Introduction

1. GSM Frequency Band Allocation

1.1 GSM frequency allocation
1.2 EGSM/RGSM frequency allocation

2. Multiple Access Technology

2.1 FDMA
2.2 TDMA

3. GSM network

3.1 The mobile station (MS)

3.1.1 Identifiers in the GSM Network

3.2 The base station subsystem (BSS)

3.2.1 The Base Transceiver Station (BTS)
3.2.2 The Base Station Controller (BSC)

3.3 The network subsystem

3.3.1 The Mobile Switching Center (MSC)
3.3.2 The Home Location Register (HLR)
3.3.3 The Visitor Location Register (VLR)
3.3.4 The Authentication Center (AuC)
3.3.5 The Equipment Identity Register (EIR)
3.3.6 Operation and Maintenance Center (OMC)

4. The Air Interface Um

4.1 Air interface for logical channel

4.2 Traffic channels on the air interface

4.3 Signaling channels on the air interface

4.3.1 The broadcast channels (BCH)

1
 4.3.2 The Common Control Channel (CCCH)
4.3.3 The Dedicated Control Channel (DCCH)

4.4 Burst formats

5. MSC-based interfaces
5.1 MSC protocols
5.2Data Transmission
5.3Voice Coding
5.3.1Channel Coding
5.3.2Interleaving
5.3.3Encryption
5.3.4Modulation and Demodulation
5.3.5Timing advance

6. Mobile Terminated Call

Handover
Data Transmission Overview
Discontinuous reception (DRX)
Power control

7. System features
Roaming
Multipath equalization
Frequency hopping
Short Message Service (SMS)
Call Waiting (CW)
Call Hold (CH)
Call Forwarding (CF)
Calling Line ID
Mobility Management (MM)
Authentication

8. The Evolution Path for GSM

9. GSM glossary

2
 INTRODUCTION
The GSM standard (Global System for Mobile Communications) for
mobile telephony was introduced in the mid-1980s. Today, GSM is the
most popular mobile radio standard in the world.

Nowadays, when we speak of GSM, we usually mean “original” GSM

also known as GSM900 since 900 MHz was the original frequency band.

 Which Technology used before GSM?

Before GSM networks there were public mobile radio networks

(cellular).
They normally used analog technologies, which varied from country to
country and from manufacturer to another.

These analog networks did not comply with any uniform standard.

There was no way to use a single mobile phone from one country to
another.

The speech quality in most networks was not satisfactory.

GSM became popular very quickly because it provided improved

speech quality and, through a uniform international standard, made it
possible to use a single telephone number and mobile unit around the
world.

European Telecommunications Standardization Institute (ETSI) adopted

the GSM standard in 1991, and GSM is now used in 135 countries.

3
  The benefits of GSM
Support for international roaming

Distinction between user and device identification

Excellent speech quality

Wide range of services

Interworking (e.g. with ISDN, DECT)

Extensive security features

Telephony

Asynchronous and synchronous data services

Access to packet data network

Telemetric services (SMS, fax, video, text, etc.)

Many value-added features

(Call forwarding, caller ID, and voice mailbox)

E-mail and internet connections

4
 1. GSM Frequency Band
Allocation
GSM cellular system can be divided into GSM 900M, GSM 1800M &
GSM 1900 according to frequency band, with carrier frequency interval
of 200 KHz and up and down frequencies as follows:

 1.1 GSM frequency allocation

Carrier
Frequency BW Frequenc freq.
Band(MHz) (MHz) y number numbe
r (pair)
GSM Up 890–915
25 1–124 124
900 Down 935–960
GSM Up 1710–1785
75 512–885 374
1800 Down 1805–1880

“Up” and “down” are classified according to base station.

Base station transmitting - mobile station receiving is “down”; mobile

station transmitting - base station receiving is up.

With the expanding services, GSM protocol adds EGSM (expanded

GSM frequency band) and RGSM (expanded GSM frequency band
including railway service) to the original GSM900 frequency band. The
frequency band allocation is as follows:

 1.2 EGSM/RGSM frequency allocation

Carrier
Frequency BW Frequency freq.
band(MHz) (MHz) Number number
(pair)
Up 880–915 0–124
EGSM 35 174
Down 925–960 975–1023

5
 Up 876–915 0–124
RGSM 40 199
Down 921–960 955–1023

2. Multiple Access Technology

In cellular mobile communications system, since many mobiles
stations communicate with other mobiles stations through one base
station,

It is necessary to distinguish the signals from different mobile

stations and base stations for them to identify their own signals.
The way to this problem is called “multiple access technology”.

There are now five kinds of multiple access technology, namely:

(1) Frequency Division Multiple Access (FDMA),

(2) Time Division Multiple Access (TDMA),
(3) Code Division Multiple Access (CDMA),
(4) Space Division Multiple Access (SDMA), and
(5) Polar Division Multiple Access (PDMA).

GSM multiple access technology focuses on TDMA, and takes FDMA

as complement. The following only introduces FDMA and TDMA
technologies.

 2.1 FDMA
FDMA divides the whole frequency band into many single radio
channels (transmitting and receiving carrier frequency pairs).

Each channel transmits one path of speech or control information.

Any subscriber has access to one of these channels under the
control of the system.

Analog cellular system is a typical example of FDMA application.

Digital cellular system also uses FDMA, but not the pure frequency
allocation. For example, GSM takes FDMA technology.

 2.2 TDMA
TDMA divides a broadband radio carrier into several time division
channels according to time (or timeslot). Each subscriber takes one

6
timeslot and sends or receives signals only in the specified timeslot.
TDMA is applied in digital cellular system and GSM.

GSM adopts a technology combined with FDMA and

TDMA.

3. GSM network
A GSM network can be divided into three groups.

 The mobile station (MS),

 The base station subsystem (BSS) and
 The network subsystem.

7
8
9
Site Sectorization

10
4 site/3 cell

11
12
They are characterized as follows:

 3.1 The mobile station (MS)

A mobile station may be referred to as a “handset”, a “mobile”, a

“portable Terminal” or “mobile equipment” (ME).

It also includes a subscriber identity module (SIM) that is normally

removable and comes in two sizes.

Each SIM card has a unique identification number called IMSI

(international mobile subscriber identity).

In addition, each MS is assigned a unique hardware identification called

IMEI (international mobile equipment identity).

In some of the newer applications (data communications in particular),

an MS can also be a terminal that acts as a GSM interface, e.g. for a
laptop computer. In this new application the MS does not look like a
normal GSM telephone.

Besides providing a transceiver (TRX) for transmission and reception of

voice and data, the mobile also performs a number of very demanding
tasks such as authentication, handover, encoding and channel
encoding.

The MS, i.e. the GSM handset, is logically built up from the following
components:

• Mobile Equipment (ME) – this is the GSM terminal, excluding

the SIM card;

• Subscriber Identification Module

(SIM) – this is the chip embedded in
the SIM card that identifies a subscriber
of a GSM network; the SIM is embedded
in the SIM card.

13
  3.1.1 Identifiers in the GSM Network

GSM uses several identifiers for the routing of calls, identifying

subscribers (e.g. for charging), locating the HLR, identifying
equipment, etc. Some of these identifiers play an important role for
Subscriber Identity

The International Mobile Subscriber Identity (IMSI) is embedded on

the SIM card and is used to identify a subscriber. The IMSI is also
contained in the subscription data in the HLR. The IMSI is used for
identifying a subscriber for various processes in the GSM network.

Figure 1.4 shows the format of the IMSI.

• Mobile Country Code (MCC) – The MCC identifies the country

for mobile networks. The MCC is not used for call establishment. The
MCC values are allocated and published by the ITU-T.

• Mobile Network Code (MNC) – The MNC identifies the mobile

network within a mobile country (as identified by MCC). MCC and MNC
together identify a PLMN (Public Land Mobile Network). The
MNC may be two or three digits in length. Common practice is that,
within a country (as identified by MCC), all MNC’s are either two or
three digits.

14
• Mobile Subscriber Identification Number (MSIN) – The
MSIN is
the subscriber identifier within a PLMN.

15
  3.2 The base station
subsystem (BSS)
The base station subsystem (BSS) is made up of the base station
Controller (BSC) and the base transceiver station (BTS).

 3.2.1 The Base Transceiver Station

(BTS):

GSM uses a series of radio transmitters called BTS s to connect the

mobiles to a cellular network.

Their tasks include channel coding/decoding.

A BTS is comprised of radio transmitters and receivers, antennas, the
interface to the PCM facility, etc.

The BTS may contain one or more transceivers to provide the required
call handling capacity.

A cell site may be omni directional or split into typically three

directional cells.

 3.2.2 The Base Station Controller

(BSC):
16
A group of BTSs are connected to a particular BSC which manages the
radio resources for them.

Today's new and intelligent BTSs have taken over many tasks that
were previously handled by the BSCs.

The primary function of the BSC is call maintenance.

The mobile stations normally send a report of their received signal

strength to the BSC every 480 ms.

With this information the BSC decides to initiate handovers to other

cells, change the BTS transmitter power, etc.

 3.3 The network subsystem

 3.3.1 The Mobile Switching Center

(MSC):

Acts like a standard exchange in a fixed network and additionally

provides all the functionality needed to handle a mobile subscriber.

The main functions are registration, authentication, location updating,

and handovers and call routing to a roaming subscriber.

The signaling between functional entities (registers) in the network

subsystem uses Signaling System.

If the MSC also has a gateway function for communicating with other
networks, it is called Gateway MSC (GMSC).

 3.3.2 The Home Location Register

(HLR):

A database used for management of mobile subscribers. It stores the

international mobile subscriber identity (IMSI), mobile station ISDN
number (MSISDN) and current visitor location register (VLR) address.

17
The main information stored there concerns the location of each
mobile station in order to be able to route calls to the mobile
subscribers managed by each HLR.

The HLR also maintains the services associated with each MS. One HLR
can serve several MSCs.

 3.3.3 The Visitor Location Register

(VLR):

Contains the current location of the MS and selected administrative

information from the HLR, necessary for call control and provision of
the subscribed services, for each mobile currently located in the
geographical area controlled by the VLR.

A VLR is connected to one MSC and is normally integrated into the

MSC's hardware.

 3.3.4 The Authentication Center

(AuC):

A protected database that holds a copy of the secret key stored in

each subscriber's SIM card, which is used for authentication and
encryption over the radio channel.

The AuC provides additional security against fraud. It is normally

located close to each HLR within a GSM network.

 3.3.5 The Equipment Identity Register

(EIR):

The EIR is a database that contains a list of all valid mobile station
equipment within the network, where each mobile station is identified
by its international mobile equipment identity (IMEI).

The EIR has three databases:

White list: for all known, good IMEIs
Black list: for bad or stolen handsets
Grey list: for handsets/IMEIs that are uncertain

18
  3.3.6 Operation and Maintenance
Center (OMC):

The OMC is a management system that oversees the GSM functional

blocks. The OMC assists the network operator in maintaining
satisfactory operation of the GSM network.

Hardware redundancy and intelligent error detection mechanisms help

prevent network down-time.

The OMC is responsible for controlling and maintaining the MSC, BSC
and BTS. It can be in charge of an entire public land mobile network
(PLMN) or just some parts of the PLMN.

Providing voice or data transmission quality over the radio link is only
part of the function of a cellular mobile network.

A public communications system also needs solid security mechanisms

to prevent misuse by third parties.

Security functions such as authentication, encryption and the use of

Temporary Mobile Subscriber Identities (TMSI s) are an absolute must.

Within a GSM network, different protocols are needed to enable the

flow of data and signaling between different GSM subsystems.

4. The Air Interface Um

The air interface for GSM is known as the Um interface.

The International Telecommunication Union (ITU), which manages

international allocation of radio spectrum (among many other
functions), has allocated the following bands:

GSM900:
Uplink: 890-915 MHz (MS to BS)
Downlink: 935-960 MHz (BS to MS).

GSM1800:
Uplink: 1710-1785 MHz (MS to BS)
Downlink: 1805-1880 MHz (BS to MS).

GSM1900 :
Uplink: 1850-1910 MHz (MS to BS)

19
Downlink: 1930-1990 MHz (BS to MS).

The basic conception of GSM in terms of radio path is burst.

Burst is a transmission unit consists of over one hundred of

modulation bits. It has a duration limit and takes a limited radio
frequency. They are exported in time and frequency window which is
called slot.

To be specific, in system frequency band, central frequency of slot is

set in every 200 KHz (in FDMA). Slot occurs periodically in each 15/26
ms, which is about 0.577 ms (in TDMA).

The interval between two slots is called timeslot. Its duration is used
as time unit, called burst period (BP).

Time/frequency map illustrates the concept of slot. Each slot is

expressed as one little rectangle with 15/26ms length and 200 KHz
width.

In Figure, the 200 KHz bandwidth in GSM is called frequency slot,

equal to radio frequency channel in GSM protocol.

20
Burst represents different meaning in different situation. Sometimes it
concerns time – frequency “rectangle” unit, and sometimes not.
Similarly, timeslot sometimes concerns time value, and sometimes
means using one of every eight slots periodically.

Using a given channel means transmitting burst with a particular

frequency at particular time, that is, a particular slot. Generally, the
slot of a channel is not continuous in time.

Frequency

200kHz

BP Tim e

15/26m s Slot
Physical channel combines FDMA and TDMA together. It consists of
timeslot flow that connects base station (BS) and mobile station
(MS).The position of these timeslots in TDMA frame is fixed.
The best way to create a manageable communications system is to
divide it into various subgroups that are interconnected using
standardized interfaces.

Since radio spectrum is a limited resource shared by all users, a

method was devised to divide the bandwidth among as many users as
possible. The method chosen by GSM is a combination of time- and
frequency-division multiple access (TDMA/FDMA).

The FDMA part involves the division by frequency of the (maximum) 25

MHz allocated bandwidth into 124 carrier frequencies spaced 200 kHz
apart.

One or more carrier frequencies are assigned to each base station.

Each of these carrier frequencies is then divided in time, using a TDMA
scheme.

21
The fundamental unit of time in this TDMA scheme is called a burst
period and it lasts approx. 0.577 ms. Eight burst periods are grouped
into a TDMA frame (approx. 4.615 ms), which forms the basic unit for
the definition of logical channels. One physical channel is one burst
period per TDMA frame.

 4.1 Air interface for logical channel

In real networking, each cell has several carrier frequencies and each
frequency has eight timeslots, proving eight basic physical channels.

Logical channel carries out time multiplexing in one physical channel.

It is classified according to the type of information in physical channel.

Different logical channel transmits different type of information

between BS and MS, such as signaling and data service. GSM defines
different burst type for different logical channel.

Several logical channels are mapped onto the physical channels. The
organization of logical channels depends on the application and the
direction of information flow (uplink/downlink or bidirectional).

A logical channel can be either a traffic channel (TCH), which carries

user data, or a signaling channel.

22
  4.2 Traffic channels on the air interface

A traffic channel (TCH) is used to carry speech and data traffic. Traffic
channels are defined using a 26-frame multiframe, or group of 26
TDMA frames. The length of a 26-frame Multiframe is 120 ms, which is
how the length of a burst period is defined (120 ms divided by 26
frames divided by 8 burst periods per frame).

Out of the 26 frames, 24 are used for traffic, 1 is used for the slow
associated control channel (SACCH) and 1 is currently unused.

23
TCHs for the uplink and downlink are separated in time by 3 burst
periods, so that the MS does not have to transmit and receive
simultaneously, thereby simplifying the electronic circuitry. This
method permits complex antenna & duplex filters to be avoided and
thus helps to cut power consumption.

In addition to these full-rate TCHs (TCH/F, 22.8 kbit/s), half-rate TCHs

(TCH/H, 11.4 kbit/s) are also defined. Half-rate TCHs double the
capacity of a system effectively by making it possible to transmit two
calls in a single channel.

 4.3 Signaling channels on the air

interface

The signaling channels on the air interface are used for call
establishment, paging, call maintenance, synchronization, etc.

There are 3 groups of signaling channels:-

 4.3.1 The broadcast channels (BCH):

Carry only downlink information and are responsible mainly for

synchronization and frequency correction.

This is the only channel type enabling point-to-multipoint

communications in which short messages are simultaneously
transmitted to several mobiles.

The BCHs include the following channels:

 The broadcast control channel (BCCH):

General information, cell specific; e.g. local area code (LAC), network
operator, access parameters, list of neighboring cells, etc.

The MS receives signals via the BCCH from many BTSs within the same
network and/or different networks.

 The frequency correction channel (FCCH):

24
Downlink only; correction of MS frequencies; transmission of frequency
standard to MS;

It is also used for synchronization of an acquisition by providing the

boundaries between timeslots and the position of the first timeslot of a
TDMA frame.

 The synchronization channel (SCH):

Downlink only; frame synchronization (TDMA frame number) and

identification of base station. The valid reception of on SCH burst will
provide the MS with all the information needed to synchronize with a
BTS.

 4.3.2 The Common Control Channels (CCCH):

A group of uplink and downlink channels between the MS card and the
BTS. These channels are used to convey information from the network
to MSs and provide access to the network.

The CCCHs include the following channels:

¬ The Paging Channel (PCH):

Downlink only; the MS is informed by the BTS for incoming calls via the
PCH.

 The Access Grant Channel (AGCH):

Downlink only; BTS allocates a TCH or SDCCH to the MS, thus allowing
the MS access to the network.

 The Random Access Channel (RACH):

Uplink only; allows the MS to request an SDCCH in response to a page

or due to a call; the MS chooses a random time to send on this
channel.

The PCH and AGCH are transmitted in one channel called the paging
and access grant channel (PAGCH). They are separated by time.

25
  4.3.3 The Dedicated Control Channels
(DCCH):

Responsible for e.g. roaming, handovers, encryption, etc. The DCCHs

include the following channels:

 The Stand-alone Dedicated Control Channel

(SDCCH):

Communications channel between MS and the BTS; signaling

during call setup before a traffic channel (TCH) is allocated;

 The Slow Associated Control Channel (SACCH):

Transmits continuous measurement reports (e.g. field strengths) in

parallel to operation of a TCH or SDCCH; needed, e.g. for handover
decisions; always allocated to a TCH or SDCCH; needed for “non-
urgent” procedures,

E.g. for radio measurement data, power control (downlink only), timing
advance, etc.; always used in parallel to a TCH or SDCCH.

 The Fast Associated Control Channel (FACCH):

Similar to the SDCCH, but used in parallel to operation of the TCH; if

the data rate of the SACCH is insufficient, “borrowing mode” is used:

Additional bandwidth is borrowed from the TCH; this happens for

messages associated with call establishment authentication of the
subscriber, handover decisions, etc.

Almost all of the signaling channels use the “normal burst” format
(Burst formats), except for the RACH (Random Access Burst), FCCH
(Frequency Correction Burst) and SCH (Synchronization Burst)
channels.

 4.4 Burst formats

Burst is the message layout of a timeslot in TDMA channel, which

means each burst is sent to a timeslot of TDMA frame.
26
Different message in the burst determines its layout.

A timeslot is a 576 ms time interval, i.e. 156.25 bits duration, and its
physical contents are known as a burst. Five different types of bursts
exist in the system. They are distinguished by different TDMA frame
divisions.

 The normal burst (NB): Used to carry information on traffic

and control channels, except for RACH. It contains 116 encrypted
bits.

 The frequency correction burst (FB): Used for frequency

synchronization of the mobile. The contents of this burst are
used to calculate unmodulated, sinusoidal oscillation, onto which
the synthesizer of the mobiles is clocked.

 The synchronization burst (SB): Used for time

synchronization of the mobile. It contains a long training
sequence and carries the information of a TDMA frame number.

 The access burst (AB): Used for random access and

characterized by a longer guard period (256 ms) to allow for
burst transmission from a mobile that does not know the correct
timing advance at the first access to a network (or after
handover).

 The dummy burst (DB): Transmitted as a filler in unused

timeslots of the carrier; does not carry any information but has
the same format as a normal burst (NB).

5. MSC-based interfaces

27
All of the interfaces around the MSC use SS7-based protocols. The B, C,
D, F and G interfaces are referred to as MAP interfaces. These connect
either the MSC to registers or registers to other registers.

The E interface supports the MAP protocol and calls setup protocols
(ISUP/ TUP). This interface connects one MSC to another MSC within the
same network or to another network's MSC.

They are designated as follows:

B interface: between MSC and VLR (use MAP/TCAP protocols)

C interface: between MSC and HLR (MAP/TCAP)
D interface: between HLR and VLR (MAP/TCAP)
E interface: between two MSCs (MAP/TCAP + ISUP/TUP)
F interface: between MSC and EIR (MAP/TCAP)
G interface: between VLRs (MAP/TCAP).

Fixed network interfaces:

 Via TUP protocol: between MSC and analog/digital networks
 Via ISUP protocol: between MSC and analog/digital networks &
provides more features than TUP
 Via INAP protocol: between MSC and IN.

The SCCP protocol provides connectionless message transport to and

from the GSM network databases for TCAP and MAP messaging. Here,
two connection types are also distinguished:

 Circuit-related call control: Related to ISUP and TUP

 Non circuit-related call control: The mobile application part (MAP)
protocol is used here, allowing implementation of functions such
as location updating/roaming, SMS delivery, handover,
authentication and incoming call routing information. The MAP
protocol uses the transaction capability application part (TCAP)
protocol to transfer real-time information (between MSCs, HLRs
and VLRs).
28
  5.1 MSC protocols:-

 MAP (Mobile Application Part):

Used to control queries to the different databases in the mobile

radio network (HLR, VLR and EIR). MAP responsibilities include
access and location management

(E.g. where is the called subscriber currently?), MSC-MSC handover,

security functions, O&M, SMS and supplementary services.

 TCAP (Transaction Capabilities Application Part):

Provides universal calls and functions for handling requests to

distributed application processes.

 ISUP (ISDN User Part):

Controls interworking (e.g. call setup/takedown) between PLMNs

and other networks, and provides the same basic functionalities as
TUP.

 INAP (Intelligent Network Application Part):

Implements intelligent supplementary services (e.g. free call, time-

dependent routing functions in a central service center).

 TUP (Telephone User Part):

Implements interworking between PLMNs and other networks.TUP is

normally used to provide international connections and is slowly
being replaced by ISUP.

 5.2 Data Transmission

Radio channel has totally different characteristics from wired channel.
Radio channel has a strong time-varying characteristic.

It has a high error rate when the signal is influenced by interferences,

multipath fading, or shadow fading. In order to solve these problems, it
is necessary to protect the signals through a series of transformation
and inverse transformation from original subscriber data or signaling

29
data to the information carried by radio wave and then to subscriber
data or signaling data.
These transformations include channel coding and decoding,
interleaving and de-interleaving, burst formatting, encryption and
decryption, modulation and demodulation. See

FIG: - Forward and reverse data transmission process

 5.3 Voice Coding

Modern digital communication system usually uses voice compression
technology. GSM takes tone and noise from human throat as well as
the mouth and tongue filter effect of acoustics as voice encoder to
establish a model. The model parameters transmit through TCH
channel.

30
Voice encoder divides voice into several 20 ms voice blocks and
samples each block with 8 kHz, so each block has 160 samples.

 5.3.1 Channel Coding

Channel coding is used to improve transmission quality and remove

the influence of interferential factors on signals at the price of
increasing bits and information.

The basic way of coding is adding some redundant information to the

original data. The added data is calculated on the basis of original data
with certain rules.

Different code is used in different transmission mode. In practice,

several coding schemes are always combined together. Common
coding schemes include block convolutional code, error correcting
cyclic code and parity code.

In GSM, each logical channel has its own coding and interleaving
mode, but the principle is trying to form a unified coding structure.

 Encode information bit into a unified block code consisting

of information bits and parity check bits.
 Encode block code into convolutional code and form
coding bits (usually 456 bits).
 Reassemble and interleave coding bits and add a stealing
flag to form interleaving bits.

All these operations are based on block. The block size depends on
channel type. After channel coding, all channels (except RACH and
SCH) are made of 464-bit block, that is, 456 coded information bits
plus 8-bit header (header is used to distinguish TCH and FACCH).

In TCH/F voice service; this block carries one speech frame of

Information. In control channel, this block usually carries one piece of
information.

In TCH/H voice service, speech information is transmitted by a block of

228 coded bits block.
For FACCH, each block of 456 coded information bits is divided into
eight sub blocks.

The first four sub blocks are transmitted by even bits of the four
timeslots borrowed from the continuous frames of TCH, and the rest
four sub blocks borrows odd bits of the four timeslots from the four
continuous frames delayed for two or four frames after the first frame.

31
  5.3.2 Interleaving

If speech signal is modulated and transmitted directly after channel

coding, due to parametric variation of mobile communication channel,
the long trough of deep feeding will affect the succeeding bits, leading
to error bit strings.

That is to say, after coding, speech signal turns into sequential frames,
while in transmission, error bits usually occur suddenly, which will
affect the accuracy of continuous frames.

Channel coding only works for detection and correction of signal error
or short error string. Therefore, it is hoped to find a way to separate
the continuous bits in a message, that is, to transmit the continuous
bits in a discontinuous mode so as to change the error channel into
discrete channel.

Therefore, even if an error occurs, it is only about a single or very short

bit stream and will not interrupt the decoding of the entire burst or
even the entire information block.

Channel coding will correct the error bit under such circumstances.
This method is called interleaving technology.

Interleaving technology is the most effective code grouping method to

separate error codes.

The essence of interleaving is to disperse the b bits into n bursts in

order to change the adjacent relationship between bits. Greater n
value leads to better transmission performance but longer
transmission delay.

Therefore, these two factors must be considered in interleaving.

Interleaving is always related to the use of channel. GSM adopts

secondary interleaving method.

After channel coding, The 456 bits are divided into eight groups; each
group contains 57 bits. This is the first interleaving, also called
internal interleaving.
After first interleaving, the continuity of information in a group is
broken. As one burst contains two groups of 57-bit voice information, if
the two-group 57 bits of a 20 ms voice block after first interleaving are
inserted to the same burst, the loss of this burst will lead to 25% loss
of bits for this 20 ms voice block. Channel coding cannot restore so
much loss.

32
Therefore, a secondary interleaving, also called inter-block
interleaving, is required between two voice blocks. The entire
interleaving process is shown in Fig.

Interleaving process

After internal interleaving, the 456 bits of a voice block B are divided
into eight groups. Interleave the first four groups of voice block B (B0,
B1, B2, and B3) with the last four groups of voice block A (A4, A5, A6,
and A6), and then (BO, A4), (B1, A5), (B2, A6), and (B3, A7) form four
bursts.

In order to break the consistency of bits, put block A at even position

and block B at odd position of bursts, that is, to put B0 at odd position
and A4 at even position. Similarly, interleave the last four groups of
block B with the first four groups of block C.

Therefore, a 20 ms speech frame is inserted into eight normal bursts

after secondary interleaving. Theses eight bursts are transmitted one
by one, so the loss of one burst only affects 12.5% voice bits.
In addition, as these bursts have no relations with each other, they can
be corrected by channel coding.

The secondary interleaving of control channel (SACCH, FACCH, SDCCH,

BCCH, PCH, or AGCH) is different from voice interleaving which
requires three voice blocks.
The 456-bit voice block is divided into eight groups after internal
interleaving (the same as that of voice block), and then the first four
groups are interleaved with the last four groups (the same interleaving
method as that of voice block) to get four bursts.

33
Interleaving is an effective way to avoid interference, but it has a long
delay. In the transmission of a 20 ms voice block, the delay period is
(9*8)-7=65 bursts (SACCH occupying one burst), which is 37.5 ms.
Therefore, MS and trunk circuit have echo cancellers added to remove
the echo due to delay.

 5.3.3 Encryption

Security is a very important feature in digital transmission system.

GSM provides high security through transmission encryption. This kind
of encryption can be used in voice, user data, and signaling. It is used
for normal burst only and has nothing to do with data type.

 5.3.4 Modulation and Demodulation

Modulation and demodulation is the last step of signal processing. GSM

modulation adopts GMSK technology with BT being 0.3 at the speed of
270.833 Kbit/s and Viterbi algorithm.

The function of modulation is to add a certain feature to

electromagnetic wave according to the rules. This feature is the data
to transmit. In GSM, the phase of electromagnetic field bears the
information.

The function of demodulation is to receive signals and restore the data

in a modulated electromagnetic wave. A binary numeral has to be
changed into a low-frequency modulated signal first, and then into an
electromagnetic wave. Demodulation is the reverse process of
modulation.

 5.3.5 Timing advance

Signal transmission has a delay. If the MS moves away from BTS during
calling, the signal from BTS to MS will be delayed, so will the signal
from MS to BTS. If the delay is too long, the signal in one timeslot from
MS cannot be correctly decoded, and this timeslot may even overlap
with the timeslot of the next signal from other MS, leading to inter-
timeslot interference.

Therefore, the report header carries the delay value measured by MS.
BTS monitors the arrive time of call and send command to MS with the
frequency of 480 ms, prompting MS the timing advance (TA) value. The
range of this value is 0–63(0–233 us), and the maximum coverage area
is 35km. The calculation is as follows:

1/2×3.7us/bit×63bit*c=35km

34
3.7us/bit is the duration per bit (156/577); 63bit is the maximum bit for
time coordination; c is light velocity (transmission rate of signal); 1/2 is
related to the round-trip of signal.

According to the preceding description, 1bit to 554 m, due to the

influence of multi-path transmission and the accuracy of MS
synchronization, TA error may be about 3 bits (1.6km).

Sometimes a greater coverage area is required, such as in coastal

areas. Therefore, the number of channels that each TRX contains must
be reduced. The method is to bind odd and even timeslots, so there
are only four channels (0/1, 2/3, 4/5, and 6/7) for each TDMA frame in
extended cell. Allocate channels 0, 2, 4, and 6 to MS.

Within 35 KM around BTS, the TA value of MS is in the normal range 0-

63; for the area beyond 35 KM, TA value stays at 63.

This technology is called extended cell technology. The maximum

value of TA in BTS measurement report is 63+156.25=219.25 bit, so
the maximum radius of coverage area is:

1/2×3.7us× (63+156.25) ×3×108m/s=120km

Principle of dual timeslot extended cell

The principle of dual timeslot extended cell is shown in Fig. In real

scheme, in order to improve the utilization of TRX, both common TRXs
and dual timeslot TRXs can be included. BCCH must be in dual timeslot
TRX to receive random access from any area.
35
The calls within 35 km are allocated to common TRX; the calls within
35 km–120 km and the switched in calls are allocated to dual timeslot
TRX. If the system detects the switched in call is within 35km, it will
switch over this call to common TRX. If the MS in conversation goes
beyond 35 km, an intra-cell switchover will be carried out. Therefore,
both the capacity requirement for remote areas and the coverage
requirement for local areas can be satisfied.

6. Mobile Terminated Call

36
  Handover:

In a cellular network, the radio and fixed voice connections are not
permanently allocated for the duration of a call. Handover or
handoff as it is called in North America, means switching an
ongoing call to a different channel or cell. The execution and
measurements required for handover are a basic function of the RR
protocol layer.

There are four different types of handovers in GSM, which involve

transferring a connection between:

(1) Channels (timeslots) in the same cell (intra-BTS handover)

(2) Cells under the control of the same BSC.
(3) Cells under the control of different BSCs, but belonging to the same
MSC (inter-BSC handover)
(4)Cells under the control of different MSCs (inter-MSC handover)

The first two types of handover involve only one base station
controller (BSC). To save signaling bandwidth, they are managed by

37
the BSC without involving the MSC, except to notify it upon
completion of the handover.

The last two types of handover are handled by the MSCs involved.
An important aspect of GSM is that the original MSC, the anchor
MSC, remains responsible for most call-related functions, with the
exception of subsequent inter-BSC handovers under the control of
the new MSC, called the relay MSC.

Handovers can be initiated by either the BSC or the MSC (as a

means of traffic load balancing). During its idle timeslots, the mobile
scans the broadcast control channel of up to 16 neighboring cells,
and forms a list of the six best candidates for possible handover,
based on the received signal strength. This information is passed to
the BSC and MSC, at least once per second, and is used by the
handover algorithm.

The decision on when to initiate a handover is a function of the

following parameters:
 Receive quality,
 Receive level.
Successful handovers in GSM can take place at propagation speeds
of up to 250 km/h.

 Transmission Overview
During communication, only 40% time is used for conversation; no
useful information is transmitted during the rest 60% time.

If all the information is transmitted to network, many of the system

resources will be wasted, in addition, the interference will
aggravate.

In order to solve this problem, GSM adopts DTX technology to stop

signal transmission when there is no voice signal. Therefore, the
interference level is reduced and the system efficiency is improved.

There are two kinds of transmission modes in GSM: normal mode

and discontinuous transmission (DTX) mode.

In normal mode, noise and voice have the same transmission

quality. In DTX mode, the transmission of unuseful messages is
prohibited. MS only sends man-made noise signals that are
tolerable, which

38
means this noise will not annoy the listeners nor affect the
conversation. This kind of noise is called comfort noise.

In DTX mode, 260-bit code is transmitted in every 480 ms; in

normal mode, 260-bit code is transmitted in every 20 ms.

Whether the downlink DTX is adopted or not is controlled by

network operators of the exchange part. This kind of control is
based on BSC.

The control information is transmitted to base band processing part

through dedicated signaling channel, and then arrives at TC through
the in band signaling of TRAU frame to indicate whether downlink
DTX is adopted. For some vendors, the downlink DTX can be
configured on the basis of cell.

To reduce the MS's power consumption and minimize interference

on the air interface, user signal transmission is interrupted during
pauses in speech. “Comfort noise” is artificially generated by the
MS to avoid disruption due to an abrupt interruption in speech.

 Discontinuous reception (DRX):

Another method used to conserve power at the mobile station is

discontinuous reception. The paging channel, used by the base
station to signal an incoming call, is structured into sub-channels.

Each mobile station needs to listen only to its own sub-channel. In

the time between successive paging sub-channels, the mobile can
go into sleep mode, when almost no power is used.

 Power control:

Power control is to change the transmission power of MS or BTS (or

both) in radio mode within certain area. Power control can reduce
the system interference and improve the spectrum utilization and
prolong the service time of MS battery. When the Relev and quality
is good, the transmission power of the peer end can be reduced to
lower the interference to other calls.

39
In GSM, power control can be used in uplink and downlink
respectively. The power control range for uplink MS is 20 dB–30dB.
Based on the power class of MS (most MSs belongs to class 4, which
means the maximum transmission power is 33 dbm), each step can
change 2 dB. The downlink power control range is decided by
equipment manufacturer. Although whether to adopt uplink or
downlink power control function is decided by network operators, all
MSs and BTS equipments must support this function. BSS manages
the power control in the two directions.

Several classes of mobile stations are defined in the GSM

specifications, according to their peak transmitter power. To
minimize co-channel interference and to conserve power, both the
mobiles and the base transceiver stations operate at the lowest
power level that will maintain an acceptable signal quality. Power
levels can be stepped up or down in steps of 2 dBm from the peak
power for the class down to a minimum of 13 dBm (20 mill watts for
MS).

The mobile station and BTS continually measure the signal strength
or signal quality (based on the bit error ratio), and pass the
information to the base station controller, which ultimately decides
if and when the power level should be changed.

40
 7. System features
This section provides a brief description of the GSM network
features.

 Roaming:

The roaming feature allows a user to make and receive calls in any
GSM network and to use the same user-specific services
worldwide1.

This requires a roaming agreement between the individual

operators. With worldwide roaming the MS is accessible under the
same phone number everywhere.

 Multipath equalization:

At the 900 MHz range, radio waves bounce off everything buildings,
hills, cars, airplanes, etc. Many reflected signals, each with a
different phase, can reach an antenna (also known as “multipath
propagation”).

Equalization is used to extract the desired signal from the unwanted

reflections. It works by finding out how a known transmitted signal
is modified by multipath fading, and constructing an inverse filter to
extract the rest of the desired signal.

This known signal is the 26-bit training sequence transmitted in the

middle of every time-slot burst.

The actual implementation of the equalizer is not specified in the

GSM specifications.

 Frequency hopping:

41
The mobile station has to be frequency-agile, meaning it can move
between different frequencies in order to transmit and receive data,
etc.

A normal handset is able to switch frequencies 217 times per

second.

GSM makes use of this frequency agility to implement slow

frequency hopping, where the mobile and the BTS transmit each
TDMA frame on a different carrier frequency. The frequency
hopping algorithm is broadcast on the broadcast control channel.
Since multipath fading is dependent on the carrier frequency, slow
frequency hopping helps alleviate the problem. In addition, co-
channel interference is in effect randomized.

The broadcast and common control channels are not subject to

frequency hopping and are always transmitted on the same
frequency.

 Short Message Service (SMS)

SMS offers message delivery (similar to “two-way-paging”) that is

guaranteed to reach the MS.

If the GSM telephone is not turned on, the message is held for later
delivery. Each time a message is delivered to an MS; the network
expects to receive an acknowledgement from this MS that the
message was correctly received. Without a positive
acknowledgement the network will re-send the message or store it
for later delivery.

SMS supports messages up to 160 characters in length that can be

delivered by any GSM network around the world wherever the MS is
able to roam.

 Call Waiting (CW)

CW is a network-based feature that must also be supported by the

GSM telephone (MS). With CW, GSM users with a call in progress will
receive an audible beep to alert them that there is an incoming call
for the MS. The incoming call can be accepted, sent to voice mail or
rejected.

42
If the incoming call is rejected, the caller will receive a busy signal.
Once the call is accepted, the original call is put on hold to allow a
connection to the new incoming call.

 Call Hold (CH)

CH must be supported by the MS and the network. It allows the MS

to “park” an “in progress call”, to make additional calls or to receive
incoming calls.

 Call Forwarding (CF)

This is a network-based feature that can be activated by the MS. CF

allows calls to be sent to other numbers under conditions defined by
the user. These conditions can be either unconditional or dependent
on certain criteria (no answer, busy, not reachable).

 Calling Line ID

Calling Line ID must be supported by the GSM network and the

telephone.

The GSM telephone displays the originating telephone number of

incoming calls. This feature requires the caller's network to deliver
the calling line ID (telephone no.) to the GSM network.

 Mobility Management (MM)

The GSM network keeps track of which mobile telephones are

powered on and active in the network. To provide as efficient call
delivery as possible,

The network keeps track of the last known location of the MS in the
VLR and HLR. Radio sites connected to the MSC are divided into
groups called “location areas”. When a call is designated for an
MS, the network looks for the MS in the last known location area.

 Authentication

43
Authentication normally takes place when the MS is turned on with
each incoming call and outgoing call. A verification that the »Ki«
(security code) stored in the AuC matches the »Ki« stored in SIM
card of the MS completes this process. The user must key in a PIN
code on the handset in order to activate the hardware before this
automatic procedure can start.

8. The Evolution Path For GSM

44
9. GSM glossary

45
46
47
The GSM network consists mainly of the following functional
parts:

MSC

The mobile service switching centre (MSC) is the core switching

entity in the network.

The MSC is connected to the radio access network (RAN); the RAN is
formed by the BSCs and BTSs within the Public Land Mobile Network
(PLMN).

Users of the GSM network are registered with an MSC; all calls to
and from the user are controlled by the MSC.

A GSM network has one or more MSCs, geographically distributed.

VLR

The visitor location register (VLR) contains subscriber data for

subscribers registered in an MSC. Every MSC contains a VLR.
Although MSC and VLR are individually addressable.

GMSC

The gateway MSC (GMSC) is the switching entity that controls

mobile terminating calls.

When a call is established towards a GSM subscriber, a GMSC

contacts the HLR of that subscriber, to obtain the address of the
MSC where that subscriber is currently registered. That MSC
address is used to route the call to that subscriber.

HLR
48
The home location register (HLR) is the database that contains a
subscription record for each subscriber of the network.

A GSM subscriber is normally associated with one particular HLR.

The HLR is responsible for the sending of subscription data to the
VLR (during registration) or GMSC (during mobile terminating, call
handling).

CN

The core network (CN) consists of, amongst other things, MSC(s),
GMSC(s) and HLR(s). These entities are the main components for
call handling and subscriber management. Other main entities in
the CN are the equipment identification register (EIR) and
authentication centre (AUC).

BSS

The base station system (BSS) is composed of one or more base

station controllers (BSC) and one or more base transceiver stations
(BTS).

The BTS contains one or more transceivers (TRX).

The TRX is responsible for radio signal transmission and reception.

BTS and BSC are connected through the Abis interface.

The BSS is connected to the MSC through the A interface.

MS

The mobile station (MS) is the GSM handset.

49