Upload
racharya
View
232
Download
0
Embed Size (px)
Citation preview
8/8/2019 GSM System - Part I
1/55
GSM
SYSTEM
Texas Instruments France
Part I
8/8/2019 GSM System - Part I
2/55
Introduction System structure Air I/F (Um) time and frequency structure GSM channels MS strategies
- cell selection
- idle mode
- connection establishment
- dedicated mode
MS system partitioning- control unit
- processing unit
Agenda
8/8/2019 GSM System - Part I
3/55
Introduction
8/8/2019 GSM System - Part I
4/55
GSM overview GSM services (Global System for Mobile communication)
Voice call and related supplementary services (call hold, calling line identity) Fax/data services
SMS / SMS-CB
Wireless capability Radio frequency (GMSK modulation)
Channel quality management (measurements, interferences)
Protection / Error correction (channel encoding)
Authentication - Ciphering
Mobility Cellular network structure
Handover
Location update
Roaming
Multiplexing TDMA FDMA
8/8/2019 GSM System - Part I
5/55
8/8/2019 GSM System - Part I
6/55
Network structure
BS: base station (BTS)BC: base station control center
PSTN: public switched telephone network
ISDN: integrated services device network
PSTN/ISDN
8/8/2019 GSM System - Part I
7/55
MSC: Mobile Switching Center
BSC: Base Station Controller
BTS: Base Transceiver Station
HLR: Home Location Register
AVC: Authentication Center
NMC: Network Management Center
ADC: Administration Center
OMC: Operation and Maintenance Center
EIR: Equipment Identity Register
System structure
8/8/2019 GSM System - Part I
8/55
System structure (cont.) MS (Mobile Station)
MT (Mobile Termination)
TE (Terminal Equipment)
BSS (Base Station Subsystem):
radio resource management
BTS: manage reception/transmission on the
physical layer
Modulation/demodulation
Equalization (Extract desired signal from
unwanted reflections)
Encoding/decoding
Error correction
TDMA/FDMA multiplexing
Encryption
Measurement of the physical path
BSC: manage radio resource
Channel allocation
Power control (according to BTS
measurements)
Handover management
8/8/2019 GSM System - Part I
9/55
System structure (cont.) NSS (Network Sub System):
call establishment / mobility MSC
Communication establishment
SMS transmission Handover
Gateway can be used for routing to fixedphone network (GMSC)
Gateway for SMS (SM-GMSC)
VLR (Visitor Location Register) Memorize subscribers data in a specific
geographic area
Same data as HLR but restricted to thegeographic area
Temporary identity (TMSI)
HLR (Home Location Register) PLMNsubscribers database
IMSI (international subscriber identity)
MSISDN (subscriber phone number)
Profile (services)
Localization (VLR number where thesubscriber is recorded)
8/8/2019 GSM System - Part I
10/55
8/8/2019 GSM System - Part I
11/55
Air interface
8/8/2019 GSM System - Part I
12/55
Frequency structure
8/8/2019 GSM System - Part I
13/55
Frequency structure
8/8/2019 GSM System - Part I
14/55
GSM bandsGSM 450 Band (35 carriers):
- 450,4 MHz to 457,6 MHz: mobile transmit, base receive;
- 460,4 MHz to 467,6 MHz base transmit, mobile receive.
GSM 480 Band (35 carriers):
- 478,8 MHz to 486 MHz: mobile transmit, base receive;
- 488,8 MHz to 496 MHz base transmit, mobile receive.
GSM 850 Band (124 carriers):
- 824 MHz to 849 MHz: mobile transmit, base receive;
- 869 MHz to 894 MHz: base transmit, mobile receive.
Standard or primary GSM 900 Band, P-GSM (124 carriers):
- 890 MHz to 915 MHz: mobile transmit, base receive;
- 935 MHz to 960 MHz: base transmit, mobile receive.Extended GSM 900 Band, E-GSM (includes Standard GSM 900 band), (174 carriers):
- 880 MHz to 915 MHz: mobile transmit, base receive;
- 925 MHz to 960 MHz: base transmit, mobile receive.
Railways GSM 900 Band, R-GSM (includes Standard and Extended GSM 900 Band), (194 carriers):
- 876 MHz to 915 MHz: mobile transmit, base receive;
- 921 MHz to 960 MHz: base transmit, mobile receive.
DCS 1 800 Band (374 carriers):
- 1 710 MHz to 1 785 MHz: mobile transmit, base receive;- 1 805 MHz to 1 880 MHz: base transmit, mobile receive.
PCS 1 900 Band (299 carriers):
- 1 850 MHz to 1 910 MHz: mobile transmit, base receive;
- 1 930 MHz to 1 990 MHz base transmit, mobile receive.
GSM 05.05
8/8/2019 GSM System - Part I
15/55
0 1 2 3 4 5 6 2 0 4 2 2 0 4 3 2 0 4 4 2 0 4 5 2 0 4 6 2 0 4 7
0 1 2 3
0 1
1 ( 2 6 - f ra m e ) m u l t if r a m e = 2 6 T D M A f r a m e s ( 1 2 0 m s )
( = 5 1 ( 2 6 - f r a m e ) m u l t i f r a m e s o r 2 6 ( 5 1 - f r a m e ) m u l t i f r a m e s )
4 7 4 8 4 9 5 0
2 4 2 5
1 ( 5 1 - fr a m e ) m u l t i f ra m e = 5 1 T D M A f r a m e s ( 3 0 6 0 / 1 3 m s )
0 1 2 3 4 6 4 7 4 8 4 9 5 00 1 2 3 4 2 2 2 3 2 4 2 5
0 1 2 3 4 5 6 7
1 T D M A f r a m e = 8 t i m e s l o t s ( 1 2 0 / 2 6 o r 4 , 6 1 5 m s )
1 t i m e s l o t = 1 5 6 , 2 5 b i t d u r a t i o n s ( 1 5 / 2 6 o r 0 , 5 7 7 m s )
( 1 b i t d u r a t i o n = 4 8 / 1 3 o r 3 , 6 9 s )
T B E n c r y p t e d b i t s T r a i n i n g s e q u e n c e E n c r y p t e d b i t s T B G P8 , 2 535 82 65 83
F i x e d b i t s T B G P
8 . 2 53
T B E n c r y p t e d b i t s E n c r y p t e d b i t s T B G P
8 , 2 53 96 43
T B E n c r y p t e d b i t s T B G P6 8 , 2 533 64 18
33 9
1 4 2
N o r m a l b u r s t ( N B )
F r e q u e n c y c o r r e c t io n b u r s t ( F B )
A c c e s s b u r s t ( A B )
( T B : T a i l b i t s - G P : G u a r d p e r io d )
1 s u p e r f r a m e = 1 3 2 6 T D M A f r a m e s ( 6 , 1 2 s )
S y n c h r o n i z a t io n s e q u e n c e
S y n c h r o n i z a t io n s e q u e n c e
S y n c h r o n i z a t io n b u r s t ( S B )
1 h y p e r f r a m e = 2 0 4 8 s u p e r f r a m e s = 2 7 1 5 6 4 8 T D M A f r a m e s ( 3 h 2 8 m n 5 3 s 7 6 0 m s )
3
T B
Time structure
8/8/2019 GSM System - Part I
16/55
Time structure
TDMA frame Time base of GSM system
Duration = 4.615 ms
FN (Frame Number) used as a counter for schedulingof transmission on the physical channel
FN = [0MAX_FN] 0MAX_FN is an hyperframe (3h 28 mn 53 s)
1 Hyperframe = 2048 Superframes Super-frame
1 superframe = 26 x multiframe 51 (MF51) 1 superframe = 51 x multiframe 26 (MF26)
Multi-frame
Used as basis for multiplexing logical channels
MF51 used for beacon / signaling purpose
MF26 used for traffic purpose (voice / data)
1 TDMA frame = 8 timeslots (multiplexing of different
channels) One channel can only use one slot per TDMA
Timeslot = 577 us
Element transmitted during one timeslot = burst
8/8/2019 GSM System - Part I
17/55
Time structure
FB (Frequency Burst): Emitted by the network to allow mobiles synchronize on frequency Fixed value (0) bearer transmission
SB (Synchronization Burst): Emitted by the network to allow mobiles synchronize on time Big fixed sequence permitting timing synchronization
Includes system date (FN) and BSIC (Base Station Identity Code)
AB (Access Burst): Transmitted by the mobile to request resources to the network Transmission time inferior to slot duration (due to propagation time)
Small content (only 8 bits are encoded)
NB (Normal Burst): Used for general transmission purpose (control messages speech data)
Training sequence used for time adjustment during the communication Control messages sent in one block always using 4 x NB
8/8/2019 GSM System - Part I
18/55
8/8/2019 GSM System - Part I
19/55
Transmission on the physical channel
f
f10 1 2
8/8/2019 GSM System - Part I
20/55
GSM channels
8/8/2019 GSM System - Part I
21/55
GSM Logical channels
FCCH: Frequency burst (fixed values) used for frequency correction
SCH: Synchro burst used for time synchronization (frame number and fine tuning)
network and BTS identification (BSIC code)
BCCH broadcast following kind of information (NB)
Cell selection mode
Area identifier (location update)
Random access rules
Control channel organization
CBCH organization
Neighbor cells description
CCCH channels
PCH: MS calling using the TMSI (call, SMS, authentication) (NB)
AGCH: Radio resource allocation (NB)
RACH: Request from the MS (AB)
CBCH: Information broadcast
8/8/2019 GSM System - Part I
22/55
GSM Logical channels: dedicated channels
TCH: traffic channel (voice/data) (NB)
SDCCH: low rate channel dedicated to signaling (NB)
SACCH (Slow Associated Control Channel) (NB)
Timing advance update mechanism
Transmit power control
Radio link quality control
Measurement reporting (for handover)
FACCH (Fast Associated Control Channel) (NB)
Handover execution
8/8/2019 GSM System - Part I
23/55
F i g u r e 8 b : T D M A f r a m e m a p p i n g f o r F C C H + S C H + B C C H + C C C H + S D C C H / 4 ( 0 . . . 3 ) + S A C C H / 4 (0 . . . 3 )
ID
LE
C
C
C
H
B
C
C
H
S
C
H
B
C
C
H
B
C
C
H
B
C
C
H
C
C
C
H
C
C
C
H
C
C
C
H
F
C
C
CH
S
C
H
C
C
C
H
C
C
C
H
C
C
C
H
C
C
C
H
C
C
C
H
C
C
C
H
C
C
C
H
C
C
C
H
F
C
C
CH
S
C
H
S
D
C
C
H
/4
(0
)
S
D
C
C
H
4
/(1
)
S
D
C
C
H
$
/(2
)
S
D
C
C
H
4
/(3
)
S
A
C
C
H
/C
4(3)
ID
L
E
C
C
C
H
B
C
C
H
SC
H
B
C
C
H
B
C
C
H
B
C
C
H
C
C
C
H
C
C
C
H
C
C
C
H
F
C
C
C
H
SC
H
C
C
C
H
C
C
C
H
C
C
C
H
C
C
C
H
C
C
C
H
C
C
C
H
C
C
C
H
C
C
C
H
F
C
C
C
H
SC
H
S
D
C
C
H
/4
(0
)
S
D
C
C
H
/4
(0
)
S
D
C
C
H
/4
(0
)
S
D
C
C
H
4
/(1
)
S
D
C
C
H
4
/(1
)
S
D
C
C
H
4
/(1
)
F
C
C
C
H
S
C
H
S
D
C
C
H
$
/(2
)
S
D
C
C
H
$
/(2
)
S
D
C
C
H
$
/(2
)
S
D
C
C
H
4
/(3
)
S
D
C
C
H
4
/(3
)
S
D
C
C
H
4
/(3
)
F
C
C
CH
S
C
H
ID
L
E
C
C
C
H
B
C
C
H
S
C
H
B
C
C
H
B
C
C
H
B
C
C
H
C
C
C
H
C
C
C
H
C
C
C
H
F
C
C
C
H
S
C
H
C
C
C
H
C
C
C
H
C
C
C
H
C
C
C
H
C
C
C
H
C
C
C
H
C
C
C
H
C
C
C
H
F
C
C
C
H
S
C
H
S
D
C
C
H
/4(0
)
S
D
C
C
H
4/(1
)
S
D
C
C
H
$/(2
)
S
D
C
C
H
4/(3
)
S
D
C
C
H
/4(0
)
S
D
C
C
H
/4(0
)
S
D
C
C
H
/4(0
)
S
D
C
C
H
4/(1
)
S
D
C
C
H
4/(1
)
S
D
C
C
H
4/(1
)
F
C
C
C
H
S
C
H
S
D
C
C
H
$/(2
)
S
D
C
C
H
$/(2
)
S
D
C
C
H
$/(2
)
S
D
C
C
H
4/(3
)
S
D
C
C
H
4/(3
)
S
D
C
C
H
4/(3
)
F
C
C
C
H
S
C
H
S
A
C
C
H
/C
4(2)
S
A
C
C
H
/C
4(1)
S
A
C
C
H
/C
4(0)
S
A
C
C
H
/C
4(2)
S
A
C
C
H
/C
4(2)
S
A
C
C
H
/C4
(2
)
S
A
C
C
H
/C
4(3)
S
A
C
C
H
/C
4(3)
S
A
C
C
H
/C
4(3)
S
A
C
C
H
/C
4(0)
S
A
C
C
H
/C
4(0)
S
A
C
C
H
/C
4(0)
S
A
C
C
H
/C
4(1)
S
A
C
C
H
/C
4(1)
S
A
C
C
H
/C
4(1)
C
C
C
H
C
C
C
H
C
C
C
H
C
C
C
H
C
C
C
H
C
C
C
H
C
C
C
H
C
C
C
H
F
C
C
C
H
SC
H
C
C
C
H
C
C
C
H
C
C
C
H
C
C
C
H
C
C
C
H
C
C
C
H
C
C
C
H
C
C
C
H
F
C
C
C
H
SC
H
C
C
C
H
C
C
C
H
C
C
C
H
C
C
C
H
C
C
C
H
C
C
C
H
C
C
C
H
C
C
C
H
F i g u r e 8 a : T D M A f r a m e m a p p i n g f o r F C C H + S C H + B C C H + C C C H
GSM 05.02Beacon frequency
FCH Frequency Channel (downlink)SCH Synchronization Channel (downlink)BCCH Broadcast Control Channel (downlink)CCCH Common Control Channel
PCH Paging Channel (downlink)AGCH Access Grant Channel (downlink)RACH Random Access Channel (uplink)
SDCCH/4: Stand-alone Dedicated Control Channel (up&downlink)
8/8/2019 GSM System - Part I
24/55
Other frequencies (traffic)
SDCCH/8 Stand-alone Dedicated Control Channel (up&downlink)
TCH/F Traffic Channel Full Rate (up&downlink)
TCH/H Traffic Channel Half Rate (up&downlink)
SACCHSlow Associated Control Channel (up&downlink)
FACCHFast Associated Control Channel (up&downlink)
CBCH Cell Broadcast Control Channel (downlink)
8/8/2019 GSM System - Part I
25/55
MS Strategies
8/8/2019 GSM System - Part I
26/55
Cell selection
Monitor the entire GSM band
Select the strongest carrier (up to 30)
Detect the Frequency Burst from this carrier (FCH)
Apply Frequency Correction
Detect the Synchronization Burst from this carrier (SCH)
Apply Time-base Correction
Read the system information (BCCH) If the Cell is suitable, MS camps on the cell (Serving Cell)
and start Idle mode
Purpose: Select the best suitable cell as the Serving Cell
8/8/2019 GSM System - Part I
27/55
Monitor the Paging Sub-Channel (PCH)
Monitor the Serving Cell System Information (BCCH)
Monitor the Cell Broadcast messages (CBCH) (optional)
Monitor the Serving Cell beacon receive power level
Purpose: maintain a good link with the Serving Cell in order
to get normal services from the BTS (call) when requested
Activity from Serving Cell
Idle mode
8/8/2019 GSM System - Part I
28/55
8/8/2019 GSM System - Part I
29/55
Idle mode
Monitor the receive power level of a list of neighbor cells (BA list)
Select the 6 strongest carriers Detect the Frequency Burst from those carriers (FCH)
(Re-)Detect the Synchronization Burst from those carriers (SCH)
Read the system information from those carriers (BCCH)
Activity from neighbor cells
8/8/2019 GSM System - Part I
30/55
Idle mode
Service quality maintenance
Monitor the link degradation (count the bad data blocks read from PCH)
Maintain a list of 6 suitable neighbor cells Apply a degradation criteria to decide to abandon the current Serving
Cell and select one of the 6 suitable neighbors as the new Serving Cell
8/8/2019 GSM System - Part I
31/55
Idle mode
Location Update
Purpose: Establishment of a full duplex communication (over SDCCH) to
notify the network that the MS is moving within a new Location Area.
This procedure is done prior to camping on a cell in normal services.
MS calls the network (Mobile Originated)
A signaling channel is established (SDCCH)
MS registration is performed
MS is told whether the Cell can grant normal service
8/8/2019 GSM System - Part I
32/55
Location update
RACH
AGCH
SDCCH
8/8/2019 GSM System - Part I
33/55
MS BSS VLR HLR AUC
Send Parameters
Send Parameters Result(RAND, SRES, Kc)
MSC
Authenticate
Authentication Request
Authentication Response
Authentication Complete
Service Accept (conditional)
Service Reject (if not accepted)
Authentication Complete
Authentication
8/8/2019 GSM System - Part I
34/55
HLR
Home
Location
Register
MSC/VLR Mobile
SIM
cardA3
A8
Store
Kc
BSS
KiRAND (128 bits) RAND
(128 bits)
SRES=
SRESc?
Acces
Granted
Yes
NO Deny Access
SEND
to BTSTransfer CipherKey to BTSKcCipher Key
64 bits
Then, A5 algorithm used to cipher data using Kc key
Authentication process
8/8/2019 GSM System - Part I
35/55
Connection establishment
Mobile Originated Call
Purpose: the MS user dial a phone number to call a distant (establish a
speech communication for instance). As a pre-requisite, the MS must be in
Idle mode in normal services.
Send Channel Request messages to the BTS (RACH)
Keep reading CCCH/BCCH channels looking for Access Grant
BTS responds with an Immediate Assignment message (AGCH).
The description of the allocated full duplex channel is provided
MS stops Connection Establishment mode and enter Dedicated
Mode
MS Leave Idle mode and enter Connection Establishment mode:
8/8/2019 GSM System - Part I
36/55
Connection Establishment
RACH
AGCH
SDCCH / TCH
TCH
Mobile Originated Call
8/8/2019 GSM System - Part I
37/55
MS BSS MSC/VLR HLR/EIR/AUC PSTN/ISDN
Dial Number
Press SEND
Channel Request
Immediate
Assignment
Service Request
TMSI, Call Setup Service Request
TMSI, Call Setup
RACH
AGCH
SDCCH
Authentication, Ciphering and TMSI assignment
Setup
(call information) Send Call Setup
Information
Check IMEI (optional)
Call CompleteCall Proceeding
Assignment Command (TCH)
Assignment Complete Initial Address Message (IAM)Called party phone rings
Address Complete Message (ACM)Alerting
Answer Message Called party takes
phone off hookConnect (TCH/FACCH)
Connect Acknowledge
Conversation starts
8/8/2019 GSM System - Part I
38/55
Mobile Terminated Call
Purpose: the network calls the MS (to establish a speech communication for
instance). As a pre-requisite, the MS must be in Idle mode in normal services.
MS leaves Idle mode and enters Connection Establishment mode:
Send Channel Request messages to the BTS (RACH)
Keep reading CCCH/BCCH channels looking for Access Grant
BTS responds with an Immediate Assignment message (AGCH). Thedescription of the allocated full duplex channel is provided
MS stops Connection Establishment mode and enter Dedicated Mode
MS receives a Paging Request message (PCH)
Connection establishment
8/8/2019 GSM System - Part I
39/55
Connection Establishment
RACH
AGCH
SDCCH / TCH
TCH
Mobile Terminated Call
8/8/2019 GSM System - Part I
40/55
Two types of dedicated channels:
SDCCH (with associated SACCH / FACCH)
TCH/F or TCH/H (with associated SACCH / FACCH)
Data bits Data bitsTraining Sequence
Tail Tail
GuardPeriod
Stealing Flags
57 bits 57 bits26 bits3 31 1 8,25
Dedicated mode
8/8/2019 GSM System - Part I
41/55
Dedicated mode
Stand Alone Control Channel(SDCCH)
Signaling outside a call: in some cases, there is a need to
establish a connection between an MS and the Network solely for
signaling matters (location updating or short message service for
instance).
Signaling in connection with a call: SDCCH is used to manage the
call establishment (Immediate Assignment).
8/8/2019 GSM System - Part I
42/55
8/8/2019 GSM System - Part I
43/55
Dedicated mode
Used for carrying the main binary data flow.
Traffic Channel TCH (/F or /H)
Full Rate Speech
Enhanced Full Rate Speech
Full Rate Data 14400
Full Rate Data 9600
Full Rate Data 4800
Full Rate Data 2400
Half Rate speech AMR (Adaptive Multi Rate)
8/8/2019 GSM System - Part I
44/55
Dedicated mode
Traffic Channel TCH (/F or /H)
T T T T T T T T T T T T A T T T T T T T T T T T T -
T t T t T t T t T t T t A T t T t T t T t T t T a
( a )
( b )
2 6 f r a m e s = 1 2 0 m s
( a ) c a s e o f o n e f u l l r a t e T C H
T , t : T D M A f r a m e f o r T C H A , a : T D M A f r a m e f o r S A C C H / T- : i d l e T D M A f r a m e
( b ) c a s e o f t w o h a l f r a t e T C H s
t
8/8/2019 GSM System - Part I
45/55
Dedicated mode
Associated Control Channels
Slow Associated control Channel (SACCH): (2 per second)
Used in uplink to report the neighbor cell measurement data needed for the
decision concerning handover
Used in downlink to carry the system information containing the list of
neighbor cells to be monitored Used in downlink to carry physical layer information:
txpwr, timing advance
Fast Associated control Channel (FACCH): (every 20ms if needed)
Used in uplink or downlink to manage call establishment progress,
subscriber authentication or handover for instance.
No real channel dedicated to FACCH. It is carried by TCH channel (user
data are stolen from TCH and used for signaling).
8/8/2019 GSM System - Part I
46/55
Timing advance algorithm
8/8/2019 GSM System - Part I
47/55
Dedicated mode
Service quality maintenance
MS continuously monitors the downlink link degradation
(percentage of bad information bit received by the MS).
BTS continuously monitors the uplink link degradation(percentage of bad information bit received by the BTS).
MS maintains a list of 6 suitable neighbor cells
MS reports to the BTS the downlink quality and the 6 suitable
neighbor base-station identities.
BTS decides whether the channel quality is acceptable. If not,
BTS arranges a Handover to another channel or another BTS.
8/8/2019 GSM System - Part I
48/55
Dedicated mode
Monitor the receive power level of a list of neighbor cells (BA list)
Select the 6 strongest carriers
Detect the Frequency Burst from those carriers (FCH)
(Re-)Detect the Synchronization Burst from those carriers (SCH)
Dedicated Mode
Activity from neighbor cells
8/8/2019 GSM System - Part I
49/55
MS System partitioning
8/8/2019 GSM System - Part I
50/55
P t l l
8/8/2019 GSM System - Part I
51/55
MMI
CM
MM
RR
DL
PL
L3
L2
L1
Protocol layers
C t l it
8/8/2019 GSM System - Part I
52/55
Control unit MMI (Man-Machine Interface)
Keyboard management
Display management SIM card management
Layer 3 CM (Call Management)
CC (Call Control)
SMS (Short Message Services)
SS (Supplementary Services) MM (Mobility Management)
Authentication
Location update
IMSI attach / detach
RR (Radio Resource Management) Cell selection / re-selection
Physical channel establishment / release
Ciphering Handover
C t l it
8/8/2019 GSM System - Part I
53/55
Control unit
Layer 2 (Data Link Layer) Used for every signaling channels (Except FB/SB/RACH) Frame segmentation and numbering Error detection Acknowledge / Re-transmission Data flow multiplexing (signaling, data)
Physical Layer Task scheduling Burst reception and transmission control
Servo Control management Receiver Adaptive Gain Control (AGC) Time Tracking Timing Advance Adaptive Frequency Control (AFC) Transmit Power Control
8/8/2019 GSM System - Part I
54/55
8/8/2019 GSM System - Part I
55/55