Section 0

Review of GSM Principles

 GSM Architecture Overview
Air Interface Abis Interface A Interface
(Um)
OMC

MS

VLR
BSS
HLR
MS TRX

BTS
MSC AuC
BSC

MS

EIR NSS
PSTN
 GSM Mobile Terminal (MT)

Reference Points

R S Um A
Interface Interface

Base Station GSM Core

TA
Subsystem Network
SIM ME
TE MS

Mobile Terminal (MT)

TE - Terminal Equipment
TA - Terminal Adaptor
MS - Mobile Station
ME - Mobile Equipment
SIM - Subscriber Identity Module
 The Mobile Station (MS)
• The mobile station consists of:
• mobile equipment (ME)
• subscriber identity module (SIM)

• The SIM stores permanent and temporary data about

the mobile, the subscriber and the network, including:
• The International Mobile Subscribers Identity (IMSI)
• MS ISDN number of subscriber
• Authentication key (Ki) and algorithms for authentication check

• The mobile equipment has a unique International Mobile

Equipment Identity (IMEI), which is used by the EIR
 The Base Station Sub-System (BSS)
• The BSS comprises:
• Base Station Controller (BSC)
• One or more Base Transceiver Stations (BTSs) BSS
• The purpose of the BTS is to:
• provide radio access to the mobile stations
• manage the radio access aspects of the system
• BTS contains: BTS
• Radio Transmitter/Receiver (TRX)
• Signal processing and control equipment
• Antennas and feeder cables
• The BSC: BSC
• allocates a channel for the duration of a call BTS
• maintains the call:
– monitors quality
– controls the power transmitted by the BTS or MS BTS
– generates a handover to another cell when required
• Siting of the BTS is crucial to the provision of BTS
acceptable radio coverage
 BSS Network Topologies

• Chain: cheap, easy to implement

• One link failure isolates several BTSs BSC

• Ring: Redundancy gives some protection if a

link fails
• More difficult to roll-out and extend
• ring must be closed
BSC

• Star: most popular configuration for first GSM

systems
• Expensive as each BTS has its own link
• One link failure always results in loss of BTS
BSC
 Network Switching System (NSS)

PSTN/ISDN
• Key elements of the NSS: VLR

MSC
GMSC
• Mobile Switching Centre (MSC) with:
• Visitor Location Register (VLR)
• Home Location Register (HLR) with: SS7
Network
• Authentication Centre (AuC)
• Equipment Identity Register (EIR) AuC
• Gateway MSC (GMSC) EIR
HLR

• These elements are interconnected by means of an SS7 network

 Mobile Switching Centre (MSC)

Functions of the MSC:

• Switching calls, controlling calls and logging calls

• Interface with PSTN, ISDN, PSPDN

• Mobility management over the radio network and other

networks

• Radio Resource management - handovers between

BSCs

• Billing Information VLR

MSC
 Visitor Location Register (VLR)

• Each MSC has a VLR

• VLR stores data temporarily for mobiles served by the MSC
• Information stored includes:
• IMSI
• MSISDN VLR
• MSRN
• TMSI
MSC
• LAI
• Supplementary service parameters
 Home Location Register (HLR)

• Stores details of all subscribers in the network , such as:

• Subscription information
• Location information: mobile station roaming number, VLR, MSC
• International Mobile Subscriber Identity (IMSI)
• MS ISDN number
• Tele-service and bearer service subscription information
AuC
• Service restrictions
• Supplementary services
HLR

• Together with the AuC, the HLR checks the validity and service
profile of subscribers
 HLR Implementation

• One HLR in a network

• May be split regionally
• Stores details of several thousand subscribers
• Stand alone computer - no switching capabilities
• May be located anywhere on the SS7 network
• Combined with AuC
AuC

HLR
Gateway Mobile Switching Centre (GMSC)

• A Gateway Mobile Switching Centre (GMSC) is a device which

routes traffic entering a mobile network to the correct destination

• The GMSC accesses the network’s HLR to find the location of the
required mobile subscriber

• A particular MSC can be assigned to act as a GMSC

• The operator may decide to assign more than one GMSC

GMSC
 Equipment Identity Register (EIR)
• EIR is a database that stores a unique International
Mobile Equipment Identity (IMEI) number for each EIR
item of mobile equipment
• The EIR controls access to the network by returning the status of a
mobile in response to an IMEI query
• Possible status levels are:
• White-listed The terminal is allowed to connect to the network.

• Grey-listed The terminal is under observation by the network

for possible problems.

• Black-listed The terminal has either been reported stolen, or is not a

type approved for a GSM network.
The terminal is not allowed to connect to the network.
 GSM Network Interfaces

VLR D HLR
MS

Um B C H

MS TRX
AuC
BTS Abis BSC A MSC

BSS F
MS

EIR

NSS
 P-GSM Spectrum (Primary GSM)

890 915 935 960 MHz

Uplink Downlink

Duplex spacing = 45 MHz

Fu(n)
Range of ARFCN:
1 - 124
1 2 3 4 n
Guard Band
100 kHz wide
Guard Band
100 kHz wide
Channel Numbers (n) (ARFCN)
200 kHz spacing
 E-GSM Spectrum (Extended GSM)

880 915 925 960 MHz

Uplink Downlink

Duplex spacing = 45 MHz

Range of ARFCN: Fu(n)

1 – 124
975 - 1023 1 2 3 4 n
Guard Band
100 kHz wide
Guard Band
100 kHz wide
Channel Numbers (n) (ARFCN)
200 kHz spacing
 DCS - 1800 Spectrum

1710 1785 1805 1880 MHz

Uplink Downlink

Duplex spacing = 95 MHz

Fu(n)
Range of ARFCN:
512 - 885
1 2 3 4 n
Guard Band
100 kHz wide
Guard Band
100 kHz wide
Channel Numbers (n) (ARFCN)
200 kHz spacing
 1800 MHz Utilization in UK

The present distribution of frequencies among UK operator is:

1710 1721.5 1751.5 1781.5 1785 MHz

Uplink

DECT
Vodafone/
One 2 One Orange
Cellnet
Downlink

1805 1816.5One 2 One

1846.5 1876.5 1880 MHz

DECT: Digital Enhanced Cordless Telecommunications

 PCS - 1900 Spectrum

1850 1910 1930 1990 MHz

Uplink Downlink

Duplex spacing = 80 MHz

Fu(n)
Range of ARFCN:
512 - 810
1 2 3 4 n
Guard Band
100 kHz wide
Guard Band
100 kHz wide
Channel Numbers (n) (ARFCN)
200 kHz spacing
 Multiple Access Techniques
• Purpose: to allow several users to share the resources of the air
interface in one cell

• Methods:
• FDMA - Frequency Division Multiple Access

• TDMA - Time Division Multiple Access

• CDMA - Code Division Multiple Access

Frequency Division Multiple Access (FDMA)
• Divide available frequency spectrum
into channels each of the same bandwidth
• Channel separation achieved by filters:
• Good selectivity

Frequency
• Guard bands between channels User 1

• Signalling channel required to allocate a traffic

User 2

channel to a user User 3

• Only one user per frequency channel at any time User 4

User 5
• Used in analog systems, such as AMPS, TACS
Time
• Limitations on:
• frequency re-use
• number of subscribers per area channel bandwidth
 Time Division Multiple Access (TDMA)
• Access to available spectrum is limited to timeslots
• User is allocated the spectrum for the duration of one timeslot
• Timeslots are repeated in frames
Frequency

Signalling

Signalling
User 6
User 3

User 7
User 1

User 2

User 4

User 5

User 6

User 7
User 1

User 2

User 3

User 4

User 5
Time
Frame Timeslot
 GSM Channels

GSM defines two fundamental channel types:

• Physical Channels:
• the individual channels carried by a radio frequency carrier

• Each carrier comprises 8 time-separated channels

• Logical Channels:
• time-dependant virtual channels carried on a single physical
channel
• one physical channel may support one or multiple logical channels
 GSM Physical Channels
• GSM employs both FDMA and TDMA at the Air Interface
• Each BTS may comprise a number of TRXs, with the carrier of each TRX
operating on a different frequency (FDM)
• Each GSM carrier supports 8 time-separated physical channels (TDMA)
• Each physical channel is allocated to a specific timeslot on the carrier
• A group of 8 timeslots on a carrier is known as a TDMA frame

1 frame period
4.615 ms

0 1 2 3 4 5 6 7

timeslot = 0.577 ms
 GSM Logical Channels
• Two types of logical channel are defined; traffic and control channels
• Each is further sub-divided as shown:

Traffic
Traffic Control
Control

TCH
TCH BCH
BCH CCCH
CCCH DCCH
DCCH

FCCH
FCCH PCH
PCH SDCCH
SDCCH
TCH/F
TCH/F

SCH
SCH RACH
RACH SACCH
SACCH
TCH/H
TCH/H

BCCH
BCCH AGCH
AGCH FACCH
FACCH

CBCH
CBCH
 Traffic Channels (TCH)
• One physical channel (1 timeslot) can support:
• 1 TCH/F or 2 TCH/H
• TCH/F: 13 kb/s voice or 9.6 kb/s data
• TCH/H: 6.5 kb/s voice or 4.8 kb/s data

Uplink / Downlink Synchronisation

BTS transmits:
The MS transmit burst is delayed by 3 timeslots after the BTS
burst.. This delay allows enables: 0 1 2 3 4 5 6 7
• Use of the same UL and DL timeslot number in TDMA frame
• Avoids simultaneous Tx/Rx requirement MS transmits:
• Allows for timing advance (TA) 5 6 7 0 1 2 3 4
• Allows time to switch between Tx and Rx
 Broadcast Channels (BCH)

BCH channels are all downlink and are allocated to

timeslot zero. BCH channels include:
• FCCH: Frequency control channel sends the MS a burst of all ‘0’ bits
which acts as a beacon and allows MS to fine tune to the downlink
frequency and time-synchronise.
• SCH: Synchronisation channel enables TDMA-Frame number
synchronisation by sending the absolute value of the frame number
(FN), together with the BTS’s BSIC
• BCCH: Broadcast Control Channel sends network-specific information
such as radio resource management and control messages, Location
Area Code etc.
 Common Control Channels (CCCH)
CCCH contains all point to multi-point downlink channels (BTS to
several MSs) and the uplink Random Access Channel:

• RACH: Random Access Channel is sent by the MS to request a resources

from the network e.g. an SDCCH channel for call setup.
• AGCH: Access Grant Channel is used to allocate a dedicated channel
(SDCCH) to the mobile.
• PCH: Paging Channel sends paging signal to inform mobile of a call.
• CBCH: Cell Broadcast Channel is an optional GSM Phase II implementations
for SMS broadcast messages, for example road traffic reports or network
engineering messages.
 Dedicated Control Channels (DCCH)

DCCH comprise the following bi-directional (uplink / downlink)

point to point control channels:

• SDCCH: Standalone Dedicated Channel is used for call set up,

location updating and also SMS
• SACCH: Slow Associated Control Channel is used for link
measurements and signalling during a call
• FACCH: Fast Associated Control Channel is used (when
needed) for signalling during a call, mainly for delivering
handover messages and for acknowledgement when a TCH is
assigned
 Logical Channels
• Multiframes provide a way of mapping the logical channels on to the
physical channels (timeslots)
• A logical channel is a series of consecutive instances of a particular timeslot

Time TDMA Frame TDMA Frame TDMA Frame

0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7

Logical Channel 1 1 1 1

• A multiframe is a repeating combination of logical channels

 Traffic Channel Multiframe
• The TCH multiframe consists of 26 timeslots.
• This multiframe maps the following logical channels:

•TCH
•SACCH
• TCH Multiframe structure: •FACCH

T T T T T T T T T T T T S T T T T T T T T T T T T I

0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

T = TCH S = SACCH I = Idle

FACCH is not allocated slots in the multiframe. It steals TCH slots when required.
 Control Channel Multiframe

• The control channel multiframe is formed of 51 timeslots

• CCH multiframe maps the following logical channels:
Downlink: Uplink:
• FCCH • RACH
• SCH
• BCCH
• CCCH (combination of PCH and AGCH)

Downlink F = FCCH S = SCH I = Idle

F S BCCH CCCH F S CCCH CCCH F S CCCH CCCH F S CCCH CCCH F S CCCH CCCH I

0 1 2-5 6-9 10 11 12-15 16-19 20 21 22-25 26-29 30 31 32-35 36-39 40 41 42-45 46-49 50

RACH

Uplink
 Multiple Signalling Channel Configurations
• In a non combined multiframe, up to 7 of the 9 blocks may be reserved
for AGCH:

F S BCCH CCCH F S CCCH CCCH F S CCCH CCCH F S CCCH CCCH F S CCCH CCCH I

• In a combined multiframe, up to 2 of the 3 blocks may be reserved for AGCH:

SDCCH SDCCH SDCCH SDCCH SACCH SACCH

F S BCCH CCCH F S CCCH CCCH F S 0 1 F S 2 3 F S 0 1 I

• Additional CCCH capacity can be provided on other timeslots (TS 2,4 or 6) of the
BCCH carrier if required
• The number of AGCH blocks reserved is indicated to the MS in the system
information messages that the MS reads on the BCCH
 Frame Hierarchy

1 timeslot = 0.577 ms

0 1 2 3 4 5 6 7 1 frame = 8 timeslots = 4.615 ms

Multiframe: = 26 TCH Frames (= 120 ms)

or
51 BCCH Frames (= 235 ms)

Superframe: = 26 BCCH Multiframes (= 6.12s)

or
51 TCH Multiframes (= 6.12s)

= 2048 Superframes
Hyperframe: (= 3 hr 28 min 53.76 s)
 TRAU Configurations
Um Abis A
BTS Site BSC Site MSC Site
CCU
TRAU A
CCU

16kbps 64kbps 64kbps

BTS Site BSC Site MSC Site

CCU
TRAU B
CCU

16kbps 16kbps 64kbps

BTS Site BSC Site MSC Site

CCU
TRAU C
CCU

16kbps 16kbps 64kbps

CCU Channel Coding Unit MSC Node BSC Node

 Air Interface Layer Functions

Speech and Data Speech and Data

Layer 3
Signalling CC: Call Control Signalling
MM: Mobility Management
CC MM RR RR: Radio Resources CC MM RR

Layer 2
Build frames
Reconstruct frames
Request
Send acknowledgement
acknowledgement

Layer 1
Channel coding Error correction
Error protection De - interleaving
Interleaving Equalization

RF modulation RF demodulation

Radio waves
 GSM Voice & Channel Coding Sequence
Speech Coding

8000 Hz
sampling

13-bit
resolution
Quantization
8000x13bits
= 104 kbps 22.8 kbps
2080-bit (20ms) 456-bit blocks
blocks
(note 1)
RPE-LTP Channel GMSK
Speech Coder Coding Interleaving Modulation

Channel Coding 156.25-bit bursts

260-bit blocks
13 kbps Radio Burst
Encryption Multiplexing
note 1: 160 samples of 13 bits per 20ms
Radio Interface
 Speech Coding
• GSM transmits using digital modulation - speech must be converted to
binary digits
• Coder and decoder must work to the same standard
• Simplest coding scheme is Pulse Code Modulation (PCM)
• Sampling every 125 µs
• Requires data rate of 64 kbps

• This is too high for the bandwidth available on the radio channels

1.2
1

PCM
0.8
0.6
0.4
0.2
0
-0.2
-0.4
-0.6
-0.8
-1

Sample analog signal at 8 kHZ Digital pulse train at 64 kbps

 Advanced Speech Coding
• We cannot send the 64 kbps required by PCM
• We need alternative speech encoding
techniques

• Estimates are that speech only contains 50 bits

per second of information
• Compare time to speak a word or sentence with
time to transmit corresponding text

• Attempts to encode speech more efficiently:

• speech consists of periodic waveforms -
so just send the frequency and amplitude
“yahoo”
• model the vocal tract - phonemes, voiced
and unvoiced speech
• Vocoder - synthetic speech quality
 GSM Voice Coding Sequence
Speech Coding

8000 Hz
sampling

13-bit
resolution
Quantization
8000x13bits
= 104 kbps 22.8 kbps
2080-bit (20ms) 456-bit blocks
blocks Radio Interface
(note 1)
RPE-LTP Channel GMSK
Speech Coder Coding Interleaving Modulation

156.25-bit bursts

260-bit blocks
13 kbps Radio Burst
Encryption Multiplexing
Channel Coding
note 1: 160 samples of 13 bits per 20ms
 Speech Digitisation

8192 (213) quantisation levels

8000 samples per second

8000 samples per second x 13 bits per sample = 104kbps per second
Divided into 20mS blocks = 2080 bits per block
 GSM Channel Coding
Speech Coding

8000 Hz
sampling

13-bit
resolution
Quantization
8000x13bits
= 104 kbps 22.8 kbps
2080-bit (20ms) 456-bit blocks
blocks Radio Interface
(note 1)
RPE-LTP Channel GMSK
Speech Coder Coding Interleaving Modulation

156.25-bit bursts

260-bit blocks
13 kbps Radio Burst
Encryption Multiplexing
note 1: 160 samples of 13 bits per 20ms
 GSM (TCH/F) Channel Coding
260 bits

50 Class 1a 78 Class 2 bits

132 Class 1b bits
bits (side information)

Inc 3 4
189 bit block coding 53 bits parity 132 bits tail
bits bits

un
co
de
d
½-rate
x2 convolution encoder

78 non-encoded
378 convolution encoded bits + bits

456 bits
 Block Interleaving
Speech Coding

8000 Hz
sampling

13-bit
resolution
Quantization
8000x13bits
= 104 kbps 22.8 kbps
2080-bit (20ms) 456-bit blocks
blocks Radio Interface
(note 1)
RPE-LTP Channel GMSK
Speech Coder Coding Interleaving Modulation

156.25-bit bursts

260-bit blocks
13 kbps Radio Burst
Encryption Multiplexing
note 1: 160 samples of 13 bits per 20ms
 Interleaving - Effects of ‘Burst’ Noise

• Non – Interleaved Channels:

1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8

Noise burst

1 Channel 1

1 Channel 2

1 Channel 3

• Interleaved Channels:

1 1 1 2 2 2 3 3 3 4 4 4 5 5 5 6 6 6 7 7 7 8 8 8

Noise burst
 Interleaving

Channel Coder Channel Coder

456 bits 456 bits

1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 (8 x 57 bit blocks)

1 11 2 22 3 33 4 44 5 55 6 66 7 77 8 8
 GSM Burst Multiplexing
Speech Coding

8000 Hz
sampling

13-bit
resolution
Quantization
8000x13bits
= 104 kbps 22.8 kbps
2080-bit (20ms) 456-bit blocks
blocks Radio Interface
(note 1)
RPE-LTP Channel GMSK
Speech Coder Coding Interleaving Modulation

156.25-bit bursts

260-bit blocks
13 kbps Radio Burst
Encryption Multiplexing
Channel Coding
note 1: 160 samples of 13 bits per 20ms
Radio Burst Multiplexing

456 bits 456 bits

1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 (8 x 57 bit blocks)

1 11 2 22 3 33 4 44 5 55 6 66 7 77 8 8

26 training
3 57 data bits 1 bits 1 57 data bits 3 8.25

1 burst = 156.25 bit periods (0.577mS)

 Types of Data Burst
• The 156.25 bit periods of a timeslot can hold different types of data burst:
Stealing flag bits

Normal Burst 26 Training

(Traffic and most control channels) 3 57 Data Bits 1 Bits 1 57 Data Bits 3 8.25

Frequency Correction Burst (FCCH)

3 142 fixed bits 3 8.25
Data and tail bits are all 0

Synchronisation Burst (SCH) 39 Data 64 Training Bits 39 Data

3 Sync Sequence 3 8.25
Data to synchronise MS with BTS Bits Bits

Dummy Burst 26 Training

Transmitted on BCCH carrier when there are no other 3 Bits 3 8.25
bursts - allows power level measurements

Access Burst (RACH) 41 Training

8 36 Data Bits 3 68.25
Long guard period to avoid collisions Bits

Tail bits Guard period

 GSM Modulation
Speech Coding

8000 Hz
sampling

13-bit
resolution
Quantization
8000x13bits
= 104 kbps 22.8 kbps
2080-bit (20ms) 456-bit blocks
blocks Radio Interface
(note 1)
RPE-LTP Channel GMSK
Speech Coder Coding Interleaving Modulation

156.25-bit bursts
260-bit blocks
13 kbps Radio Burst
Encryption Multiplexing
Channel Coding
note 1: 160 samples of 13 bits per 20ms
 GSM Voice/Channel Coding Summary
Speech 20ms Block 20ms Block 20ms Block (2080 bits per block)

Speech Coder Speech Coder RPE-LTP encoding

13kbps 260 bits 260 bits

Channel Coder Channel Coder Block and convolution encoding

22.8kbps 456 bits 456 bits

1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 8 x 57-bit blocks

Interleaving

1 11 2 22 3 33 4 44 5 55 6 66 7 77 8 8

26
3 57 data bits 1 training
bits
1 57 data bits 3 8.25 1 burst = 156.25 bit periods (0.577mS)
Mobile-Initiated RR Connection Setup

Mobile BSS

Channel Request RACH

Channel Request RACH

Channel Request RACH

AGCH Immediate Assignment

Network-Initiated RR Connection Setup

Mobile BSS

PCH Paging Request

Channel Request RACH

AGCH Immediate Assignment

 RR Connection Release
• Initiated by network only
• Reasons could include:
• End of a call
• Too many errors
• Removal of channel in favour of higher priority call
• MS waits for a short random period and returns to idle state

Mobile BSS
SDCCH Channel Release

Short random delay

Return to idle state

 Handover Types

There are four different types of handover in the GSM

system, which involve transferring a call between:
• Channels (time slots) in the same cell BSC
Internal
• Cells within the same BSS (same BSC)
BSC
• Cells in different BSSs (different BSCs) but under the
control of the same MSC VLR
External
• Cells under the control of different MSCs MSC
BSC

GSM handovers are ‘hard’ – i.e. mobile only communicates VLR

with one cell at a time MSC
 Handover Causes

• Handover can be initiated by either MS or MSC

• Handover decision is based on the following parameters (in
priority order):
• Received signal quality
• Received signal strength
• Distance of MS from BTS
• Drops below power budget margin

• Each parameter has a operator-defined threshold and

handover decisions can be based on one or a combination of
the parameters
 Handover Command Message
Structure of the message sent to MS by original BSS:

MS BSS
Message Type

Cell Description Handover Command

Handover Reference
Power Command

Includes Frequency Hopping

Channel Description information if required

Frequency List Non - Frequency Hopping

or
Mobile Allocation Frequency Hopping
 Handover Margin

Handover to BTS 1 Handover to BTS 2

Mobile remains with

BTS 1 BTS 1 or BTS 2 BTS 2

Nominal cell boundary

Hysteresis due to handover margin

 Example of Handover Signalling
Signalling for a basic Inter-BSC handover involving only one MSC (Intra -
MSC):

MS BSS 1 BSS 2 MSC

Measurement report

Measurement report
Handover Required
Measurement report
Handover Request
Measurement report
Acknowledgement

Handover Command
Handover Command

Handover Access
Handover Detection
Physical Information

Handover Complete
Handover Complete

Clear Command
Measurement report

Clear Complete
Measurement report
 Network Areas
• Cell: radio coverage area of one base station (BTS)
• GSM assigns a cell global identity number to each cell

• Location Area: Group of cells served by one or more BSCs.

• When there is an incoming call, the mobile is paged throughout
its location area. A unique Location Area Identity (LAI) is
assigned to each LA.

• MSC Service Area: part of network covered by one MSC.

• All mobiles in this area will be registered in the VLR associated
with the MSC.

• PLMN Service Area: public land mobile network area - the area
served by one network operator
 MS Mobility States
A Mobile Station (MS) can be in one of three mobility states:

• MS turned off

• MS turned on in idle mode

• MS turned on in dedicated mode

 MS Network Connection Sequence

Scan RF Select highest Scan for FCCH

Power on
channels carrier level frequency correction burst

NO
Select next highest FCCH
carrier level detected?
NO

YES
SCH Scan for SCH
detected? synchronisation burst

YES

‘camp-on’ to BCCH Monitor PCH and

and start decoding adjacent carriers
 IMSI Attach

• Mobile camps on to best serving BTS

• Mobile sends IMSI to MSC
• MSC/VLR is updated in HLR BSC

• Subscriber data including current location area

is added to local VLR
• MSC and HLR carry out authentication check - VLR
challenge and response using Ki
MSC
• Optionally EIR checks for status of mobile
(white/grey/black)
AuC
EIR
HLR
 IMSI Detach

• Explicit:
• Mobile informs MSC it is switching off BSC
• HLR stores last location area for mobile
• VLR records that mobile is no longer available on network
• Mobile powers down VLR
• Implicit
MSC
• VLR forces IMSI Detach due to no response

AuC

HLR
 Location Update Options

• Send location update on every cell change

• No paging requirement
• Excessive signalling traffic load
• Page every cell in network
• No location update reuqirement
• Excessive signalling traffic load
• Subdivide network into paging areas
• Requires paging procedure with reduced traffic load
• Required location updating with reduced traffic load
 Location Updates

BSC
• Location Area Change
BSC
• Periodic Location Update

• IMSI Attach VLR

MSC
• Cell change during call
BSC
• TMSI update on LA change
Au
C
HLR
VLR

MSC
 TMSI Re-allocation

• Used to protect a subscriber’s IMSI

• TMSI only unique within a Location Area (LA)
• Outside an LA, TMSI must be combined with LAI to remain unique
• TMSI re-allocated on LA change (minimum) or as a result of an
exceptional condition.
• Normally takes place in encrypted mode
• Normally tales place in conjunction with another procedure e.g. Location
update, call setup etc
 Mobile Originated Call
• When the mobile requests access to the network to
make a call:

• BSS determines the nature of the call - e.g. regular voice call,
emergency call, supplementary service

• Allocates radio resources to the mobile for the call

?
• NSS determines the destination of the call:
•Mobile to mobile on same PLMN
•Mobile to mobile on another PLMN
•Mobile to fixed network (PSTN, ISDN)

• MSC / GMSC routes the call appropriately

and handles signalling
 Mobile-Originated Call Setup

Mobile BSS

Channel Request RACH

Channel Request RACH

Radio Resource
Connection
Channel Request RACH

AGCH Immediate Assignment

LAPDm Connection Setup

SDCCH Unnumbered Acknowledgement

Service Request SDCCH

Mobile-Terminated (Network-Originated) Call

VLR 3 HLR
BSS
4
8 7 6
4 2
11 10
8 8
9 BSS 9 1 PSTN
MSC GMSC
5
12 12

BSS
 Network-Initiated Call Setup

Mobile BSS
PCH Paging Request

Channel Request RACH

Radio Resource
Connection

AGCH Immediate Assignment

LAPDm Connection Setup

Paging Response SDCCH

SDCCH Unnumbered Acknowledgement

 General Authentication Procedure
AuC

MS BSS MSC HLR

Access Request
MS HLR/AuC [IMSI]
Ki RAND RAND Ki Send Authentication info
[IMSI]
A3 A3
Send Authentication info Ack
SRES2 SRES1
[IMSI, Triplet (RAND SRES1 Kc)]
Authentication & ciphering Request
SRES1 SRES1/RAND [RAND]

SRES2
= Authentication & ciphering Response
[SRES2]
MSC
 User Data Encryption

• Benefits of user data encryption include:

• Provides confidentiality for user data across air interface
• Selection from seven encryption algorithms

• Capability is mandatory for MS and network

• Implementation is optional
• Does not provide for end-to-end encryption
 General GSM Encryption Procedure

MS BTS MSC AuC

Ki RAND Ki

A8 A8
Kc
Kc

Data Kc Data

A5 A5

Encrypted Data
 2.5 Generation GSM
• Evolution of GSM towards 3G systems
• Main requirement is for increased data
rates
3rd Generation
• Mobile access to: n
tio
• Internet era UMTS
384 kb/s
2 Mb/s
en
G
• E-mail . 5 38.8 kb/s ECSD
2
• Corporate networks
69.2 kb/s
EDGE EGPRS
14.4 HSCSD
kb/s

GPRS 21.4 kb/s

9.6 CSD
kb/s
SMS
Circuit Switched
2nd Generation
Packet Switched
 HSCSD

• Increases bit rate for GSM by a mainly

software upgrade

• Uses multiple GSM channel coding

schemes to give 4.8 kb/s, 9.6 kb/s or 14.4
kb/s per timeslot
Maximum data rate quoted as
115 kb/s = 14.4 x 8
• Multiple timeslots for a connection
e.g. using two timeslots gives data rates
up to 28.8 kb/s

• Timeslots may be symmetrical or

asymmetrical, e.g. two downlink, one
uplink, giving 28.8 kb/s downloads but 14.4
kb/s uploads.
 HSCSD Mobile Equipment

• HSCSD handsets are typically limited to 4

timeslots, allowing:
• 2 up / 2 down (28.8 kb/s in both directions)
• 3 down and 1 up (43.2 kb/s down 14.4 kb/s up)

• This limitation arises because the handset

operates in half duplex and needs time to change
between transmit and receive modes

• Nokia cardphone (PCMCIA card for laptops) uses

HSCSD (Orange network)
- quotes data downloads at 28.8 kb/s
 GPRS
• General Packet Radio Service
• Packet switching: Data
packet
• Data divided into packets
• Packets travel through network
individually
• Connection only exists while packet
is transferred from one node to next
• When packet has passed a node,
the network resources become
available for another packet
• User sees an ‘always on’ virtual
connection through the network
PCU Circuit/Packet Data Separation

Visited Gateway PSTN

MSC/VLR MSC
Circuit Switched
A

BTS BSC PCU HLR

Gb
Packet Switched
Serving Gateway
GSN GSN PDN
 GPRS Air Interface
• New ‘Packet’ logical channels defined - PBCCH, PDTCH etc.
• New multiframe structure based on ‘radio blocks’ of 4 timeslots
• Allows up to 8 mobiles to share a timeslot
• For high data rates, several physical channels may be allocated to one
user
• 4 levels of channel coding schemes (CS-1 to CS-4):
• Decreasing level of error checking
• Greater data throughput rates
• Scheme selected according to CS-4
interference level (C/I)

Data throughput
CS-3

CS-2

CS-1

C/I
 Using Spare GSM Capacity
• GPRS can use traffic capacity on
the GSM network away from the Maximum Capacity
Available
busy hour for non time critical

Timeslot Usage
Available
for GPRS
data transfers for GPRS

• Even during the busy hour, there Circuit Switched Demand

is spare capacity that GPRS can
make use of:
Time (hours)
• Voice calls start and finish at 0 24
random times, leaving short
periods when channels are
unused Ti
m
es
• Packets of data can be sent when
Timeslots
lot
these channels become available s
- dynamic allocation

Time
Time
 Charging for GPRS Services
• GPRS allows the user to be ‘always connected’
- charging by time is not appropriate
• Some possible methods of charging are:
• By volume of data transferred Internet
• Flat rate for Internet access
• By Quality of Service
• For content - operator may provide own £
pages (value added services)
• Quality of Service parameters:
£
• Service Precedence (priority)
£
• Reliability £
• Delay £
• Throughput
 EDGE
(0,1,0)
(0,1,1) (1,1,0)
• Enhanced Data rates for GSM Evolution
• Use 8 Phase-Shift Keying (8PSK) modulation (0,0,1) (1,1,1)
- 3 bits per symbol
• Improved link control allows the system to adapt
to variable channel quality - leads to slightly (0,0,0) (1,0,1)
reduced coverage area (1,0,0)
• Applied to GSM, EDGE allows a maximum data rate of 48 kb/s per
timeslot, giving the quoted figure of 384 kb/s per carrier (8 timeslots)

• EDGE can be applied to HSCSD (ECSD) and GPRS (EGPRS)

• EDGE will be expensive for operators to implement:
• Each base station will require a new EDGE transceiver
• Abis interface between BTS and BSC must be upgraded