gsm interface report

8/3/2019 Gsm Interface Report

1/42

1

Overview of the GSM Radio Interface

zgr Ertu

Middle East Technical UniversityElectrical and Electronical Engineering Department

The radio interface in GSM provides the means by which a mobile stationcommunicates with the base station of the network. Figure 1. provides asimplified block diagram of the GSM radio link. We will begin byexamining the modulation scheme and the carrier frequencies used in GSM.Then, we will discuss the construction of TDMA bursts or packets and theway in which these may be demodulated in the presence of intersymbol

interference (ISI) caused by the radio channel and the modulation processitself.

Following these we will discuss the different channels that are available inGSM and the mapping of the radio resources to each of these channels. Thenwe will turn our attention to the coding, interleaving and ciphering processesthat occur on the GSM radio interface specifically for the speechinformation, user data and signalling information separately since they aresignificantly different.

SpeechEncoder

ChannelEncoder

Interleaver CipheringBurst

Assembler

RF RxEqualize/DemodDechipheringDeinterleavingChannelDecoder

RecoveredUser Data

SpeechDecoder

RecoveredSpeech

Channel

RF Tx

GMSKModulator

Figure 1.: Block diagram of a GSM transmitter and receiver


2/42

2

I. GSMModulationSchemeThe modulation scheme used in GSM is Gaussian minimum-shift keying

(GMSK) with a normalized time bandwidth product BT of 0.3 and themodulation symbol rate is 270.8 kb/s. In GMSK, a logical 1 cause the carrier

phase to increase by 90o over a bit period and a logical 0 cause the carrierphase to decrease by 90o. This phase change is produced by instantaneouslyswitching the carrier frequency between two different values f1 and f2:

(2)4/

(1)4/

2

1

bc

bc

Rff

Rff

!

!

where Rb is the modulation rate (270.8 kb/s) and fc is the nominal carrierfrequency.

In theory, since there exists abrupt changes in the carrier frequency, themodulated spectrum is infinitely wide. However, smoother changes can beobtained if the modulated signal is passed through a bandlimited linear filter.The type of the filter used has a Gaussian impulse response and the resultingmodulation scheme is called Gaussian MSK or GMSK. On the other hand,the Gaussian filter also introduces ISI whereby each modulation symbol

spreads into adjacent symbols.

The ith data bit di is differentially encoded by performing modulo-2addition of the current and previous bits that takes values 0 and 1:

(3)1

^

!

iiiddd

The modulating data at the input of the GMSK demodulator that takes onvalues +1 and -1 is given by:

(4)1,0,21^^

!! iii ddE

The modulating data iE are then passed through a linear filter with a

Gaussian-shaped impulse response given by:


3/42

3

(5)2

exp2

1)(

22

2

!

T

t

Tth

WWT

where:

(6)2

)2ln(

BTTW !

with T=1/270.8 milisecs being the bit period and B is the 3 dB filter bandwidth. The BT product is the relative bandwidth of the basebandGaussian filter and in GSM it is set to 0.3. This effectively means that each

bit is spread over three modulation symbols that has to be removed at thereceiver using an equalizer.

The pulse response of this filter when a pulse of width T is applied to the

input is given by:

(7))/()()( Ttrectthtg ! where rect (t/T)=1/T for T/2


4/42

4

II. GSM Radio CarriersGSM uses a combined TDMA/FDMA multiple-access scheme. The

available spectrum is partitioned into a number of bands, each 200 KHz

wide. Each of these bands may be occupied by a GMSK modulated RFcarrier supporting a number of TDMA time slots. The RF carriers are

paired to allow a simultaneous data flow in both directions; i.e. full-duplex. The GSM900 frequency bands are 890 MHz to 915 MHz for theuplink and 935 MHz to 960 MHz for the downlink.

There is a guard band of 200 KHz at the lower end of both uplink anddownlink and these freqeuncy bands are not used. Each RF carrierfrequency is assigned an absolute radio frequency channel number

(ARFCN). The upper and lower frequency bands for a specific ARFCNis related by:

(11)45)()(

(10)2.0890)(

!

!

nFnF

nnF

lu

l

where the frequencies are both in MHz and 1241 ee n . In addition tofrequency separation between the duplex carriers that is 45 MHz forGSM900, the downlink and uplink bursts of a duplex link are separated

by 3 time-slots and downlink is 3 time-slots in advance of uplink.

III. GSM Power ClassesThe specifications define five classes of MS for GSM900 based on

their output power capabilities as given in Table 1. The classicalhandheld is the Class 4 and a classical vehicular unit is Class 2. Each MShas the ability to reduce its output power from its maximum power insteps of 2 dB to a minimum of 3.2 mW in response to commands fromBTS. This facility is used to implement uplink power control whereby an

MSs transmitted power is adjusted to ensure that it is sufficient to provide a staisfactory up-link quality. This process is used to conserveMS battery power and also reduce uplink interference. Furthermore, theBTS output power may also be adjusted by upto 15 steps to allow powercontrol on the downlink.


5/42

5

PowerClass

MaximumPower(Watts)

1 202 83 54 25 0.8

IV. GSM BurstsEach GSM RF carrier supports 8 time slots per frame and the data are

transmitted in the form of bursts that are designed to fit within these slots.Each TDMA frame is 4.615 ms in length and each TDMA slot is 577microseconds in length. The GSM specifications define 5 different typesof bursts (Figure 2.).

Table 1. MS power classes in GSM900

1 TDMA Frame=8 Time Slots

1 Time Slot=156.25 bits

Access Burst

Synchronization Burst

Frequency Correction Burst

Normal Burst

Tail Bits

Tail Bits

Tail Bits

Tail BitsGuard Period

Tail Bits

Tail Bits

Tail Bits

Information InformationTraining

Fixed Bits

Information InformationTraining

Training InformationTail Bits

3 58 26 58 3 8.25

3

3

3

3

3

8.25

8.25

68.25

142

39 3964

8 41 36

Guard Period

Guard Period

Guard Period

Figure 2.: The GSM Bursts


6/42

6

In normal burst (NB), the training sequence is used to sound the radiochannel and produce an estimate of the impulse response at the receiverfor equalization. The training sequences used in each time slot aretabulated in Table 2. The tail bits in normal burst are also always set to 0to ensure that the Viterbi decoder begins and ends in a known state.Furthemore, the last bit of the first 58 information bits and the first bit ofthe last 58 information bits are the stealing bits.

The frequency correction burst (FB) is used by the MS to detect aspecial carrier which is transmitted by every BTS in GSM network. Thiscarrier is called the broadcast control channel (BCCH) carrier and MSsserach for BCCH carriers to detect the presence of a GSM network.Every bit in the FB is set to zero and after GMSK modulation, this resultsin a pure sine wave at a frequency around 68 KHz higher than the RFcarrier center frequency.

The synchronization burst (SB) carries 78 bits of coded data formed into

two blocks of 39 bits on either side of a 64-bit training sequence. This burst carries details of the GSM frame strurcture and allows an MS tofully synchronize with the BTS. The SB is the first burst the MS has todemodulate and thus, the training sequence is extended to 64 bits forreliability and the arrangement of this sequence is given by:

Time slotnumber

Training sequence bits (b61-b86)

0

1

2

3

4

5

6

7

(0,0,1,0,0,1,0,1,1,1,0,0,0,0,1,0,0,0,1,0,0,1,0,1,1,1)

(0,0,1,0,1,1,0,1,1,1,0,1,1,1,1,0,0,0,1,0,1,1,0,1,1,1)

(0,1,0,0,0,0,1,1,1,0,1,1,0,1,0,0,0,1,0,0,0,1,1,1,1,0)

(0,1,0,0,0,1,1,1,1,0,1,1,0,1,0,0,0,1,0,0,0,1,1,1,1,0)

(0,0,0,1,1,0,1,0,1,1,1,0,0,1,0,0,0,0,0,1,1,0,1,0,1,1)

(0,1,0,0,1,1,1,0,1,0,1,1,0,0,0,0,0,1,0,0,1,1,1,0,1,0)

(1,0,1,0,0,1,1,1,1,1,0,1,1,0,0,0,1,0,1,0,0,1,1,1,1,1)

(1,1,1,0,1,1,1,1,0,0,0,1,0,0,1,0,1,1,1,0,1,1,1,1,0,0)

Table 2.: GSM training sequences


7/42

7

(12))1,1,0,1,1,0,0,0,0,1,1,0,1,1,1,0,1,0,1,0,0

,0,1,0,1,0,1,1,0,1,0,0,1,1,1,1,0,0,0,0,0,0,1,0,0,0,0,0

,0,1,0,0,0,1,1,0,1,0,0,1,1,1,0,1(105,...,43,42 !bbb

The access burst (AB) consists of a 41-bit training sequence followedby 36 information bits. The access burst is used by the MS to access thenetwork initially and it is the first uplink burst that a BTS will have todemodulate from a particular MS. The extended tail bits at the front ofthe burst are:

(13))0,1,0,1,1,1,0,0(7,...,1,0 !bbb and this is followed by the training sequence:

(14))0,0,0,1,1,1,1,0,0,0,1,0,1,0,1,0,1,1,0,0,1,1

,0,0,1,1,1,1,1,1,1,1,0,1,1,0,1,0,0,1,0(48,...,9,8 !bbb

In order to smooth and shorthen the RF output spectrum transmitted,the output power must be switched up and down when transmitting a

burst. The power ramping masks for the normal, frequency correctionand synchronization bursts are given by:

ee

ee

ee

ee

ee

ee

! (15)

598.8ust588.8us30

8.5888.5806

8.580281

28184

18106

10030

(dB)powerRelative

ustus

ustus

ustus

ustus

ust

and the power ramping mask for the access burst is given by:


8/42

8

ee

ee

eeee

ee

ee

! (16)

2377236730

2.3672.3596

2.35928128184

18106

10030

(dB)powerRelative

us.tus.

ustus

ustus

ust

us

ustus

ust

A fifth type of burst not shown in Figure 2. is the dummy burst (DB). Itis similar to NB in that it has the same structure and uses the sametraining sequences. The main difference between the DB and NB is that

the information bits on either side of the training sequence are set to apredefined sequence in DB. The DB is used to fill inactive time slots onthe BCCH carrier which must be transmitted continuously at a constant

power.

V. GSM ReceiverAlthough GSM standard do not specifically define the manner in which

the transmitted information should be recovered at BTS and MS, the

bursts are specifically designed with the Viterbi equalizer in mind.

V.I. Channel Equalizer

Figure 3 shows the block diagram of a typical GSM baseband link. Thefigure shows that the bursts which contain both the data and the trainingsequence are passed through a baseband modulator at the transmitter andthen through the baseband channel before arriving at the receiver. Thereceived waveform will contain ISI caused by the radio transmission

channel and the GMSK modulation process. At the receiver the burst isdemultiplexed to give the training sequence and the data bits. Thetraining sequence is used to estimate the impulse response of the radiochannel in the channel estimator.

The entire demodulation process is accomplished using digital signalprocessing techniques. After the signal has passed through the RF front-


9/42

9

end at the receiver, it is sampled to produce a complex digitalrepresentation of the baseband signal where double arrows in Figure 2represents the flow of complex signals.

In order to explain the channel estimation process, we represent thereceived training sequence as the convolution of the transmitted trainingsequence and the impulse response of the baseband channel:

(17))()()( thtstscr !

where * denotes convolution. Passing )(tsr through filter with impulse

response )(thMF , that is matched to the training sequence yields a channel

impulse response estimate, )(the , that is given by:

(18))()(

)()()(

)()()(

thtRththts

thtsth

cs

MFc

MFre

!

!

!

where )()()( thtstR MFs ! is the autocorrelation function of the trainingsequence. It is important to note that this is the autocorrelation of the

Baseband

ModulatorBasebandChannel

ChannelEstimator

EstimatedChannel

LocalBasebandModulator

PossibleData

Sequencesy(t)

sr(t)

r(t)

AmbiguityFunction

EstimatedChannel

ViterbiAlgorithm

hw(t)

x(t)

x(t)

RecoveredData

Figure 3: The baseband link


10/42

10

modulated GMSK symbols that are generated by the training sequence.The actual shape is pulse-like and its magnitude is less than the number

of chips in the sounding sequence. Given that )(tRs has this property:

(19))()( thth ce } Every increase in delay corresponding to a bit duration results in the

doubling of the number of states in the equalizer. In general it is commonpractice to accomodate a channel excess delay spread of only 2 bits. Forthis purpose, a windowing procedure is implemented, where a 2 bit

duration window is moved over )(the and the portion of )(the used is

where the maximum energy resides. At this position, the windowedchannel estimate is given by:

(20))().()( twthth ew ! All possible data sequences are then generated at the receiver and

passed through a local baseband modulator. This produces a number ofGMSK symbols, y(t) which are then convolved with the estimated

channel impulse response )(thw to produce a number of waveform

templates x(t). Furthermore, in order to mimic the distortions produced by the autocorrelation function of the training sequence and thewindowing procedure, the received signal is convolved by the ambiguity

function or the autocorrelation function of the training sequence, )(tRs .

Suppose the equalizer is to accommodate a 5-bit overall dispersion ofdata resulting from 3-bit spreading in the GMSK modulator and 2-bitspreading in the channel, thus in any bit period we must consider theeffect of 5 bits. Since 5 bits can yield 32 different binary patterns, wemust generate 32 different waveform templates of one bit duration anduse them as each bit of the information x(t) arrives. The same 32 valuesof x(t) will be used for each bit in x(t). The mean-squared error between

each waveform template x(t) and the received waveform x(t) iscomputed for each bit period. These mean-squared error values are calledincremental metrics. The waveform template that most closely matchesthe received waveform will produce the lowest incremental metric andthis could be used to regenerate the data bit, b(t). However, this is donefor the first bit in the burst through the last bit. Only at the end of the

burst will al the bits be regenerated.


11/42

11

Viterbi equalizer has12 v states where v in our example is 5. Thus,

we have 16 states. Each state is associated with a different 4-bit binarynumber. The states are formed into a column having 16 circles. A trellisdiagram is formed of the same columns of 16 states. Each state will

change to another state depending on whether the new bit is a logical 0 or1. Thus, there are 32 incremental metrics at each bit period. At each statethe path with the lowest metric survives and at the next bit period, a newset of 32 metrics are computed. The two incremental metrics are added tothe previously retained metric at this state and now the summation istermed as the path metric. The smaller of the two metrics retained, itsvalue noted, as well as the logical value of the bit with which it isassociated. At the end of the burst, the state with the lowest path metric ischosen and the trace of that path is chosen as the regenerated bits thatwill go through deinterleaving and FEC decoding. It is important to notehere that, for GMSK, there are 16 states associated with 0, 2/T ,T , 2/3T radians and hence there are 64 instant phase states for each bit duration inour example.

V.II. Channel Models

In GSM systems, the design and performance analysis is generally done based on some finite-impulse response channel models previously

defined in terms of delays of paths in us and average relative power in dBwith a specific Doppler power spectrum for each path. We provide majorones of these channel models in Table 3. to Table 8. In these tables, theDoppler power spectrum identified by CLASS is the classical Doppler

power spectrum defined by:

(21)

1

1)(

2

!

df

f

fS

and RICE is the Ricean Doppler power spectrum that is the sum of aclassical Doppler power spectrum and a direct path defined by:

(22))7.0(91.0

12

41.0)(

2 d

d

ff

f

f

fS

! H

T


12/42

12

where the maximum Doppler frequency is:

(23)c

d

vf

P!

v is the speed of MS in m/s, P is the carrier wavelength in m.

TapNumber

RelativeTime (us)

AverageRelative

Power (dB)

Dopplerspectrum

1

(1) (1)(2) (2)

0.0 0.0 0.0 0.0

23456

0.10.30.5

15.017.2

0.20.40.6

15.017.2

-1.5-4.5-7.5-8.0

-17.7

-2.0-4.0-7.0-6.0

-12.0

CLASSCLASSCLASSCLASSCLASS

Table 5.: Hilly terrain (HT) channel (six taps)

CLASS

TapNumber

RelativeTime (us)

AverageRelative

Power (dB)

Dopplerspectrum

1

(1) (1)(2) (2)

0.0 0.0 -3.0 -3.0

23456

0.20.51.62.35.0

0.20.61.62.45.0

0.0

-2.0-6.0-8.0

-10.0

0.0

-2.0-6.0-8.0

-10.0

CLASS

CLASSCLASSCLASSCLASS

Table 4.: Typical urban area (TU) channel (six taps)

CLASS

TapNumber

RelativeTime (us)

AverageRelative

Power (dB)

Dopplerspectrum

1

(1) (1)(2) (2)

0.0 0.0 0.0 0.0RICE

234

56

0.10.20.3

0.40.5

0.20.40.6

--

-4.0-8.0

-12.0-16.0-20.0

-2.0-10.0-20.0

-

-

CLASSCLASSCLASSCLASS

CLASS

Table 3.: Rural area (RA) channel (six taps)


13/42

13

TapNumber

RelativeTime (us)

AverageRelative

Power (dB)

Dopplerspectrum

1(1) (1)(2) (2)0.0 0.0 -4.0 -4.0

23456

0.10.30.50.81.1

0.20.40.60.81.2

-3.00.0

-2.6-3.0-5.0

-3.00.0-2.0-3.0-5.0


Table 7.: Typical urban (TU) channel (twelve taps)

CLASS

789

101112

1.3 1.41.7 1.82.3 2.43.1 3.03.2 3.25.0 5.0

-7.0 -7.0-5.0 -5.0-6.5 -6.0-8.6 -9.0

-11.0 -11.0

-10.0 -10.0


CLASS

TapNumber

RelativeTime (us)

AverageRelative

Power (dB)

Dopplerspectrum

1 0.0 0.0

23456

3.26.49.6

12.816.0

0.00.00.00.00.0


Table 6.: Equalizer (EQ) test profile (six taps)

CLASS


14/42

14

VI. Physical and Logical ChannelsWhen an MS and a BTS communicate, they do on a specific pair of

radio frequency (RF) carriers, one for uplink and the other for thedownlink transmissions, and within a given time slot in each consecutive

TDMA frame. The combination of time slot and carrier frequency formswhat is termed a physical channel. One RF channel support eightphysical channels in time slots 0 through 7. The data, whether user trafficor signalling information, are mapped onto the physical channels bydefining a number of logical channels. A logical channel carryinformation of a specific type and a number of these channels may becombined before being mapped onto the same physical channel.

VI.I. Traffic Channels

GSM defines 2 types of traffic (TCH) channels. The full-rate TCHallows speech transmission at 13 Kb/s denoted TCH/FS. The full-rateTCH also allows user data transmission at the primary user rates of 9.6,4.8 and


15/42

15

The half-rate TCH allows speech tranmission at around 7 Kb/s(TCH/HS) and data at primary user rates of 4.8 and


16/42

16

the control channel configuration used at the BTS, a list of the BCCH carrierfrequencies used at the neighbouring BTSs and a number of parameters thatare used by the MS when accessing the BTS. Other information sent overthese channels include country code, network code, local area code, PLMNcode, RF channels used within the cell, surrounding cells, frequency hoppingsequnce number, mobile RF channel number for allocation, cell selection

parameters, and RACH description. It is always transmitted on a designatedRF carrier and time slot 0 at a constant power. BCCH, FCH and SCH cannot be hopped.

The cell broadcast channel (CBCH) is used to transmit shortalphanumeric text messages to all the MSs within a particular cell. Thesemessages appear on the MSs display and a subscriber may choose toreceive different messages by selecting different pages. The BCCH and the

CBCH both use the normal burst.

Associated Control Channels

When an MS is engaged in a call, a certain amount of signallinginformation must flow across the radio interface in order to maintain the call.This type of signalling is supported using logical control channels whichoccupy the same physical channel as the traffic data. Non-urgent informationsuch as measurement data is transmitted using the slow associatedcontrolchannel (SACCH). This occupies one time slot in every 26. More urgentinformation such as handover is sent using time slots that are stolen from thetraffic channel. This channel is known as the fastassociatedcontrolchannel(FACCH) because of its ability to transfer information between the BTS andMS more quickly than SACCH. A FACCH signalling block is used toexactly replace a single (20 ms) speech block and a complete FACCHmessage may be sent once every 20 ms. Both the SACCH and FACCH usethe normal burst and they are both uplink and downlink channels.

Stand-Alone Dedicated Control Channel

In some situations, signalling information must also flow when a call is

not in progress. This could be accomodated by allocating either a full or halfrate TCH and by using either the SACCH or FACCH to carry theinformation. However, this would be a waste of radio resources. Instead, alower data rate channel has been defined which has around 1/8 of thecapacity of a full-rate TCH known as stand-alone dedicatedcontrolchannel(SDCCH). It exists independently of a TCH and it is dedicated to a singleMS. It also has an associated SACCH. Since SDCCH always carries


17/42

17

signalling traffic there is no frame stealing and consequently it does not needan FACCH. SDCCH always uses the normal burst and operates both in thedown and uplink.

Common Control Channels

The common control channels may be used by any MS within a cell. Thepagingchannel(PCH) is a downlink-only channel that is used by the systemto page individual MSs. There is a full-rate and a half-rate PCH. PCHalways uses normal burst.

The access grantchannel (AGCH) shares the same physical resources asPCH, a particular time slot may be used by each channel. An AGCH is used

by network to grant or deny an MS access to the network by supplying itwith details of a dedicated channel; i.e. TCH or SDCCH to be used for

subsequent communications. The AGCH is a downlink only channel anduses always normal burst.

The random access channel (RACH) is an uplink-only channel that isused by an MS to initially access the network; i.e. at call-setup or prior to alocation update. The random term stems from the fact that more than oneMS may transmit in an RACH time slot and thus collide. If such a collisionoccurs, MS waits for a random time interval and transmits another access

burst on RACH.

VI.III. Mapping Logical Channels onto Physical Channels

The various logical channels described above may be combined in one of7 ways before being mapped onto a physical channel. The simplest mappingis the full-rate traffic channel (TCH/F) and its SACCH. When combinedthese channels fit exactly into one physical channel.

A single physical channel will also support two half-rate channels(TCH/H) and their SACCHs or eight SDCCHs and their associatedSACCHs. The remaining three logical channel combinations are a little morecomplicated and are explained below.

The basic broadcast and common control channel combinations consistsof a single FCCH, SCH and BCCH on the downlink, along with a full-ratePCH and full-rate AGCH. The uplink is entirely dedicated to a full-rate


18/42

18

RACH. This control channel combination may only occur on time slot zeroof a carrier. The carrier that supports these channels at a BTS is called theBCCH carrier and it will be unique to a cell or sector; i.e. each BTS willonly have one BCCH carrier.

In smaller capacity cells, a second combination of the access channels isemployed. The downlink continues to support an FCCH, SCH and BCCH;however the rate of the downlink PCH and AGCH is reduced to around 1/3of their full-rate. The extra slots that have been created as a result of this ratereduction on the downlink are used to support 4 SDCCHs and theirassociated SACCHs. The SDDCHs will also occupy a number of uplinktime slots and the number of time slots allocated to the RACH on the uplinkis reduced accordingly. This effectively halves the number of time slotsallocated to RACH. Again, this control channel combination may only occur

on the time slot 0 of the BCCH carrier.

The final control channel combination consists of a BCCH and a full-ratePCH and AGCH on the downlink and a full-rate RACH on the uplink. Thischannel combination may only occur on slot 2, or slots 2 and 4, or slots 2, 4and 6 of the BCCH carrier. The various channel combinations describedabove are summarized in Table 9. where * means reduced rate channels.

Lets now look at the timing of the possible channel combinationsmentioned in Table 9. For the full-rate traffic channel in combination I, 12th

PossibleTime Slots Downlink Uplink

0-7

0

2,4,6

0

1 TCH/F(+SACCH)

Table 9.: Logical channel configurations

0-7 2TCH/H(+SACCH)0-7 8SDCCH(+SACCH)

1SCH+1FCCH+1BCCH+1AGCH+1PCH

1SCH+1FCCH+1BCCH+1AGCH*+1PCH*

+4SDCCH(+SACCH)

1 BCCH+1AGCH+1PCH

2TCH/H(+SACCH)1 TCH/F(+SACCH)

8SDCCH(+SACCH)1RACH

1RACH+4SDDCH(+SACCH)

1RACH


19/42

19

frame is the associated SACCH and 26th frame is kept idle. Rest of theframes are used to send speech data. In half-rate traffic channel, eachchannel is time-multiplexed, 12th frame is SACCH1, 25th frame isSACCH2 and 26th frame is kept idle.

The third combination uses 2 51-frame multiframes consecutively. In theuplink, frames 0-31 are SDCCH0 to SDCCH7 for four frames, frames 32 to47 are SACCH4 to SACCH7 for four frames and the rest three frames arekept idle. In the second multiframe, again frames 0-31 are SDCCH0 toSDCCH7 for four frames, frames 32 to 47 are SACCH0 to SACCH3 forfour frames and the rest three frames are kept idle. In the downlink, frames0-11 are SACCH5 to SACCH7 for four frames, 12-14th frames are kepthidle, 15-46 frames are SDCCH0 to SDCCH7 and frames 47-50 is SACCH0.In the second multiframe, frames 0-11 are SACCH1 to SACCH3, 12-14th

frames are kept idle, frames 15th to 46 are SDCCH0 to SDCCH7, andframes 47-50 is reserved for SACCH4.

In the 4th combination downlink, frames 0-1,10-11,20-21,30-31 and 40-41 are successive frequency correction channel (FCCH) and synchronizationchannels (SCH). Frames 2-5 is BCCH, and frames 6-9,12-19,22-29,32-39,42-49 is CCCH that is either PCH or AGCH and frame 50 is kept idle. Inuplink, frames 0-1,10-11,20-21,30-31,40,41 and 50 are RACH and rest iskept idle. In combination 5, the rates of AGCH and PCH is reduced to halfof their rate in the downlink. In the uplink, the 5 idle blocks are filled withan SACCH followed by 4 SDCCHs. 6th combination is also similar to 4thcombination and the only difference is that there are no FCCH or SCH, theyare left idle.

VII.GSM Frame StructureFrame structure in GSM, whereby each carrier supports eight time

slots, and a physical channel occupies one time slot in each frame. The

TDMA frame represents the lowest layer in a complex hierarchical framestructure. The next level in the GSM frame structure is the multiframewhich consists of 26 TDMA frames in the case of full-rate and half-ratetraffic channels, or 51 frames for all other logical channels.

The first 12 time slots in each TDMA frame of the multiframe; i.e. 0 to11, are used by the TCH/F itself. The next time slot is not used and is


20/42

20

termed an idle slot.The next 12 slots are again used by the TCH/F andthe last timeslot in TDMA frame 26th is used by the SACCH. This isvalid for odd numbered multiframes. In even numbered multiframes, idleslots and SACCH slots are exchanged. We should note again that there isan offset of three timeslots between the frame timing on the uplink anddownlink, and downlink is 3 timeslots in advance of uplink. The trafficmultiframe is exactly 120 ms in duration and 1 TDMAframe=120ms/26=4.615 ms. The organization of the half-rate channel(TCH/H) is somewhat different than the full-rate channel. When twohalf-rate channels TCH0 and TCH1 are combined on the same physicalchannel, in timeslots 0-11, TCH0 and TCH1 are multiplexed. Timeslot12 is SACCH0. Again in timeslots 13-24, TCH0 and TCH1 aremultiplexed and timeslot 25 is SACCH1.

The next level in GSM frame structure is superframe and in the case ofTCH/F and TCH/H, superframe consists of 51 multiframes. The durationof a superframe is 6.12 s. The final level in the frame structure is thehyperframe and this consists of 2048 superframes and has a duration ofaround 2715648 TDMA frames that is approximately 3 hours 28 mins.

In the case of control channels set on time slot 0, the multiframeconsists of 51 TDMA frames and lasts around 235 ms. Except TCH/Fand TCH/H , the four different control channel combinations uses the 51-frame multiframe. Furthermore, a superframe is 26 multiframes and ofduration 6.12 s. Finally, a hyperframe is 2048 superframes and ofduration 2715648 TDMA frames or 3 hours 28 mins.

The way in which the group of 8 SDCCHs are mapped onto a single physical channel is further important. This mapping is based on a two-multiframe cycle. If we denote the time slots in two multiframes from 0to 50 and from 51 to 101, the SDCCHs of 0-7 occupies 4-slotsconsecutively in two multiframes from 0-31 and 51-82. 32-47 in oddmultiframe are occupied by consecutive 4-slots of associated SACCHs of

0-3 and 83-98 of even multiframe are occupied by consecutive 4-slots ofassociated SACCHs of 4-7. The last 3 slots on each multiframe is leftidle. This control channel arrangement may be used on any time slot andany carrier, except time slot zero of the BCCH carrier. Furthermore, if wedenote by F the frequency correction channel FCCH, by S thesynchronization channel (SCH), by P the PCH/AGCH and by R theRACH, the control channel arrangements on the BCCH carrier from slot


21/42

21

0-50 is given by:Downlink={F,S,B,B,B,B,P,P,P,P,F,S,P,P,P,P,P,P,P,P,F,S,P,P,P,P,P,P,P,P,F,S,P,P,P,P,P,P,P,P,,F,S,P,P,P,P,P,P,P,P,idle} andUplink={All Rs}.

We also see that the superframe represents the smallest time cycle forwhich the traffic channel and control channel relationships are repeatedand for this reason, the multiframe structure in use on each physicalchannel may only change at superframe boundaries. Furthermore, each ofthe 2715648 timeslots in the hyperframe for both and traffic and controlchannels has a unique number and this is used in the ciphering andfrequency hopping algorithms.

VIII. SpeechTransmissionIn GSM, a speech coder is used to convert the analog speech signal

into a digital signal that is suitable for transmission over the radiointerface. Forward error correction (FEC) is then applied to the speechdata to allow all or some of the transmission errors to be corrected at thereceiver. The FEC-coded data are then interleaved and ciphered before

being assembled into bursts ready for transmission over the radiointerface. Following the equalization and demodulation process at thereceiver, the recovered data is dechiphered, deinterleaved and decoded toremove as many transmission errors as possible. The data are then passed

to the speech decoder where it is converted back to the analog speechsignal.

VIII.I. Speech Coding

In GSM, the speech information is conveyed by transmitting the filtercoefficients of the vocal tract and an excitation sequence which allowsthe speech to be reconstructed at the receiver.

At an MS, the users acoustic pressure signal is converted into anelectrical signal using a microphone. The electrical signal is sampled at 8KHz and each sample is converted into 13-bit digital representation usinga uniform analog-digital conversion. Following this conversion process,the signal is passed to the GSM speech coder.


22/42

22

The GSM speech encoder belongs to the family of regular-pulse-excited (RPE) linear predictive codecs (LPC). It also employs long-term

prediction (LTP) in addition to the conventional short-term prediction(STP) and accordingly it is called an RPE-LTP speech coder. An RPE-LTP encoder can be divided into 4 parts: preprocessing, STP analysisfiltering, LTP analysis filtering and RPE computation.

Pre-processing

The sampled speech signal is initially passed through a notch filter toremove any DC offsets that may be present and passed through a first-order finite-impulse response (FIR) pre-emphasis filter. The pre-emphasis filter is used to emphasize the low-power high-frequency partof the speech spectrum and this provides better numerical precision in the

subsequent computations. The form of the preemphasis filter is1

11)(

! zczH where the coefficient 1c =0.9. The speech signal is thendivided into non-overlapping frames consisting of 160 samples, eachhaving a duration of 20 ms. Later, the preprocessed speech samples arewindowed by the Hamming window presented as:

!

N

nnW

T2cos46.054.0)( .

STP Analysis Filtering

Speech data inherently contain a high level of redundancy and this meansthat it is possible to predict a future speech sample from previous speechsamples. In mathematical terms, we can say that a speech sample may beapproximated as the linear combination of a number of past speechsamples such that the predicted speech sample at an instant n is given by:

!

!

p

k

k knsans1

_

(23))()(

where p is thepredictororder. The prediction error, e(n), is defined as:


23/42

23

!

!

!

p

k

k knsans

nsnsne

(24))()(

)()()(_

Taking the z-transform of (24) gives:

(25))()()( zAzSzE !

where:

(26)1)(1!

!

p

k

kkzazA

The coefficients ak are computed by minimizing the mean-squared errorover a 20 ms segment of the speech waveform. The inverse of A(z);H(z)=1/A(z), is an all-pole digital filter which models the spectralenvelope of the speech waveform.

In practice, the predictor coefficients are not calculated directly, butinstead, 8 reflection coefficients are derived from the autocorrelation

coefficients of the speech block by Schur recursion. The reflectioncoefficients are then transformed into another set of coefficients known

as log-area ratios (LARs) as:

!

)(1

)(1log)( 10

ir

iriLAR . There are 8 LARs per

20 ms speech block and they are quantized using 6 bits for LAR(1) andLAR(2), 5 bits for LAR(3) and LAR(4), 4 bits for LAR(5) and LAR(6),and 3 bits for LAR(7) and LAR(8), which results in 36 bits per speech

block.

LTP Analysis Filtering

Filtering the speech signal using the inverse filter, A(z), tends toremove the redundancy by subtracting from each speech sample its

predicted value using the past p samples. The resulting signal is knownas the short-term prediction residual and it will generally exhibit acertain amount of periodicity related to the pitch period of the original


24/42

24

speech when it is voiced. This periodicity represents a further level ofredundancy which can be removed using a pitch predictor or a long-term

predictor.The general form of the long-term predictor filter is given by:

(27))(1

1

)(

1

zPzPi

!

where:

(28)(z)2

1

)(

!

!

m

-mk

k

ki zGPE

is the long-term predictor, m1 and m2 determine the number of predictortaps, E is the LTP delay and G

kis the LTP gain. In the case of full-rate

GSM speech coder, m1=m2 =0, resulting in a single-tap predictor. Theparameters E and G0 are determined by minimizing the mean-squaredresidual error after both short-term and long-term prediction over a

period of 40 samples; i.e. 5 ms. For the single-tap predictor, this residualerror:

(29))()()( E! nGrnrne where r(n) is the residual that is produced following the short-term

prediction. The mean-squared residual, R, is given by:

! !

!!

39

0

39

0

22 (30))]()([)(n n

nGrnrneE E

The parameters G and E are then quantized and coded using 2 and 7 bitsrespectively, resulting in 9 bits per 5 ms sub-block and 36 bits per 20 msspeech block.

RPE Computation

Removing the redundancy from the speech signal produces a residualsignal. In the speech decoder, this residual is used to excite therecounstructed LTP and STP filters. The GSM system uses the regular

pulse excited (RPE) approach to encode this residual efficiently. For each5 ms sub-block, the excitation signal is assumed to consist of 13 pulsesspaced apart by 3 samples. The magnitude and initial starting position of


25/42

25

the first pulse are computed to minimize the error between the speech andits locally reconstructed version. Given the pulse spacing of 3 samples,there are three possible grid positions for the first excitation pulse andthis information can be encoded using only 2 bits. The pulse magnitudesare normalized to the highest magnitude for the block and quantizedusing 3 bits. Finally, the block maxima is quantized using 6 bits. Thisresults in 47 bits per 5 ms sub-block. The full bit allocation for the GSMvoice encoder is given in Table 10. Each 20 ms block of speech isencoded using 260 bits and this produces a bit rate of 260/20 ms=13Kb/s.

VIII.II. Speech Decoding

Decoding the speech data is much less complex task than the encoding process. The decoder performs the opposite operations, namely RPEdecoding, LTP synthesis filtering, STP synthesis filtering and post-

processing

RPE Decoding

In the decoder, the grid position, the subsection excitation maxima andthe excitation pulse amplitudes are recovered from the received data andthe actual pulse amplitudes are computed by multiplying the decodedamplitudes by their corresponding block maxima. The LTP residual

No. of bits

8 STP coefficients

4 RPE grid positions

4*13=52 pulse amplitudes

4 RPE block maxima

Table 10.: Bit allocations for full-rate GSM speech encoder

4 LTP Gains G4 LTP delays D

36

Parameter to beencoded

4*2=84*7=28

4*2=84*6=24

52*3=156

Total number of bits er 20 ms 260

Transmission bit rate 13 Kb/s


26/42

26

model is recovered by properly positioning the pulse amplitudesaccording to the initial offset grid position.

LTP Synthesis Filtering

The LTP filter parameters G and E are recovered from the receiveddata and they are used to derive the LTP synthesis filter. Then therecovered LTP excitation model is used to excite this LTP synthesis filterto recover a new subsegment of the estimated STP residual.

STP Synthesis Filtering

The STP filter is reconstructed and excited by the reconstructed STPresidual signal to regenerate the speech.

Post-processing

The speech signal is deemphasized using the inverse of thepreemphasis filter employed in the encoding.

The data bits produced by the speech encoder will each have a differentimpact on the speech signal if they are received in error. For this reason,each bit is ranked in order of importance and forward error correction isapplied accordingly. In GSM, the most important bits are protected by a

parity check and a powerful half-rate constraint length 5 convolutionalcode, where as the least important bits are left unprotected. Thespecifications define three classes of bits and these are termed Class Ia,Class Ib and Class II. The ClassIa bits are the most important and receivethe most protection. In fact, if an error is detected in the Class Ia bits,then the entire speech frame is discarded and interpolation techniques areused to reconstruct the speech from frames on either side of the discarded

block. The Class Ib bits are slightly less important and receivecorrespondingly less protection. The Class II bits are least important andthey are transmitted unprotected.

VIII.III. Voice Activity Detection

During a typical telephone conversation, a person will generally speakfor around about %40 of the total time. The interference levels may bereduced and MS battery may be saved by turning off the transmitter whn


27/42

27

user is silent. This technique is known as discontinous tranmission(DTX) and relies on the accurate detection of the periods of silence inusers speech. This is achieved using voice activity detection (VAD)where the energy in the speech signal is computed for each speech blockand a decision is made using an adaptive threshold as to whether the

block contains speech or background noise.

VIII.IV. Channel Coding

Channel coding is employed in an effort to reduce the system BER toacceptable levels and improve the overall performance. However, FECcoding introduces a level of redundancy and hence increases transmitted

data rate and system bandwidth. For this reason, channel coding isapplied in a selective manner in GSM. The speech coder delivers 260 bits

per 20 ms that is equivalent to a data rate of 13 Kb/s and these bits aredivided into three classes depending on the impact on the received speechquality if they are received in error. In a speech block of 260 bits at theoutput of speech encoder, The ClassIa bits are labeled {d0,,d49}, theClassIb bits are labeled {d50,,d181}, and the ClassII bits are labeled{d182,,d259}.

ClassIa bits are so important that the speech frame must be discarded ifany of these bits are received in error. Therefore it is important for thereceiver to be able to detect when errors in the ClassIa bits have leakedthrough the FEC process. This is achieved using a weak error detecting

block code. The code used is a shortened cyclic code (53,50,2) with agenerator polynomial given by:

(31)1)( 3 ! DDDg This coding process generates three parity bits that are appended to the

end of ClassIa bits. The ClassIb bits and 4 all zero tail bits are thenappended to the end of ClassIa bits and the parity bits, and all the bits arereordered according to the following relationship:


28/42

28

(32)7,188185,186,18kforbits)(tail0

0,1,...,90kfor

0,1,...,90kfor

12184

2

!!

!!

!!

k

kk

kk

u

du

du

The reordering process groups the even-numbered data bits at thebeginning of the frame, and the odd-numbered data bits at the end of theframe followed by 4 zero tail bits with the three parity bits at the centreof the reordered frame at {91,92,93} bit positions. The resulting 189-bit

block is then convolutionally encoded using rate constraint length 5code with the following generator polynomials:

(33)1

1

431

43

0

DDDG

DDG

!

!

This produces a coded block of 189*2=378 to which the uncoded 78ClassII bits are added to produce a block of 456 bits.

VIII.V. Interleaving

In a mobile environment, the errors in the transmitted bits tend to occurin bursts as the MS moves into and out of deep fades. The convolutional

error correcting code described above is most effective when the errorsare randomly distributed throughout the bit stream. For this reason, thecoded data are interleaved before they are transmitted over the radiointerface. At the receiver, the deinterleaving process tends to distributethe error bursts randomly thorughout the received data thereby increasingthe effectiveness of the subsequent channel decoding. The GSM systememploys two distinct levels of interleaving.

Block-diagonal interleaving

For a full-rate traffic channel (TCH/FS) carrying speech information,the 456-bit coded speech block is partitioned into 57-bit sub-blocks byassigning coded bit ck to sub-block Bi based on the relationship:

(34)8modki !


29/42

29

i.e. every eight bit is assigned to the same sub-block. Each sub-block thenforms the one half of eight consecutive transmission bursts over the radiointerface. The remaining half of each burst is occupied by sub-blocks

from either the previous speech frame or the next frame wheren

iB refers

to the sub-block i of speech frame n. The burst also contains 2 stealingflags, lh and uh , which are used to indicate whether either half-burst has

been stolen by the FACCH.

Inter-burst interleaving

In addition to the block diagonal interleaving described, the data bitsare interleaved within the burst due to the definition of coding and block-diagonal interleaving. One sub-block will occupy either the odd or even

bit positions within the burst. Where a sub-block from a speech frameshares its burst with a sub-block from the previous speech frame, it willuse the even numbered bit positions. Conversely, where a sub-blockshares its burst with a sub-block from the next speech frame, it will usethe odd-numbered bit positions.

VIII.VI. Ciphering

The GSM system has the ability to encrypt the information on the radio

path to reduce the security threats posed by evaesdroppers. Theencryption process involves performing the modulo-2 addition of a 114- bit wide encryption word and the 114 bits in a speech burst. Thiseffectively scrambles the bits within a burst in a known manner allowingthem to be unscrambled by a receiver that knows the encryption word.Generation of the encryption word with A8 algorithm will be explainedin Secion XII.

VIII.VII. Data TransmissionVIII.VII.I. Channel Coding

TCH/F9.6

Although the data service operates at 9.6 KB/s, a certain amount ofauxiallary information is added to produce an intermediate data rate of 12Kb/s. This data are delivered to the encoding unit in the form of 60-bit

block every 5 ms and the coder operates on a group of 4 blocks; i.e. 240


30/42

30

bits {d(0),...,d(239)}. 4 all-zero tail-bits are then added at the end of block and the data are the convolutionally encoded using a rateconstraint length 5 code with generator polynomials:

(35)1

1

43

1

43

0

DDDG

DDG

!

!

This produces a coded data block of 488 bits {C(0),,C(487)}. The block size is then adapted for transmission on the radio path usingpuncturing, whereby 32 of the coded bits are deleted using the rule:

(36)0,...,31jwhere),1511(bitsDeleted !! jC

This means that bits C(11), C(26), C(41) and so on are removed resultingin a block of 456 bits, {c(0),,c(455)}. Puncturing is used to preciselytailor the rate of convolutional code to the requirements of a transmission

link. At the receiver, the convolutional decoder will effectively treat thedeleted bits as errors and they will be corrected in the conventional waywithin the Viterbi decoder.TCH/F4.8

The data are delivered to the coding unit at an intermediate bit rate of 6Kb/s or to be more precise, one 60-bit block every 10 ms. Each block isextended to 76 bits by the addition of all-zero 16 bits, which are insertedin blocks of 4, once every 15 bits. 2 of these blocks are then assembled to

form a single 152-bit block, which is 1/3 rate constraint length 5convolutionally encoded with following generator polynomials:

(36)13

12

11

432

42

43

DDDDG

DDG

DDDG

!

!

!

This results in a coded block of 456 bits.

TCH/H4.8

The data are delivered to the coding unit in blocks of 60 information bitsevery 10 ms, i.e. 6 Kb/s. 4 of these blocks ar grouped together to producea block of 240 bits. The subsequent coding process is identical to those ofTCH/F9.6 channel.


31/42

31

TCH/F2.4

The data are delivered to the coding unit at an intermediate bitrate of 3.6Kb/s in the form of 36-bit blocks every 10 ms. The coding unit operateson the blocks of 72-bits formed by assembling 2 36-bit blocks. Initially 4all-zero tail bit are added to the end of the block to produce 76-bit block.This block is then 1/6 rate constraint length 5 convolutionally encodedusing the following generator polynomials:

(37)16

15

14

13

12

11

432

42

43

432

42

43

DDDDG

DDG

DDDG

DDDDG

DDG

DDDG

!

!

!

!

!

!

This results in a coded data block of 456 bits.

TCH/H2.4

The information data are delivered to the coding unit at a rate of 3.6 Kb/sin the form of 36-bit block every 10 ms. Two blocks are assembled toform a single 72-bit block and each block is expanded by the addition of4 all zero tail bits at the end of the block. 2 of these 76-bit blocks are thenassembled to form a single 152-bit block for channel coding. The block is1/3 rate constraint length 5 convolutionally encoded to produce a codeddata block of 456 bits using the convolutional code specified for theTCH/F4.8 channel.

VIII.VII.II. Interleaving

The interleaving process can be partitioned into 2 levels: blockdiagonal and inter-burst interleaving. The TCH/H2.4 channel uses thesame interleaving scheme as TCH/FS described previously. Thereamining channels use a complex interleaving scheme described as: The456 bit blocks is subdivided into 4 114-bit sub-blocks, each of which is


32/42

32

evenly distributed over 19 bursts with 6 bits in each. The sub-blocks areblock diagonal interleaved with a shift of 1 burst between each sub-block.

VIII.VII.III. Ciphering

The bursts are encrypted in the same manner as that described for thefull-rate speech channel.

VIII.VIII. Control Data Transmission

VIII.VIII.I. Slow-Associated Control Channel (SACCH)

The SACCH data is delivered to the coding unit in fixed blocks of184-bits. The initial encoding is performed using a shortened binary

cyclic code defined by generator polynomial:

(38))1)(1()( 31723 ! DDDDg This type of code is commonly referred to as fire code and is used todetect bursty residual errors that are not corrected by the convolutionaldecoder. The result of the coding process is the generation of 40 parity

bits that are appended to the end of the block to form a 224-bit block.This block is extended to 228 bits wit the addition of 4 all-zero tail bits atthe end of the block. This data block is then convolutionally encoded

using a rate constraint length 5 convolutional code with the generatorpolynomials:

(39)1

1

43

1

43

0

DDDG

DDG

!

!

The result is a block of 456 coded bits. The bits are then divided into 857-bit sub-blocks in the same way as the 456-bit speech block on theTCH/FS; i.e. some blocks occupy the even-numbered bits and some

blocks occupy the odd-numbered bits. However, in the case of SACCH,

the block interleaving occurs over 4 full bursts with each burst containingbits from the same block in both even and odd bit positions, that is calledblock rectangular interleaving. We note that SACCH bursts occur onceevery 26 bursts or 120 ms in the case of a full-rate traffic channel, whichmeans that the overall delay caused by interleaving and coding processeswill be 4*120=480 ms. In the case of a SACCH burst, the stealing flagsare always set to 1.


33/42

33

VIII.VIII.II. Fast-Associated Control Channel (FACCH)

The FACCH information is delivered to the channel coder in blocks of184 bits which are block and convolutionally encoded using the samecodes as em ployed for the SACCH. The interleaving scheme is differentfor FACCHs on full-rate and half-rate channels. For the full-rate channel,the interleaving scheme is identical to that used for the full-rate 456-bitcoded speech frames. To note, when the even numbered bits in first 4sub-blocks are stolen by an FACCH, the hu flag is set to 1, and if the oddnumbered bits in the last 4 sub-blocks are stolen by FACCH, h l flag is setto 1. Consequently, the insertion of an FACCH block will result in theloss of a 20 ms speech block.

Since the TCH/F2.4 also uses the same interleaving scheme, theinsertion of an FACCH block results in the loss of a single 456-bit codedinformation block, or a 72-bit information block. In the case ofTCH/F9.6, the difference between the two interleaving schemes meansthat the insertion of the FACCH results in the loss of a maximum of 24coded bits in each 114-bit block, and in the case of TCH/f4.8, amaximum of 48 coded bits will be lost every 228 bits.

When an FACCH is inserted on the half-rate channel, 184-bit FACCH block is block and convolutionally encoded in the same manner as theSACCH block to produce a 456-bit coded data block. The block isinterleaved over six bursts in the following manner. The 456-bit block isdivided into 8 sub-blocks with the first 4 sub-block {B(0),...,B(3)}occupying the even-numbered bit positions and the last 4 sub-blocks{B(4),...,B(7)} occupying the odd-numbered bit positions. Sub-blocksB(2) and B(3) are combined with sub-blocks B(4) and B(5) to fill 2complete bursts and the remaining sub-blocks fill half bursts. The blocksare therefore effectively block diagonally interleaved over 6 bursts and anew data block beginning every 4th burst. Accordingly, an FACCH block

steals the even-numbered bits of the first 2 bursts of the TCH/H with huflag is set to 1, all of the bits of the next two bursts with both hu and hlflags are set to 1, anf the odd-numbered bits of the next 2 bursts with hlflag is set to 1. The effects of FACCH bit stealing on a half-rate speechchannel TCH/HS will be the loss of 2 consecutive speech frames. In thecase of TCH/H4.8 and TCH/H2.4 channels, a maximum of 24 in every114 coded bits will be lost.


34/42

34

VIII.VIII.III. Random Access Channel (RACH)

The short RACH bursts transmitted on the uplink contain only 8information bits. 6 parity bits are generated using a simple systematiccyclic code with the following feedback polynomial:

(40)1)( 2356 ! DDDDDDG The six parity bits are then added bitwise modulo-2 to the 6-bit BSIC of

the BTS for which the RACH message is intended. This process is includedto ensure that 2 BTSs with the same BCCH carrier frequency do not bothdecode and respond to a RACH frame from a single MS. Only the BTS withthe same BSIC as that used in the RACH burst generation will be able tosuccessfully decode the information. This process results in a 14-bit block to

which 4 all-zero tail bits are added to form an 18-bit block. This block isthen rate constraint length 5 convolutionally encoded using the samegenerator polynomials as those used in the TCH/FS producing a 36-bitcoded block. There is no interleaving on the RACH channel.

VIII.VIII.IV. Synchronization Channel (SCH)

The synchronization bursts, each containing 25 information bits, aretransmitted on time slot 0 in the downlink BCCH carrier. The data

transmitted include the BSIC and the frame number of the current frame inthe hyperframe. 10 parity bits are generated using the following polynomial:

(41)1)( 2456810 ! DDDDDDDG and 4 all zero tail bits are added to produce a 39-bit data block. The block isthen rate constraint length 5 convolutionally encoded using the same codeas the TCH/FS to produce a coded data of 78 bits. There is no interleavingon SCH channel.

VIII.VIII.V. Other Control Channels

BCCH, PCH, AGCH, CBCH and SDDCH all use the same coding andinterleaving scheme as the SACCH.

VIII.IX. Ciphering of Control Data


35/42

35

SCH, BCCH, AGCH, RACH, and CBCH are never encrypted. Theonly control channels that may carry encryption are the SACCH, FACCHand SDCCH. The data on these channels are encrypted by EXOR-ing the114 bits in the burst with 114-bit encryption word generated by A8algorithm thereby scrambling the data in a known way.

IX. Cell Selection

When an MS is switched on, its first task is to locate a suitable BTSthrough which it can gain access to the network, if required. This isachieved by searching the relevant frequency band for BCCH carriers

and then decoding the information they carry to select an appropriateBTS.

Initially, the MS searches the entire downlink frequency band (124carriers for primary GSM900) and measures the received signal strengthof each carrier. The received signal level for each carrier is determinedfrom the average of at least 5 measurements spread evenly over a time

period of 3 to 5 s. The MS then retunes to the strongest carrier and waitsfor an FCCH burst; i.e. a burst of pure sine wave. If an FCCH burst,which occurs every 10 or 11 time frames on time slot 0 of a BCCH

carrier, is not detected, then the MS retunes to the next strongest carrierand repeats the process. Once the MS identifies a BCCH carrier bymeans of an FCCH burst, it synchronizes to the BTS and attempts todemodulate the synchronization information. The FCCH burst is used bythe MS to correct its internal time base to ensure that its carrier frequencyis accurate compared with the signal received from the BTS. The MSemploys its internal time base to generate both the local versions of RFcarriers for demodulation and the clock signals for its internal counters.

Having applied the relevant frequency correction, the mobile attemptsto decode the synchronization burst contained in the SCH time slot. Theslot is easily located beacuse it always follows immediately after theFCCH time slot on the same physical channel; i.e. 8 time slots later. Thesynchronization burst contains sufficient information for the MS toidentify its position within the complete GSM frame structure. The burstcontains 25 bits of information prior to channel coding and 6 of these bits


36/42

36

are used to transmit the BSIC. The remaining 19 bits are used to transmitthe reduced TDMA frame number (RFN) of the time slot containing thesynchronization burst. The RFB consists of three parameters, T1 (11

bits), T2 (5 bits) and T3 (3 bits), which are determined using the fullframe number (FN) unique to each TDMA frame within the hyperframe.The FN ranges from 0 to 2715647 and the RFN parameters are defined asfollows:

(42)4to0rangebits)(310)13('3

25to0rangebits)(526mod2

2047to0rangebits)(11)51*26(1

divTT

FNT

FNdivT

!

!

!

where T3 is a number in the range 0 to 50 and is given by:

(43)51mod3 FN

T!

The mod and div operators return the integer result and the reminderof an integer division, respectively. This shows that T1 provides the

position of the superframe containing the synchronization burst in thehyperframe, while T2 provides the position of the multiframe within thesuperframe. The control channel multiframe contains 51 TDMA framesand the position of the frame containing the synchronization burst withinthe multiframe is given by T3, which requires 6 bits. However, thesynchronization burst can only occupy 1 of 5 different positions withinthe multiframe and consequently, this information is transmitted using 3

bits as T3.

In addition to FN, the mobile must also maintain the time slot number(TN) and quarter-bit numer (QN) counters. The QN counter is set usingthe extended training sequence located in he middle of thesynchronization burst and is incremented every 12/13 us. The QN countsthe quarter-bit periods and its value ranges 0 to 624; i.e. 0 to 156-bit

periods. The TN counter is set to 0 when the synchronization burst isreceived and it is incremented each time the QN count changes from 624

to 0. The TN counter is used to hold the position of the time slot withinthe TDMA frame and its value ranges from 0 to 7. As the value of TNchanges from 0 to 7, the FN is incremented.

Having successfully synchronized to the BS, the mobile may proceed todecode the system information contained on the BCCH. The BCCH iseasily located since it always occupies the same position within the


37/42

37

control channel multiframe. This channel contains a number of parameters that influence the cell-selection, including the maximum power that MS may transmit while accessing the BTS (parameterMS_TXPWR_MAX_CCH) and the minimum received power at the MSfor access ( parameter RXLEV_ACCESS_MIN). These parameters arecombined with the received power of the base station, R, and themaximum output power of the MS, P, to produce a radio parameterknown as CI given by:

(44)0Bfor

0Bfor

e!

"!

ACI

BACI

where:

(45),___

,__

PCCHMAXTXPWRMSB

MINACCESSRXLEVRA

!

!

and all values are expressed in dBm. If CI for a given BTS is greater than0, then the MS is considered to have the ability to access the BTS, ifrequired. Also, the BTS with the highest CI is considered to be the mostsuitable BTS as far as the radio resource is concerned.

X. Power ControlGSM system employs power control to ensure that the MS and BTS

only transmit sufficient power to maintain an acceptable link, therebyreducing interference to neighbouring cells and improving the spectralefficiency. An MS has the ability to decrease its transmitted power is stepsof 2 dB from the maximum for its class down to 5 dBm for GSM900. Thetransmission power of the MS is controlled by the network conveyingmessages over the SACCH. After receiving a power control command, anMS adjusts its transmitted power to the requested power level at a maximumrate of 2 dB every 60 ms. Thus a tranmsitter power change of 30 dB will

take around 900 ms.

The power control algorithm is based on the uplink signal measurementstaken at the BTS, and although the specifications include an examplealgorithm, the implementation is operator specific. The BTS must be able todynamically adjust its power in at least 15 steps of 2 dB. Power control may

be applied independently on downlink and uplink, or it may not be applied


38/42

38

either. However, downlink power control may not be applied to any slots onthe BCCH carrier as it must be transmitted at a constant power because it ismeasured by the MSs in surrounding cells for handover preparation.

XI. Frequency HoppingGSM employs slow frequency hopping (SFH) to mitigate the effects of

multipath fading and interference. Each burst belonging to a particular physical channel will be transmitted on a different carrier frequency ineach TDMA frame. Thus the hopping rate is equal to the frame rate(216.7 frames/s). The only physical channels that are not allowed to hop

are FCH, SCH, BCCH, PCH and AGCH.The hopping sequence defines the order in which the different carrier

frequencies are used on the uplink and downlink. Since the uplink anddownlink frequencies always remain separated by the duplex channelspacing 45 MHz for GSM900, only a single hopping sequence is requiredto describe the complete duplex link.

The mobile allocation parameter prescribes the carrier frequencies thatmay be used by each MS in its hopping sequence. For 124 possible

TDMA carriers, the mobile allocation parameter requires a minimum of124 bits to uniquely describe every possible carrier combination. Werecall that initial assignment messages are sent on the common accessgrant channel (AGCH) where the message size should be kept short to

preserve the access capacity of the system. To avoid transmitting the fullmobile allocation parameter at initial assignment, a 2-step approach isused. Each BTS transmits details of all the carriers it is using in the formof a channel description message, carried on the BCCH. This messagetakes the form of a 124-bit map where each bit represents a carrier and a

1 or 0 is inserted to indicate whether each particular carrier is in use atBTS. The MS decodes and stores this information while it is in idlemode. On initial assignment, the mobile allocation is described as asubset of cell allocation, thus reducing the signalling overhead on theAGCH.


39/42

39

Having established the list of carrier frequencies assigned to thefrequency hopping channel, the MS must also determine the sequence inwhich each frequency is to be used. The hopping sequence is described

by 2 parameters: the hopping sequence number (HSN) and the mobileallocation index offset (MAIO). The HSN selects one of 64 predefinedrandom hopping sequences, while the MAIO selects the start point withinthe sequence. The MAIO may take as many values as there arefrequencies in the mobile allocation. The value HSN=0 chooses a cyclicsequence where the frequencies in the mobile allocation are used oneafter another.

Frequency hopping channels with the same HSN but different MAIOswill never use the same frequency simultaneously because they areorthogonal. Consequently, all frequency hopping channels within a cell

employ the same HSN but have different MAIOs. Where 2 frequencyhopping channels use different HSNs, they will interfere for 1/n of the

bursts and consequently frequency hopping channels in co-channel cellswill use different HSNs.

To briefly summarize the frequency hopping algorithm again, for a setof n given frequencies, GSM allows 64*n different hopping sequences to

be built. They are described by 2 parameters, the Mobile AllocationIndex Offset (MAIO), which may take as many values as the number offrequencies in the set, and the HSN, which may take 64 different values.Two channels bearing the same HSN but different MAIOs will never usethe same frequency on the same burst. All mobiles in a given cell willhave the same HSN, while each will have different MAIOs. Thefrequency assigned to each mobile is also a function of the framenumber. The actual parameters of the frequency hopping algorithm are asfollows:

MA: the actual allocation of frequencies 1


40/42

40

The frequency hopping algorithm in GSM based on these parameters isthen given by the following description:

- The input parameters to the algorithm are MA, MAIO, HSN, T1, T2,T3. T1, T2, T3 are received on SCH. If HSN=0, hopping is cyclic andthe mobile allocation index is choosen as:

MAI=(FN+MAIO) mod N- If HSN is not 0, intermediate parameters M, M and T are computed

according to:M=T2+RNTABLE(HSN+(T1mod64)+T3)M=M mod (2^NBIN)T=T3 mod (2^NBIN)

If M is smaller than or equal to N, then S=M

Else S=(M+T) mod N

- Finally, MAI=(S+MAIO) mod N

XII.SecurityIssuesXII.I. Authentication

Authentication is initiated by the network in the form of anauthentication requestmessage sent to the MS. This message contains a128-bit random number, called RAND. At the MS, this number is used asone input to algorithm A3. The other input to A3 is the subscriberssecret key, Ki . Both A3 and Ki are stored in the SIM under heavy

protection. Ki may be of any format and any length. The result ofapplying the A3 algorithm to RAND and Ki is another number SRES(Signed Result), which must be 32 bits in length. Once computed, SRESis returned to the newtwork in the form of an authentication responsemessage. On the network side, the AuC also stores the users secret key

Ki and the A3 algorithm and it generates a version of SRES in naidentical manner to that at the MS. The HLR (home location register)sends SRES to the visited MSC/VLR (visitior location register) where 2versions are compared. If they match, then the MS is deemed to beauthentic. The A3 algorithm has the property that it is a relatively simpletask to generate SRES from RAND and Ki but it is very difficult to


41/42

41

determine Ki from SRES and RAND or pairs of SRES and RAND. Ingeneral A3 algorithm is operator specific.

XII.II. Encryption

Once a subscriber has been authenticated, thereby protecting both thesubscriber and the network operator from the effects of fradulent access,the user must be protected from the evaesdroppers. This is achieved byencyrpting the data on the radio interface using a second key, Kc and analgorithm A5. Kc is generated during the authentication phase using Ki ,RAND and algorithm A8, which is also stored in SIM. A8 is alsooperator specific. The Kc key for each user is computed in the homenetworks AuC to overcome the problems of internetwork roaming.

In contrast to A3 and A8, that are operator specific, A5 will be chosenfrom a list of different candidates, which will not exceed 7. Prior toencryption being enabled, a negotitation phase will occur whereby theMS and the network decide which version of A5 to use. The A5algorithm takes the 64-bit long Kc key and a 22-bit long representation ofthe TDMA frame number and produces 2 114-bit long encryption words,BLOCK1 and BLOCK2 for use on the uplink and downlink respectively.The encryption words are EXORed with the 114 data bits in each burst.The authentication and encryption process is summarized in Figure 4

where represents the EXOR function.

+ +

A8 A3 A3 A8

A5 A5Framenumber Frame

number

RANDKi Ki

SRESSRES

AuthenticationKc Kc

BLOCK1

BLOCK1

BLOCK2

Uplink data-in Uplink data-out

DownlinkData-in+

Figure 4.: The GSM authentication and encryption process

BLOCK2

DownlinkData-out

+


42/42

References:

- Sigmund Redl, Matthias Weber and Malcolm Oliphant. AnIntroduction to GSM. Artech House Publishers, 1995.

- Asha Mehrotra. GSM System Engineering. Artech House Publishers,1997.

- Raymend Steele, Chin-Chun Lee and Peter Gould. GSM, CDMAOneand 3G Systems. Wiley Pres, 2001.

gsm interface report

Documents