GSMFDMA/TDMA

Cell structure, reuse factor

Logical channelsBursts

Multiframes

Modern Mobile Networks

Dr. Dóra Maros

GSM

GSM900 :Uplink: 890~915MHz

Downlink: 935~960MHzDuplex distance: 45MHz

Bandwidth: 25MHzChannel bandwidth: 200KHz

124 duplex carriersChannel numbering: 1-124

GSM1800 :Uplink: 1710-1785MHz

Downlink: 1805-1880MHzDuplex distance : 95MHz

Bandwidth: 75MHzChannel Bandwidth: 200KHz

374 duplex carriersChannel numbering: 512-885

EGSM900 :Uplink: 880~890MHz

Downlink: 925~935MHzDuplex distance: 45MHz

Bandwidth: 10MHzChannel bandwidth:

200KHz

GSM1900MHz:Uplink:1850~1910MHz

Downlink:1930~1990MHzDuplex distance: 80MHz

Bandwidth: 60MHzChannel bandwidth:

200KHz

GSM Frequency Bands

GSM

Physical channel:

One carrier, one timeslot - fxTy

0 1 765432

1 TDMA frame = 8 timeslots

time

TS0-TS7DL and UL timing

BTS

GSM Radio Interface

GSM

Omni-directional antenna

360° radiation

Directional antenna(sector antenna)

120°, 60° radiation

GSM Antennas

GSM

R

R R

Omni antennas

On the green line

we can measure

same signal strength

Hexagonal Cell Pattern

GSM

Cells using same carrier frequencies, reuse factor:7

Using the same carriers is not allowed in the

adjacent cells!

We apply omni antennas!

Theory of Frequency Reuse

GSM

A3

C2B1

B3

A2C1

C3

B2A1

A3

C2B1

B3

A2C1

B3

A1C1

A1

A3A2

C3

B2A1

A3A3

C3

C1

B2A1B2A1

A2C1

B3

We apply 120° sector antennas

Reuse factor = 9

3/9 Cluster

GSM

A3

D2B1

C3

B2D1

D3

A2C1

B3

C2A1

B3

C2A1

A3

A1B1

D1

D3D2

C3

B2A1

C3D2

C3

C1

D2B1C2A1

A2C1

D3

Reuse factor = 12

4/12 Cluster

We apply 120° sector antennas

GSM

200 KHz

200 KHz

Overlapping causes adjacent

channel interference

No overlapping between two

frequency bands

f

f

Adjacent Channel Interference

GSM

C/ICarrrier f1/ carrier f1

interference

C/A Carrier f1/ adjacent carrier f2

interference

C/I and C/A

GSM

TCH

CCH

Voice CH

Data CH

FR (Full Rate, 13Kbit/s))

HR (Half Rate, 6.5 Kbit/s)

4.8Kbit/s HR TCH (TCH/H4.8)

9.6Kbit/s FR TCH4.8Kbit/s FR TCH

BCHFCCH (DL): Frequency Correction CH.SCH (DL): Synchronization CH.BCCH (DL): Broadcast Control CH.

CCCHRACH (UL): Random Access CH.AGCH (DL): Access Grant CH. PCH (DL): Paging CH.

DCCHSDCCH: Stand-alone Dedicated CCH.FACCH: Fast Associated CCH.SACCH: Slow Associated CCH.

14.4Kbit/s FR TCH

Traffic Channels

Control Channels

GSM Logical Channels

GSM

Broadcast Channels (BCH): Downlink channels. Responsible for sychronization, frequency correction, the BTS broadcasts general information about cell and network. Point to multipoint connection, all MS in the cell receives the information on BCH.

Broadcast Control Channel (BCCH): BTS sends general information around the cell (eg. Cell identity, Location Area Code, Network Code, maximum MS output power, etc.).

Frequency Correction Channel (FCCH): MS can find the BCCH carrier in the cell by FCCH. The channel sends an unmodulated sine signal (it sends only zeros), so the MS can tune to BCCH carrier frequency. FCCH also helps to find a new BCCH carrier in the new cell after power on.

Synchronization Channel (SCH): BTS sends a synchronization sequence for all MS for time synchronization. Base Station Identity Code (BSIC) and TDMA Frame Number (TFN) is also sent on this channel. TDMA frame number plays an important role in cryptografical algorithm (ciphering) on the radio channel.

Broadcast Channels

GSM

Common Control Channels (CCCH): Common physical cannel, but the messages is addressed only for one MS. Directional (uplink or downlink)

Paging Channel (PCH): Downlink channel. If MS has an incoming call, network sends a paging (searching) message in the cells inside Location Area. IMSI or TMSI is also sent in the paging message.

Access Grant Channel (AGCH): Downlink channel. This channel grants (offers) an SDCCH (numbered 0-7) in the cell for the MS point to point signalling.

Random Access Channel (RACH): Uplink channel. MS uses when it initiates a connection to the network in case of power on, outgoing (MS originated) call, or location update procedure, etc.

Common Control Channels

GSM

Dedicated Control Channels (DCCH): Dedicated means that the channel is unique for one MS (point to point connection). These channels are used for connection establishment procedures, for signalling information in case of handover and other control information (power and timing control). DCCHs are bidirectional.

Stand-alone Dedicated Control Channel (SDCCH): There are 8 SDCCHs in a cell (0-7). Used for connection establishment (authentication, ciphering, IMEI checking, and TCH assignment). When a TCH is assigned for MS, the mobile tunes to another channel.

Slow Associated Control Channel (SACCH): Uplink: MS sends measurement report to BTS.Downlink: power regulation of MS, time alignment (accurate timing) of MS. Associates to TCH and SDCCH-hoz.

Fast Associated Control Channel (FACCH): Used when handover procedure is needed. Downlink: a handover command (new channel and timeslot) is sent on TCH when Stealing Flags (F) bits are not zero.Uplink: handover acknowledge, power regulation, timing. Associates to TCH.

Dedicated Control Channels

GSM

Types of GSM Bursts

Information Information

Information Information

Information

Sychronization bits

Training bits

Training bits

Sychronization bits

Dummy bits Dummy bits

All „0”

GSM

FC, S and A Burst

G

T

Guard perriod: no information transmitted

Tail bits:000

0,577 ms, 156,25 bit

148 bits

86 bits

FCCH

SCH

RACH

InformationInformation

InformationSychronization bits

Sychronization bits

GSM

N and D burst

F Stealing Flag

0,577 ms, 156,25 bit

TCH, BCCH, PCH, AGCH, SDCCH, SACCH, FACCH

IDLE: no user info, predefined bit sequence

Dummy bits Dummy bitsTraining bits

Training bitsInformation Information

GSM

Burst contents

Guard period

Guard Period

GSM

TCH Multiframe

GSM

Repetition time: 51 frame

Multiframe on BCCH Carrier TS0

Downlink

Uplink

RACH

F:FCCHS:SCHC:Common

TDMA frames DL

TDMA frames DL

GSM

Dowlink multiframe structure is the same, but it is shifted in time!

Multiframe on BCCH Carrier TS1

GSM

Frame Structure

GSMRadio propagation

Path lossShadowing

Multipath fading, ISIFrequency hopping

Interleaving

Modern Mobile Networks

Dr. Dóra Maros

GSM

The wavelength is inversly proportional to the frequency of elektromagnetic wave :

λ = c/f, where

λ - wavelength (m)c - velocity of electromagnetic wave (in vacuum and in the air about 3*108 m/s, accurate value: 299792458 m/s)f - frequency (Hz)

Example: 1. f=900 MHz (9*108 Hz) λ =? 3*108 / 9*108 = 3/9 [m] ~ 0,33 [m] 2. f=2,6 GHz (2,6*109)

3*108 / 2,6*109 = 1,154 * 10-1 ~ 0,1154 [m]

Radio propagation I. Frequency and wavelength

GSM

RSL Received

Signal Level (dB)

d (distance from antenna)

Free space attenuation:

a0 = 20 log (4Πd/λ)

a0 = 20 log (df) + 28,14

Radio propagation II. Path loss

GSM

Makrocell propagation models:Relative small traffic (rural, road), high speed of movement (>100 km/h)

Hata, COST231

Mikrocell propagation models:High traffic (urban, suburban), smaller speed of movement (30-80 km/h)Walfish-Ikegami modell, COST 231

Indoor propagation models:Mootley-Keenan (félempirikus)Ray-tracing

Radio Propagation III. Propagation Models

GSM

RSL (dB)

Mean value

Slow fading caused by shadowing

Radio Propagation IV. Shadowing

d (distance from antenna)

Base Station

Mobile Equipment

GSM

Fast fading caused by reflections

Radio Propagation V. Multipath Fading

Base Station Mobile Equipment

GSM

Consecutive bursts are transmitted on different carriers

Number of hopping: 217/s

4 frequencies Different wavelengths

Fading dips shift!

Radio Propagation VI. Frequency Hopping

GSM

If delay of received bit is > 1 bit duration, it may cause Inter Symbol Interference (ISI) in the receiver. Two consecutive bits interfere each other.

1 or 0?

Bit error in the

receiver!

Radio Propagation VII. Inter Symbol Interference (ISI)

Base Station Mobile Equipment

GSM

Burst contents on radio channel

(received)

Modified training sequence (noisy

channel)

Training sequence pattern in the

receiver

Correlator

Modified channel model

Viterbi Decode

r

Reconstructed bitsRadio

channel

Radio Propagation VIII. VITERBI Demodulator and Decoder

GSM

• Original sequence is segmented into blocks• Consecutive blocks are sent in different

bursts (different timeslots and frames )

Original sequence

Interleaved sequence

Packet loss

Reconstructed sequence

Radio Propagation IX. Interleaving

GSM

57 bits

Segmentation456 bits (20 ms

speech) are divided

into 8 blocks (57 bits each)

I. Level interleaving

Radio Propagation X. Interleaving on GSM Speech Channel (example)

II. Level interleaving

GSMSecurity functions

AuthenticatonCiphering

Location updateCell selection

Handover

Modern Mobile Networks

Dr. Dóra Maros

GSM

The network elements which take part in security functions :  Mobile Station (MS) Base Station (BTS) Mobile Switching Center (MSC or MSS) Autentication Center (AUC) Home Location Register (HLR) Visitor Location Register(VLR). 

GSM Security Functions I.

GSM

SIM card unlock: PIN = Personal Identity Number (4 digits)

PIN unlock key: PUK code

Authentication: A procedure of verification of IMSI validity on SIM card.

Ciphering: This is an encyption procedure in BTS and MS for protection of user information (speech or data) on radio interface.

IMEI checking: This procedure checks the ME IMEI number. • If IMEI is on the black list of EIR, the connection

establishment is denied! • If IMEI is on the white list, MS can connect to the

network. • When IMEI is on the grey list , mobile has some

restrictions in communication, but attach is allowed.

GSM Security Functions II.

GSM

Random number

generator

IMSI1 – Ki1

IMSI2 - Ki2

IMSI3 – Ki3

RAND

Ki

AUC

A8 algorith

m

A3 algorith

m

SRES

Kc

RAND

Ki

RAND

Signed Response

Ciphering Key

Random Number

AUC and TRIPLETs

Kc: Ciphering Key Ki: Subscriber Identity Key

GSM

A3

Ki RAND

SRES

MS

A3

RAND

SRESegyezik?

network

SIM

Authentication procedure

SRESSIM = SRESAUC

?

GSM

A8

Ki RAND

Kc

MS

RAND

Kc

network

A8

SIM

Kc Generation

Kc: Ciphering Key Ki: Subscriber Identity Key

GSM

frame number22 bits

MS BTS

A5

Kc64 bits

S1114 bits

S2114 bits

ciphering

deciphering

frame number22 bits

A5

Kc64 bits

S1114 bits

S2114 bits

deciphering

ciphering

In Mobile Equipment (ME)

Ciphering Procedure

GSM

BCCH carrier

1

BCCH carrier 3

BCCH carrier 2

Serving BTS

RSL carrier1 > RSL carrier2 > RSL carrier 3

Cell Selection (IDLE mode)

Mobile tunes to the strongest BCCH carrier in

its IDLE mode

GSM

Power On: IMSI attached (1)

Power Off: IMSI detached (0)

VLR

IMSI record

1

0

SDCCH

IMSI Attach/Detach, az IMSI flag

IMSI flag

GSM

Location Area 1 (LAC1)

Location Area 2 (LAC2)

Location Area 3 (LAC3)

MSC/MSS

Location Area and LAC

GSM

Paging message is sent in all cells inside LA!

Location Area in Paging Procedure

Serving cell, where the connection is established

GSM

Location Area 1 (LAC1)

Location Area 2 (LAC2)

VLRLAC1 LAC2

IMSI record

On BCCH LAC (Location Area Code) is transmitted

Location Update procedure updates LAC in VLR IMSI record!

Location Update Procedure

GSM

LA2

LA1

BSC1

VLR

MSC

BSC2

(1) new LAI

(2) Channel Req. IMSI (RACH)

(3) Channel required

IMSI: LA1 LA2

(6)

(7)Loc. Upd. Accept.

(7) Loc. Upd. Accept. (SDCCH)

(4) Immediate Assign. (AGCH)

(5) Loc. Upd, Req. (SDCCH)

Location Update Procedure inside MSC/MSS Service Area

GSM

(8) Loc. Upd. Ack

(SDCCH)

(4) Suscribe

r Informat

ion Request

VLR

MSC2

IMSI: VLR1 VLR2

BSC2

VLR

MSC1

(5)

LA2

LA1

BSC1

(1) new LAI

(2) Loc. Upd. Req. (SDCCH)

(2) Loc. Upd. Request

(6) Loc. Upd. Acknowledge

HLR

IMSI MGT(3)

(6) Subscriber Information

(7) Location Cancellation

Location Update Procedure Between MSC/MSS Service Areas

GSM

Rescue handover:• System rescues the connection if the

received signal is too weak or noisy (caused by path loss or shadowing)

• BSC sends a handover command to the MS and BTS if measurement report evaluation results indicate weak connection quality

Traffic handover:Handover because of high traffic in the serving cell. (eg. traffic is increasing suddenly in the cell, and probability of congestion is very high)

Confinement handover:S/N optimization, TRX power minimalization

Types of Handover (Handoff)

GSM

TCH multiframe

24. 25. IDLE Downlink 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3

Uplink 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 024. 25. IDLE

At the end of TCH multiframe we have 12 timeslots duration for checking BSIC on the adjacent cell’s

SCH!

Measurements on the Adjacents Cells

GSM

TCH BCCH carrier2

BCCH carrier1

Serving BTS

On TCH (serving cell):

RXLEV

RXQUAL

DISTANCE

On BCCH carrier (adjacent cells)

RXLEV

Measurement report

on

SACCH

MR from MS nad BTS

BSC

Adjacent cells

Measurement Report

On TCH:

RXLEV

RXQUAL

DISTANCE

GSM

a bc

Jelerősség (SS)

Jelerősség (SS)

BTSA

BTSB

SS MIN.

(A) SS MIN.

(B)

HO. MARGIN (B)

Handover Margin

GSM

Forrás: Alien Coders: Basics of GSM in depth

Handover CasesI. Intracell Handover

GSM

Handover Cases II. Intercell handover

Source: Alien Coders: Basics of GSM in depth

GSM

Handover Cases II. Inter BSC Handover

Source: Alien Coders: Basics of GSM in depth

GSM

Handover Cases III. Inter MSC handover

Source: Alien Coders: Basics of GSM in depth