GSM

Global System
for Mobiles
1

TOPICS

GSM CONCEPTS
GSM SYSTEM ARCHITECTURE
IDENTITIES USED IN GSM
GSM CHANNELS
GSM RADIO LINK
MOBILITY MANAGEMENT
CALL MANAGEMENT
RADIO RESOURCE MANAGEMENT

TOPICS

GSM CONCEPTS
GSM SYSTEM ARCHITECTURE
IDENTITIES USED IN GSM
GSM CHANNELS
GSM RADIO LINK
MOBILITY MANAGEMENT
CALL MANAGEMENT
RADIO RESOURCE MANAGEMENT

Background to GSM
1G : Advanced Mobile Phone Service (AMPS)
Analog, Circuit Switched, FDMA, FDD

2G : Digital Advanced Mobile Phone Service (D-AMPS)

Digital, Circuit Switched, FDMA, FDD

2G : Global System for Mobile (GSM)

Digital, Circuit Switched, FDMA and TDMA, FDD

2G : Code Division Multiple Access (CDMA)

Digital, Circuit Switched, FDMA, SS, FDD

Cellular Network Basics

There are many types of cellular services;
Cellular network/telephony is a radio-based technology;
radio waves are electromagnetic waves that antennas
propagate
Most signals are in the 850 MHz, 900 MHz, 1800 MHz,
and 1900 MHz frequency bands

Cell phones operate in this frequency range

(note the logarithmic scale)

Cellular Network
Base stations transmit to and receive from mobiles at the
assigned spectrum
Multiple base stations use the same spectrum (spectral
reuse)
The service area of each base station is called a cell
Each mobile terminal is typically served by the closest
base stations
Handoff when terminals move

3G, 3.5G and 4G (LTE)

3G Overview
3G is created by ITU-T and is called IMT-2000

Evolution from 2G
2G

2.5G

IS-95

IS-95B

GSM-

GPRS
HSCSD

Cdma2000-1xRTT
3G

IS-136 & PDC

EDGE

W-CDMA
EDGE

Cdma2000-1xEV,DV,DO
Cdma2000-3xRTT
3GPP2

TD-SCDMA
3GPP

Service Roadmap
Improved performance, decreasing cost of delivery
Broadband
in wide area

3G-specific
3G-specific services
services take
take
advantage
of
higher
bandwidth
advantage of higher bandwidth
and/or
and/or real-time
real-time QoS
QoS

Video sharing
Video telephony
Real-time IP
A
Anumber
number of
of mobile
mobile
Multitasking
multimedia and games
services
services are
are bearer
bearer
WEB
browsing
Multicasting
independent
independent in
in nature
nature
Corporate data access
Streaming audio/video
MMS picture / video
xHTML browsing
Application downloading
E-mail
Presence/location
Voice & SMS
Push-to-talk
EGPRS
473
kbps

WCDMA
2
Mbps

HSDPA
1-10
Mbps
CDMA
2000EVDV

GPRS
171
kbps

CDMA
2000EVDO

GSM
9.6
kbps

CDMA
2000 1x

Typical
average bit
rates
(peak rates
higher)

GSM Evolution to 3G
High Speed Circuit Switched Data
Dedicate up to 4 timeslots for data
connection ~ 50 kbps
Good for real-time applications c.w. GPRS
Inefficient -> ties up resources, even when
nothing sent
Not as popular as GPRS (many skipping
HSCSD)
Enhanced Data Rates for Global Evolution
GSM
9.6kbps (one
timeslot)
GSM Data
Also called CSD
GSM

HSCSD

GPRS

Uses 8PSK modulation

3x improvement in data rate on short
distances
Can fall back to GMSK for greater
distances
Combine with GPRS (EGPRS) ~ 384 kbps
Can also be combined with HSCSD

General Packet Radio Services

Data rates up to ~ 115 kbps
Max: 8 timeslots used as any one time
Packet switched; resources not tied up all the
time
Contention based. Efficient, but variable
delays

GSM / GPRS core network re-used by

WCDMA
EDGE

UMTS
Universal Mobile Telecommunications System (UMTS)
UMTS is an upgrade from GSM via GPRS or EDGE
The standardization work for UMTS is carried out by Third
Generation Partnership Project (3GPP)
Data rates of UMTS are:
144 kbps for rural
384 kbps for urban outdoor
2048 kbps for indoor and low range outdoor
Virtual Home Environment (VHE)

UMTS Frequency Spectrum

UMTS Band
1900-2025 MHz and 2110-2200 MHz for 3G
transmission
In the US, 17101755MHz and 21102155MHz will
be used instead, as the 1900MHz band was already
used.

UMTS Architecture
Mobile Station

ME

SIM

Base Station
Subsystem

BTS

BSC

Network Subsystem

MSC/
VLR

EIR

Other Networks

GMSC

HLR

PSTN

AUC

PLMN

RNS

ME

USIM

S
D

Node
B

RNC

SGSN

GGSN

Internet

UTRAN

Note: Interfaces have been omitted for clarity purposes.

UMTS Network Architecture

UMTS network architecture consists of three domains
Core Network (CN): Provide switching, routing and
transit for user traffic
UMTS Terrestrial Radio Access Network (UTRAN):
Provides the air interface access method for user
equipment.
User Equipment (UE): Terminals work as air interface
counterpart for base stations. The various identities
are: IMSI, TMSI, P-TMSI, TLLI, MSISDN, IMEI, IMEISV

UTRAN
Wide band CDMA technology is selected for UTRAN air
interface
WCDMA
TD-SCDMA
Base stations are referred to as Node-B and control
equipment for Node-B is called as Radio Network
Controller (RNC).
Functions of Node-B are
Air Interface Tx/Rx
Modulation/Demodulation
Functions of RNC are:
Radio Resource Control
Channel Allocation
Power Control Settings
Handover Control
Ciphering
Segmentation and reassembly

3.5G (HSPA)
High Speed Packet Access (HSPA) is an amalgamation
of two mobile telephony protocols, High Speed
Downlink Packet Access (HSDPA) and High Speed
Uplink Packet Access (HSUPA), that extends and
improves the performance of existing WCDMA
protocols
3.5G introduces many new features that will enhance
the UMTS technology in future. 1xEV-DV already
supports most of the features that will be provided in
3.5G. These include:
- Adaptive Modulation and Coding
- Fast Scheduling
- Backward compatibility with 3G
- Enhanced Air Interface

4G (LTE)

LTE stands for Long Term Evolution

Next Generation mobile broadband technology
Promises data transfer rates of 100 Mbps
Based on UMTS 3G technology
Optimized for All-IP traffic

Advantages of LTE

Comparison of LTE Speed

Major LTE Radio Technogies

Uses Orthogonal Frequency Division
Multiplexing (OFDM) for downlink
Uses Single Carrier Frequency Division Multiple
Access (SC-FDMA) for uplink
Uses Multi-input Multi-output(MIMO) for
enhanced throughput
Reduced power consumption
Higher RF power amplifier efficiency (less
battery power used by handsets)

GSM History

23

Development of the GSM Standard

1982:

Groupe Spcial Mobile (GSM)

created

1984:

Description of GSM features

1985:

List of recommendations settled

1987:

Initial MoU (Memorandum of

Understanding) aside the drafting
of technical specifications was
signed by network operators of 13
countries:

1992:

Official commercial launch of

GSM service in Europe. First
Launch in Finland

1993:
The GSM-MoU has 62
signatories in 39 countries
worldwide.
1995:

Specifications of GSM phase 2

are frozen.

1999:

GSM MoU joins 3GPP (UMTS)

GPRS Trials begins

480M GSM subscribers

Worldwide
First GPRS Networks roll out

1988:

Validation and trials, of the radio

interface.

2000:

1991:

First system trials are

demonstrated at the Telecom 91
exhibition.

End 2002:

792M GSM subscribers

Worldwide
24

GSM Specifications
12 SERIES
OPERATION AND
MAINTENANCE

01 SERIES
GENERAL

02 SERIES
SERVICE ASPECTS

11 SERIES
EQUIPMENT AND TYPE
APPROVAL SPECIFICATIONS

03 SERIES
NETWORK ASPECTS

10 SERIES
SERVICE INTERWORKING

04 SERIES
MS-BSS INTERFACE AND
PROTOCOLS

09 SERIES
NETWORK
INTERWORKING

05 SERIES
PHYSICAL LAYER ON THE
RADIO PATH.

08 SERIES
BSS TO MSC INTERFACES

07 SERIES
TERMINAL ADAPTERS
FOR MOBILE STATIONS

06 SERIES
SPEECH CODING
SPECIFICATIONS

Increasing GSM Data Rates

UMTS

photo

E/GPRS

web

video
clip

report

video
report clip

photo

ISDN

e-mail web

photo

PSTN

e-mail

web

GSM

e-mail

Transmission
Time

10 sec

video
report clip
video
report clip

photo

web

photo

1 min

video
report clip

10 min

GPRS = General Packet Radio Service

HSCSD = High Speed Circuit Switched Data
EDGE = Enhanced Data rate for GSM Evolution
UMTS = Universal Mobile Telecommunication System

1 hour

Wireless Data Technology Options

2M
throughput kbps

1M

et
k
c
pa
100 k

it
u
c
cir

64 k

10 k

1k

9.6

EDGE

UMTS

HSCSD

14.4

GPRS

Time frame
1998

1999

2000

2001

2002

GPRS = General Packet Radio Service

HSCSD = High Speed Circuit Switched Data
EDGE = Enhanced Data rate for GSM Evolution
UMTS = Universal Mobile Telecommunication System
27

Circuit-Switched or Packet-Switched
Circuit mode

Packet mode

GFH

D
A
C

FGH

A
D
C

GFH

C
A
D

28

Multiple Access Technique

Multiple Access Achieved by dividing the available
radio frequency spectrum, so that multiple users can
be given access at the same time.
FDMA - Frequency Division Multiple Access
( eg: GSM each Frequency channel is 200KHz)
TDMA - Time Division Multiple Access
( eg: GSM each frequency channel is divided into
8 timeslots)
CDMA - Code Division Multiple Access
(eg: IS95- Each User data is coded with a unique
code)
29

Duplex Technique
Duplex - How the up link and Down link of a user
is separated
FDD - Frequency Division Duplex
(eg:In GSM the up link and down link of a user is
separated by 45MHz )

TDD - Time Division Duplex

(the up link and down link of a user will be at the same
frequency but at different Time )

30

What are the types in

GSM Network?
GSM-900 (Channels 125 operating band 900Mhz
carrier spacing 200khz spacing 45Mhz)
GSM -1800 (Channels 374 spacing 95Mhz)
GSM -1900(Used in USA)

32

GSM Band Allocations (MHz)

GSM
systems

GSM 450
GSM 480
GSM 850

Uplink

450.4457.6
478.8486
824-849

Downlin
k

Duple
Ban x
Duplex
d
Spacin channels
g

460.4467.6
488.8496
869-894

2x7.
2
2x7. 10
2
10
45
2x2
5

35
35
124

2x2
GSM 900
5
Frequencies are
in MHz
E-GSM
890-915
935-960
45
124
2x3
(900)
880-915 925-960
45
174
5
Carrier frequency
= ARFCN921-925
= Absolute Radio Frequency
R-GSM
876-880
41 Channel
40Number
2x0
(900)
4
1710-

1805-

2x7

GSM Family Radio Band Spectrum

Uplink

450.4

457.6

478.8

GSM 450

Downlink

460.4

824

GSM 480

467.6

488.8

849

GSM 850

496

869

894

MHz

915

Uplink
876 880

486

915
890

915

1710

1785

1850

1910

P-GSM
E-GSM

GSM 1800

GSM 1900

R-GSM
921 925

Downlink

935

960
960
960

1805

1880

1930

1990

MHz

Traffic/Signaling
Traffic
bla bla bla...

Signaling

RING !
riiiiing

Network

MS

GSM - Network Structure

Um
BTS

HLR

VLR
BSC
Abis

MSC
A

MS

GMSC

BTS
E
Abis
A

MSC

F
EIR

E
PSTN

BSC
Um
BTS

X.25
VLR
X.25
OMC Server
36

AuC

GSM System specifications

Frequency band
Uplink
890 - 915 MHz
Downlink
935 - 960MHz
Duplex Frequency Spacing 45MHz
Carrier separation
200KHz
Frequency Channels
124
Time Slots /Frame(Full Rate)8
Voice Coder Bit Rate
13Kbps
Modulation
GMSK
Air transmission rate
270.833333 Kbps
Access method
FDMA/TDMA
Speech Coder
RPE-LTP-LPC
37

Paired Radio Channels in GSM

Case of GSM 900

Uplink
890 MHz

Frequency

channel #

Downlink
915 MHz

124

935 MHz

Frequency

channel #

BTS
960 MHz

124

Example:
Channel 48

Duplex spacing = 45 MHz

Frequency band spectrum = 2 x 25 MHz
Channel spacing = 200 kHz
38

GSM Time Division Multiplex

Frame and Physical Channels
Time-slot

TDMA frame

TDMA frame

TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS
0

(frames repeat continuously)

Time
0

4.615 ms

Physical channel # 2 = recurrence of time-slot # 2

9.23 ms

Physical Channel
BTS
With FH

BTS
Without FH

time

n+1

TDMAs
n TS

n-1

MS1
MS2

MS3
1

FDMA

//

124

ARFCN

Radio Link Aspects

From Speech to RF Signal
Blah... Blah... Blah...

Blah Blah Blah...

Digitizing and
Source Coding

Source Decoding

Channel Coding

Channel Decoding

Interleaving

De-interleaving

Ciphering

Burst Formatting
Modulating

Deciphering

Burst De-formatting
Demodulating

Access Techniques
Uplink 890 MHz to 915 MHz
Down Link 935 MHz to 960 MHz
25 MHz divided into 125 channels of 200 KHz
bandwidth
UP

890.0

890.2

890.4

914.8

915.0

DOWN 935.0

935.2

935.4

959.8

960.0

43

Access Techniques ...

Time Division Multiple Access
Each carrier frequency subdivided in time domain
into 8 time slots
Each mobile transmits data in a frequency, in its
particular time slot - Burst period = 0.577 milli secs.
8 time slots called a TDMA frame. Period is .577 * 8
= 4.616 milli secs
0.577 ms
0

4.616 ms

7
44

45

Fundamentals
960 MHz
959.8MHz

TS: Time slot

124

GSM utilizes two bands of 25 MHz. 890-915

Downlink (TDMA frame) = 8 TS
MHz band is used for uplink while the 935960 MHz is used for downlink.

123

DOWNLINK

.
200KHz

935.2 Mhz

935 MHz

0 1

914.8 MHz

124

UPLINK

200KHz

4 5 6 7

The frequency bands are divided into 200

KHz wide channels called ARFCNs (Absolute
Radio Frequency
Channel Numbers) i.e.
Data burst = 156.25 bit periods = 576.9s
there are 125 ARFCNs out of which only 124
are used.

915 MHz

45 MHz

2 3

123
.

890.2 MHz

890 MHz

The technology

Each ARFCN supports 8 users with each user

transmitting / receiving on a particular time
Delay
2 3 4 5 6 7
slot (TS). 0 1

Uplink (TDMA frame)

Therefore 1 TDMA frame = 156.25 x 8 = 1250 bits

and has a duration of 576.92s46x 8 = 4.615 ms

GSM Delays Uplink TDMA Frames

BTS side

The start of the uplink TDMA

is delayed of three time-slots

TDMA Frame (4.615 ms)

Downlink TDMA
BTS

T
Down
link

MSs side
MS1

MS2

Up
link
T

Fixed transmit
delay of three
time-slots

6
R

7
R

Timing Advance

1 - Propagation Delay

M2

BTS Frame reference

d1>>d2

d2

TS0

Propagation Delay p
MSs transmit

TS1

TS2

TS3

TS4

M1

TS5

TS6

TS7

Bits Overlapping

Timing Advance
2 - Without Timing Advance: Collision
TX BTS
RX BTS

CAN

GSM

CAN

RX MS2
TX MS2

+3TS

yes

WHEN
the

WHAT
ms-isdn

yes

WHAT

GSM

the

ms-isdn

RX MS4
TX MS4
RX MS5
TX MS5

HOW

TA

RX MS1
TX MS1

RX MS3
TX MS3

WHAT

HOW

Propagation Delay

WHEN

RX MS6
TX MS6

WHAT

RX MS7
TX MS7
RX MS8
TX MS8

49

Timing Advance
3 - With Timing Advance: No Collision
TX BTS
RX BTS

CAN

RX MS1
TX MS1

CAN

RX MS2
TX MS2
RX MS3
TX MS3

WHAT

GSM

+3TS - TA
WHAT

WHEN
the

WHAT
ms-isdn

yes

the

GSM
ms-isdn

RX MS4
TX MS4
RX MS5
TX MS5

HOW
yes

HOW

Propagation Delay

WHEN

RX MS6
TX MS6
RX MS7
TX MS7

WHAT

Timing Advance = 2 * Propagation Delay

RX MS8
TX MS8

50

GSM in comparison with other

Standards
GSM gives mobility without any loss in Audio quality
Encryption techniques used gives high security in the
air Interface and also use of SIM.
Bit Interleaving for high efficiency in Transmission.
Variable Power (Power budgeting- extend battery life)
Minimum Interference.
Features-CCS7 Signaling
SMS (Short Message Services)
Emergency Calls
CELL Broadcast
51

TOPICS

GSM CONCEPTS
GSM SYSTEM ARCHITECTURE
IDENTITIES USED IN GSM
GSM CHANNELS
GSM RADIO LINK
MOBILITY MANAGEMENT
CALL MANAGEMENT
RADIO RESOURCE MANAGEMENT
52

MS

GSM - Network Structure

Um
BTS

HLR

VLR
BSC
Abis

MSC
A

MS

GMSC

BTS
E
Abis
A

MSC

F
EIR

E
PSTN

BSC
Um
BTS

X.25
VLR
X.25
OMC Server
53

AuC

GSM Network
SS
External
PSTN &
PDN N/W

VLR

Switching
System

AUC
HLR

EIR
OMC

MSC
MS Mobile Station
BTS Base transceiver System
BSC Base Station Controller
MSC Mobile Switching Center
BSS BSC
HLR Home Location Register
VLR Visitor Location Register
BTS
EIR Equipment Identity Register
AUC Authentication Center
MS
OMC Operation And Maintenance Center

Base Station
System
54

GSM Architecture
VMSC

GSM
Air interface
B
S
C
Abis
interface

TRAU

BTS
BTS

BTS

BTS

A
interface

B
S
C

SMSC

HLR

AUC

MSC

PSTN
VLR

EIR

OMCS

BTS
BTS

Mobile
Station

Network and switching

subsystem
A interface SS7 / speech
X.25
SS7

OMCR
Base Station System

55

Mobile Equipment(ME)

Frequency and Time Synchronization

Voice encoding and transmission
Voice encryption/decryption functions
Power measurements of adjacent cells
Display of short messages
International Mobile Equipment Identifier (IMEI)

56

SIM
Portable Smart Card with memory (ROM-6KB to
16KB-A3/A8 algorithm, RAM- 128KB TO 256KB,
EEPROM- 3KB to 8KB )
Static Information
International Mobile Subscriber Identity(IMSI)
Personal Identification Number (PIN)
Authentication Key (Ki)
Dynamic Information
Temporary Mobile Subscriber Identity(TMSI)
Location Area Identity (LAI)
Phone memories, billing information
Ability to store Short Messages received
57

SIM-Card and GSM Mobile

Equipment

Global GSM Mobility

Card
The Smart Card to use

GSM
Contains:
- IMSI

SIM-Card

The SIM-Card Functions

Credit Card Size

SIM-Card

Global GSM Mobility

Card
15 mm

The Smart Card to use

25 mm

Permanent data:
Unique mobile subscriber identity
through IMSI number and PIMSI
for Packet Mode
Authentication parameter Ki,
Authentication algorithm A3,
Generating encryption key Kc
algorithm A8,
PIN code.

GSM
Microchip with stored
user information

Removable data:
- Temporary Mobile Subscriber Number,
- Location Area Identification
- Routing Area Identification (Packet mode)

Subscriber Identification
IMSI
Nature

International Mobile Subscriber Identity

Mobile Station Integrated Services Digital Network Nb

Conformity with E212

Similar to ISDN,
Conformity with E164/E213

Identify a PLMN
worldwide

MCC

MNC

Meaning

Mobile
Country
Code

Mobile
Network
Code

Nb. digits

Format

MS - ISDN

Identify the subscriber

of a PLMN

MSIN
H1 H2

x x x ......... x x x

Mobile Subscriber
Ident. Nb
H1 H2 = Identity of HLR
within the home PLMN

max 10

National Significant Mobile Number

CC

NDC

SN

M1 M2

xx xx xx xx

Country
National Mobile Subscriber
Code
Destination(national definition)
(where
M1 M2 = nbr of logical HLR
subscription Code *
has been made)

1 to 3

2 to 4

total max 15

*This code does not identify a geographical area

but an operator

Description Stored in SIM Card

MCC
=
208 (France)
234 (G-B)
262 (Germany)
404,405(India)

MNC
=
71(APBSNL)
72(TNBSNL)
20 (Bytel)

Mobile
Country
Code

Mobile
Network
Code

3 digits

2 digits

Global GSM Mobility

Card
The Smart Card to use

Mobile Subscriber Identification Number (MSIN)

H1 H2 X X X X X X
10 digits max

NMSI
LAI
Mobile
Country
Code

Mobile
Network
Code

3 digits

2 digits

GSM

IMSI = 15 digits max

Temporary Mobile
Subscriber Identity
4 octets

Location Area Code

LAC

RAI

Routing Area Code

RAC

Description Stored in the Network

MS-ISDN (15 digits max)
Country
Code

National
Destination
Code

3 digits max

2 or 3 digits

Subscriber Number (SN)

Must be dialed to
make a call to
mobile
subscriber

M1 M2 X X X X X X X X X X X X X
10 digits max
MSRN

Country
Code

Country
Code

National
Destination
Code

National
Destination
Code

CC = 33 (France)
091(India)
001(US)

Is a PSTN-like
number used to
reach a roaming
MS

Roaming Number (RN)

Is a PSTN-like
number to track the
MS that hands over
to another MSC
during call-in-state

HO-number

NDC = 9448(BSNL-karnataka)
9845,9880(Airtel)
9886(Hutch)
= 660, 661, 618 (Bytel)

62

Descriptor Embodied in the

Mobile Equipment
IMEI enables the operator to check
the Mobile Equipment Identity
at call setup and make sure
that no stolen or unauthorized MS
is used in the GSM network

ED
V
E
P O
TY PPR
A

TAC
Type Approval
Code

FAC

Final Assembly
Code

SNR

SP

Serial NumbeR

(SPare)

International Mobile Equipment Identity

(IMEI)

PE VED
Y
T O
PR
P
A

TAC
Type Approval
Code

FAC

SNR

SP

Serial number

(SPare)

Final Assembly
Code

351475 60 IMEI:
926514 4# 0 6 #

MS Classmark
Power classes
Classmark
Revision level
RF power
Encryption algorithm
Frequency
Short message
LoCation Services

For GMSK modulation

GSM
GSM
Class
400/850/900 1800
1
1 W**
8 W*
2
0.25 W
5W
3
4W
2 W**
4
0.8 W
5

GSM
1900
1 W**
0.25 W
2W

MS Positioning Method
8-PSK modulation
Multi-slot class
Multi-band
*
**

Typical value for car mounted

Typical value for handheld

For 8-PSK modulation

GSM
GSM
GSM
Class
400/850/900 1800
1900
2W
E1
1W
1W
0.5 W
E2
0.4 W 0.4 W
0.2 W
E3
0.16 W 0.16 W

Base Transceiver Station

(BTS)
Handles the radio interface to the mobile station.
Consists of one or more radio terminals for
transmission and reception
Each Radio terminal represents an RF Channel
TRX and MS communicates over Um interface
Received data transcoding
Voice encryption/decryption
Signal processing functions of the radio interface
Uplink Radio channel power measurements
66

Base Station Controller (BSC)

Provides all the control functions and physical links
between the MSC and BTS
External Interfaces
Abis interface towards the BTS
A interface towards the MSC
Monitors and controls several BTSs
Management of channels on the radio interface
Alarm Handling from the external interfaces
Performs inter-cell Handover
Switching from Abis link to the A link
Interface to OMC for BSS Management
67

Mobile Switching Center

(MSC)
Performs call switching
Interface of the cellular network to PSTN
Routes calls between PLMN and PSTN
Queries HLR when calls come from PSTN to mobile
user
Inter-BSC Handover
Paging
Billing

68

Home Location Register

(HLR)
Stores user data of all Subscribers related to the
GMSC
International Mobile Subscriber Identity(IMSI)
Users telephone number (MS ISDN)
Subscription information and services
VLR address
Reference to Authentication center for key (Ki)
Referred when call comes from public land network

69

Visitor Location Register

(VLR)

Database that contains Subscriber

parameters and location information for all
mobile subscribers currently located in the
geographical area controlled by that VLR
Identity of Mobile Subscriber
Copy of subscriber data from HLR
Generates and allocates a Temporary
Mobile Subscriber Identity(TMSI)
Location Area Code
Provides necessary data when mobile
originates call

70

Authentication Center (AuC)

Stores Subscriber authentication data called Ki, a
copy of which is also stored in in the SIM card
Generates security related parameters to authorize a
subscriber (SRES-Signed RESponse)
Generates unique data pattern called Cipher key (Kc)
for user data encryption
Provides triplets - RAND, SRES & Kc, to the HLR on
request.

71

EIR (Equipment Identity

Register)
EIR is a database that contains a list of all valid
mobile station equipment within the network, where
each mobile station is identified by its International
Mobile Equipment Identity(IMEI).
EIR has three databases.,
White list - For all known,good IMEIs
Black list - For all bad or stolen handsets
Grey list - For handsets/IMEIs that are
observation

on

72

Location Area Identity

LAI identifies a location area which is a group of
cells..
It is transmitted in the BCCH.
When the MS moves into another LA (detected by
monitoring LAI transmitted on the BCCH) it must
perform a LU.
LAI = MCC + MNC + LAC
MCC= Mobile Country Code(3 digits), identifies the country
MNC= Mobile Network Code(1-2 digits), identifies the GSMPLMN
LAC= Location Area Code, identifies a location area within a
GSM PLMN network. The maximum length of LAC is 16
bits,enabling 65536 different location areas to be defined in
73
one GSM PLMN.

Interfaces and Protocols

Digital
Networks

Abis

LAPD

Um

LAPDm

BSSAP

ISUP
TUP

MAP

MAP
MAP

C
D

POTS

74

GSM Entities and Signaling

Architecture

75

GSM Protocols

CM
- Connection Management
MM
- Mobility Management
RR
- Radio resource
LAPDm
- LAPD for mobile
LAPD - Link Access Procedure for D channel
BTSM - BTS Management Part
BSSAP
- BSS Application Part (BSC - MSC)
DTAP
- Direct Transfer Application Part (MS - MSC)
MAP
- Mobile Application Part
MTP
- Message Transfer part of SS7
SCCP
- Signalling Connection Control Part of SS7
TCAP
- Transaction Capabilities Application Part
ISUP - ISDN User Part
76

Functional Plane of GSM

MS

BTS

BSC

MSC/VLR

HLR

MSC/
VLR

HLR

GMSC

CC

MM

RR

Trans
MS

BTS

BSC

77

GMSC

TOPICS

GSM CONCEPTS
GSM SYSTEM ARCHITECTURE
IDENTIFIERS USED IN GSM
GSM CHANNELS
GSM RADIO LINK
MOBILITY MANAGEMENT
CALL MANAGEMENT
RADIO RESOURCE MANAGEMENT
78

TOPICS

GSM CONCEPTS
GSM SYSTEM ARCHITECTURE
IDENTITIES USED IN GSM
GSM CHANNELS
GSM RADIO LINK
MOBILITY MANAGEMENT
CALL MANAGEMENT
RADIO RESOURCE MANAGEMENT
79

Channels : differentiating
between Physical and Logical
channels
Physical channels : The combination of an ARFCN
and a time slot defines a physical channel.
Logical channels : These are channels specified by
GSM which are mapped on physical channels.

80

Channel concept
Physical channel:
One timeslot of a TDMA-frame on one carrier
is referred to as a physical channel.
There are 8 physical channels per carrier in
GSM,channel 0-7(timeslot 0-7)
Logical channel:
A great variety of information must be
transmitted between BTS and the MS,for e.g.
user data and control signaling.Depending
on the kind of information transmitted we
refer to different logical channels.These logical

channels are mapped on physical81

channel.

Logical Channels on Air interface

LOGICAL
CHANNELS
COMMON
CHANNELS

COMMON
CONTROL
CHANNELS

BROADCAST
CHANNELS

FCCH

SCH

DEDICATED
CHANNELS

BCCH

PCH

DEDICATED
CONTROL
CHANNELS

SDCCH

RACH

AGCH

SACCH

TCH/F

TRAFFIC
CHANNELS

FACCH

TCH/H
82

TCH/EFR

Logical channels
Logical channels

Control channels

BCH

CCCH

Traffic channels

DCCH

Full
rate

Half
rate

FCCHSCH BCCH CBCH PCH AGCH RACH SDCCH SACCH FACCH

83

Broadcast channels BCH

Broadcast Channel-BCH
Alloted one ARFCN & is ON all the time in every cell.
Present in TS0 and other 7 TS used by TCH.

Frequency correction channel-FCCH

To make sure this is the BCCH carrier.
Allow the MS to synchronize to the frequency.
Carries a 142 bit zero sequence and repeats once in every
10 frames on the BCH.

Synchronization Channel-SCH
This is used by the MS to synchronize to the TDMA frame
structure within the particular cell.
Listening to the SCH the MS receives the TDMA frame
number and also the BSIC ( in the coded part- 39 bits).
84
Repeats once in every 10 frames.

Broadcast channels BCH ...

BCCH
The last information the MS must receive in order to receive
calls or make calls is some information concerning the cell.
This is BCCH.
This include the information of Max power allowed in the
cell.
List of channels in use in the cell.
BCCH carriers for the neighboring cells,Location Area
Identity etc.
BCCH occupies 4 frames (normal bursts) on BCH and
repeats once every Multiframe.
This is transmitted Downlink point to multipoint.

Cell Broadcast Channel - CBCH

Used for the Transmission of generally accessible
85
information like Short Message Services(SMS)

Common Control Channels

CCCH
CCCH-

Shares TS-0 with BCH on a Multiframe.

Random access channel-RACH:

Used by Mobile Station for requesting for a channel. When
the mobile realizes it is paged it answers by requesting a
signaling channel (SDCCH) on RACH. RACH is also used
by the MS if it wants to originate a call.
Initially MS doesnt know the path delay (timing advance),
hence uses a short burst (with a large guard period = 68.25
bits).
MS sends normal burst only after getting the timing advance
info on the SACCH.
It is transmitted in Uplink point to point.
86

Common Control Channels

CCCH ..
Access Grant Channel-AGCH
On request for a signaling channel by MS the network
assigns a signaling channel(SDCCH) through AGCH. AGCH
is transmitted on the downlink point to point.

Paging Channel-PCH
The information on this channel is a paging message
including the MSs identity(IMSI/TMSI).This is transmitted on
Downlink, point-to-multipoint.

87

Dedicated Control ChannelsDCCH

Stand alone dedicated control channel(SDCCH)
AGCH assigns SDCCH as signaling channel on
request by MS.The MS is informed about which
frequency(ARFCN) & timeslot to use for traffic.
Used for location update, subscriber authentication,
ciphering information, equipment validation and
assignment of TCH.
This is used both sides, up and Downlink point-point.

88

Dedicated Control ChannelsDCCH

Slow associated control channel-SACCH
Transmission of radio link signal measurement, power
control etc.
Average signal strengths(RXLev) and quality of service
(RXQual) of the serving base station and of the neighboring
cells is sent on SACCH (on uplink).
Mobile receives information like what TX power it has to
transmit and the timing advance. It is associated with TCH
or SDCCH

Fast associated control channel-FACCH

Used for Hand over commands and during call setup and
release. FACCH data is sent over TCH with stealing flag set
89

Traffic Channels-TCH
TCH carries the voice data.
Two blocks of 57 bits contain voice data in the normal
burst.
One TCH is allocated for every active call.
Full rate traffic channel occupies one physical
channel(one TS on a carrier) and carries voice data
at 13kbps
Two half rate (6.5kbps) TCHs can share one physical
channel.
90

GSM Channels
GSM Channels
Traffic Channels
(TCHs)

Control Channels

Broadcast
Channels
(BCHs)
Full
rate

TCH /F

Half
rate

Common Control
Channels
(CCCHs)

Downlink

Downlink

Uplink

(down uplink)
Fast

TCH /H FCCH SCH BCCH PCH

Traffic Multiframing

Dedicated Control
Channels
(DCCHs)

AGCH

CBCH

Signaling Multiframing

RACH SDCCH

FACCH

Slow

SACCH

Traffic Multiframing
91

The Logical Channels on Radio Interface

TS

0123456 7

BTS
Frequency correction
Synchronization
Broadcast control
Access request
Subscriber paging
Answer to Access request

MS
FCCH

TCH

SCH

FACCH

Traffic (speech-data)
Associated Signaling

BCCH
RACH
PCH

SACCH
SDCCH

CBCH

AGCH

Radio Measurement + SMS

Dedicated Signaling
Broadcast info

FCCH
Broadcast info
Dedicated Signaling
Sys InFo 5, 6 + SMS
Traffic (speech data)

CBCH
SDCCH
SACCH

SCH
BCCH
RACH
PCH

TCH

Associated Signaling
FACCH

M.S. Pre-synchronization

AGCH

Access request
Subscriber paging
Answer to Access request

92

Logical Channel Description

SACCH MESSAGES
TCH MESSAGES
(1/2)

Measures:

power level of the communication

Speech

quality level of the communication

Data

level on the beacon frequency of

Handover Access message (uplink)

the neighboring cells

Timing Advance
Power Control

FACCH MESSAGES

SMS

Connection establishment from

SDCCH to TCH

SDCCH MESSAGES
Request for a SDCCH assignment
Request for the end of channel

assignment
Order of commutation from SDCCH to

TCH
SMS

End validation of a SDCCH-TCH

commutation
Characteristics of the future used BS

after handover
Connection establishment to BS after

handover
Validation of an handover

93

Logical
Channel
Description
FCCH MESSAGES
AGCH MESSAGES
(2/2)

no message is sent (all bits 0)

SCH MESSAGES
Frame Number

For dedicated channel assignment:

frequency number
slot number
frequency hopping description
Timing Advance (1st estimation)
MS identification

Base Station Identity Code (BSIC)

CBCH MESSAGES
BCCH MESSAGES

Specific information

(weather, road information

ormation type 1, 2, 2bis,

8
(idle mode)

RACH MESSAGES

Service request:

PCH MESSAGES
messages containing a mobile

identity for a call, a short message

or an authentication

emergency call
answer to an incoming call
outgoing call
short message
call re-establishment
inscription
94

Traffic and Control Multiframing

Control channel

Traffic channel
Frame
4.615 ms
TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS
0
1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7

TS TS TS TS TS TS TS TS
0 1 2 3 4 5 6 7

TS TS TS TS TS TS TS TS
0 1 2 3 4 5 6 7

26 traffic frames = 120 ms

0

21 22 23 24 25

46 47 48 49 50

1326
frames
0

1
0

51 x 26 traffic frames = 6.12 s

26 x 51 control frames = 6.12 s

46
22

47
23

48
24

49

50
25

2042 2043 2044 2045 2046 2047

1 Hyperframe = 2,715,648 frames= 3h 28 min. 53 s 760 ms

96

97

Logical Channel Mapping

1 - Traffic Channel Combination

T

Full Rate - Downlink & Uplink

26 frames = 120 ms

T T T T T T T T T T T T A T T T T T T T T T T T T

time

Half Rate - Downlink & Uplink

26 frames = 120 ms

T0 T1 T0 T1 T0 T1 T0 T1 T0 T1 T0 T1 A0 T1 T0 T1 T0 T1 T0 T1 T0 T1 T0 T1 T0 A1

T : TCH

Ti : TCH

sub-channel no. i

A : SACCH

Ai : SACCH

: IDLE

sub-channel no. i

99

time

Logical Channel Mapping

2 - Dedicated Signaling Channel Combination

A

Downlink
51 frames = 235 ms

D0

D1

D2

D3

D4

D5

D6

D7

A0

A1

A2

A3

D0

D1

D2

D3

D4

D5

D6

D7

A4

A5

A6

A7
time

Uplink
51 frames = 235 ms

A5

A6

A7

D0

D1

D2

D3

D4

D5

D6

D7

A0

A1

A2

A3

D0

D1

D2

D3

D4

D5

D6

D7

A4
time

A : SACCH

D : SDCCH

: IDLE
100

Logical Channel Mapping

3 - Common Channel Combination

Downlink

Multiframe
m-1

Multiframe m
Multiframe
m+1

51 frames = 235.38 ms

FS

FS

FS

FS

FS

FS

time

Frames repeat continuously

BTS

PCH/AGCH

Physical Channel
ARFCN (n)

TS (s)

SCH

MS

BCCH

FCCH

Uplink
51 frames = 235.38 ms
R R R RR R R RR R RRR R R RR R R RRR R RR R R RR R R R R R R R R R RRR R RR RR RR R R R

F : FCCH

S : SCH

B : BCCH

: PCH /
C AGCH

time

R : RACH

: IDLE
101

Logical Channel Mapping

4
Common
Channel
Combination
Downlink
51 frames = 235 ms

FS

FS

FS

D0

D1

FS

D2

D3

FS

A0

A1

FS

FS

FS

D0

D1

FS

D2

D3

FS

A2

A3
time

Uplink
51 frames = 235 ms

D3

RR

A2

A3

RRRRRRRRRRRRRRRRRRRRRRR

D0

D1

RR

D2

D3

RR

A0

A1

RRRRRRRRRRRRRRRRRRRRRRR

D0

D1

RR

D2
time

: AGCH

F : FCCH S : SCH B : BCCH C /PCH

R : RACH

A : SACCH

D : SDCCH
102

: IDLE

103

Why 26 and 51
0 1

FS

Frames

10

per Multiframe?
20

FS

30

FS

TTTTTTTTTTTTATTTTTTTTTTT T
01

12

40

FS

FS

50 0 1

TTTTTTTTTTTTATTTTTTTTTTTT

25 0 1

12

25

Downlink
message
Uplink
message
Mobile
activity

Rx
(n)

Rx

FS

Tx Rx Rx
(n)

Tx

Rx
(n)

Rx

Tx

Neighboring BTS
(downlink)
Measurement Windows
104

TOPICS

GSM CONCEPTS
GSM SYSTEM ARCHITECTURE
IDENTITIES USED IN GSM
GSM CHANNELS
GSM RADIO LINK
MOBILITY MANAGEMENT
CALL MANAGEMENT
RADIO RESOURCE MANAGEMENT
105

From Speech to Radio Transmission

Speech

Step 1

Digitizing and
source coding

Step 2

Channel
coding

Interleaving

Source
decoding
Channel
decoding

De-interleaving

Step 3
Burst formatting

Step 4

Ciphering

Step 5

Modulation

Step 6

Transmission

Burst deformatting

Deciphering

Demodulation
equalization

Diversity

106

GSM Radio Link

Speech Coding -Done at Transcoder of BSC and MS
The Linear Predictive Coder uses RPE-LTP(Regular Pulse
Excitation- Long Term Prediction)
Converts 64kbps voice to 13kbps(260 bits every 20ms)

Channel Coding - Done at BTS and MS

Uses Convolution Coding and CRC (Cyclic Redundancy
Check)
Converts 13 kbps to 22.8 kbps (456 bits per 20ms)

107

GSM Radio Link

Bit Interleaving - Done at BTS and MS
Encryption - Done at BTS and MS
EX OR data with cipher block, which is generated by
applying A5 Algorithm to the Ciphering Key(Kc)

Multiplexing - Done at BTS

Modulation - Done at BTS and MS
GMSK(Gaussian filtered Minimum Shift Keying)
Phase change of +90 for 0 and -90 for 1

108

Speech Coding
BP

A/D

BAND
PASS
300 Hz 3.4 kHZ

SPEECH
ENCODER

Every 125 s value is

sampled from analog
signal and quantised by
13 bit word
Data rate = 13/125*10 -6
= 104 kbps

CHANNEL
CODING

Every 20ms 160 samples

taken
Data rate = 160 * 13/20ms
= 104 kbps

To modulator

1A

1B

50

132

78

3 crc bits

Four 0 bits for codec

50 3

132

Conv coding rate = 1/2 delay = 4

Linear Predictive Coding & Regular

Pulse Excitation Analysis
1. Generates 160 filter coeff
2. These blocks sorted in 4 sequence
1,5,9,37 / 2,6,10----38/
3,7,1139/8,12,1640
3. Selects the sequence with most
energy
So data rate = 104/4 = 26 kbps

LP

D/A

Long term prediction analysis

1. Previous sequences stored in memory
2. Find out the correlation between the
present seq. And previous sequences
3. Select the highest correlation sequence
4. Find a value representing the difference
between the two sequences.

378 coded bits

456 bits in 20 ms = 22.8 kbps
57 x 8 = 456

1A = Filter Coeff
block ampl, LTP
params
1B = RPE pointers &
pulses
2 = RPE pulse & filter
params

Reduces data rate = 26 kbps/2 = 13 kbps

ie 260 bits in 20ms

SPEECH
DECODER

78

CHANNEL
DECODING

111

Channel Processing in GSM

Overview for Full Rate
20 ms

Speech blocks

20 ms

20 ms

Codec dependent

Codec dependent

Codec dependent

Source coding
Channel coding

456 bits

A A A A
5 6 7 8

Normal
burst

A5
B1

A6
B2

A7
B3

A8
B4

B5
C1

B6
C2

456 bits

8 Sub blocks
of 57 bits

B B B B B B B B
1 2 3 4 5 6 7 8

Interleaving

8 Bursts

456 bits

B7
C3

C C C C
1 2 3 4

B8
C4

57 bits

26 bits

57 bits

Tail

Information

CRL

Training

CRL

Information

Tail

112

113

Channel Processing in GSM

Overview for Half Rate
Speech blocks

20 ms

20 ms

20 ms

Codec dependent

Codec dependent

Codec dependent

Source coding
Channel coding

228 bits

A A A A
1 2 3 4

A3
B1

A4
B2

B3
C1

228 bits

4 Sub blocks
of 57 bits

B B B B
1 2 3 4

Interleaving

4 Bursts
Normal
burst

228 bits

C C C C
1 2 3 4

B4
C2

114

Interleaving: TCH Full Rate

0 1 2 3 4 5 6 7 8 ...

...

456
coded bits

452 453 454 455

Divide 456 bits in 8 sub-blocks

1
9

2
10

3
11

4
12

5
13

6
14

7
15

57 Rows

0
8

reordering
&
partitioning
out

448 449 450 451 452 453 454 455

3
diagonal
interleaving

bit
interleaving

burst
b0 b1

b56

b0 b1

b56

115

Burst Formatting
Normal Burst

1 frame:
4.615 ms
0

DATA

Training
sequence

57

26

S
1

Guard
Band

DATA
57

8.25

Burst
148 bits

Guard

156.25 bits duration

(0.577 ms)

116

Burst Formats
Frequency Correction Burst
(FCCH)
Tail

Data

3 bits

Tail

142 fixed bits (0)

3 bits

Guard
Period
8.25 bits

156.25 bits duration

(0.577 ms)

Synchronization Burst
(SCH)
Tail

Data

3 bits 39 encrypted bits

Extended Training Sequence

Data

64 synchronization bits

39 bits

Tail

Guard
Period

3 bits 8.25 bits

156.25 bits duration

(0.577 ms)

117

Burst Formats
Normal Burst
Tail

Data

3 bits 57 encrypted bits

Training Sequence
1

26 bits

Data
1

Tail

57 encrypted bits

Guard
Period

3 bits 8.25 bits

156.25 bits (0.577 ms)

Dummy Burst
Tail Dummy Sequence
3 bits 58 mixed bits

Training Sequence
26 midamble bits

Dummy Sequence Tail

58 mixed bits

3 bits 8.25 bits

156.25 bits (0.577 ms)

Tail

Training
Sequence

8 bits

41 synch bits

Access Burst
Data

Tail

36 encrypted bits 3 bits

Guard
Period

Guard Period
68.25 bits

156.25 bits (0.577 ms)

118

Ciphering
Burst to be
transmitted

Data

Data

Plain data:
0 1 1 1 0 0 1 0.....
Ciphering sequence:
0 0 0 1 1 0 1 0.....
XOR:
Ciphered data (transmitted): 0 1 1 0 1 0 0 0.....
Ciphered sequence:
0 0 0 1 1 0 1 0.....
XOR:
Recovered data:
0 1 1 1 0 0 1 0.....

Received
burst

Data

S Training S
sequence

119

Data

Interleaving
Encoded speech blocks - Diagonal Interleaving
57 57 57 57 57 57 57 57

57 57 57 57 57 57 57 57

57 57 57 57 57 57 57 57

57

57

57

57

57

57

57

57

57

57

57

57

57

57

Bn-4 Bn-3 Bn-2 Bn-1

57
57

57

57

57

57

57

57

57

57

57

57

57

57

57

57

57

57

Even bits
Odd bits

Bn Bn+1 Bn+2 Bn+3

Encoded control channel blocks - Rectangular Interleaving

57 57 57 57 57 57 57 57

57
57

57
57

57 57 57 57 57 57 57 57

57
57

57
57

Bn-4 Bn-3 Bn-2 Bn-1

Tb
3

Coded Data
57

57 57 57 57 57 57 57 57

57

57

57

57

57

57

57

57

57

57

57

57

57

57

57

57

Even bits
Odd bits

Bn Bn+1 Bn+2 Bn+3

F Training Sequence F
1
26
1

Coded Data
57

Tb
3

120

Gp
8.25

Burst
The information format transmitted during one
timeslot in the TDMA frame is called a burst.
Different Types of Bursts

Normal Burst
Random Access Burst
Frequency Correction Burst
Synchronization Burst

121

Normal Burst
156.25 bits 0.577 ms

T
3

Coded Data
57

S
1

T. Seq.
26

S
1

Coded Data
57

T
3

GP
8.25

Tail Bit(T) :Used as Guard Time

Coded Data
:It is the Data part associated with the burst
Stealing Flag :This indicates whether the burst is carrying
Signaling data (FACCH) or user info (TCH).
Training Seq. :This is a fixed bit sequence known both to
the BTS & the MS.This takes care of the
signal deterioration.

122

156.25 bits 0.577 ms

T
3

Training Sequence
41

Coded Data
36

T
3

GP
68.25

Random Access Burst

156.25 bits 0.577 ms
T
3

Fixed Bit Sequence

142

T
3

GP
8.25

Freq. Correc. Burst

156.25 bits 0.577 ms
T
3

Coded Data
39

Training Sequence
64

Coded
Data 39

T
3

GP
8.25

Synchronization Burst
123

Transmission on the
radio channels

A timeslot has a duration of .577 m seconds (148 Bits)

8 timeslots(8 x 0.577 = 4.62 ms) form a TDMA frame
If a mobile is assigned one TS it transmits only in this time
slot
and stays idle for the other 7 with its transmitter off, called
bursting
The start on the uplink is delayed from downlink by 3 TS
periods
One TS = duration of 156.25 bits, and its physical contents
is
called a burst

Downlink 0
BTS > MS

Uplink
MS > BTS

Offset

4
124

Timing Advance
MS1 0
near

MS2
0
far

MS1 0
near
MS2
0
far

At
BTS

At
BTS
0

1
0

2
1

3
2

4
3

5
4

6
5

7
6

125

Frames Types On Um
Interface
TDMA Frame
8 Time slots (Burst Period)
Length is 4.62 ms(8 * 0.577ms)

26-TDMA Multiframe
26 TDMA Frames (24 TCH, SACCH, Idle)
120 ms (26 * 4.62ms)

51-TDMA Multiframe
26 TDMA Frames (FCCH, SCH, BCCH, SDCCH, CCCH)
235.6 ms (51 * 4.62ms)

126

Frames Types On Um
Interface
Super Frame
51* 26 TDMA Frames
6.12 S

Hyper Frame
2048 * 51* 26 TDMA Frames
3 Hours, 28 Minutes, 53 Secs and 760 ms

127

TOPICS

GSM CONCEPTS
GSM SYSTEM ARCHITECTURE
IDENTITIES USED IN GSM
GSM CHANNELS
GSM RADIO LINK
MOBILITY MANAGEMENT
CALL MANAGEMENT
RADIO RESOURCE MANAGEMENT
128

Mobility Management

Mobility Management (MM)

Location updating- normal,periodic, IMSI attach
Paging
Security Management
Preventing unauthorized users- authentication
Maintaining Privacy of users- ciphering

Providing roaming facility

MM functionality mainly handled by MS, HLR,
MSC/VLR.
129

Network Attachment
Cell Identification
MS scans complete GSM frequency band for
highest power
Tunes to highest powered frequency and looks
for FCCH. Synchronizes in frequency domain
Get training sequence from SCH which follows
FCCH. Synchronizes in time domain.
Accesses BCCH for network id, location area and
frequencies of the neighboring cells.
Stores a list of 30 BCCH channels

130

Network Attachment..
PLMN Selection
Get the operator information from SIM.

Cell Selection
Selected cell should be a cell of the selected
PLMN
Signal strength should be above the threshold.
Cell should not be barred

Location Update
Register with the network by means of location
updation procedures.

131

MS

BTS

MS Location Update
(registration)
BSC
(G)MSC VLR
HLR

Action
Channel Request (RACH)
Channel Assignment (AGCH)
TMSI + old LAI

Location Update Request (SDCCH)

Authentication Request (SDCCH)
Authentication Response (SDCCH)

Comparison of Authentication param

Accept LUP and allocTMSI (SDCCH)
Ack of LUP and TMSI (SDCCH)
Entry of new area and identity into
VLR and HLR
Channel Release (SDCCH)
132

Security - Authentication

MS
Ki

RAND

A3
SRES
MS

BTS

AuC

RAND
SRES
SRES
Auth Result

Authentication center
provides RAND to Mobile
AuC generates SRES using
Ki of subscriber and RAND
Mobile generates SRES
using Ki and RAND
Mobile transmits SRES to
BTS
BTS compares received
SRES with one generated
by AuC
133

Security - Ciphering
MS
Ki

RAND

A8

Kc

Um interface

MS

Network
Kc

Data

A5

Kc
Ciphered
Data

A5

Data

Data sent on air

interface ciphered
for security
A5 and A8
algorithms used to
cipher data
Ciphering Key is
never transmitted
on air
134

TOPICS

GSM CONCEPTS
GSM SYSTEM ARCHITECTURE
IDENTITIES USED IN GSM
GSM CHANNELS
GSM RADIO LINK
MOBILITY MANAGEMENT
CALL MANAGEMENT
RADIO RESOURCE MANAGEMENT
135

Communication Management
(CM)
Setup of calls between users on request
Routing function i.e. Choice of transmission
segments linking users
Point to Point Short message services

136

PLMN Selection
Yes

Is there an up to date
found PLMNs list?

Yes

No
Creation of a found
PLMN list
manual
mode

automatic
mode

The user selects a

PLMN from the
displayed PLMNs

No (manual)

The MS selects the first

PLMN from the preferred
PLMNs list (if it is not in
the forbidden PLMNs list)
Cell Selection
succeed?
Yes
End of PLMN
selection

No (automatic)

Selection of the
next preferred
possible PLMN

PLMN Selection

Constitution of the "Found PLMN list"

Listen to all the
frequencies of the GSM
spectrum:
power level measurement
and average on these
measurements

Select the best

frequencies
according to the
power level
Memorize the
beacon
frequencies in the
precedent
selection

=> Create the

Found PLMN list

(124 channels in GSM

900, 374 in GSM 1800
and 299 in GSM 1900

(30 in GSM 900 and 40 in GSM 1800)

Initial Cell Selection

List of the
frequencies of the
selected PLMN

Eligible cell?
No

Selection of
another PLMN

Yes
C1 Computation for
eligible cells

Suitable cell:
Eligible cell

- cell of the selected PLMN

- cell not barred
- C1 > 0
Suitable cell?

No

Yes
Look for the cell with the best
C1 in the suitable cells list
PLMN set in the
forbidden
PLMN list

IMSI Attach
End of Cell Selection
Rejected?
No

Yes

Cell Selection
Purpose: get synchronization
with the GSM network
prior establishing any communication.

1
BTS-5

BTS-4

H
FCC

1
5

BTS-3

SCH
CH
BC

BTS-2

This cell

2
3
4
BTS-1

Immediate Assignment
BTS

MS
1

CHANNEL REQUEST

RACH

CHANNEL REQUIRED
CHANNEL ACTIVATION

IMMEDIATE ASSIGNMENT

AGCH

OR
6

CM SERVICE REQUEST

SDCCH or TCH
LOCATION UPDAT. REQU.

SDCCH or TCH

MSC

BSC

CHANNEL ACTIVATION
ACK.
IMMEDIATE ASSIGNMENT
COMMAND

Immediate
Assignment

Registration: the Very First

Location Update
1
2

BSS

IMSI
BSC

4
TMSI
Release

4
TMSI

MSC
5
6

BTS

TMSI
5

LAI

VLR

HLR
IMSI
VLR id

IMSI
TMSI
LAI

Intra VLR Location Update

1
2

BSS

TMSI + old LAI

new TMSI

2
BSC
3
4

BTS

MSC
3
4
2
New TMSI

TMSI

3
New LAI

VLR
IMSI
TMSI
LAI

IMSI not Required

Inter VLR Location Update

BSS

1
2

TMSI + old LAI

newTMSI

BSC

MSC

5
7

BTS

2
TMSI New TMSI
5

New LAI

New VLR

Old VLR
IMSI, TMSI
Old LAI

RAND, SRES, 4
Kc

IMSI,TMSI
LAI
RAND, SRES,
Kc

IMSI not Required

HLR

subscriber
data

6
new
VLR id
145

IMSI Attach
1

CHANNEL
REQUEST
IMMEDIATE
ASSIGNMENT

BSS
2

3 LOCATION UPDATING

REQUEST (IMSI Attach)

Authentication
4
Procedure

LOCATION UPDATING
5
ACCEPT (LAC, TMSI)

BSC
BTS

3
4

MSC

5
4

VLR
6

146

IMSI Detach
1

CHANNEL
REQUEST
IMMEDIATE
ASSIGNMENT

BSS
2
BSC

IMSI DETach
INDication
CHANNEL
RELEASE

BTS

MSC

IMSI DETach
INDication

VLR

147

Mobile Originating Call

BSS

MS
CHANNEL REQUEST

Dialing 1

VLR

IMMEDIATE ASSIGNMENT

CM SERVICE REQUEST

3
3

Sending
Number

PSTN

MSC

Authentication procedure
Ciphering procedure

SETUP (basic) or
EMERGENCY

CALL PROCEEDING
7

CM SERVICE REQUEST

SETUP
5

CALL PROCEEDING

Assignment procedure

CONNECT

Path
Established
11

IAM

Ring
Ringing

ALERTING 9

Ringing

ACM
ANM

11

CONNECT ACKnowledge

8
10

ACM = Address Complete Message

ANM = ANswer Message
IAM = Initial Address Message

149

Mobile Terminating Call

1 - Paging Principle
LA1
6

BSC1

BTS11

4
5

BTS12

MSC/
VLR

GMSC

BSC2

BTS21

2
BTS22

LA2

HLR
BSC3

BTS23

BTS31

150

PSTN

Mobile Terminating Call

2 - Detailed Procedure
Visitor PLMN

Home PLMN

International
SS7

VLR

Provide Roaming Number

(IMSI)

HLR
4

Roaming Number
(MSRN)

9
PAGING
REQUEST
(TMSI)

11

BSS

Send info
to I/C
(MSRN)

PAGE
(TMSI + LA)

Routing
Information
(MSRN)

1
MSISDN

8
PAGING
REQUEST 10
(TMSI + LA)

Send
Routing
Information
(MSISDN)

IAM (MSRN)

VMSC

GMSC

IAM
(MSISDN) 2

ISDN

PN
IAM
MSISDN
MSRN

: Initial Address Message

: Mobile Station Integrated Services Digital
network Number
: Mobile Station Roaming Number

IMSI
GMSC
VMSC
TMSI

:
:
:
:

International Mobile Subscriber Identity

Gateway MSC
Visitor MSC
Temporary Mobile Subscriber Identity

151

Mobile Terminating Call

3 - End to End Procedure
VMSC

BSS

MS

PAGING REQUEST

PAGING REQUEST
(TMSI or IMSI, LA)

IAM
(MSRN)

PSTN

GMSC
IAM
(MSISDN)

Dialing

CHANNEL REQUEST
(LAC, Cell ID)

IMMEDIATE ASSIGNMENT 6
(SDCCH or TCH)
CM SERVICE REQUEST
(Paging Response)

8
9

Ringing
10
12

PAGING RESPONSE
(TMSI or IMSI, LA)

Authentication procedure
Ciphering procedure
Setup, Assignment, Alerting
CONNECT

11
12

Address Complete Message

ANswer Message
152

Path
Established

Call Release
1 - Mobile Initiated

DISCONNECT

RELEASE
4

PSTN

Call in progress

DISCONNECT
RELEASE

RELEASE COMPLETE

CHANNEL RELEASE 6
7

MSC

BSS

MS

Release

RELEASE INDICATION
RF Channel Release
procedure
8
9

153

Release
tone

Call Release
2 - PSTN Initiated
1

3
BSC

4
5

BSS

BTS

4
5

MSC

REL
6

RLC

PSTN

Purpose:
informs the mobile
then releases radio
and network resources.
On hook

154

Mobile Originated Call

Request for Service

Authentication
Ciphering
Equipment Validation
Call Setup
Handovers
Call Release

155

Mobile Terminated Call

Paging
Authentication
Ciphering
Equipment Validation
Call Setup
Handovers
Call Release

156

Mobile Terminated Call

MS
Paging
Assignment CMD
(=TCH) on SDCCH

BTSTMSI Paged
on PCH
BSC

*RESP
MS
tunes
Allocate
Page
SDCCH
on SDCCH
REQ
MS Ch.
*
Assgn
CMP
over
( TMSI
AGCH
+ LAI)
over
RACH
BTS
* Phone rings

HLR
VLR
Query for
VLR info

Connect traffic Ch.to trunk

GMSC
frees SDCCH Query VLR
Page
Page RES
Assgn CMP for LAC and
Assign.
REQ
Paging
TMSI
the area
(+TMSI)
Route
toNetwork
MSC Alerting
MSC
BSC

AuC

Reply
(MSRN)
EIR

PSTN

BTS
Land to
Mobile call
(MSISDN)
157
Authentication and Ciphering procedure done as seen in Location
Updation

TOPICS

GSM CONCEPTS
GSM SYSTEM ARCHITECTURE
IDENTITIES USED IN GSM
GSM CHANNELS
GSM RADIO LINK
MOBILITY MANAGEMENT
CALL MANAGEMENT
RADIO RESOURCE MANAGEMENT
158

Radio Resource Management

Establish maintain and release stable connections
between MS and MSC
Manage Limited Radio and Terrestrial resources
Handover process is the sole responsibility of the RR
Layer
Functions of RR layer are performed by MS and BSC
and partly by MSC

159

Radio Resource Management

Power Control
Hand over Control
Discontinuous Transmission
Frequency Hopping

160

Power Control

BTS commands MS at different

distances to use different power levels
so that the power arriving at the BTSs Rx is
approximately the same for each TS
- Reduce interference
- Longer battery life
161

Handover
Means to continue a call even a mobile crosses
the border of one cell to another
Procedure which made the mobile station really
roam
Handover causes
RxLev (Signal strength , uplink or downlink)
RxQual (BER on data)
O & M intervention
Timing Advance
Traffic or Load balancing
162

Handover Types
Internal Handover (Intra-BSS)
Within same base station - intra cell
Between different base stations - inter cell
External Handover (Inter-BSS)
Within same MSC -intra MSC
Between different MSCs - inter-MSC

163

Handover Types
GMSC

MSC
BSC

BSC

C-3
BSC
MSC

C-4

C-1

C-2

BSC
164

Intra BSC handover

HO performed
HO required
Activate TCH(facch)
with HoRef#

BSC

Acknowledges and
alloctes TCH (facch) if
1. Check for HO passed
2. Channel avail in new BTS

BTS 2

Periodic Measurement
Reports (SACCH)

Periodic Measurement
Reports

MS tunes into new frequency

and TS and sends HO message to
new BTS (facch)

HO cmd with HoRef#

Receives new BTS data(FACCH)

Release TCH

Cell 2
Periodic Measurement
Reports (SACCH)

BTS 1

Cell 1
165

Frequency plan and importance of BCCH

Sectored
antennas

B5
B6

B4

ample frequency plan:

adcast frequencies :

B7

Broadcast channels = 48-62

Hopping channels

B3
B1

B8

= 32-46

B2
B12

MS ( monitoring the
broadcast radio B1 in idle
mode )

B9
B10
B11
F0

F1

F2

F3

F4

F5

..

F10

F11

F,S,B exist in time slot 0 of each frame

F50

..

..

166

What information does Broadcast Control

channel (BCCH) contain?

Serves as a Beacon for the Cell

Country Code (CC) and the Network Code (NC)

Location Area Identity (LAI)

List of neighboring cells which should be monitored

by MS

List of frequencies used in the cell

Cell identity
167

Back

Location Updates
Location Updates can be classified
into two:
Periodic Location Updates:
This occurs as per the timer set by the network
operator. If the MS does not perform this update
the MSC marks the MS as Detached on the VLR.

Location Update on a handover:

This occurs if during a handover the MS is moved
into a new Location Area Code (LAC).
168

1.

The MS is monitoring the BCCH and has all the decoded

information stored on the SIM ( including the LAC)

2.

As soon as the mobile is on a TCH it sends the signal

strength indication on the corresponding SACCH

3.

The BSC monitors the signal strengths and on analysis

sends a handoff request on FACCH. The handoff process is
completed on the FACCH.

4.

After the completion of call, the MS starts monitoring the

BCCH again. On finding the LAC (stored on SIM) and that
decoded from the BCCH to be different , the MS requests a
Location Update through SDCCH.

169

Back

Discontinuous
Transmission
Discontinuous Transmission(DTX) allows the
radio transmitter to be switched off most of the
time during speech pauses.
A Silence Indicator Block is transmitted at
500bps, which generates a comfort noise
Down Link interference is decreased.
Up link battery is saved

170

Frequency Hopping
Frequency Hopping permits the dynamic switching of
radio links from one carrier frequency to another.
Base Band Hopping
At the BTS each the timeslot is shifted to another
transceiver, which is transmitting at the hop
frequency. User will be connected to different
Transceivers depending on hop sequence.
Synthesis Hopping
At the BTS transceiver changes the frequencies used.
The user will be connected to only one transceiver.
Decreases the probability of interference
Suppresses the effect of Rayleigh fading
171

Add-on to GSM
network
: rate for GSM Evolution
Enhanced
Data
PCU; Packet Segmentation/re-assembly
and
scheduling
EDGETelecommunication
is an enhancementStandards
of GPRS
and CSD technologies.
Mobile
Universal
Radio channel
access
control
and
management
Based
on Architecture
the current GSM
technology
same TDMA
Innovative
Service
: VHE
Concept - -providing
the frame
us
Transmission
error
detection
and
retransmission.
structure,
same
bandwidth
(200
kHz).
same
look and feel of its personalized services independent of
the
Power
control

Uses
8-PSK modulation instead of GMSK. Surf the Internet while on the move
network
andmobility
terminal.
SGSN:
GPRS
Requires
good
propagation
conditions.
High Convergence
Speed
Circuit
Data Telecom/Datacom,
Global
:Switched
Fixed/Mobile,
Encryption
Allows
upto 48 kbps (EGPRS) and upto 28.8
kbps
(ECSD) :on
User Data
Rate:14.5kbps
public/private
W@P
Gateway
Charging
every
radio
channel
Use multiple
timeslots
(max=8),
SMS
Adaptation of the information to the mobile
Mobile
Multimedia
driven
market.
160
-numeric
characters
GGSN
: Data:
Interface
to
the
PDN,
Internet

EDGE
helps
GSM-Only
operators
to
compete
with
UMTS. of the
henceRate
max
=- 115.2kbps.
User
UMTS
Wideband
bearers
2GHz band ( 5 MHz per carrier), -max.
2Mbps
Compression
data
Data
: rate
9.6kbps
UMTS
Needs
a
duplexor
in
MS
for
Buffering of the information
One
time
slotrate
over
the air
interface
Max
user
data
: 21.4
kbps
simultaneous Tx and Rx
Dynamic rate adaptation to suit the radio conditions at
EDGE
EDGE
that time ( 9.05 kbps, 13.4 kbps, 15.6 kbps 21.4 kbps)

Wireless Data

Data Application

GPRS
GPRS

HSCSD
HSCSD
SIM
SIM
Toolkit
Toolkit

GSM
GSM
DATA
DATA

W
@
P

WAP
WAP

Circuit Switched technology

Packet Switched technology

F
o
n
e

Internet

Mobile Network
98

W@P Gateway

99

Technology for Applications

Time

W@P Service

2000

172

2001

References

Wireless and Personal Communication Systems. Vijay.K.Garg and

Wilkes
Overview of the GSM System and Protocol Architecture, IEEE Comm.
Magazine, Moe Rahnema.
The GSM System for Mobile Communications- Michel Mouly & MarieBernadette Pautet
Overview of the GSM Comm- John Scourias.

173

Coverage or Traffic Limitations

TRAFFICLIMITED
AREA
(10000
subscribers
per km2)

COVERAGELIMITED
AREA
(-75 dBm
at cell edge)

COVERAGELIMITED
AREA
(-70 dBm
at cell edge)
174

Erlang Concept
Erlang is the unit of statistical resource use

Average number of busy channels

during the period of observation
(usually, the peak hour).

Erlang B
At any time, more than 1 user may request the same resource simultaneously. The use of such a
resource is associated with a blocking rate.
Erlang C
When more than 1 user request at the same time, instead of rejecting the extra calls, there is a
queuing system.

175

Different Types of Cells

EXTENDED-CELL:
macro cell with system coverage
extension ( 120 km) for coasts...

CONCENTRIC-CELL:
macro cell with system coverage
limitation inside another macro
MACRO-CELL:
antenna radiating above roofs
---> Wide Coverage ( 35 km)

High sensitivity to
interference
Requires "secured"
Frequency reuse pattern

PICO-CELL:
Antenna inside building
---> Very small coverage

MICRO-CELL:
Antenna below the roofs
---> small coverage

High isolation from

interferences
A few Frequencies
intensively reused

176

Cell Patterns

177

Cell Sectorization

TRI

OMNI

BI

Omnidirectional Site Antennas

Bi and Trisectorial Site Antennas

Link Budgeting
Calculation of the maximum coverage range of each cell in a specific
environment.
Definition of planning tools parameters.
Based on the path loss calculation between the MS and the BS in both ways.
This calculation considers:

RF parameters of MS and BS,

system parameters (diversity gains...),
propagation parameters (shadowing),
physical installation parameters (antenna height),
environment classification.

- What is the maximum EIRP?

- What are the losses in
transmission and reception?
- Is diversity used?

EIRP:Equivalent Isotropic Radiated Power

- Beyond which distance the

communication will cut off?
- Is indoor coverage
guaranteed?
- Is frequency hopping used?
- What is the minimum
equivalent sensitivity?
- What is the maximum
equivalent output power?
- What are the body losses?

Link Budget Parameters

Overview
Propagation Parameters:
- Incar, Indoor penetration factors
- Frequency 900, 1800, 1900 MHz
- Antenna Height
- Environment

Standard conf. DLNA conf.

Antenna Gain

Rx Sensitivity

Design Parameters:
Overlapping margin

Radio Link

Common cable Losses

Rx Sensitivity

Specific Tx Cable
Losses
Antenna Gain

Combiner losses

Rx Sensitivity

Tx PA Output
Power

Tx PA Output Power

MS

Rx Diversity Gain

Base Station
Duplexer
Combiner
Power Amplifier

Other factors for MS

Body Losses
Common cable losses

DLNA:Diversity Low Noise Amplifier

Link Budget Parameters

BTS TX Power Amplifier

2.5W PA
GSM 900 S2000L

DCS 1800 S2000L

PCS 1900 S2000L

25W PA

35W PA

20W PA

S2000E
S4000 Indoor S4000 Indoor S2000H
S4000 Outdoor

S4000 Indoor

30W PA
S8000 Indoor
S8000 Outdoor

S2000E
S2000H
S4000 Outdoor

S4000 Indoor
S8000 Indoor
S8000 Outdoor

S2000E
S2000H
S4000 Indoor
S4000 Outdoor

S8000 Outdoor

Link Budget Parameters

Combiners

H2D

4.5
4.5dB
dBLoss
Loss

4.9
4.9dB
dBLoss
Loss
C

Hy/2

TX

TX

2-Way
2-WayHybrid
HybridCombiner
Combinerwith
withDuplexer
Duplexer
allows Synthesized Frequency Hopping

TX TX TX TX

4-Way
4-WayCavity
CavityCombiner
Combinerwith
with
Duplexer
Duplexer
allows Baseband Frequency Hopping

Link Budget Parameters

Cable Losses
At the BS, for a 7/8 foam dielectric coaxial cable:
4 dB/100 m (900 MHz),
6 dB/100 m (1800 MHz),
Common cable losses for 40 meters: 2.5 dB (900 MHz) and 3.5 dB (1800 MHz).
Jumpers (up and down the feeder)
0.5 dB (800 MHz),
1 dB (1800 MHz).

Link Budget Parameters

BTS Antenna Gain
Omnidirectional antenna
Default 6.5 V with 11 dBi gain
Directional antenna for trisectorial site
Default 65 H / 6.5 V with 18 dBi gain

Link Budget Parameters

Mobile Station Parameters
900 MHz

1800/1900 MHz

TX PA Output
Power

33 dBm (2W)

30 dBm (1W)

RX Sensitivity

-102 dBm

-100 dBm

Antenna Gain

-2 dBi for Handheld

2 dBi for Car Kit

Common Cable
Loss

0 dB for Handheld
2 dB for Car Kit

Body Loss

3 dB for Handheld
0 dB for Car Kit

Link Budget Presentation

Parameters
Antenna Gain (65 )
18 dBi

Frequency
Base Height
Mobile Height
Environment

Jumper Loss
0.5 dB
Feeder Loss
3 dB

Penetration Factor 15 dB

Sensitivity
-110 dBm
Coupling system
Tx loss
4.5 dB

RXm

Body Loss 3 dB

Outdoor Minimum Field

95%: -80 dBm
Coverage Range
95%: 810 m

Cable Loss
0 dB

Antenna Gain
-2 dB

RX

TX

Output Power
30 dBm

RXd

Sensitivity
Max TX Output Power
44.8 dBm

-100 dBm

Options
Rx Diversity Gain: 5 dB

Base Station

1800 MHz
40.0 m
1.5 m
Urban

Mobile

Overlapping Margin: 0 dB

189

Link Budget Calculation

Exercise 1: S8000 INDOOR: OPERATING FREQUENCY 1800

MHz

BTS

MS

TX OUTPUT POWER

30.00 W (44.8
dBm)

1.00 W (30.0
dBm)

COMBINER LOSSES

5.0 dB

None

RX SENSITIVITY

-110.0 dBm

-102.0 dBm

RX SENSITIVITY +
DIVERSITY

-115.0 dBm

None

3.0 dB

0.0 dB

18.0 dBm

-2.0 dBm

COMMON CABLE
LOSSES
ANTENNA GAIN

BODY LOSSES

3.0 dB

OVERLAPPING
MARGIN

0.0 dB

INDOOR PENETRATION
FACTOR
18.0 dB

190

Fading
Example of Field Strength Variation for GSM 1800
-10

Zoom on
Short Term Fading

-20
Measurement
Free Space

Field Strength (dBm)

-30

/2

-40

2m
-50
-60

Long Term Fading

-70
-80
-90
0

-100

500

1000

1500

2000

2500

3000

Distance (m)

3500

4000

4500

5000

Clutters

Thank you

193

Mobile Station (MS)

Hand portable unit
Contains Mobile Equipment(ME) and
Subscriber Identity Module (SIM)

194