GSM System Theory

Shi Xi

2004.2

Outline

Development of Mobile Communication

Basic Theory
Network Architecture Multiple Access Mode System Capacity Anti Interference Technology Network Planning Numbering arrangement Security Management

Development of Mobile Communication

Analog

AMPSAmerica NMTNorth Europe TACSU.K.

Evolution
DAMPS

Digital

GSM
CDMA

PDC

Development of Mobile Communication

AMPSAmerica
NMTNorth Europe TACSU.K. Disadvantages of First Generation Analog Mobile
Communication System

Not standard interface between several system Can not provide Mobile Data Services Less efficient use of the Frequency Can not roaming automatically Lower security, easy to be wiretapped

Development of Mobile Communication

GSM
Communication System

CDMA
PDC

Advantages of Second Generation Digital Mobile

High efficient use of the Frequency, Support large capacity Can provide not only Mobile Voice Services, but also Mobile Data Services (GSM) Automatic roaming (GSM) High security The better quality of tone Easy to provide new services and powerful functions (GSM)

Worldwide GSM System Application

TDMA 9%

PDC Analog 4% 5%

CDMA 13%
GSM 69%

GSM CDMA TDMA PDC Analog

Worldwide Mobile Subscribers: 1,155 million

Source: Gartner Dataquest (October 2002)

Outline

Development of Mobile Communication

Basic Theory
Network Architecture Multiple Access Mode System Capacity Anti Interference Technology Network Planning Numbering arrangement Security Management

GSM Network Structure

OMC MSC/VLR BTS BSC
BIE
E

BTS

Abi s

BSS

MSC/VLR
C

PSTN ISDN PSPDN

H

BSS
Um

HLR/ AUC

EIR

SC/VM

MSS

MS

GSM Network Entity

BTS
Base Transceiver Station (BTS) Wireless transmission Conversion between wired and wireless signals Wireless diversity Wireless channel encryption FH etc..

BaseBand Unit: voice and data speed adapting and channel coding RF Unit: modulating/demodulating ,transmitter and receiver Common Control Unit: BTS operation and maintenance

GSM Network Entity

BSC
Wireless network management And wireless BTS monitoring Controls: Wireless link distribution between MS and BTS Communication connection and disconnection MS location, handover and paging

GSM Network Entity MSC

holds all the switching functions needed for mobiles located in an associated geographical area, called an MSC area.
manages the necessary radio resources, especially those procedures required to handle and update the location registration procedure and procedures required to carry out the handover.

Interworks with other networks (IWF).

GSM Network Entity

HLR

Manages the mobile subscribers data base Including: subscriber information

part of the mobile location information

three identities essential to the system:
the International Mobile subscriber Identity (IMSI) the Mobile station ISDN Number the VLR address

GSM Network Entity dynamically stores subscriber information needed to handle incoming/outgoing calls
Mobile Station Roaming Number
When a roaming mobile enters an MSC area,this MSC warns the associated VLR of this situation; the mobile enters a registration procedure through which it is assigned a mobile subscriber roaming number (MSRN)

VLR

Temporary Mobile Subscriber Identity, if applicable The location area in which the mobile has been registered Data related to supplementary service parameters

GSM Network Entity AUC/EIR

Authentication Centre(s) (AUC)
This is in charge of providing the authentication key used for authorizing the subscriber access to the associated GSM PLMN.

Equipment Identity Register(s) (EIR)

This is in charge of handling Mobile Station Equipment Identity included with each Mobile Station.

Location Area Identification

GSM Service Area (every country provide GSM service) PLMN Service Area (one or several in one country) MSC Service Area (areas covered by one MSC) Location Area (MS do not need to update the data in VLR when moving in one location area) Cell (the smallest unit the network can identify in wireless) GSM Service Area PLMN Service Area MSC Service Area Location Area Cell

Outline

Development of Mobile Communication

Basic Theory
Network Architecture Multiple Access Mode System Capacity Anti Interference Technology Network Planning Numbering arrangement Security Management

FDMA Concept:
In a relative narrow channel inside a frequency domain, the signal power is concentrated to transmit the signal. Different channels are distributed into different channel. The interference from and to adjacent channels is restricted by the BPF. Thus, in specified narrow channel, only the useful signal energy can be passed, while any other signal will be excluded.

Time

User
1

User 2

User 3 Frequency

Frequency Resource
GSM900 : up: 890~915MHz down: 935~960MHz duplex interval: 45MHz bandwidth: 25MHz frequency interval: 200KHz

EGSM900 : up: 880~890MHz down: 925~935MHz duplex interval: 45MHz bandwidth: 10MHz frequency interval: 200KHz GSM1900MHz: Up:1850~1910MHz Down:1930~1990MHz duplex interval: 80MHz working bandwidth: 60MHz frequency interval: 200KHz

GSM1800 : up: 1710-1785MHz down: 1805-1880MHz duplex interval: 95MHz working bandwidth: 75MHz frequency interval: 200KHz

ARFCN
GSM900 Fu(n)=890+0.2n(MHz) Fd(n)=Fu(n)+45(MHz)

1n124

EGSM900 Fu1(n)=890+0.2n(MHz) 1n124 Fu2(n)=880+0.2(n-1024)(MHz) 975n1023 Fd(n)=Fu(n)+45(MHz) GSM1800 Fu(n)=1710.2+0.2(n-512)(MHz) Fd(n)=Fu(n)+95(MHz) 512n885

Frequency Resource
Single Band Network
Which one?

General Priority 900MHz 1800MHz 1900MHz Low

Reason

High

New Operator

Propagation Characteristic
For Operator For Subscriber

Frequency Resource
Single Band Network

Single Band

900MHz 1800MHz

Dual Band

Triple Band

1900MHz

In a sense, the network determines the handsets can be selected. But nowadays, all handsets almost support dual band.

Frequency Resource
Single Band Network Cell coverage radius : We know

Propagation characteristic The higher the propagation frequency

The higher the propagation loss 900MHz 1800MHz 1900MHz

The smaller the cell coverage radius.

TDMA

Concept:
time

User 3 User 2

User 1
Frequency

GSM adopts TDMA/FDMA mode channel width: 200KHz each channel has 8 timeslots

channel is composed of a series of timeslots of periodicity. Different signal energies are distributed into different timeslots. The adjacent channel interference is restricted by connection choosing from time to time. So the useful signal is passed only in the specified timeslot.

Timeslot and Frame structure

Frequency

200KHz

BP

time interval

15/26ms

Timeslot and Frame structure

1 super high frame = 2048 super frame = 2715648 TDMA frame 0 1 2 3 2044 2045 2046 2047
BCCH CCCH SDCH

SACCH/TCH FACCH

1 super frame = 1326 TDMA frame6.12s 0 0 1 2 1 3 47 48 24 49 25 50

1 multiplex frame = 26 TDMA frames120ms 1 multiplex frame = 51 TDMA frame 0 1 24 25 0 1 49 50

1 TDMA frame = 8 timeslot120/26 = 4.615ms 0 1 2 3 4 5 6 7

Physical Channel

0
8

1
9

2
10

3
11

4
12

5
13

6
14

7
15

16

17

18

19

20

21

22

23

The physical channel adopts FDMA and TDMA techs. On the time domain, a specified channel occupies the same timeslots in each TDMA frame, so it can be identified by the timeslot number and frame number.

Channel Type
Traffic Channel It is used to transmit voice and data 1. FR, (TCH/F) 2. HR,(TCH/H) Control Channel transmit the signalling and synchronous data between BTS and MS. BCH : Broadcast Control Channel (down link channel) CCCH: Common Control Channel (up & down link channel) Dedicated Control Channel:

Channel Type
BCH : Frequency Correction CHannelFCCH -- for MS frequency synchroonization Synchronous ChannelSCH) -- for MS frame synchronization and BTS recognization Broadcasting Control CHannelBCCH -- broadcasting information(cell selection information, etc..)

Channel Type
Dedicated Control Channel: Self-help Dedicated Control ChannelSDCCH -- for channel distribution information transmission Slow Associated Control Channel SACCH -- combined with one traffic channel or SDCCH, to transmit some specific information of user information Fast Associated Control Channel FACCH -- combined with one traffic channel, taking the same signal as SDCCH. It occupies the service channel to transmit signalling information.

Channel Type
14.4Kbit/s FR TCH (TCH/F14.4) 9.6Kbit/s FR TCH(TCH/F9.6) 4.8Kbit/s FR TCH (TCH/F4.8) 2.4Kbit/s FR TCH (TCH/F2.4) Data CH TCH Voice CH 4.8Kbit/s HR TCH (TCH/H4.8) 2.4Kbit/s HR TCH (TCH/H2.4) FR Voice Traffic Channel(TCH/FS) Enhanced FR Traffic Channel (TCH/EFR) HR Traffic Channel (TCH/HS) channel BCH FCCH(down) SCH(down) BCCH(down) RACH(up) AGCH(down) PCH(down) SDCCH FACCH SACCH

CCH

CCCH

DCCH

Channel Combination Type

In GSM, several logic channels combine together in some way to form some specific types of channel to transmit user data or signalling information. They are called combined channels. One combined channel can be mapped to a physical channel. There are the following combined channels: TCH/F + FACCH/F + SACCH/TF TCH/H(0,1) + FACCH/H(0,1) + SACCH/TH(0,1) TCH/H(0,0) + FACCH/H(0,1) + SACCH/TH(0,1) + TCH/H(1,1) FCCH + SCH + BCCH + CCCH FCCH + SCH + BCCH + CCCH + SDCCH/4(0...3) + SACCH/C4(0...3) BCCH + CCCH SDCCH/8(0 ..7) + SACCH/C8(0 .. 7) CCCH = PCH + RACH + AGCH

a b c d e f g

How these channels work

Summary:
When MS first logs on to network: 1. MS listens for strongest signal

2. Frequency Correction Channel, FCCH

3. Synchronisation Channel, SCH 4. Broadcast Control Channel, BCCH 5. If not correct network (eg. mobilink instead of paktel), procedure repeated for next strongest signal

How these channels work

Summary:
When network needs to contact MS: 1. Paging Channel used, PCH (Base Station => Terminal) 2. MS responds using Random Access Channel, RACH 3. Network assigns dedicated signalling channel using Access Grant Channel, AGCH

How these channels work

Summary:

When MS needs to contact network:

1. MS uses Random Access Channel, RACH 2. Network assigns dedicated signalling channel using Access Grant Channel, AGCH

Channels for SMS

SMS:
160 characters long MS in idle mode => SDCCH used

Stand Alone Dedicated Control Channel

MS busy => SACCH is used Slow Associated Control Channel Cell Broadcast is a form of SMS => an SMS to every MS in cell

Channel Feature
The transmission path is very complex, ranging from the simple lineof-sight transmission to encountering such terrain as buildings, hills and trees. Wireless channels are extremely unpredictable. Abrupt drop, or fading, of signal strength in the land mobile wireless channel is quite common. The fading feature of the mobile channel depends on the radio wave propagation environment.
environmental factors: 1. 2. 3. 4. 5. 6. 7. Terrain (mountains, hills, plains, water bodies, etc.); The number, heights, distribution and materials of buildings; The vegetation of the said region; Weather conditions; Natural and artificial electromagnetic noises; frequency; the movement conditions of the MS;

Burst (1)

Different kinds of bursts:

A burst is one times slot

1. Normal burst 2. Frequency correction burst 3. Synchronisation burst 4. Access burst 5. Dummy burst

Burst (2)

The normal burst is used for:

1. TCH
2. BCCH 3. PCH 4. AGCH 5. SDCCH 6. SACCH 7. FACCH

Burst (3)-normal burst

Burst (4)
Structure of normal burst: 1. 2*57 bits used used for coded (encrypted) speech or data 2. 2*S1 bits used to indicate if burst used for FACCH 3. training sequence, 26 bits, used by equaliser to counteract time dispersion 4. 2*T3, tail bits, used by equaliser to detect start and stop of burst. 000 is used for tail bits. 5. a guard period of 8.25 bits is used to stop overlap of calls

Burst (5)

FDMA TDMA CDMA Demonstration

time User 1 time

FDMA
code

User
2

User 3 frequency User 3 User 2 User 1

User 3 User 2 User 1

TDMA
time

frequency

CDMA

frequency

Outline

Development of Mobile Communication

Basic Theory
Network Architecture Multiple Access Mode System Capacity Anti Interference Technology Network Planning Numbering arrangement Security Management

Cell Mode Layout

Omni-directional cell Adopt omni-directional antenna the overall directional propagation characteristic is the same.
O

Directional cell In general, cell with multi-sector is in common use. Every directional cell adopts directional antenna.

BTS Mode
Capacity When the traffic is very low, and no possibility for quick increment , Omni-directional cell is used in common. Otherwise , we suggest to adopt the sector cell.

Note: TRX-transceiver,each TRX handles 1 frequency.

Coverage Area Sector cell is often used to enlarge the cell coverage radius because of the higher antenna gain. For special coverage ,such as road coverage, two-sector cell is adopted firstly.

System capacity
Erlang : the traffic intensity of a totally occupied channel (i.e. the call hour of a unit hour or the call minute of a unit minute). For example, the traffic of a channel occupied for 1.8 minutes in an hour is 0.03 E rlang) GOS: defined as the probability of call blocking or the probability when the call delay time is longer than a given queuing time.

Erlang B table
GOS=2% TRX/Sector 1 TCH 7 ERL 2.94 GOS=5% ERL 3.74

2
3 4 5 6 7 8 9 10 11 12

14
22 30 37 45 53 60 68 76 83 91

8.20
14.90 21.93 28.25 35.61 43.06 49.64 57.22 64.85 71.56 79.27

9.73
17.13 24.80 31.64 39.55 47.53 54.56 62.64 70.75 77.87 86.03

How many subs a BTS supports Take S222 (3S2F) for example, assume GOS=2% and 0.015Erlang/sub
1. 2TRX per sector, 14 TCH achieved 2. According to Erlang B table, GOS=2%, 14TCH, 8.20 Erlang achieved 3. 3 sectors, 8.20*3=24.6 Erlang for total 4. 24.6/0.015=1640 Subs

Outline

Development of Mobile Communication

Basic Theory
Network Architecture Multiple Access Mode System Capacity Anti Interference Technology Network Planning Numbering arrangement Security Management

Interference
Co-Channel Interference
Conception: the interference among the signals of cochannel cells is called co-channel interference. Frequency reuse co-channel cells must physically be spaced at a minimum interval to ensure adequate isolation of transmissions. The signal interference from the frequency adjacent to that of the signal used is called adjacent channel interference. accurate filtering and channel allocation (maximizing channel intervals of the cell). interval of frequency reuse inter-cell interference, such as C/I, C/A

Result from : Reduction method:

Adjacent Channel Interference

Conception:

Reduction method:

Solution --Anti-interference

FH technology Dynamic power control (DPC) Discontinuous transceiving (DTX) Diversity receiving technique

Frequency Hopping Technique

Reason: counteract Rayleigh Fading scatter interference among multiple calls Type: Base band frequency hopping keeps the transmission and receiving frequency of each carrier unit unchanged, but merely sends FU transmission data to different carrier units at different FN moments. radio frequency hopping controls the frequency synthesizer of each transceiver, making it hop according to different schemes in different time slots.

Baseband FH

Discontinuous Speech Transmission (DTX)

Two aims can be achieved by adopting DTX mode:

lower the total interference electric level in the air save transmitter power.
TRAU

BTS

BTS

MS

480 ms

comfort noise frame Speech frame

Diversity Reception Technology

The multi-path propagation of radio signals causes magnitude fading and delay time. Space Diversity (antenna diversity) Polarization Diversity orthogonal polarization diversity. horizontal polarization and vertical polarization. Frequency Diversity The working principle of this technology is that such fading wont take place on the frequency outside the coherence bandwidth of the channel.

Outline

Development of Mobile Communication

Basic Theory
Network Architecture Multiple Access Mode System Capacity Anti Interference Technology Network Planning Numbering arrangement Security Management

Network planning
GSM is a system of both coverage limited and capacity limited.

Capacity:
Bandwidth available Frequency reuse pattern Traffic model

Coverage:
Link budget

Propagation model
Subscriber density

Frequency Reuse

D3 C1 C3 A1 D2 B2 A2

A1 A3 B1 B3 A1

C2 D1 D2 C1 C2

C3 B2 D3 A2 C3

B1 B3 A1 A3 B1

D2 C1 C2 D1 D2 A1 D3 C3

4 3 reuse mode: one group includes 3 sectors /site ,12 frequency which are distributed to 4 sites. Every site owns 3 frequency.

Frequency Reuse

B3 C1 C3 A1 A3 B2 A2

A1 A3 B1 B3 C1

B2 C1 C2 A1 A2

B3 A2 C3 B2 A3

A1 A3 B1 B3 C1

B2 C1 C2 A1 A2 A1 A3 C3

3 3 reuse mode: one group includes 3 sectors /site ,9 frequency which are distributed to 3 sites. Every site owns 3 frequency.

Site configuration available

For example, we get 6MHz bandwidth from authorities, We use 4*3 re-use for BCCH, 3*3 re-use for TCH 1. 6MHz/200k=30 ARFCN 2. 30-4*3=18; (4*3=12 ARFCN for BCCH)

3. 18/(3*3)=2;(3*3*2=18 ARFCN for TCH)

4. Conclusion: 1 TRX including BCCH and 2 TRX including TCH per sector, S333 can be achieved

Traffic model
Traffic model refers to: GOS Erlang/sub BHCA

etc

Link budget-calculation

Link budget-uplink
Handset transmitting power Human body loss Building loss Handset equivalent transmitting power BTS receiving sensitivity BTS antenna gain Feeder loss Diversity gain Attenuation margin BTS equivalent receiving power In-door coverage permitted path loss Out-door coverage permitted path loss 30 3 17 10 -112 17 4 2 6 -117 127 144 dBm dB dB dBm dBm dBi dB dB dB dBm dBm dBm

Link budget-downlink
BTS transmitting power Combiner loss BTS antenna gain Feeder loss BTS equivalent transmitting power Handset receiving sensitivity Human body loss Building loss Attenuation margin Handset equivalent receiving electrical level In-door coverage permitted path loss Out-door coverage permitted path loss 43 5 17 4 51 -101 3 17 6 -75 126 143 dBm dB dBi dB dBm dBm dB dB dB dBm dBm) dBm

Link budget-conclusion

Comparing the uplink link budget and downlink link budget, we need to pick up the smaller In-door coverage permitted path loss and Out-door coverage permitted path loss.

The smaller one is to guarantee a reliable two way communication.

Propagation model
Usually, those propagation model are used for the following cases:

Okumura-Hata for GSM 900

COST231-walfish for GSM 1800

No classic propogation model for micro cells, where radius less than 1km

Hata model

Subscriber density
Subscriber density is another important factor when considering the radius of a cell/sector. With the same traffic model, propagation model, different cell radius are always implemented in different areas (urban, suburb, countryside,etc)

Outline

Development of Mobile Communication

Basic Theory
Network Architecture Multiple Access Mode System Capacity Anti Interference Technology Network Planning Numbering arrangement Security Management

Numbering Arrangement
International mobile subscriber identification number (IMSI)
It identifies a unique international universal number of a mobile subscriber, which consists of MCC+MNC+MSIN. 1MCC: country code, 460 2MNC: network code, 00 or 01 3MSIN: subscriber identification, H1H2H3H4 9XXXXXX, H1H2H3H4: subscriber registering place H1H2: assigned by the P&T Administrative Bureau (operator )to different provinces, to each province H3H4: assigned by each province/city
the IMSI of user will be written into the SIM card by specific device and software and be stored into the HLR with other user information.

Numbering Arrangement

Mobile subscriber ISDN numberMSISDN

It is the subscriber number commonly used. China uses the TDMA independent numbering plan:

CC+NDC+ H1H2H3H4 +ABC

CC: country code, 86 NDC: network code, 135139, 130 H1H2H3H4: HLR identification code ABCD: mobile subscriber number inside each HLR

Numbering Arrangement

International Mobile Equipment Identification code (IMEI)

It will uniquely identify a mobile station. It is a decimal number of 15 digits. Its structure is: TAC+FAC+SNR+SP TAC=model ratification code, 6 digits FAC=factory assembling code, 2 digits SNR=sequence code, 6 digits SP=reserved, 1 digit

Numbering Arrangement

Mobile subscriber roaming number (MSRN)

The MSRN is temporarily distributed to the subscriber by the VLR according to the request by the HLR when this subscriber is called. The MSRN is released and can be assigned to other subscriber later. CC + NDC + 00 + M1M2M3 + ABC CC: country code, 86 NDC: mobile network code, 135139, 130 M1M2: same as the H2H3 of MSISDN ABC: 000 -- 999

Numbering Arrangement
Temporarily Mobile Subscriber Identification Number (TMSI)

To insure the IMSI security, the VLR will assign an unique TMSI number for the accessed subscriber. It is used locally only and is a 4-byte TMSI number BCD code.

Outline

Development of Mobile Communication

Basic Theory
Network Architecture Multiple Access Mode System Capacity Anti Interference Technology Network Planning Numbering arrangement Security Management

Security Management
The user authentication and encryption is finished by the three parameter group generated by the AUC. Each user will be distributed with user number and user identification number (IMSI) when registering. This IMSI number is written into the SIM card by the SIM card writer. In the mean time, in the card writer a user secret key Ki corresponding uniquely to this IMSI will be generated and be stored inside the SIM card and AUC. In AUC, there is also a pseudo-random code generator to generate an unpredictable pseudo-random number RANDfor the user. The RAND and Ki will be calculated through A8 algorithm (encryption algorithm) to generate the Kc, and through A3 algorithm (authentication algorithm) to generate a responding number SRES. Then the RAND, SRES, Kc will consist the three parameter group. Inside the AUC, each time, 7-10 such groups will be generated for each user and will be forwarded to the HLR to be stored into the information database of the user.

Authentication
Authentication is used here to protect legal users and to prevent illegal user from entering the network. When the user applies to access to the network, the MSC/VLR will forward the RAND to the user through the control channel. When the SIM card receives it, it will do calculation of this RAND and the Ki inside the SIM card by the A3 algorithm to get the responding number SRES and then forward to MSC/VLR.

The MSC/VLR will compare the received SRES with the SRES inside the three parameter group. If they are the same, the access will be accepted, if not the access will be refused.
The VLR will ask 5 such three parameter groups from the HLR in one time. Each authentication will use one group. When two groups are left, it will ask another 5 groups from the HLR and do this way repeatedly.

Authentication

MS Ki RAND

MSC/VLR pseudo-random data Ki A3 SRES' SRES

A3

Encryption

Encryption is done on the wireless channel to avoid illegal user monitoring of filching the user information and parameters when they are exchanged between BTS and MS. At the MS side, the A8 algorithm is used to get Kc

According to the encryption command from the MSC/VLR, the Kc will be used at both the BTS and MS side. At the MS side, a calculation will be down using Kc, TDMA frame number and encryption command M by the A5 algorithm to encrypt the user information data flow and transmit it on the wireless path. At the BTS side, the received data flow, TDMA frame number and the Kc will again be deencryption by the A5 algorithm and be transmitted to the BSC and MSC.

Encryption

MS

MSC/VLR pseudo-random data RAND

Ki

Ki
A8 A8

Kc

Kc

Encryption

Frame Number 22 bit

Frame Number

Kc 64 bit

22 bit

Kc 64 bit

A5
S1 114 bit S2 S1 114 bit 114 bit

A5
S2 114 bit

MS

BTS