever a SDCCH has not been dedicated for a particular user and there is an urgent © _ messaBe¥such as a handoff request). The FACCH gains access to a time slot by “steal- ing” frames from the traffic channel to which it is assigned. This is done by setting two special bits, called stealing bits, in a TCH forward channel burst. If the stealing bits are set, the time slot is known to contain FACCH data, not a TCH, for that frame. To understand how the various traffic and control channels are used, consider the case of a mobile call origination in GSM. First, the subscriber unit must be synchronized to a nearby base station as it monitors the BCH. By receiving the FCCH, SCH, and BCCH messages, the subscriber would be locked on to the system and the appropriate BCH. To originate a call, the user first dials the intended digit combination and presses the “send” button on the GSM phone. The mobile transmits a burst of RACH data, using the same ARFCN as the base station to which it is locked: The base station then responds with an AGCH message on the CCCH which assigns the unit to a new channel for SDCCH connection. The subscriber unit, which is monitoring TS 0of the BCH, would receive its ARFCN and TS assignment from the AGCH and would immediately tune to the new ARFCN and TS. This new ARFCN and TS assignment is physically the SI é 11.3.5 Example of a GSM Call. the subscriber ui a . St, at most, 26 frames nit first waits for the SACCH frame to ich informs th ile of . which informs the mobile of any required timing ese 45 shown in Figure 11.7), smitter power command, pase station is able to determine the per timii eo Proper timing advance and signal level from the mob eae lier RACH Transmission and sends the Proper value over festa fe fa Sr pied ; le to process, messages between the mobile unit and the be i : e ase station, idation, while the PSTN connects the dialed Party oa the servi . path to the serving base station. After a few seconds, the mobile unit is commanded by the base station via the SDCCH to retune to a new ARFCN and new TS for the TCH assignment. Once retuned to the TCH, speech data is transferred on both the forward and reverse ints the call is successfully underway, and the SDCCH is vacated, , ° taking care of authentication and user val- ie MSC, and the MSC switches the speech oon on are Originated from the PSIN, the Process is quite similar. The base station : message during TS 0 within an appropriate frame on the BCH. The mobile station, locked on to that same ARFCN, detects its page and replies with an RACH message acknowledging receipt of the page. The base station then uses the AGCH on the CCCH to assign the mobile unit to a hew physical channel for connection to the SDCCH and SACCH while the network and the serving base station are connected. Once the subscriber establishes timing advance and authentication on the SDCCH, the base station issues a new physical channel assignment over the SDCCH, and the TCH assignment is made. 11.3.6 Frame Structure for GSM s a burst of data during the time slot assigned to it. These data bursts may have one of five specific formats, as defined in GSM [Hod90}. Figure 11.9 illustrates the five .d traffic bursts. Normal bursts are used for TCH types of data bursts used for various control an and DCCH transmissions on both the forward and reverse link. FCCH and SCH bursts are used in TS 0 of specific frames (shown in Figure 11,8(@)) to broadcast the frequency and time syn- chronization control messages on the forward link, The RACH burst is used by all Baier access service from any base station, and the dummy burst is used as filler: information for unused time slots on the forward link. Each user transmit: ructure within a normal burst. It consists of 148 bits unused guard time of 8.25 bits is Figure 11.10 illustrates the data su per TS, 114 are information-bearing which are transmitted at a rate of 270.833333 kbps (an 1 148 bits the end of each burst). Out of the total 14 = Hove ee gensmited as two 57 bit sequences close to the beginning and end of the burst. The fa 26 Ch fi sa . . hich all mobil ver to analyze the radio channel characteristics before decoding the le or base station receive! adi fc alled stealing flags. These two pee idamble, there are control bits ¢ ver dat On either side ofthe midambles tere fe SOM or onal (FACCH) dt flags are used to distinguish whether the142 fixed bits of all zeroes SCH burst _ = Tatar 30 bits of [64 bits of 39 bits of [3stopl 8: » init encrypted datal bits |guard bits encrypted data training : & RACH burst 8 start 41 bits of 36 bits of [8 stop|68.25 bit extend, 4 encrypted datal bits guard period bits | synchronization Dummy burst 3 start ~ 26 training] _,_ |Sstop| 8.25 bi 8 mixed bi 58 mixed bit pits | Smee Pits | pits ixed DIES | bits [guard Figure 11.9 Time slot data bursts in GSM. F ’ Superframe 1 612 os > ial 51 Multiframes. Multiframe Frame Time slot Tail Coded Bal Code Stile Midamble Stealing Coded Tail Guard flag ~ data bit Period Figure 11.10 GSM frame structure.genni sytem for Mobile (asia) os poth wie ae Tecumseh channel. During a frame, a GSM subscriber unit uses one TS pvansmit, Teceive, and may use the six spare time slot i five adjacent base stations as well as its own base station, nn MANNE SBRAl strength on As shown in Figure 11.10, there ai Fe eight timeslots iod is 4.615 ms. A frame contains 8 x ie per TDMA frame, and the frame frames which in turn are d int and hyperframes (hypertrames are not shown i Smulifame cooing 26 in Figure 11.10). i TDMA frames and one sperm contins 51 mulitames or 326 TDMA ton wine? frame contains 2048 superframes, or 2,715,648 TDMA frames, A complete hyperframe is sent about every 3 hours, 28 minutes, and 54 seconds and is important to GSM since the encryption algorithms rely on the particular frame number, and sufficient security can only be obtained by the hyperframe. Figure 11.8 shows that the control multiframes span 51 frames to 26 frames (120 ms) used by the traffic/dedicated control channel intentionally to ensure that any GSM subscriber (whether in the servis certain to receive the SCH and FCCH transmissions from the BCH. frame or time slot they are using. age grouped into larger structures called mutif using a large number of frames as provided by (235.365 ms), as opposed multiframes. This is done ing or adjacent cell) will be , no matter what particular 11.3.7 Signal Processing in GSM Figure 11.11 illustrates all of the GSM operations from transmitter to receiver. Speech Coding — The GSM speech coder is based on the Residually Excited Linear Predictive Coder (RELP), which is enhanced by including a Long-Term Predictor (LTP) [Hel89}. The coder provides 260 bits for each 20 ms blocks of speech, which yields a bit rate of 13 kbps. This speech coder was selected after extensive subjective evaluation of various candi- date coders available in the late 1980s. Provisions for incorporating half-rate coders are included in the specifications. The GSM speech coder takes advantage of the fact that in a normal conversation, each Person speaks on average for less than 40% of the time. By incorporating a voice activity detector (VAD) in the speech coder, GSM systems operate in a discontinuous transmission mode (DTX) which provides a longer subscriber battery life and reduces instantaneous radio interference since the GSM transmitter is not active during silent periods, A comfort noise sub- system (CNS) at the receiving end introduces a background acoustic noise to compensate for the annoying switched muting which occurs due to DTX. TCH/FS, SACCH, and FACCH Channel Coding — The output bits of the speech coder te ordered into groups for error protection, based upon their significance in contributing to Speech quality. Out of the total 260 bits in a frame, the most important 50 bits, called type Ia bits, have 3 parity check (CRC) bits added to them. This facilitates the detection of non-correctable errors at the receiver. The next 132 bits along with the first 53 (50 type Ia bits + 3 parity bits) areChannel decoding coding De-interleaving Interleaving 4 Burst oe Formatting Formatting ; ielach De-ciphering Ciphering —_ . J Channel Modulation oe Demodulation Figure 11.11 GSM operations from speech input to speech output. ee reordered and appended by four trailing zero bits, thus providing a data block of 189 bits. This block is then encoded for error protection using a rate 1/2 convolutional encoder with co length K = 5, thus providing a sequence of 378 bits. The least important 78 bits do no any error protection and are concatenated to the existing sequence to form a block of 4: a 20 ms frame. The error protection coding scheme increases the gross data rate of th speech signal, with channel coding, to 22.8 kbps. This error protection scheme as deset illustrated in Figure 11.12. Channel Coding for Data Channels — The coding provided for GSM full channels (TCH/F9.6) is based on handling 60 bits of user data at 5 ms intervals, in accorda the modified CCITT V.110 modem standard. As described by Steele [Ste94]), 240 bits off a are applied with four tailing bits to a half-rate punctured convolutional coder with constrai K=5. The resulting 488 coded bits are reduced to 456 encoded data bits through pune (32 bits are not transmitted), and the data is Separated into four 114 bit data bard that are OPP" in an interleaved fashion to consecutive time slots. f Channel Coding for Control Channels — GSM control channel messages are defi be 184 bits long, and are encoded using a shortened binary cyclic fire code, followed by rate convolutional coder,