2012 2nd International Conference on Advances in Computational Tools for Engineering Applications (ACTEA)

Implementing an Enhanced Base Station using the Software

Defined Radio (CUOPENBTS)
Islam E. Hashem, Ahmed ElShaarany, Ahmed Y. Abdelbarr, Eslam S. Hassan, *Magdi Fikri

 Department of Electrical and Communications Engineering, Cairo University

*E-mail: mifkri@eng.cu.edu.eg

Abstract— An enhanced OpenBTS is implemented. OpenBTS is a

software-based GSM access point, allowing standard GSM-compatible
mobile phones to make phone calls without depending on existing
telecommunication providers' networks. In this paper, the goal was to
improve the design of the OpenBTS system by improving the sensitivity
and also minimizing the cost of the whole system. So far, we
implemented a base station using state-of-the-art software and
hardware components, namely GNU Radio and, OpenBTS software
with USRP and a single WBX daughterboard hardware (CUOpenBTS),
and made a phone call using regular GSM cell phones.

Index Terms— GSM, OpenBTS, RFX, SDR, WBX.

I. INTRODUCTION Fig. 1 Spectrum sensing.

S oftware Defined Radio (SDR) enables reconfigurable system

architectures through a collection of hardware and software
technologies. SDR provides an efficient and comparatively
inexpensive solution to the challenge of building multi-mode, multi-
band, multi-functional wireless devices that can be adapted, updated,
or enhanced by using software upgrades, and according to the
Federal Communications Commission (FCC), the SDR can carry out
the functions that were formerly carried out by hardware such as: the
transmitted signal generation, and the received signal tuning and
detection. This advantage results in a high signal processing [1].
Unlike other analog communication circuitry, the software radio is
responsible for the transmitted waveform modulation and the
received waveform demodulation, i.e. it gets the code closer to the
antenna side. Hence, all the radio hardware problems can be handled
using the software. In this paper, we use GNU Radio and Universal
Software Radio Peripheral (USRP) as the software and hardware
platforms for the SDR [2].
GNU Radio is a free software tool kit for building software radios
which provides a library of signal processing primitives and also
provides the glue to tie it all together. The programmer builds a radio
by creating a graph where the nodes are signal processing primitives
and the edges represent the data flow between them. GNU Radio
applications are primarily written using the Python programming
language, while the supplied performance-critical signal processing
path is implemented in C++ using processor floating point
extensions where available. Thus, the developer is able to implement
real-time, high-throughput radio systems in a simple-to-use, rapid-
application-development environment. While not primarily a
simulation tool, GNU Radio supports the development of signal
processing algorithms using pre-recorded or generated data, avoiding
the need for actual RF hardware [3]. In this paper, we use a python
simple tool for spectrum sensing in order to find an unallocated
frequency to use as our own carrier frequency. For example, Fig. 1
shows the results of sensing the spectrum, carried out in Maadi,
Cairo, Egypt. As it is depicted from the figure, the 939 MHz is
appropriate here to be used as the downlink frequency and a phone
call can be managed at this frequency.
The USRP is an extremely flexible USB device that connects your
PC to the RF world. The USRP consists of a small motherboard
containing up to four 12-bit 64M sample/sec ADCs, four 14-bit,
128M sample/sec DACs, a million gate-field programmable gate
array (FPGA) and a programmable USB 2.0 controller (as shown in
Fig. 2) [3].
Each fully populated USRP motherboard supports four
daughterboards, two for transmission and two for reception. RF front
ends are implemented on the daughterboards. A variety of
daughterboards is available by ettus research to handle different
frequency bands [4]. For amateur radio use, low-power
daughterboards are available that receive and transmit in the 440
MHz band and the 1.24 GHz band. A receive-only daughterboard
based on a cable modem tuner is available that covers the range from
50 MHz to 800 MHz. Daughterboards are designed to be easy to
prototype by hand in order to facilitate experimentation.

978-1-4673-2489-2/12/$31.00 ©2012 IEEE 39

 UNIX
Receiving Machine Transmission
Antenna Antenna
USB 2.0

ADC DAC
RXA TXA
ADC DAC

Receiving Signal Transmission

Antenna Antenna
FPGA Front-End

ADC DAC
RXB TXB
ADC DAC

Fig. 2 Basic USRP Block Diagram.

This paper is structured as follows. Section II.A discusses the

OpenBTS system and its hardware requirements. Section II.B shows
a comparison between the traditional global system for mobile
communications (GSM) network and OpenBTS system. In Section
II.C, we introduce an alternative way to enhance this system in order Fig. 3 OpenBTS network components.
to decrease its sensitivity and cost. Achieved results are presented in
Section III, and finally, the paper is concluded in Section IV.

II. SYSTEM MODEL

A. OpenBTS project and it's Hardware requirements

The OpenBTS Project is an effort to construct an open-source

Linux application that uses the USRP as the hardware that presents
the GSM air interface (―Um‖) to standard GSM handset and uses the
Asterisk Voice over Internet Protocol (VoIP) private branch
exchange (PBX) to connect calls. This is in fact very different from
a conventional GSM BTS, which is a dumb device that is managed
externally by a base station controller (BSC) and connects calls in a
remote mobile switching center (MSC). Because of this important
architectural difference, the end product of this project is better
referred to as an access point, even though the project is called
―OpenBTS‖ [5].
Fig. 3 shows the minimal hardware requirements to implement the
OpenBTS system; and for a small network with 50 m range, the
components are as follows: (i) Linux based platform (Ubuntu was
our choice) (ii) USRP, (iii) Two RFX900 daugtherboards (one for
TX and one for RX), (iv) Two antennas covering GSM range (one
for TX and one for RX).
B. Traditional GSM network and OpenBTS.
GSM is a digital mobile telephone system that is popular in many
parts of the world. The principal component group of a GSM
network shown in Fig. 4 is as follows: (i) Base Station System (BSS)
which provides the link between the MS and the MSC. The BSS
communicates with the MS over the digital air interface and
Fig. 4 Traditional GSM network.
with the MSC via 2 Mbit/s links. The BSS consists of Base
Transceiver Station (BTS) which contains the RF components that
provide the air interface for a particular cell, the BSC which controls
single or multiple BTSs and communicates directly with the MSC,
and finally, a transcoder which is used to compress the signals from
the MS so that they are more efficiently sent over the terrestrial
interfaces, (ii) MSC which is included in the GSM system for call-
switching. Its overall purpose is the same as that of any telephone
exchange, (iii) Home Location Register (HLR) which is the
reference database for subscriber parameters. Various identification
numbers and addresses are stored there, as well as authentication
parameters. This information is added into the database by the
network provider when a new subscriber is added into the system.
Fig. 5 shows the block diagram of the OpenBTS system. It
replaces the traditional GSM network with (i) A USRP as hardware;
USRP can be readily adapted as a GSM transceiver (i.e. it transmits
and receives the GSM signaling to and from the mobile phone). (ii)
OpenBTS, which is a software code, generates with GNU Radio an

40
 Fig. 5 OpenBTS block diagram.
air interface that to a cell phone looks just like any GSM cellular
network. (iii) On the network side, it is an Asterisk server (VoIP).
What we are doing is putting a cellular air interface on an Asterisk
PBX and using this Asterisk to connect calls.
OpenBTS software code plays the role of the MSC and the visitor
location register (VLR) in processing all the calls incoming to, or
originating from subscribers visiting the given switch area. While
Asterisk, which is a free software implementation of a PBX
originally created in 1999 by Mark Spencer of Digium, allows
attached telephones to make calls to one another, and to connect to
other telephone services including the public switched telephone
network (PSTN) and VoIP services.
Using OpenBTS source code only creates a beacon signal such that
the OpenBTS network is created and a phone can manually detect
the network but cannot register to it or make a phone call with
another registered phone except when asterisk is installed and
configured in this system as Asterisk plays the role of HLR in the
traditional GSM network which is the main database of permanent
subscriber information for a mobile network (i.e. it stores an
international mobile subscriber identity (IMSI) for each subscriber,
authentication key, subscriber status (i.e. registered or unregistered)
and the current location).
C. Enhanced OpenBTS (CUOpenBTS)
The GSM-900 uses the frequency range 890–915 MHz to send
information from the mobile station to the base station (uplink) and
the frequency range 935–960 MHz for the other direction
(downlink), providing 124 RF channels (channel numbers 1 to 124)
spaced at 200 kHz. 100 kHz wide Guard bands are placed at either
end of the range of frequencies. For OpenBTS to operate as if it was
a BTS, the hardware used will have to support these frequency
specifications and therefore, two RFX900 daughterboards were used
to implement the system.
Daugtherboards turn the USRP motherboard into a complete RF
transceiver system. Just add an antenna, and you are ready for a two-
way, high bandwidth communications in many popular frequency
bands. The daugtherboards that cover the GSM900 band are RFX
900 & WBX (as shown in Fig. 6) and available at ettus research. On
Developing the OpenBTS project, RFX900 was the only choice that
the developers had and the default implementation of OpenBTS was
on the RFX900, two RFX daugtherboards were used instead of one
in order to minimize the crosstalk between the transmitter and the
receiver sides as a result of the RF coupling between TX and RX
sides that occurs in case of using one RFX daughterboard.
In this paper, the OpenBTS network is implemented as shown in Fig.
7 using a single WBX daughterboard (CUOpenBTS). A single WBX
41
Fig. 6 Spectrum allocation of RFX and WBX dautherboards.
Fig. 7 Enhanced OpenBTS block diagram (CUOPENBTS).
daughterboard is used as a transceiver instead of the two RFX
daugtherboards. The use of a single WBX daughterboard results in
the decrease of the crosstalk between the WBX’s transmitter and
receiver sides due to the better isolation between them compared to
the isolation between the transmitter and receiver sides of a single
RFX900 daughterboard, this prevents interference between phone
calls. In addition, a capacitor that causes RF coupling between the
transmitter and the receiver sides of the WBX daughterboard has
been removed in order to enhance the isolation between both the
transmitter and receiver sides of the single WBX daughterboard.
Some previous works have used the WBX to implement a WiFi
system. To the knowledge of the authors, this is the first trial to
implement the OpenBTS using this daughterboard.
Some Previous trials took place to cover the GSM1800 so, another
daughterboard (RFX1800) has been used to implement the OpenBTS
and they proved success excluding one issue which is switching
from GSM900 to GSM1800 would need hardware modifications.
OpenBTS using WBX daughterboard would be able to operate in the
GSM900 and GSM1800 bands without any modifications to the
hardware and using single WBX daughterboard.
III. RESULTS
The upcoming measurements were done in the lab to make sure
that the Phase Locked Loop (PLL), mixers, synthesizers, amplifiers
and attenuators of the transmitting and the receiving sides of the
WBX daughterboard are operating correctly. Spectrum sensing is
carried out in the Communications Lab at Cairo University before
arranging a phone call. It was found adequate to use the 945 MHz as
the downlink frequency (i.e. absolute radio-frequency channel
number (ARFCN) =50). Fig. 8 shows the signal frequency before the
mixer of the transmitter, Fig. 9 shows the signal frequency after the
mixer of the transmitter and Fig. 10 shows the signal frequency
before the mixer of the receiver.
The OpenBTS as an open source software implements a Mobile
Base Station using the USRP as hardware. The OpenBTS has been

Fig. 8 The signal frequency before the mixer of the transmitter.
Fig. 9 The signal frequency after the mixer of the transmitter.
Fig. 10 The signal frequency before the mixer of the receiver.
42
designed to work on two RFX daughter boards which are considered
to be the RF front end and they operate either in frequency range of
(800 MHz- 1000 MHz with maximum output power 200 mWatt on
using RFX900) or in the range of (1.5 GHz- 2.1 GHz with maximum
output power of 100 mWatt on using RFX1800) consuming the two
sides of the USRP (i.e. the whole USRP). Hence, to operate in a new
range of the frequencies for another application, we would need to
change the RF front end to suit our needs. The changing of RF front
end each time you change the application is not a step towards the
SDR concept. From here we had the idea to use a single
daughterboard for both receiving and transmitting and to use a
daughterboard that covers a wider range of the spectrum so that it
would include most of our applications so we used WBX
daughterboard (50 MHz - 2.3 GHz with maximum output power of
100 mWatt) which covers many bands of interest, including white
spaces, broadcast television, public safety, land-mobile
communications, low-power unlicensed devices, wireless sensor
networks, cell phones and six amateur radio bands.
On doing that we have saved one side of the USRP to be used by
another daughterboard that could complete the range from 2.3 GHz
to 2.9 GHz or the entire 4.9 to 5.9 GHz range (that would be
XCVR2450) and hence achieving maximum use of the USRP which
is a step towards applying the concept of SDR.
IV. CONCLUSION
CUOpenBTS is not just an enhanced OpenBTS, CUOpenBTS is a
step towards the concept of SDR. CUOpenBTS could be considered
one of the cheapest telecommunications systems nowadays and
achieving the dream of the original founders of OpenBTS to offer
the poor uncovered areas in Africa with the mobile technology at a
price they can afford. The whole system costs no more than 1500$.
Not just offering the GSM network but also supporting various
communications standards within the range of frequencies it could
support.
CUOpenBTS used state-of-the-art software and hardware
components, namely GNU Radio, OpenBTS and USRP software and
hardware platforms using a single WBX daughterboard to give the
hope to billions of people to communicate with a very reasonable
price using un-modified handsets which are usually dumped not
because issues with their functionality but just because they are out-
dated.
REFERENCES
[1] Bruce Alan, ''Software Defined Radio.", U.S. Patent 0242261, Dec. 2,
2004.
[2] E. Blossom, "GNU radio: tools for exploring the radio frequency
spectrum," Linux J., vol. 2004, p. 4, 2004.
[3] GNU Radio website, .
Available: http://gnuradio.org/redmine/wiki/gnuradio
[4] Ettus research website,
Available: http://www.ettus.com/
[5] OpenBTS research website,
Available: http://OpenBTS.sourceforge.net/