GSM
GSM
GSM
M ob
blll
le (GSM)
for
tem
System
for
551
ajobal
chosed, celhu
stems that use nonstandard control channels. IS-94 systems were introduced in
i were proliferating throughout office buildings and hotels until 2001.
1994, a n d were
IS-54 Rev.C standard provided 48.6 kbps control channel signaling on the USDC-
The
trol ch
only control channels and 10 kbps FSK control channels on the original AMPS channels. How
losed network capabilities are not fully developed under IS-54 Rev.C. The final USDC
ever, c l o s e
sd. IS-136, was developed to provide a host of new features and services that allowed
standard
cDC to be competitive with IS-95 and GSM 2G standards. IS-136 specifies short messaging
USDC
vate, user group features, making it well-suited for wireless PBX applications
apabilities and privat.
solve the fragmentation problems of the first cellular systems in Europe. GSM was
developed to
modulation and network level architectures
the world's first cellular system to specify digital
countries
and services, and is the world's popular 2G technology. Before GSM, European
most
and it was not possible for a customer
used different cellular standards throughout the continent,
the
to use a single subscriber unit throughout Europe.
GSM was originally developed to serve as
the use of
wide range of network services through
pan-European cellular service and promised a the
of virtually everyone, and it is now
SDN. GSM's success has exceeded the expectations
Telephone services. including emergency calling and facsimile. GSM also supports
S
Videotex and Teletex, though they are not integral parts of the GSM standard.
Bearer services or data services which are limited to layers 1, 2, and 3
open sys.
tem interconnection (OSI) reference model (see Chapter 10). Supported services
of the
include
packet switched protocols and data rates from 300 bps to 9.6 kbps. Data may be transmit
ted using either a transparent mode (where GSM provides standard channel coding for the
user data) or nontransparent mode (where GSM offers special coding efficiencies based
on the particular data interface).
Supplementary ISDN services, are digit¡l in nature, and include call diversion, closed
user groups, and caller
identification, and are not available in analog mobile networks.
Supplementary services also include the short messaging service (SMS) which allows
GSM subscribers and base stations to Ismit
alphanumeric pages of limited length (160
7 bit ASCII characters) while
simultaneously carrying normal voice traffic. SMS also pro-
vides cell broadcast, which allows
GSM base stations to repetitively transmit ASCIl mes-
sages with as
many as fifteen 93-character strings in concatenated fashion.
SMS may be
used for safety and advisory
applications, such as the broadcast of highway or weather
information to all GSM subscribers within
reception range.
From the user's point of view, one of the most remarkable features of GSM is the
Subscriber ldentity Module (SIM), which is a
memory device that stores information such as
the subscriber's
identification number, networks and countries where the subscriber s
the
entitled to service, privacy keys, and other
SIM with a
user-specific information. A subscriber uses the
four-digit personal
ID number to activate service from
available as smart cards (credit card sized cards that any GSM phone. SIMs are
may be inserted into any GSM phone) or
plug-in modules, which are less convenient than the SIM cards but are nonetheless removabie
and portable. Without a SIM installed, all GSM mobiles are
the SIM that gives GSM subscriber units identical and nonoperational. It 18
their identity. Subscribers
any suitable terminal-such as a may plug their SIM into
hotel phone, public phone,
phone-and then able to have all
are
or any
portable or monl
incoming GSM calls routed to that terminal
outgoing calls billed to their home and have a
phone, no matter where
A second remarkable feature they world.
are in the
of GSM is the on-the-air
privacy which is provided by he
system. Unlike analog FM cellular phone
systems which can be readily
impossible to eavesdrop on a GSM radio transmission. The privacy
monitored, it is virtua
ing the digital bit stream sent by a GSM transmitter, according is made secret cryptograypt-
to a specific
possible by ency raphic
for
Moblie (GSM)
tem 553
eknown only to the cellular carrier. This key changes with time for each user. Every
key GSM equipment manufacturer must sign the Memorandum of Understanding (MoU)
carrierand
developing GSM equipment or deploying a GSM system. The MolU is an international
beront hich allows the sharing of cryptographic algorithms and other proprietary informa-
agreement which allows
betw
ntries and carriers.
cour
tion
The BSS, also known as the radio subsystem, provides and manages radio tfransmission
paths between the mobile stations and the Mobile Switching Center (MSC). The BSS also man-
ages the radio interface between the mobile stations and all other subsystems of GSM. Each BSS
consists of many Base Station Controllers (BSCs) which connect the MS to the NSS via the
MSCs. The NSS manages the switching functions of the system and allows the MSCs to com-
municate with other networks such as the PSTN and ISDN. The OSS supports the operation and
maintenance of GSM and allows system engineers to monitor, diagnose, and troubleshoot all
aspects of the GSM system. This subsystem interacts with the other GSM subsystems, and is
provided solely for the staff of the GSM operating company which provides service facilities for
the network.
Figure 11.5 shows the block diagram of the GSM system architecture. The Mobile Stations
(MSs) communicate with the Base Station Subsystem (BSS) over the radio air interface. The BSs
of many BSCs which connect to a single MSC, and each BSC typically controls up to
consists
Several hundred Base Transceiver Stations (BTSs). Some of the BTSs may be co-located at the
BSC, and others may be remotely distributed and physically connected to the BSC by microwave
inkor dedicated leased lines. Mobile handoffs (called handovers, or HO, in the GSM specifica-
on) between two BTSs under the control of the same BSC are handled by the BSC, and not the
MSC. This greatly reduces the switching burden of the MSC.
As shown in Figure 11.6, the interface which connects a BTS to a BSC is called the Abis
erace. The Abis interface carries traffic and maintenanee data, and is specified by GSM to be
andardized for all manufacturers. In practice, however, the Abis for each GSM base station
aufacturer has subtle differences, thereby forcing service providers to use the same manufac-
turer for the BTS
and BSC equipment.
The BSCs are physically connected via dedicated/leased lines or microwave link to the
T h e interface between a BSC and a MSC is called the A interace, which is standardized
n USM. The A interface uses an SS7 protocol called the Signaling Correction Control Part
Chapter 11 Wirelese Systems and Standaa
554
BTS
BTS BSC
HLR VLR AUC
MS BTS
PSTN
BTS
MSC ISDN
BTS BSC
BTS Data
Networks
OMC
Operation Support |
Subsystem
MS
Base Station Subsystem Network Switching Subsystemi Public Networks
BTS
MS
SS7
BTS
MS A interface
Abis Interface (standardized)
(standardized)
(SCCP) which supports communication between the MSC and the BSS, as well as network mes*
sages between the individual subscribers and the MSC. The A
interface allows a service pro
vider to use base stations and switching equipment made
by different manufacturers.
Mobile(GSM)
ystemfor 555
Globa
NSS handles the switching of GSM calls between external networks and the BSCs in
aa Subsystem and is also responsible for managing and providing external access to sev-
the
radio.
theomer databases. The MSC is the central unit in the NSS and controls the traffic among
r a l c u s t o m e r
he BSCs. In the NSS, there are three different databases called the Home Location Regis-
R)Visitor Location Register (VLR), and the Authentication Center (AUC). The HLR is
tabase which contains subscriber information and location information for each user who
e s in the same city as the MSC. Each subscriber in a particular GSM market is assigned a
enternational Mobile Subscriber Identity (IMS), and this number is used to identify each
ne ser. The VLR is a database which temporarily stores the IMSI and customer information
ho
ach roaming subscriber who is visiting the coverage area of a particular MSC. The VLR is
ked between several adjoining MSCs in a particular market or geographic region and contains
aihscription information of every visiting user in the area. Once a roaming mobile is logged in
he VLR, the MSC sends the necessary information to the visiting subscriber's HLR so that calls
to the roaming mobile can be appropriately routed over the PSTN by the roaming user's HLR.
a strongly protected database which handles the authentication and
The Authentication Center is
in the HLR and VLR. The Authentication Center
encryption keys for every single subscriber
which identifies stolen or fraud-
contains a register called the Equipment Identity Register (EIR)
not match with information contained
ulently altered phones that transmit identity data that does
in either the HLR or VLR.
used
The OSS supports one Operation Maintenance Centers (OMC) which are
or several
GSM sys-
to monitor and maintain the performance of each MS, BS, BSC, and MSC within a
tem. The OSS has three main functions,
which are 1) to maintain all telecommunications hard-
duration is 3.692 us, and th2 effective channel transmission rate per user
is 33 Rsa
(270.833 kpbs/8 users). With GSM overhead (described subsequently), user data is actually 33.854 kbps
a maximum rate of 24.7
kbps. Each TS has an equivalent time allocation of 156.25 chann sent at
but of this, 8.25 bits of guard time and six total start and
stop bits are provided to prevent
prevent coverlap
with adjacent time slots. Each TS has a time duration
of S76.92
jus as shown in
and aFigure 11.7. and
single GSM TDMA frame spans 4.615 ms. The total number of available
channels within
25 MHz bandwidth is 125 (assuming no vithin a
guard band). Since each radio channel consists of eich!
time slots, there are thus a total of 1000 traffic channels within GSM. In
practical implementations
a guard band of 100 kHz is provided at the upper and lower end of the GSM
124 channels
spectrum, and onlv
are implemented. Table 11.3 summarizes the GSM air interface.
The combination of a TS number and an ARFCN constitutes
physical channel for both the
a
forward and reverse link. Each physical channel in a GSM
system can be mapped into different
logical channels at different times. That is, each specific time slot or frame may be dedicated
to
either handling traffic data (user data such as
speech, facsimile, or teletext data), signaling data
required by the internal workings of the GSM system), or control channel data (from the MSC,
base station, or mobile user). The GSM
specification defines a wide variety of logical chanels
which can be used to link the physical
layer with the data link layer of the GSM network. These
logical channels efficiently transmit user data while simultaneously providing control of the
network on each ARFCN. GSM
provides explicit assignments of time slots and frames for specific
logical channels, as described below.
156.25 bits
576.92 us
4.615 ms
120 ms
data. When transmitted as full-rate, user data is contained within one TS per frame. When
smatted as half-rate, user data is mapped onto the same time slot, but is sent in altemate
ames. That is, two half-rate channel users would share the same time slot, but would alter
nately transmit during every other frame.
Chapter 11 Wireless
558 stems and Standarda
Half-Rate TCH
The following half-rate speech and data channels are supported:
and CCCH forward control channels are allocated only TS 0 and are broadcast only during cer
tain frames within a repetitive fifty-one frame sequence (called the control channel
muliframe)
on those ARFCNs which are designated as broadcast channels. TS1
through TS7 carry regular
TCH traffic, so that ARFCNS which are designated as control channels are still able to carry
full-rate users on seven of the eight time slots.
The GSM specification defines thirty-four ARFCNs as standard broadcast channels. For
each broadcast channel, frame 51 does not contain any BCHICCCH forward channel data and is
considered to be an idle frame. However, the reverse channel CCCH is able to receive subscriber
transmissions during TS 0 of any frame (even the idle frame). On the other hand, DCCH data
may be sent during any time slot and any frame, and entire frames are specifically dedicated to
certain DCCH transmissions. GSM control channels are now described in detail.
560
Standards
Multiframe = 51 TDMA Frames
Control
235 ms
202122 39 40 4142 4950
o 1 2 3 4 6 6 7 8910111213|14 c c
c l c P s c c Ps
FsB B B BccclcF s|c
F:FCCH burst (BCH)
S : SCH burst (BCH)
BCCH burst (BCH)
PCH/AGCH burst (CCCH)
Idle
(a)
TDMA Frames
Control Multiframe 51 =
235 ms
BCCH data. It should be noted from Figure 11.8 that Ts Ocontains BCCH dataduring
specific frames, and contains other BCH channels (FCCH and SCH), common control
channels (cCCHs), or an idle frame (sent every 51st frame) during other specific frames.
b) Frequency Correction Channel (FCCH)- The FCCH is a special data burst which
occupies TS 0 for the very first GSM frame (frame 0) and is repeated every ten frames
within a control channel multiframe. The FCCH allows each subscriber unit to syn-
chronize its internal frequency standard (local oscillator) to the exact frequency of the
base station.
all mobiles in the cell, and notifies a paging signals from the base station to
specific mobile of an incoming call which origi-
nates from the PSTN. The PCH transmits
the IMSI of the subscriber, along with
arequest for acknowledgment from the mobile unit on the target
RACH. Alternatively, the
PCH may be used to provide cell broadcast ASCII text
messages to all subscribers, as
part of the SMS feature of GSM.
b) Random Access Channel (RACH)-The RACH is a reverse
link channel used by a
subscriber unit to acknowledge a page from the PCH, and is also
used by mobiles to
originate a call. The RACH slotted ALOHA access scheme. All mobiles must
uses a
request access or respond to a PCH alert within TS 0 of a GSM frame. At the
BTS,
every frame (even the idle frame) will accept RACH transmissions from
mobiles dur-
ing TS 0. In establishing service, the GSM base station must
respond to the RACH
transmission by allocating a channel and assigning a stand-alone dedicated control
channel (SDCCH) for signaling during a call. This connection is
confirmed by the base
station over the AGCH.
c) Access Grant Channel
(AGCH)-TheAGCH is used by the base station to provide
forward link communication to the mobile, and carries data which instructs the mobile
to operate in a particular
physical channel (time slot and ARFCN) with a particular
dedicated control channel. The AGCH is the final CCCH message sent by the base
station before a subscriber is moved off the control channel. The AGCH is used by the
base station to respond to a RACH sent by a mobile station in a previous CCCH frame.
Dedicated Control Channels (DCCHs) --There are three types of dedicated control
channels in GSM, and, like traffic channels (see Figure 11.7), they are bidirectional and
have the same format and function on both the forward and reverse links. Like TCHs.
DCCHs may exist in any time slot and on any ARFCN except TSO of the BCH ARFCN.
The stand-alone dedicated control channels (SDCCHs) are used for providing signaling
services required by the users. The Slow- and Fast-Associated Control Channels (SACCHs
and FACCHs) are used for supervisory data transmissions between the mobile station and
the base station during a call.
a) Stand-alone Dedicated Control Channels (SDCCHs)- The SDCCH caries signaling
data
following the connection of the mobile with the base station, and just before a
CH assignment is issued by the base station. The SDCCH ensures that the mobile
Chapter 11
Wireless Systema
562 andsSlandarda
while the base station
station remain connected
station and the base
allocate resources
for the mobile. The SDCCuSC SC verity
the subscriber unit and an be though
channel which accepts a newly co thou
of as an intermediate
and temporary
the traffic while waiting
for the base station to mpleted cacal
ad
from the BCH and holds
authentication and alert locate aTCH
a Tou
channel. The SDCCH is
used to send
the frame structure
messages
and (butonot
speech) as the mobile synchronizes itself with for aTCH
SDCCHs may be assigned their own physical channel or may occupy TSO
of TOH
if there is low demand for BCH or CCCH
traffic. BCH
-The SACCH is always
a) Slow Associated Control Channel(SACCH)
an.
a traffic channel or a SDCCH and maps onto the Same physical channel. The with
ARFCN systematically carries SACCH data for all ofits current users
users. As in
the
standard, the SACCH carries general information between the S and BTS. USDC
ward link, the SACCH is used to send slow but regularly changing controlOn
ct
tion to the mobile, such as transmit power level instructions and specifictimina forma-
advance instructions for each user on the ARFCN. The reverse SACCHcarmies infor
mation about the received signal strength and quality of the TCH, as well as BCH ma
mea-
surement resultsfrom neighboring cells. The SACCHis transmitted durine the
thirteenth frame (and the twenty-sixth frame when half-rate traffic is used) of every
speech/dedicated control channel multiframe (Figure 11.7), and within this frame.the
eight timeslots are dedicated to providing SACCH data to each of the eight full-rate lar
sixteen half-rate) users on the ARFCN.
a) Fast Associated Control Channels (FACCHs)- FACCH carries urgent messages, and
contains essentially the same type of information as the SDCCH. A FACCH is assigned
whenever a SDCCH has not been dedicated for a particular user and there is an urgent
message (such as a handoff request). The FACCH gains access to a time slot by "steal-
ing" frames from the traffic channel to which it is assigned. This is done by setting two
special bits, called stealing bits, in a TCH forward channel burst. If the stealing bis are
set, the time slot is known to contain FACCH data, not a TCH, for that frame.
System
Global
TCH). Once
tuned to the SDCCH, the subscriber unit first waits for the SACCH frame to
the
(not (the wait would last, at most, 26 frames or 120 ms, as shown in Figure 11.7),
transmitted
efortmsthe mobile of any required timing advance and transmitter powerthe mobile's The
ear-
command.
wation is able to determine the proper timing advance and signal level from
DACH transmission and sends the proper value over the SACCH for the mobilesubscriber
process. to
the is
receiving and processing the timing advance information in the SACCH,
ier
Upon .
sends
able
nowable to
transmit normal burst messages as required for speech traffic. The SDCCH
authentication and user val-
base station, taking care of
between the mobile unit and the
messages betw
switches the speech
aion, while the PSTN connects the dialed party to the MSC, and the MSC
is commanded by the base
h to the serving base station. After a few seconds, the mobile unit TCH
SDCCH to retune to a new ARFCN and new TS for the assignment. Oncee
tian via the
station
the call is
reluned to the TCH, speech data is transferred on both the forward and reverse links,
and the SDCCH is vacated.
Successfully underway,
When calls originated from the PSTN, the process is quite similar. The base station
are
chronization control messages on the forward link. The RACH burst is used by all mobiles to
access service from any base station, and the dummy burst is used as filler information for
unused time slots on the forward link.
illustrates the data structure within a normal burst. It consists of 148 bits
Figure 11.10
wnch are transmitted at a rate of 270.833333 kbps (an unused guard time of 8.25 bits is
I14 information-bearing
POvIded at the end of each burst). Out of the total 148 bits per TS,
are