Chapter 7 GSM: Pan-European

Digital Cellular System

7-1
 Background and Goals
• GSM (Global System for Mobile Communications)
– Beginning from 1982
– European standard
– Full roaming in Europe
– A purely digital system
• Goals:
– full international roaming
– provision for national variations in charging and rates
– efficient interoperation with ISDN systems

ch7 - 2
 Background and Goals

– Signal quality better than or equal to that of existing

mobile systems
– traffic capacity higher than or equal to that of present
systems
– lower cost than existing systems
– accommodation of non-voice services, and
– accommodation of portable terminals

ch7 - 3
 Architecture

• Network elements
– Mobile stations, base stations, and mobile switching
center
• Three databases
– Home location registers (HLR): for full roaming
– Visitor location registers (VLR): for full roaming
– Equipment identity registers (EIR)

ch7 - 4
ch7 - 5
 SIM of GSM
• Subscriber identity module (SIM)
– A removable card that stores subscriber information:
• ID number
• abbreviated dialing code
• subscriber’s service plan
– The SIM is the subscriber’s link to the cellular system.
• By removing the SIM, the phone is disabled (except the emergency call).
– Easy to change to other telephones
• In earlier systems, the subscriber’s information is in a FIXED
hardware within a terminal.
– Thus, when changing phones, the service provider gets involved, which is
inconvenient.

ch7 - 6
• GSM uses a variety of ID codes, which are exchanged between base
stations and handsets.
– TSMI (temporary mobile subscriber ID): a temporary number assigned to a
terminal
• used in call management and mobility management
• this adds privacy and security
– Ki: authentication key stored in both SIM and the subscriber’s Home system
– Kc: cipher key computed from Ki by the terminal and the network.
– Mobile Station Classmark: to state the property of the terminal
• GSM version
• RF power capability
• encryption algorithm, etc.

ch7 - 7
ch7 - 8
 Radio Transmission
• GSM Spectrum
– There are two 25 MHz bands separated by 45 MHz
– Initial GSM systems operate in the upper 10 MHz
• The lower part can be used by older systems.
• This serves for the purpose of “graceful” transition.

ch7 - 9
 Physical Channels

• GSM is a Hybrid FDMA/TDMA system

• Each GSM band is partitioned into 125 carriers, each
spaced at 200 kHz
– Only 124 carriers are used.
– The remaining one serves as a guarded band between
existing service and GSM (see Fig. 7.3).
• Each carrier is framed, and each frame contains 8
time slots.
– The frame duration is 4.62 ms (= 120/26)
• This equals 26 frames with a duration of 120 ms.
ch7 - 10
ch7 - 11
ch7 - 12
• Thus, each physical channel is specified by a
(carrier, time_slot).

• In order to make it unnecessary for a terminal to

transmit and receive simultaneous, time slot i at
the downlink is coupled with time slot i+3 at the
uplink.

ch7 - 13
 Radio Transmission
• GSM time interval
– A hyperframe = 2048 superframe
– A superframe = 51 traffic multiframes = 26 control
multiframes = 6.12 s
– A traffic multiframe = 26 frames = 120 ms
– A control multiframe = 51 frames = 235.4 ms
– A frame = 8 time slots = 4.615 ms
– A slot = 156.25 bits = 577 µs
– A bit = 3.69 µs

ch7 - 14
ch7 - 15
 Traffic Channels
• A traffic multiframe = 26 frames with duration 120ms
• A phone speech is a full-rate traffic channel (TCH/F)
occupying one time slot in 24 of the 26 frames.
– Traffic travels in frames 0-11 and 13-24.
– Control information (called SACCH) may travel in frames 12
and 25.
• A SACCH associated with a full-rate traffic channel
alternatively occupies one slot in frame 12 and one slot in
frame 25
– Each GSM carrier can convey 8 TCH/F’s.

ch7 - 16
ch7 - 17
• GSM also supports half-rate traffic channel
(TCH/H):
– It occupies a specific time slot in 12 of the 26 frames.
– Each carrier can carry up to 16 TCH/H channels.
– The SACCH control data is in frames 12 and 25.
• There is also a control multiframe of length 51
frames.
– So a complete coupling of traffic multiframe and
control multiframe will form a cycle of 51x26 =1326
superframe, of length 6.12 sec.

ch7 - 18
GSM Bit Stream

ch7 - 19
• Training sequence:
– for synchronization, to estimate the characteristic of time-varying
channel.
– to train an adaptive equilizer
• 2 data fields:
– to carry user information or network control information
• FLAG: indicate whether the DATA field contains user
information or control one
• The TAIL bits all set to 0
• There is also a guard time 0f 30.5 µs
• The GSM transmission rate is 270.833 kb/s

ch7 - 20
 Radio Carrier’s Frequency

• GSM supports two kinds of radio carrier:

– conventional sine wave at a single frequency
– frequency hopping
• Slow Frequency Hopping
– The signal moves from one frequency to another in every
frame.
– The purpose of FH is to reduce the transmission
impairments.
– Without FH, the entire signal is subject to distortion
whenever the assigned carrier is impaired.
ch7 - 21
ch7 - 22
 Radiated Power

• GSM specifies 5 classes of mobile stations

transmitting power, ranging from 20 W (43 dBm)
to 0.8 W (29 dBm)

• Typically, vehicle-mounted terminal is 8 W and

portable terminals is 2 W

ch7 - 23
 Efficiency

• Spectrum Efficiency
– The reuse factor of N = 3 or 4
– The number of physical channel is 124 carriers x 8
channels/carriers = 992 physical channels
– When N = 3:
• The efficiency of GSM is E = 992 channels/3
cells/cluster/50 MHz = 4.96 conversation/cell/MHz
– When N = 4:
• The efficiency of GSM is E = 992 channels/4
cells/cluster/50 MHz = 4.96 conversation/cell/MHz
ch7 - 24
 Logical Channels

• Logical channels
– Traffic channels (two-way)
– Signaling Channels:
• Broadcast channels (base-to-mobile)
• Common control channels (base-to-mobile or
mobile-to-base): available to ALL terminals
• Dedicated control channels (two-way): available to
specific terminals

ch7 - 25
ch7 - 26
 Broadcast and Common Control
Channels
• Purpose:
– mobile terminal to synchronize with base stations, even
without a call in progress
– to set up new calls
• Broadcast channels and Common control channels
share the same carrier, in a multiplexing manner.
– The broadcast channels always occupy time slot 0.
– The common control channels can occupy time slots 0, 2, 4,
and 6.
• The frames of each channel is determined by their
positions in the 51-frame control multiframe.
ch7 - 27
• Time slot 0 in each of the 51 frames in a control multiframe:
– Fig. 7.11
– There are 5 groups of frames, each containing ten frames
• beginning with a frequency-correction frame (FCCH)
• a synchronization frame (SCH)
– These 5 groups end with an Idle Frame (X)
• In the reverse direction (from Terminal to BS):
– The control multiframe share the similar structure.
– Terminals without a call in progress contend on time slot 0 on a
contention basis.
– The rest 7 time slots are typically used by traffic channels.
– The even-number slots can also be used for control.

ch7 - 28
ch7 - 29
• Frequency Correction Channel (FCCH)
– The FCCH simply transmits 148 0’s.
– A terminal without a call in progress searches for a
FCCH.

ch7 - 30
• Synchronization Channel (SCH)
– A BS transmits a SCH in time slot 0 of every frame that
follows a frame containing an FCCH.
– The SCH contains a TRAINING sequence.
– The DATA fields contain BS identity code and the
present frame number.

ch7 - 31
• Broadcast Control Channel (BCCH)
– BS use the BCCH to transmit the information that
terminals need to set up a call, including the control
channel configuration and the access protocol.
– The message length is 184 bits.
• which is encoded to 224 bits (error-checking)
• and then to 456 bits (1/2 convolution code)
occupying 4 time slots.

ch7 - 32
• Paging Channel (PCH) and Access Grant Channel
(AGCH)
– PCH: to notify terminals of arriving calls
– AGCH: to direct a terminal to a stand-alone dedicated
control channel (SDCCH)
– A terminal is allowed to enter a sleep mode.
• Then it will only monitor the PCH and AGCH
frames that are assigned to it for newly arrival calls.
– They together occupy 36 frames per multiframe.

ch7 - 33
• Random Access Channel (RACH)
– Terminals send messages on the RACH to originate phone calls,
initiate transmissions of short messages, respond to paging messages,
and register their locations.
– Terminals with information to transmit use the slotted ALOHA
protocol to gain access to the time slot.
– The Ack directs the terminal to a stand-alone dedicated control
channel (SDCCH) to be used for further communications.
– RACH is located in 1 time slot in each frame of the 51-frame control
multiframe (in the direction from terminals to base stations).

ch7 - 34
ch7 - 35
– The 36-bit DATA field simply carries a 8-bit message.
• This message is protected by error-detecting code and
error-correcting code.

• 3 of the 8 bits indicate the purpose of the access attempt.

• 5 of the 8 bits contains a random number.

ch7 - 36
• When there is a collision, this 5-bit random code
can serve as a purpose to distinguish the
successful terminal from the unsuccessful one
(with a probability of 31/32).
– This is based on the “capture capability”, that the base
station may hear only part of the RACH.
– Then the random code will increase the probability of
success.

ch7 - 37
ch7 - 38
• Stand-Alone Dedicated Control Channel (SDCCH)
– SDCCH is a two-way channel assigned to a specific
terminal.
– The physical channel used by an SDCCH is a set of four
time slots in each 51-frame control multiframe.
– With 114 data bits per time slot, the data rate of the
SDCCH is 1937.25 b/s
– Each SDCCH has a slow associated control channel
called SACCH.

ch7 - 39
• Traffic Channels (TCH)
– two kinds:
• a full-rate channel occupies 24 time slots
– The bit rate of a full-rate traffic channel is 22,800 b/s
• a half-rate channel occupies 12 time slots
– SACCH occupies time slots in frames 12 or 25 of each 26-frame traffic
multiframe.
• S means “slow”.
• The transmission rate of a traffic SACCH is 950 b/s
• Fast Associated Control Channel (FACCH)
– If SACCH is too slow, we can use the traffic channel to transmit control
information.
– Each FACCH message is multiplexed with user information.

ch7 - 40
 Messages

• GSM Protocol Layers

– GSM provides a large number of open interfaces
• Message Structure
– All of the signaling message length is 184 bits with the
exception of the FCCH, SCH, and RACH

ch7 - 41
ch7 - 42
 Network Operations (I)
• Call to a GSM Terminal
– Terminal uses the frequency correction channel
(FCCH) to synchronize its local oscillator
– It then gains timing information from the SCH
– The terminal then obtains important information from
broadcast control channel (BCCH)
– After the initialization procedure, the terminal monitors
a paging channel (PCH)
– Eventually, it detects a paging request message and this
message cause the terminal to transmit a channel
request message on the random access channel (RACH)

ch7 - 43
– The network responds this request by transmitting an
immediate assignment message on an access grant
channel (AGCH)
– This message established a stand-alone dedicated control
channel (SDCCH) to be used for exchange of mobility
management messages and call management messages.
– When terminal moves to SDCCH, it transmits a paging
response message to BS
– The BS then initiates the GSM authentication procedure

ch7 - 44
 Network Operations (II)
• Authentication and Encryption Procedure
– The terminal received a 128-bit random number from BS
– Then it applies a GSM encryption algorithm A3 to
compute a 32-bit signed response, SRES
• The secret key Ki is stored in the subscriber
information module (SIM)
– From SRES and Ki, the terminal applies another
encryption algorithm A8 to compute a 64-bit ciphering key
Kc.
– The base station also uses the same way to compute these
numbers.

ch7 - 45
– If the two values of SRES are identical, the network
accept the the user as an authorized subscriber
– To encrypt user information and network control
information, the BS and network derive, through an
algorithm A5, a 114-bit mask to be added to the two
DATA fields.
• The inputs of A5 are the 64-bit ciphering key Kc and
the current 22-bit frame number
• Because A5 uses the frame number to compute the
ciphering mask, the mask change from frame to
frame.
ch7 - 46
ch7 - 47
 Network Operations (III)

• To Setup a Call
– BS transmits a setup message to the terminal
– The terminal Ack this message with a call confirmed
– The terminal then send a connect message to the
network
– In response, the network moves the call to a traffic
channel by means of an assignment command message
• Note that, GSM assigns a traffic channel after the
mobile subscriber accepts the call

ch7 - 48
ch7 - 49
 Network Operations (IV)
• Location-Based Registration
– Terminal registers its location when it moves to a new cell
• Mobile-Assisted Handover
– When mobile terminal finds a channel quality is better than
present one the handover procedures will be executed
• Status of GSM
– GSM operates in 900 MHz, 1800 MHz, and 1900 MHz bands
– New GSM services include a packet data transmission protocol
referred to as GPRS (generalized packet radio service) and
multiple-full-rate circuit switched services

ch7 - 50