GSM

Global System
for Mobiles
1
 TOPICS
• GSM CONCEPTS
• GSM SYSTEM ARCHITECTURE
• IDENTITIES USED IN GSM
• GSM CHANNELS
• GSM RADIO LINK
• MOBILITY MANAGEMENT
• CALL MANAGEMENT
• RADIO RESOURCE MANAGEMENT

2
 TOPICS
• GSM CONCEPTS
• GSM SYSTEM ARCHITECTURE
• IDENTITIES USED IN GSM
• GSM CHANNELS
• GSM RADIO LINK
• MOBILITY MANAGEMENT
• CALL MANAGEMENT
• RADIO RESOURCE MANAGEMENT

3
 Background to GSM
• 1G : Advanced Mobile Phone Service (AMPS)
• Analog, Circuit Switched, FDMA, FDD
• 2G : Digital Advanced Mobile Phone Service (D-AMPS)
• Digital, Circuit Switched, FDMA, FDD
• 2G : Global System for Mobile (GSM)
• Digital, Circuit Switched, FDMA and TDMA, FDD
• 2G : Code Division Multiple Access (CDMA)
• Digital, Circuit Switched, FDMA, SS, FDD

5
Cellular Network Basics
• There are many types of cellular services;
• Cellular network/telephony is a radio-based technology;
radio waves are electromagnetic waves that antennas
propagate
• Most signals are in the 850 MHz, 900 MHz, 1800 MHz,
and 1900 MHz frequency bands

Cell phones operate in this frequency range

(note the logarithmic scale)
Cellular Network
• Base stations transmit to and receive from mobiles at the
assigned spectrum
• Multiple base stations use the same spectrum (spectral
reuse)
• The service area of each base station is called a cell
• Each mobile terminal is typically served by the ‘closest’
base stations
• Handoff when terminals move
3G, 3.5G and 4G (LTE)
 3G Overview
• 3G is created by ITU-T and is called IMT-2000
 Evolution from 2G
2G IS-95 GSM- IS-136 & PDC

GPRS
IS-95B
2.5G
HSCSD EDGE

Cdma2000-1xRTT W-CDMA
3G Cdma2000-1xEV,DV,DO EDGE
TD-SCDMA
Cdma2000-3xRTT
3GPP2 3GPP
 Service Roadmap
Improved performance, decreasing cost of delivery

Broadband
3G-specific
3G-specific services
services take
take in wide area
advantage of higher bandwidth
advantage of higher bandwidth
and/or Video sharing
and/or real-time
real-time QoS
QoS Video telephony
A
A number
number of
of mobile
mobile Real-time IP
services Multitasking multimedia and games
services are
are bearer
bearer
independent WEB browsing Multicasting
independent inin nature
nature
Corporate data access
Streaming audio/video
MMS picture / video
xHTML browsing
Application downloading
E-mail
Voice & SMS Presence/location
Push-to-talk
Typical
average bit GSM GPRS EGPRS WCDMA HSDPA
rates 9.6 171 473 2 1-10
(peak rates kbps kbps kbps Mbps Mbps
higher)
2000 1x
CDMA

CDMA

CDMA
EVDO

EVDV
2000-

2000-
 GSM Evolution to 3G
High Speed Circuit Switched Data
Dedicate up to 4 timeslots for data
connection ~ 50 kbps
Good for real-time applications c.w. GPRS
Inefficient -> ties up resources, even when
nothing sent
Not as popular as GPRS (many skipping
HSCSD) Enhanced Data Rates for Global Evolution
Uses 8PSK modulation
GSM HSCSD 3x improvement in data rate on short
9.6kbps (one distances
timeslot) Can fall back to GMSK for greater
GSM Data distances
Also called CSD Combine with GPRS (EGPRS) ~ 384 kbps
Can also be combined with HSCSD
GSM GPRS

General Packet Radio Services WCDMA

Data rates up to ~ 115 kbps EDGE
Max: 8 timeslots used as any one time
Packet switched; resources not tied up all the
time
Contention based. Efficient, but variable
delays
GSM / GPRS core network re-used by
UMTS
• Universal Mobile Telecommunications System (UMTS)
• UMTS is an upgrade from GSM via GPRS or EDGE
• The standardization work for UMTS is carried out by Third
Generation Partnership Project (3GPP)
• Data rates of UMTS are:
– 144 kbps for rural
– 384 kbps for urban outdoor
– 2048 kbps for indoor and low range outdoor
• Virtual Home Environment (VHE)
UMTS Frequency Spectrum
• UMTS Band
– 1900-2025 MHz and 2110-2200 MHz for 3G transmission
– In the US, 1710–1755 MHz and 2110–2155 MHz will be used
instead, as the 1900 MHz band was already used.
UMTS Architecture
Base Station
Network Subsystem
Mobile Station Subsystem Other Networks

MSC/ GMSC
BSC VLR PSTN
BTS
ME
SIM

EIR HLR AUC PLMN

RNS
GGSN
SGSN
Node RNC Internet
ME B
USIM

UTRAN
+
SD

Note: Interfaces have been omitted for clarity purposes.

UMTS Network Architecture
• UMTS network architecture consists of three domains
– Core Network (CN): Provide switching, routing and transit for user
traffic
– UMTS Terrestrial Radio Access Network (UTRAN): Provides the air
interface access method for user equipment.
– User Equipment (UE): Terminals work as air interface counterpart
for base stations. The various identities are: IMSI, TMSI, P-TMSI,
TLLI, MSISDN, IMEI, IMEISV
 UTRAN
• Wide band CDMA technology is selected for UTRAN air interface
– WCDMA
– TD-SCDMA
• Base stations are referred to as Node-B and control equipment for
Node-B is called as Radio Network Controller (RNC).
– Functions of Node-B are
• Air Interface Tx/Rx
• Modulation/Demodulation
– Functions of RNC are:
• Radio Resource Control
• Channel Allocation
• Power Control Settings
• Handover Control
• Ciphering
• Segmentation and reassembly
3.5G (HSPA)
High Speed Packet Access (HSPA) is an amalgamation of two mobile
telephony protocols, High Speed Downlink Packet Access (HSDPA)
and High Speed Uplink Packet Access (HSUPA), that extends and
improves the performance of existing WCDMA protocols
3.5G introduces many new features that will enhance the UMTS
technology in future. 1xEV-DV already supports most of the features
that will be provided in 3.5G. These include:
- Adaptive Modulation and Coding
- Fast Scheduling
- Backward compatibility with 3G
- Enhanced Air Interface
4G (LTE)
• LTE stands for Long Term Evolution
• Next Generation mobile broadband technology
• Promises data transfer rates of 100 Mbps
• Based on UMTS 3G technology
• Optimized for All-IP traffic
Advantages of LTE
Comparison of LTE Speed
Major LTE Radio Technogies
• Uses Orthogonal Frequency Division Multiplexing (OFDM)
for downlink
• Uses Single Carrier Frequency Division Multiple Access
(SC-FDMA) for uplink
• Uses Multi-input Multi-output(MIMO) for enhanced
throughput
• Reduced power consumption
• Higher RF power amplifier efficiency (less battery power
used by handsets)
GSM History

23
Development of the GSM Standard
1982: Groupe Spécial Mobile (GSM) 1992: Official commercial launch of
created GSM service in Europe. First
Launch in Finland
1984: Description of GSM features
1993: The GSM-MoU has 62
signatories in 39 countries
1985: List of recommendations settled worldwide.

1987: Initial MoU (Memorandum of 1995: Specifications of GSM phase 2

Understanding) aside the drafting are frozen.
of technical specifications was
signed by network operators of 13 1999: GSM MoU joins 3GPP (UMTS)
countries: GPRS Trials begins

1988: Validation and trials, of the radio 2000: 480M GSM subscribers
interface.
Worldwide
First GPRS Networks roll out
1991: First system trials are
demonstrated at the Telecom 91 End 2002: 792M GSM subscribers
exhibition. Worldwide

24
 GSM Specifications
01 SERIES
12 SERIES GENERAL 02 SERIES
OPERATION AND
MAINTENANCE SERVICE ASPECTS

11 SERIES 03 SERIES
EQUIPMENT AND TYPE NETWORK ASPECTS
APPROVAL SPECIFICATIONS

10 SERIES 04 SERIES
SERVICE INTERWORKING MS-BSS INTERFACE AND
PROTOCOLS

09 SERIES 05 SERIES
NETWORK PHYSICAL LAYER ON THE
INTERWORKING RADIO PATH.

08 SERIES 06 SERIES
BSS TO MSC INTERFACES 07 SERIES SPEECH CODING
TERMINAL ADAPTERS SPECIFICATIONS
FOR MOBILE STATIONS
 Increasing GSM Data Rates
report video
UMTS photo clip

video
E/GPRS web photo report clip

video
ISDN e-mail web photo report clip

video
PSTN e-mail web photo report clip

video
GSM e-mail web photo report clip

0 10 sec 1 min 10 min 1 hour

GPRS = General Packet Radio Service

Transmission HSCSD = High Speed Circuit Switched Data

EDGE = Enhanced Data rate for GSM Evolution
Time UMTS = Universal Mobile Telecommunication System
 Wireless Data Technology Options
2M
1M
et
throughput kbps

ck
pa

100 k
64 k u it EDGE
UMTS
c
cir HSCSD

14.4
10 k GPRS
9.6

Time frame
1k
1998 1999 2000 2001 2002
GPRS = General Packet Radio Service
HSCSD = High Speed Circuit Switched Data
EDGE = Enhanced Data rate for GSM Evolution
UMTS = Universal Mobile Telecommunication System

27
 Circuit-Switched or Packet-Switched

Circuit mode

Packet mode A
→F
A

F
B →F
A

C →GHF
D
A
C

→GHF
C
D
A

C →G →
→GHF
C
D
A C →G
G

D D →H D →H

H
E
28
Multiple Access Technique
• Multiple Access – Achieved by dividing the available
radio frequency spectrum, so that multiple users can
be given access at the same time.
• FDMA - Frequency Division Multiple Access
– ( eg: GSM each Frequency channel is 200KHz)
• TDMA - Time Division Multiple Access
– ( eg: GSM each frequency channel is divided into
8 timeslots)
• CDMA - Code Division Multiple Access
– (eg: IS95- Each User data is coded with a unique
code) 29
 Duplex Technique
• Duplex - How the up link and Down link of a user
is separated
• FDD - Frequency Division Duplex
– (eg:In GSM the up link and down link of a user is
separated by 45MHz )
• TDD - Time Division Duplex
– (the up link and down link of a user will be at the same
frequency but at different Time )

30
What are the types in
GSM Network?
• GSM-900 (Channels 125 operating band 900Mhz
carrier spacing 200khz spacing 45Mhz)

• GSM -1800 (Channels 374 spacing 95Mhz)

• GSM -1900(Used in USA)

32
 GSM Band Allocations (MHz)
Duplex Duplex
GSM systems Uplink Downlink Band Spacing channels

GSM 450 450.4-457.6 460.4-467.6 2x7.2 10 35

GSM 480 478.8-486 488.8-496 2x7.2 10 35
GSM 850 824-849 869-894 2x25 45 124

GSM 900 890-915 935-960 2x25 45 124

E-GSM (900) 880-915 925-960 2x35 45 174
R-GSM (900) 876-880 921-925 2x04 41 40

GSM 1800 1710-1785 1805-1880 2x75 95 374

GSM 1900 1850-1910 1930-1990 2x60 80 299

Frequencies are in MHz

Carrier frequency = ARFCN = Absolute Radio Frequency Channel Number

 GSM Family Radio Band Spectrum
Uplink 450.4 457.6 478.8 486 824 849

GSM 450 GSM 480 GSM 850

Downlink 460.4 467.6 488.8 496 869 894 MHz

915
Uplink
915
876 880 890 915 1710 1785 1850 1910

P-GSM
E-GSM GSM 1800 GSM 1900

R-GSM

921 925 935 960 1805 1880 1930 1990

960 MHz
Downlink
960
 Traffic/Signaling
Traffic

«bla bla bla...»

Signaling « RING ! »
riiiiing

Network
 MS
GSM - Network Structure
Um

BTS VLR HLR

BSC
Abis MSC
A B H
MS C AuC
BTS GMSC
E F
Abis
EIR
A E
MSC

BSC PSTN
Um
BTS X.25
VLR
X.25
OMC Server
36
GSM System specifications
Frequency band
Uplink 890 - 915 MHz
Downlink 935 - 960MHz
Duplex Frequency Spacing 45MHz
Carrier separation 200KHz
Frequency Channels 124
Time Slots /Frame(Full Rate)8
Voice Coder Bit Rate 13Kbps
Modulation GMSK
Air transmission rate 270.833333 Kbps
Access method FDMA/TDMA
Speech Coder RPE-LTP-LPC
37
 Paired Radio Channels in GSM
Case of GSM 900

Uplink Downlink BTS

890 MHz Frequency 915 MHz 935 MHz Frequency 960 MHz

0 channel # 124 0 channel # 124

Example:
Channel 48

Duplex spacing = 45 MHz

Frequency band spectrum = 2 x 25 MHz
Channel spacing = 200 kHz

38
 GSM Time Division Multiplex
Frame and Physical Channels
Time-slot TDMA frame TDMA frame

TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS

0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7

(frames repeat continuously)

Time
0 4.615 ms 9.23 ms

Physical channel # 2 = recurrence of time-slot # 2

 Physical Channel
BTS
BTS time Without FH
With FH
n+1
TDMAs
7
n TS
0

n-1 MS1

MS2

MS3

1 //
FDMA 2 124 ARFCN
 Radio Link Aspects
• From Speech to RF Signal
Blah... Blah... Blah... Blah… Blah… Blah...
Digitizing and
Source Decoding
Source Coding

Channel Coding Channel Decoding

Interleaving De-interleaving

Ciphering Deciphering

Burst Formatting Burst De-formatting

Modulating Demodulating
 Access Techniques
Uplink 890 MHz to 915 MHz
Down Link 935 MHz to 960 MHz
25 MHz divided into 125 channels of 200 KHz
bandwidth

UP 890.0 890.2 890.4 914.8 915.0

DOWN 935.0 935.2 935.4 959.8 960.0

43
 Access Techniques ...

Time Division Multiple Access

Each carrier frequency subdivided in time domain
into 8 time slots
Each mobile transmits data in a frequency, in its
particular time slot - Burst period = 0.577 milli secs.
8 time slots called a TDMA frame. Period is .577 * 8
= 4.616 milli secs

0.577 ms

0 1 2 3 4 5 6 7

4.616 ms 44
45
Fundamentals
960 MHz

959.8MHz TS: Time slot

124
123 GSM utilizes two bands of 25 MHz. 890-915
DOWNLINK Downlink (TDMA frame) = 8 TS
……. MHz band is used for uplink while the 935-
…… 960 MHz is used for downlink.
200KHz

935.2 Mhz 2
0 1 2 3 4 5 6 7
The frequency bands are divided into 200
935 MHz 1 KHz wide channels called ARFCNs (Absolute
Radio Frequency Channel Numbers) i.e.
Data burst = 156.25 bit periods = 576.9s
there are 125 ARFCNs out of which only 124
915 MHz are used.
914.8 MHz
Each ARFCN supports 8 users with each user
124
45 MHz transmitting / receiving on a particular time
slot (TS). 0 1 2 3 4 5 6 7
200KHz
123 Delay
UPLINK …….
Uplink (TDMA frame)
……
890.2 MHz
2
890 MHz 1
Therefore 1 TDMA frame = 156.25 x 8 = 1250 bits
The technology and has a duration of 576.92s x 8 = 4.615 ms 46
 GSM Delays Uplink TDMA Frames
BTS side The start of the uplink TDMA TDMA Frame (4.615 ms)
is delayed of three time-slots
0 1 2 3 4 5 6 7
R R R R R R R R
Downlink TDMA

BTS
T T T T T T T T

Down Up
MSs side link link

MS1 R T

MS2 R T

Fixed transmit
delay of three
time-slots
 Timing Advance
1 - Propagation Delay

M2 d2 d1>>d2 M1

BTS Frame reference TS0 TS1 TS2 TS3 TS4 TS5 TS6 TS7

Propagation Delay t p
Bits Overlapping
MSs transmit
 Timing Advance
2 - Without Timing Advance: Collision
TX BTS CAN WHAT GSM HOW WHEN WHAT
RX BTS yes the ms-isdn
TA
RX MS1 CAN
TX MS1 +3TS yes

RX MS2 WHAT
TX MS2 the

RX MS3 GSM
D
TX MS3
D ms-isdn

RX MS4 HOW
TX MS4

RX MS5
TX MS5 Propagation Delay WHEN

RX MS6 WHAT
TX MS6

RX MS7
TX MS7

RX MS8
TX MS8

49
 Timing Advance
3 - With Timing Advance: No Collision
TX BTS CAN WHAT GSM HOW WHEN WHAT
RX BTS yes the ms-isdn

RX MS1 CAN
TX MS1 +3TS - TA yes

RX MS2 WHAT
TX MS2 D the
RX MS3 GSM
TX MS3 D ms-isdn

RX MS4 HOW
TX MS4

RX MS5
TX MS5
Propagation Delay WHEN

RX MS6 WHAT
TX MS6

RX MS7
TX MS7
Timing Advance = 2 * Propagation Delay
RX MS8
TX MS8

50
GSM in comparison with other
Standards
• GSM gives mobility without any loss in Audio quality
• Encryption techniques used gives high security in the
air Interface and also use of SIM.
• Bit Interleaving for high efficiency in Transmission.
• Variable Power (Power budgeting- extend battery life)
• Minimum Interference.
• Features-CCS7 Signaling
– SMS (Short Message Services)
– Emergency Calls
– CELL Broadcast
51
 TOPICS

• GSM CONCEPTS
• GSM SYSTEM ARCHITECTURE
• IDENTITIES USED IN GSM
• GSM CHANNELS
• GSM RADIO LINK
• MOBILITY MANAGEMENT
• CALL MANAGEMENT
• RADIO RESOURCE MANAGEMENT
52
 MS
GSM - Network Structure
Um

BTS VLR HLR

BSC
Abis MSC
A B H
MS C AuC
BTS GMSC
E F
Abis
EIR
A E
MSC

BSC PSTN
Um
BTS X.25
VLR
X.25
OMC Server
53
 GSM Network
SS
Switching
AUC System
External
PSTN & VLR HLR EIR
PDN N/W OMC
MSC
MS Mobile Station
BTS Base transceiver System
BSC Base Station Controller
MSC Mobile Switching Center BSS BSC Base Station
HLR Home Location Register
VLR Visitor Location Register BTS
System
EIR Equipment Identity Register
AUC Authentication Center MS 54
OMC Operation And Maintenance Center
GSM Architecture
GSM VMSC SMSC
Air interface
B
S A AUC
C interface HLR
Abis
interface
TRAU MSC PSTN

VLR
BTS
B
S
BTS C
BTS EIR
OMCS

BTS BTS
BTS
Network and switching
subsystem
Mobile A interface SS7 / speech
Station X.25
OMCR SS7

Base Station System 55

Mobile Equipment(ME)
• Frequency and Time Synchronization
• Voice encoding and transmission
• Voice encryption/decryption functions
• Power measurements of adjacent cells
• Display of short messages
• International Mobile Equipment Identifier (IMEI)

56
SIM
• Portable Smart Card with memory (ROM-6KB to
16KB-A3/A8 algorithm, RAM- 128KB TO 256KB,
EEPROM- 3KB to 8KB )
• Static Information
– International Mobile Subscriber Identity(IMSI)
– Personal Identification Number (PIN)
– Authentication Key (Ki)
• Dynamic Information
– Temporary Mobile Subscriber Identity(TMSI)
– Location Area Identity (LAI)
– Phone memories, billing information
– Ability to store Short Messages received
57
SIM-Card and GSM Mobile
Equipment
Global GSM Mobility
Card

= +
The Smart Card to use

GSM
Contains:
- IMSI

SIM-Card
 The SIM-Card Functions
Credit Card Size
µ SIM-Card
Global GSM Mobility
Card
15 mm
The Smart Card to use
25 mm

Permanent data:
­Unique mobile subscriber identity
through IMSI number and PIMSI
for Packet Mode
­Authentication parameter Ki,
­Authentication algorithm A3,
­Generating encryption key Kc
algorithm A8,
­PIN code.
GSM
Microchip with stored
user information
Removable data:
- Temporary Mobile Subscriber Number,
- Location Area Identification
- Routing Area Identification (Packet mode)
 Subscriber Identification
IMSI MS - ISDN

Mobile Station -
International Mobile Subscriber Identity
Nature Integrated Services Digital Network Nb

Similar to ISDN,
Conformity with E212
Conformity with E164/E213

Identify a PLMN Identify the subscriber

worldwide of a PLMN National Significant Mobile Number

MCC MNC MSIN CC NDC SN

Format H1 H2 x x x ......... x x x M1 M2 xx xx xx xx

Country
Mobile Mobile Mobile Subscriber National Mobile Subscriber
Code
Meaning Country Network Ident. Nb
(where Destination (national definition)
Code Code H1 H2 = Identity of HLR
subscription Code * M1 M2 = nbr of logical HLR
within the home PLMN
has been made)

Nb. digits 3 2 max 10 1 to 3 2 to 4 total max 15

*This code does not identify a geographical area

but an operator
Description Stored in SIM Card
Global GSM Mobility
Card
MCC MNC The Smart Card to use
= =
208 (France) 71(APBSNL)
234 (G-B) 72(TNBSNL)
262 (Germany) 20 (Bytel) IMSI = 15 digits max GSM
404,405(India)

Mobile Mobile Mobile Subscriber Identification Number (MSIN)

Country Network
Code Code H1 H2 X X X X X X
3 digits 2 digits 10 digits max

NMSI Temporary Mobile

Subscriber Identity
LAI
4 octets

Mobile Mobile
Country Network Location Area Code Routing Area Code
Code Code LAC RAC
3 digits 2 digits

RAI
 Description Stored in the Network
MS-ISDN (15 digits max)

Country National Subscriber Number (SN) Must be dialed to

Code Destination make a call to
Code M1 M2 X X X X X X X X X X X X X mobile
10 digits max subscriber
3 digits max 2 or 3 digits

MSRN

Roaming Number (RN) Is a PSTN-like

National number used to
Country reach a roaming
Destination
Code MS
Code

Is a PSTN-like
number to track the
National
Country MS that hands over
Code
Destination HO-number to another MSC
Code during call-in-state

NDC = 9448(BSNL-karnataka)
CC = 33 (France)
9845,9880(Airtel)
091(India)
9886(Hutch)
001(US)
62
= 660, 661, 618 (Bytel)
Descriptor Embodied in the
Mobile Equipment
IMEI enables the operator to check
the Mobile Equipment Identity
at call setup and make sure
that no stolen or unauthorized MS
is used in the GSM network

Y PE VED
T O
P PR
A
TAC FAC SNR SP

Type Approval Serial NumbeR (SPare)

Code Final Assembly
Code
International Mobile Equipment Identity
(IMEI)

Y PE VED
T O
P PR
A
TAC FAC SNR SP

Type Approval Serial number (SPare)

Code Final Assembly
Code

351475 60 IMEI:
926514 4# 0 6 #
*
 MS Classmark
Power classes
Classmark For GMSK modulation
Revision level GSM GSM GSM
Class
RF power 400/850/900 1800 1900
1 1 W** 1 W**
Encryption algorithm
2 8 W* 0.25 W 0.25 W
Frequency
3 5W 4W 2W
Short message 4 2 W**
LoCation Services 5 0.8 W
MS Positioning Method
For 8-PSK modulation
8-PSK modulation
GSM GSM GSM
Multi-slot class Class
400/850/900 1800 1900
Multi-band E1 2W 1W 1W
E2 0.5 W 0.4 W 0.4 W
* Typical value for car mounted E3 0.2 W 0.16 W 0.16 W
** Typical value for handheld
Base Transceiver Station
(BTS)
• Handles the radio interface to the mobile station.
• Consists of one or more radio terminals for
transmission and reception
• Each Radio terminal represents an RF Channel
• TRX and MS communicates over Um interface
• Received data transcoding
• Voice encryption/decryption
• Signal processing functions of the radio interface
• Uplink Radio channel power measurements

66
Base Station Controller (BSC)
• Provides all the control functions and physical links
between the MSC and BTS
• External Interfaces
– ‘Abis’ interface towards the BTS
– ‘A’ interface towards the MSC
• Monitors and controls several BTSs
• Management of channels on the radio interface
• Alarm Handling from the external interfaces
• Performs inter-cell Handover
• Switching from ‘Abis’ link to the ‘A’ link
• Interface to OMC for BSS Management
67
Mobile Switching Center
(MSC)
• Performs call switching
• Interface of the cellular network to PSTN
• Routes calls between PLMN and PSTN
• Queries HLR when calls come from PSTN to mobile
user
• Inter-BSC Handover
• Paging
• Billing

68
Home Location Register
(HLR)
• Stores user data of all Subscribers related to the
GMSC
– International Mobile Subscriber Identity(IMSI)
– Users telephone number (MS ISDN)
– Subscription information and services
– VLR address
– Reference to Authentication center for key (Ki)
• Referred when call comes from public land network

69
 Visitor Location Register
(VLR)
• Database that contains Subscriber
parameters and location information for all
mobile subscribers currently located in the
geographical area controlled by that VLR
• Identity of Mobile Subscriber
• Copy of subscriber data from HLR
• Generates and allocates a Temporary
Mobile Subscriber Identity(TMSI)
• Location Area Code
• Provides necessary data when mobile
originates call
70
Authentication Center (AuC)
• Stores Subscriber authentication data called Ki, a
copy of which is also stored in in the SIM card
• Generates security related parameters to authorize a
subscriber (SRES-Signed RESponse)
• Generates unique data pattern called Cipher key (Kc)
for user data encryption
• Provides triplets - RAND, SRES & Kc, to the HLR on
request.

71
 EIR (Equipment Identity
Register)
• EIR is a database that contains a list of all valid
mobile station equipment within the network, where
each mobile station is identified by its International
Mobile Equipment Identity(IMEI).
• EIR has three databases.,
– White list - For all known,good IMEI’s
– Black list - For all bad or stolen handsets
– Grey list - For handsets/IMEI’s that are on
observation

72
Location Area Identity
• LAI identifies a location area which is a group of
cells..
• It is transmitted in the BCCH.
• When the MS moves into another LA (detected by
monitoring LAI transmitted on the BCCH) it must
perform a LU.
• LAI = MCC + MNC + LAC
– MCC= Mobile Country Code(3 digits), identifies the country
– MNC= Mobile Network Code(1-2 digits), identifies the GSM-
PLMN
– LAC= Location Area Code, identifies a location area within a
GSM PLMN network. The maximum length of LAC is 16
bits,enabling 65536 different location areas to be defined in
one GSM PLMN. 73
 Interfaces and Protocols
Digital
Networks
ISUP
Abis A E

LAPD BSSAP TUP

MAP

Um LAPDm F MAP B POTS

MAP
C

D G

74
GSM Entities and Signaling
Architecture

75
 GSM Protocols
• CM - Connection Management
• MM - Mobility Management
• RR - Radio resource
• LAPDm - LAPD for mobile
• LAPD - Link Access Procedure for D channel
• BTSM - BTS Management Part
• BSSAP - BSS Application Part (BSC - MSC)
• DTAP - Direct Transfer Application Part (MS - MSC)
• MAP - Mobile Application Part
• MTP - Message Transfer part of SS7
• SCCP - Signalling Connection Control Part of SS7
• TCAP - Transaction Capabilities Application Part
• ISUP - ISDN User Part

76
 Functional Plane of GSM

MS BTS BSC MSC/VLR HLR GMSC

CC

MM

RR

Trans

MS BTS BSC MSC/ HLR GMSC

VLR
77
 TOPICS
• GSM CONCEPTS
• GSM SYSTEM ARCHITECTURE
• IDENTIFIERS USED IN GSM
• GSM CHANNELS
• GSM RADIO LINK
• MOBILITY MANAGEMENT
• CALL MANAGEMENT
• RADIO RESOURCE MANAGEMENT

78
 TOPICS
• GSM CONCEPTS
• GSM SYSTEM ARCHITECTURE
• IDENTITIES USED IN GSM
• GSM CHANNELS
• GSM RADIO LINK
• MOBILITY MANAGEMENT
• CALL MANAGEMENT
• RADIO RESOURCE MANAGEMENT

79
Channels : differentiating
between Physical and Logical
channels
Physical channels : The combination of an ARFCN
and a time slot defines a physical channel.

Logical channels : These are channels specified by

GSM which are mapped on physical channels.

80
 Channel concept
Physical channel:
One timeslot of a TDMA-frame on one carrier
is referred to as a physical channel.
There are 8 physical channels per carrier in
GSM,channel 0-7(timeslot 0-7)

Logical channel:
A great variety of information must be
transmitted between BTS and the MS,for e.g.
user data and control signaling.Depending
on the kind of information transmitted we
refer to different logical channels.These logical
channels are mapped on physical 81
channel.
Logical Channels on Air interface
LOGICAL
CHANNELS

COMMON DEDICATED
CHANNELS CHANNELS

BROADCAST COMMON DEDICATED TRAFFIC

CHANNELS CONTROL CONTROL CHANNELS
CHANNELS CHANNELS

FCCH SCH BCCH SDCCH SACCH FACCH

PCH RACH AGCH TCH/F TCH/H TCH/EFR

82
 Logical channels
Logical channels

Control channels Traffic channels

Half Full
CCCH DCCH
BCH rate rate

FCCHSCH BCCH CBCH PCH AGCH RACH SDCCH SACCH FACCH

83
Broadcast channels BCH
• Broadcast Channel-BCH
– Alloted one ARFCN & is ON all the time in every cell.
Present in TS0 and other 7 TS used by TCH.
• Frequency correction channel-FCCH
– To make sure this is the BCCH carrier.
– Allow the MS to synchronize to the frequency.
– Carries a 142 bit zero sequence and repeats once in every
10 frames on the BCH.
• Synchronization Channel-SCH
– This is used by the MS to synchronize to the TDMA frame
structure within the particular cell.
– Listening to the SCH the MS receives the TDMA frame
number and also the BSIC ( in the coded part- 39 bits).
– Repeats once in every 10 frames. 84
Broadcast channels BCH ...
• BCCH
– The last information the MS must receive in order to receive
calls or make calls is some information concerning the cell.
This is BCCH.
– This include the information of Max power allowed in the
cell.
– List of channels in use in the cell.
– BCCH carriers for the neighboring cells,Location Area
Identity etc.
– BCCH occupies 4 frames (normal bursts) on BCH and
repeats once every Multiframe.
– This is transmitted Downlink point to multipoint.
• Cell Broadcast Channel - CBCH
– Used for the Transmission of generally accessible
85
information like Short Message Services(SMS)
Common Control Channels
CCCH
• CCCH-
– Shares TS-0 with BCH on a Multiframe.
• Random access channel-RACH:
– Used by Mobile Station for requesting for a channel. When
the mobile realizes it is paged it answers by requesting a
signaling channel (SDCCH) on RACH. RACH is also used
by the MS if it wants to originate a call.
– Initially MS doesn’t know the path delay (timing advance),
hence uses a short burst (with a large guard period = 68.25
bits).
– MS sends normal burst only after getting the timing advance
info on the SACCH.
– It is transmitted in Uplink point to point.
86
Common Control Channels
CCCH ..
• Access Grant Channel-AGCH
– On request for a signaling channel by MS the network
assigns a signaling channel(SDCCH) through AGCH. AGCH
is transmitted on the downlink point to point.
• Paging Channel-PCH
– The information on this channel is a paging message
including the MS’s identity(IMSI/TMSI).This is transmitted on
Downlink, point-to-multipoint.

87
Dedicated Control Channels-
DCCH
• Stand alone dedicated control channel(SDCCH)
• AGCH assigns SDCCH as signaling channel on
request by MS.The MS is informed about which
frequency(ARFCN) & timeslot to use for traffic.
• Used for location update, subscriber authentication,
ciphering information, equipment validation and
assignment of TCH.
• This is used both sides, up and Downlink point-point.

88
Dedicated Control Channels-
DCCH
• Slow associated control channel-SACCH
– Transmission of radio link signal measurement, power
control etc.
– Average signal strengths(RXLev) and quality of service
(RXQual) of the serving base station and of the neighboring
cells is sent on SACCH (on uplink).
– Mobile receives information like what TX power it has to
transmit and the timing advance. It is associated with TCH
or SDCCH
• Fast associated control channel-FACCH
– Used for Hand over commands and during call setup and
release. FACCH data is sent over TCH with stealing flag set
89
Traffic Channels-TCH
• TCH carries the voice data.
• Two blocks of 57 bits contain voice data in the normal
burst.
• One TCH is allocated for every active call.
• Full rate traffic channel occupies one physical
channel(one TS on a carrier) and carries voice data
at 13kbps
• Two half rate (6.5kbps) TCHs can share one physical
channel.

90
 GSM Channels
GSM Channels

Traffic Channels Control Channels

(TCHs)

Broadcast Common Control Dedicated Control

Channels Channels Channels
(BCHs) (CCCHs) (DCCHs)

(down uplink)
Full Half
Downlink Downlink Uplink
rate rate
Fast Slow

TCH /F TCH /H FCCH SCH BCCH PCH AGCH CBCH RACH SDCCH FACCH SACCH
Traffic Multiframing Signaling Multiframing Traffic Multiframing

91
 The Logical Channels on Radio Interface
TS 0123456 7

BTS MS
FCCH TCH
Frequency correction Traffic (speech-data)
SCH FACCH
Synchronization Associated Signaling
BCCH
Broadcast control
RACH Radio Measurement + SMS
SACCH
Access request SDCCH
Dedicated Signaling
PCH
Subscriber paging CBCH
Broadcast info
AGCH
Answer to Access request
FCCH
CBCH
Broadcast info SCH
M.S. Pre-synchronization
SDCCH
Dedicated Signaling BCCH
SACCH
Sys InFo 5, 6 + SMS RACH
Access request
PCH
Traffic (speech data) Subscriber paging
TCH
AGCH
Associated Signaling Answer to Access request
FACCH
92
 Logical Channel Description
(1/2)
SACCH MESSAGES
TCH MESSAGES
Measures:
­power level of the communication • Speech

­quality level of the communication • Data

­level on the beacon frequency of • Handover Access message (uplink)

the neighboring cells
• Timing Advance
• Power Control
• SMS FACCH MESSAGES
• Connection establishment from
SDCCH to TCH
SDCCH MESSAGES • End validation of a SDCCH-TCH
commutation
• Request for a SDCCH assignment
• Characteristics of the future used BS
• Request for the end of channel after handover
assignment
• Connection establishment to BS after
• Order of commutation from SDCCH to handover
TCH
• Validation of an handover
• SMS

93
 Logical Channel
FCCH MESSAGES
Description
AGCH MESSAGES
(2/2)
• no message is sent (all bits 0) • For dedicated channel assignment:
­frequency number
­slot number
­frequency hopping description
SCH MESSAGES ­Timing Advance (1st estimation)
• Frame Number ­MS identification
• Base Station Identity Code (BSIC)
CBCH MESSAGES
BCCH MESSAGES • Specific information
(weather, road information
ormation type 1, 2, 2bis,
8
(idle mode) RACH MESSAGES
• Service request:
­emergency call
PCH MESSAGES ­answer to an incoming call
­outgoing call
• messages containing a mobile ­short message
identity for a call, a short message ­call re-establishment
or an authentication ­inscription

94
 Traffic and Control Multiframing
Traffic channel Control channel
Frame
4.615 ms

TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS TS
0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7

26 traffic frames = 120 ms

0 1 2 3 4 21 22 23 24 25 0 1 2 3 4 46 47 48 49 50

1326
frames

0 1 2 3 4 51 x 26 traffic frames = 6.12 s 46 47 48 49 50

0 1 2 3 26 x 51 control frames = 6.12 s 22 23 24 25

0 1 2 3 4 5 2042 2043 2044 2045 2046 2047

1 Hyperframe = 2,715,648 frames= 3h 28 min. 53 s 760 ms

96
97
 Logical Channel Mapping
1 - Traffic Channel Combination
T
Full Rate - Downlink & Uplink
26 frames = 120 ms

T T T T T T T T T T T T A T T T T T T T T T T T T time

Half Rate - Downlink & Uplink

26 frames = 120 ms

T0 T1 T0 T1 T0 T1 T0 T1 T0 T1 T0 T1 A0 T1 T0 T1 T0 T1 T0 T1 T0 T1 T0 T1 T0 A1 time

T : TCH Ti : TCH A : SACCH Ai : SACCH : IDLE

sub-channel no. i sub-channel no. i

99
 Logical Channel Mapping
2 - Dedicated Signaling Channel Combination

A A A A

Downlink
51 frames = 235 ms
D0 D1 D2 D3 D4 D5 D6 D7 A0 A1 A2 A3

D0 D1 D2 D3 D4 D5 D6 D7 A4 A5 A6 A7
time

Uplink
51 frames = 235 ms
A5 A6 A7 D0 D1 D2 D3 D4 D5 D6 D7 A0

A1 A2 A3 D0 D1 D2 D3 D4 D5 D6 D7 A4
time
A : SACCH D : SDCCH : IDLE

100
 Logical Channel Mapping
3 - Common Channel Combination
Downlink Multiframe m
Multiframe Multiframe
m-1 51 frames = 235.38 ms m+1

C FS B C FS C C FS C C FS C C FS C C FS B

Frames repeat continuously time

PCH/AGCH
Physical Channel
BTS ARFCN (n) TS (s) MS
SCH BCCH
FCCH

Uplink
51 frames = 235.38 ms
R R R RR R R RR R RRR R R RR R R RRR R RR R R RR R R R R R R R R R RRR R RR RR RR R R R

time
: PCH /
F : FCCH S : SCH B : BCCH C AGCH R : RACH : IDLE

101
 Logical Channel Mapping
4 - Common
Downlink
Channel Combination
51 frames = 235 ms

FS B C FS C C FS D0 D1 FS D2 D3 FS A0 A1

FS B C FS C C FS D0 D1 FS D2 D3 FS A2 A3
time

Uplink
51 frames = 235 ms
D3 RR A2 A3 RRRRRRRRRRRRRRRRRRRRRRR D0 D1 RR D2

D3 RR A0 A1 RRRRRRRRRRRRRRRRRRRRRRR D0 D1 RR D2
time

: AGCH
F : FCCH S : SCH B : BCCH C /PCH R : RACH A : SACCH D : SDCCH : IDLE

102
103
 Why 26 and 51 Frames per Multiframe?
0 1 10 20 30 40 50 0 1

FS B C FS C C FS C C FS C C FS C C FS

TTTTTTTTTTTTATTTTTTTTTTTT TTTTTTTTTTTTATTTTTTTTTTTT

01 12 25 0 1 12 25

Downlink
message

Uplink
message

Mobile Rx Rx Tx Rx Rx Tx Rx Rx Tx
activity (n) (n) (n)

Neighboring BTS
(downlink)

Measurement Windows
104
 TOPICS
• GSM CONCEPTS
• GSM SYSTEM ARCHITECTURE
• IDENTITIES USED IN GSM
• GSM CHANNELS
• GSM RADIO LINK
• MOBILITY MANAGEMENT
• CALL MANAGEMENT
• RADIO RESOURCE MANAGEMENT

105
From Speech to Radio Transmission
Speech

Digitizing and Source

Step 1 source coding decoding

Channel Channel
Step 2 coding decoding

Interleaving De-interleaving

Step 3
Burst deformatting
Burst formatting

Deciphering
Step 4 Ciphering

Demodulation
Step 5 Modulation equalization

Step 6 Diversity
Transmission

106
 GSM Radio Link

• Speech Coding -Done at Transcoder of BSC and MS

– The Linear Predictive Coder uses RPE-LTP(Regular Pulse
Excitation- Long Term Prediction)
– Converts 64kbps voice to 13kbps(260 bits every 20ms)
• Channel Coding - Done at BTS and MS
– Uses Convolution Coding and CRC (Cyclic Redundancy
Check)
– Converts 13 kbps to 22.8 kbps (456 bits per 20ms)

107
GSM Radio Link
• Bit Interleaving - Done at BTS and MS
• Encryption - Done at BTS and MS
– EX OR data with cipher block, which is generated by
applying A5 Algorithm to the Ciphering Key(Kc)
• Multiplexing - Done at BTS
• Modulation - Done at BTS and MS
– GMSK(Gaussian filtered Minimum Shift Keying)
– Phase change of +90 for 0 and -90 for 1

108
 Speech Coding
BP A/D SPEECH
ENCODER
CHANNEL
CODING
To modulator

Every 20ms 160 samples 1A 1B 2

BAND Every 125 s value is taken
PASS Data rate = 160 * 13/20ms
300 Hz -
sampled from analog 50 132 78
signal and quantised by = 104 kbps
3.4 kHZ
13 bit word 3 crc bits
Data rate = 13/125*10 -6 Four 0 bits for codec
= 104 kbps
50 3 132 4

Conv coding rate = 1/2 delay = 4

Linear Predictive Coding & Regular Long term prediction analysis

Pulse Excitation Analysis 1. Previous sequences stored in memory
378 coded bits 78
1. Generates 160 filter coeff 2. Find out the correlation between the
2. These blocks sorted in 4 sequence present seq. And previous sequences
1,5,9,…37 / 2,6,10----38/ 3. Select the highest correlation sequence 456 bits in 20 ms = 22.8 kbps
3,7,11…39/8,12,16…40 4. Find a value representing the difference 57 x 8 = 456
3. Selects the sequence with most between the two sequences.
1A = Filter Coeff
energy
block ampl, LTP
Reduces data rate = 26 kbps/2 = 13 kbps
params
So data rate = 104/4 = 26 kbps ie 260 bits in 20ms
1B = RPE pointers &
pulses
2 = RPE pulse & filter
params
CHANNEL
LP D/A SPEECH
DECODER
DECODING

111
 Channel Processing in GSM
Overview for Full Rate
20 ms Speech blocks 20 ms 20 ms
A B C

Codec dependent Codec dependent Codec dependent

Source coding
Channel coding

A 456 bits B 456 bits C 456 bits

A A A A B B B B B B B B 8 Sub blocks C C C C
5 6 7 8
Interleaving 1 2 3 4 5 6 7 8 1 2 3 4
of 57 bits

A5 A6 A7 A8 B5 B6 B7 B8
8 Bursts B1 B2 B3 B4 C1 C2 C3 C4

Normal 3 57 bits 1 26 bits 1 57 bits 3

burst
Tail Information CRL Training CRL Information Tail
112
113
 Channel Processing in GSM
Overview for Half Rate
20 ms Speech blocks 20 ms 20 ms
A B C

Codec dependent Codec dependent Codec dependent

Source coding
Channel coding

A 228 bits B 228 bits C 228 bits

A A A A B B B B 4 Sub blocks C C C C
1 2 3 4
Interleaving 1 2 3 4 1 2 3 4
of 57 bits

A3 A4 B3 B4
4 Bursts B1 B2 C1 C2

Normal
burst 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7

114
 Interleaving: TCH Full Rate
0 1 2 3 4 5 6 7 8 ... ... 452 453 454 455 456
coded bits
Divide 456 bits in 8 sub-blocks

0 1 2 3 4 5 6 7

57 Rows
8 9 10 11 12 13 14 15 reordering
•• •• •• •• •• •• •• •• &
• • • • • • • • partitioning
out
448 449 450 451 452 453 454 455

4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3

diagonal
interleaving

bit
interleaving

burst
b0 b1 b56 b0 b1 b56
115
 Burst Formatting
Normal Burst
1 frame:
4.615 ms

0 1 2 3 4 5 6 7

Training Guard
DATA S sequence
S DATA
Band

3 57 1 26 1 57 3 8.25

Burst
148 bits Guard

156.25 bits duration

(0.577 ms)

116
 Burst Formats
Frequency Correction Burst
(FCCH) Guard
Tail Data Tail Period
3 bits 142 fixed bits (0) 3 bits 8.25 bits

156.25 bits duration

(0.577 ms)

Synchronization Burst
(SCH) Guard
Tail Data Extended Training Sequence Data Tail Period
3 bits 39 encrypted bits 64 synchronization bits 39 bits 3 bits 8.25 bits

156.25 bits duration

(0.577 ms)

117
 Burst Formats
Normal Burst
Tail Data Training Sequence Data Tail Guard
Period
3 bits 57 encrypted bits 1 26 bits 1 57 encrypted bits 3 bits 8.25 bits

156.25 bits (0.577 ms)

Dummy Burst
Guard
Tail Dummy Sequence Training Sequence Dummy Sequence Tail Period

3 bits 58 mixed bits 26 midamble bits 58 mixed bits 3 bits 8.25 bits

156.25 bits (0.577 ms)

Access Burst
Training
Tail Sequence Data Tail Guard Period

8 bits 41 synch bits 36 encrypted bits 3 bits 68.25 bits

156.25 bits (0.577 ms)

118
 Ciphering
Burst to be
Data S S Data
transmitted

Plain data: 0 1 1 1 0 0 1 0.....

Ciphering sequence: 0 0 0 1 1 0 1 0.....
XOR:
Ciphered data (transmitted): 0 1 1 0 1 0 0 0.....
Ciphered sequence: 0 0 0 1 1 0 1 0.....
XOR:
Recovered data: 0 1 1 1 0 0 1 0.....

Received S Training S
Data Data
burst sequence

119
 Interleaving
Encoded speech blocks - Diagonal Interleaving

57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57

57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 Even bits
57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 Odd bits
Bn-4 Bn-3 Bn-2 Bn-1 Bn Bn+1 Bn+2 Bn+3

Encoded control channel blocks - Rectangular Interleaving

57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57

57 57 57 57 57 57 57 57 57 57 57 57 Even bits
57 57 57 57 57 57 57 57 57 57 57 57 Odd bits
Bn-4 Bn-3 Bn-2 Bn-1 Bn Bn+1 Bn+2 Bn+3

Tb Coded Data F Training Sequence F Coded Data Tb Gp

3 57 1 26 1 57 3 8.25

120
Burst
• The information format transmitted during one
timeslot in the TDMA frame is called a burst.
• Different Types of Bursts
– Normal Burst
– Random Access Burst
– Frequency Correction Burst
– Synchronization Burst

121
 Normal Burst
156.25 bits 0.577 ms

T Coded Data S T. Seq. S Coded Data T GP

3 57 1 26 1 57 3 8.25

Tail Bit(T) :Used as Guard Time

Coded Data :It is the Data part associated with the burst
Stealing Flag :This indicates whether the burst is carrying
Signaling data (FACCH) or user info (TCH).
Training Seq. :This is a fixed bit sequence known both to
the BTS & the MS.This takes care of the
signal deterioration.

122
 156.25 bits 0.577 ms

T Training Sequence Coded Data T GP

3 41 36 3 68.25

Random Access Burst

156.25 bits 0.577 ms

T Fixed Bit Sequence T GP

3 142 3 8.25

Freq. Correc. Burst

156.25 bits 0.577 ms

T Coded Data Training Sequence Coded T GP

3 39 64 Data 39 3 8.25

Synchronization Burst

123
 Transmission on the
radio channels
• A timeslot has a duration of .577 m seconds (148 Bits)
• 8 timeslots(8 x 0.577 = 4.62 ms) form a TDMA frame
• If a mobile is assigned one TS it transmits only in this time
slot
• and stays idle for the other 7 with its transmitter off, called
bursting
• The start on the uplink is delayed from downlink by 3 TS
periods
• One TS = duration of 156.25 bits, and its physical contents
is
• called a burst
Downlink 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7
BTS > MS

Uplink 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7
MS > BTS
124
Offset
 Timing Advance
MS1 0 1 2 3 4 5 6 7 MS1 0 1 2 3 4 5 6 7
near near

MS2 MS2
0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7
far far

At At
BTS BTS
0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7

0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7

125
Frames Types On Um
Interface
• TDMA Frame
– 8 Time slots (Burst Period)
– Length is 4.62 ms(8 * 0.577ms)
• 26-TDMA Multiframe
– 26 TDMA Frames (24 TCH, SACCH, Idle)
– 120 ms (26 * 4.62ms)
• 51-TDMA Multiframe
– 26 TDMA Frames (FCCH, SCH, BCCH, SDCCH, CCCH)
– 235.6 ms (51 * 4.62ms)

126
Frames Types On Um
Interface
• Super Frame
– 51* 26 TDMA Frames
– 6.12 S
• Hyper Frame
– 2048 * 51* 26 TDMA Frames
– 3 Hours, 28 Minutes, 53 Secs and 760 ms

127
 TOPICS
• GSM CONCEPTS
• GSM SYSTEM ARCHITECTURE
• IDENTITIES USED IN GSM
• GSM CHANNELS
• GSM RADIO LINK
• MOBILITY MANAGEMENT
• CALL MANAGEMENT
• RADIO RESOURCE MANAGEMENT

128
Mobility Management
• Mobility Management (MM)
• Location updating- normal,periodic, IMSI attach
• Paging
• Security Management
– Preventing unauthorized users- authentication
– Maintaining Privacy of users- ciphering
• Providing roaming facility
• MM functionality mainly handled by MS, HLR,
MSC/VLR.

129
Network Attachment
· Cell Identification
· MS scans complete GSM frequency band for
highest power
· Tunes to highest powered frequency and looks
for FCCH. Synchronizes in frequency domain
· Get training sequence from SCH which follows
FCCH. Synchronizes in time domain.
· Accesses BCCH for network id, location area and
frequencies of the neighboring cells.
· Stores a list of 30 BCCH channels

130
 Network Attachment…..
· PLMN Selection
· Get the operator information from SIM.
· Cell Selection
· Selected cell should be a cell of the selected
PLMN
· Signal strength should be above the threshold.
· Cell should not be barred
· Location Update
· Register with the network by means of location
updation procedures.

131
 MS Location Update
MS BTS BSC
(registration)
(G)MSC VLR HLR
Action
Channel Request (RACH)
Channel Assignment (AGCH)

TMSI + old LAI

Location Update Request (SDCCH)
Authentication Request (SDCCH)

Authentication Response (SDCCH)

Comparison of Authentication param

Accept LUP and allocTMSI (SDCCH)

Ack of LUP and TMSI (SDCCH)

Entry of new area and identity into

VLR and HLR

Channel Release (SDCCH)

132
 Security - Authentication
MS
Ki RAND
Authentication center
provides RAND to Mobile
A3 AuC generates SRES using
SRES Ki of subscriber and RAND
Mobile generates SRES
MS BTS AuC using Ki and RAND
Mobile transmits SRES to
BTS
RAND
BTS compares received
SRES
SRES with one generated
SRES by AuC
Auth Result
133
 Security - Ciphering
MS
Ki RAND

A8
Data sent on air
interface ciphered
for security
Kc
Um interface A5 and A8
MS Network

Kc
algorithms used to
Kc
cipher data
Data
A5
Ciphered
A5
Data
Ciphering Key is
Data
never transmitted
on air
134
 TOPICS
• GSM CONCEPTS
• GSM SYSTEM ARCHITECTURE
• IDENTITIES USED IN GSM
• GSM CHANNELS
• GSM RADIO LINK
• MOBILITY MANAGEMENT
• CALL MANAGEMENT
• RADIO RESOURCE MANAGEMENT

135
Communication Management
(CM)
• Setup of calls between users on request
• Routing function i.e. Choice of transmission
segments linking users
• Point to Point Short message services

136
PLMN Selection
Yes Yes
Is there an up to date
found PLMNs list?

No

Creation of a found
PLMN list

manual automatic
mode mode

The user selects a The MS selects the first

PLMN from the PLMN from the preferred
displayed PLMNs PLMNs list (if it is not in
the forbidden PLMNs list)

No (manual) Cell Selection

succeed?

Yes Selection of the

No (automatic) next preferred
End of PLMN possible PLMN
selection
 PLMN Selection
• Constitution of the "Found PLMN list"
Listen to all the
frequencies of the GSM
spectrum:
power level measurement (124 channels in GSM
and average on these 900, 374 in GSM 1800
measurements and 299 in GSM 1900

Select the best

frequencies
according to the
power level (30 in GSM 900 and 40 in GSM 1800)

Memorize the
beacon
frequencies in the
precedent
selection

=> Create the

Found PLMN list
 Initial Cell Selection
List of the
frequencies of the
selected PLMN

Selection of
Eligible cell? another PLMN
No
Yes
C1 Computation for
Suitable cell:
eligible cells
- cell of the selected PLMN
Eligible cell
- cell not barred
- C1 > 0 Suitable cell?
No
Yes
Look for the cell with the best
C1 in the suitable cells list

PLMN set in the

IMSI Attach forbidden
PLMN list
End of Cell Selection
Rejected?

No Yes
 Cell Selection
Purpose: get synchronization
with the GSM network
prior establishing any communication.
1

BTS-5
1 BTS-4 1

H 2
FCC
1 3
BTS-3 5 SCH
4
CH
BC BTS-1

This cell
BTS-2
 Immediate Assignment
MS BTS BSC MSC

CHANNEL REQUEST
1 CHANNEL REQUIRED
RACH 2
CHANNEL ACTIVATION
3 Immediate
4
CHANNEL ACTIVATION Assignment
ACK.

IMMEDIATE ASSIGNMENT
IMMEDIATE ASSIGNMENT 5
5 COMMAND
AGCH

CM SERVICE REQUEST
6
SDCCH or TCH
OR
LOCATION UPDAT. REQU.
6
SDCCH or TCH
Registration: the Very First
Location Update
1
BSS
IMSI 2
2 4 MSC
4 BSC TMSI
5
TMSI 6
5 BTS 2
Release
6
4 TMSI

LAI HLR VLR

IMSI 3 IMSI
VLR id TMSI
LAI
 Intra – VLR Location Update
1 BSS
TMSI + old LAI 2
2 MSC
BSC
new TMSI 3
3
BTS 4
4 2
New TMSI
TMSI
3

New LAI VLR

IMSI
TMSI
LAI

IMSI not Required

Inter – VLR Location Update
1 BSS
2
TMSI + old LAI
2 BSC 5 MSC
newTMSI
5
BTS 7
7 2
TMSI New TMSI
5
New LAI Old VLR New VLR
IMSI, TMSI 3 IMSI,TMSI
Old LAI LAI
RAND, SRES, 4 RAND, SRES,
Kc Kc

IMSI not Required HLR subscriber

6 data
new
VLR id

145
 IMSI Attach
CHANNEL
1
REQUEST BSS
IMMEDIATE
ASSIGNMENT
2

3 LOCATION UPDATING BSC 3

REQUEST (IMSI Attach)
Authentication BTS
4 4 MSC
Procedure
LOCATION UPDATING
5
5
ACCEPT (LAC, TMSI)

VLR

146
 IMSI Detach
CHANNEL
1 BSS
REQUEST
IMMEDIATE
ASSIGNMENT
2
BSC
IMSI DETach
MSC
IMSI DETach 3
3 INDication
INDication
BTS
CHANNEL
4
RELEASE

VLR

147
 Mobile Originating Call
MS BSS MSC PSTN
CHANNEL REQUEST VLR
Dialing 1
IMMEDIATE ASSIGNMENT
2
CM SERVICE REQUEST CM SERVICE REQUEST
2 2

3 Authentication procedure

3 Ciphering procedure

Sending SETUP (basic) or SETUP

4 4
Number EMERGENCY 5
IAM
CALL PROCEEDING 6 Ring
CALL PROCEEDING 7
7
Ringing
7 Assignment procedure
ACM
ALERTING 9 8
Ringing
ANM
Path CONNECT 10
11
Established
CONNECT ACKnowledge ACM = Address Complete Message
11 ANM = ANswer Message
IAM = Initial Address Message

149
 Mobile Terminating Call
1 - Paging Principle
LA1

6 BSC1 4
BTS11
5
3 1
BTS12 MSC/ PSTN
6 GMSC
5 VLR
BSC2
BTS21
2
BTS22
HLR
LA2
BTS23 BSC3

BTS31

150
 Mobile Terminating Call
2 - Detailed Procedure
Visitor PLMN International Home PLMN
SS7
VLR HLR
Provide Roaming Number
(IMSI) 4

Roaming Number
5 (MSRN)
6
9
Send 1
Send info Routing Routing
PAGE to I/C
PAGING Information Information MSISDN
(TMSI + LA) (MSRN)
REQUEST (MSRN) (MSISDN)
(TMSI)
8 3
11 PAGING IAM (MSRN)
REQUEST 10 IAM
VMSC 7 GMSC (MSISDN) 2 ISDN
BSS (TMSI + LA)
PN

IAM : Initial Address Message IMSI : International Mobile Subscriber Identity

MSISDN : Mobile Station Integrated Services Digital GMSC : Gateway MSC
network Number VMSC : Visitor MSC
MSRN : Mobile Station Roaming Number TMSI : Temporary Mobile Subscriber Identity
151
 Mobile Terminating Call
3 - End to End Procedure
MS BSS VMSC GMSC PSTN

IAM
IAM 1
PAGING REQUEST 2 (MSISDN)
PAGING REQUEST 3 (MSRN)
4 (TMSI or IMSI, LA) Dialing
CHANNEL REQUEST
5
(LAC, Cell ID)

IMMEDIATE ASSIGNMENT 6
(SDCCH or TCH)

CM SERVICE REQUEST PAGING RESPONSE

7
(Paging Response) 7
(TMSI or IMSI, LA)

8 Authentication procedure

9 Ciphering procedure
Ringing
10 Setup, Assignment, Alerting Address Complete Message
11
CONNECT ANswer Message
12
12
Path
Established
152
 Call Release
1 - Mobile Initiated
MS BSS MSC PSTN

1 Call in progress

DISCONNECT
2 DISCONNECT
2

RELEASE RELEASE
3
3

RELEASE COMPLETE
4
Release
CHANNEL RELEASE 6 5

RELEASE INDICATION
7

RF Channel Release
procedure 8
Release
9
tone

153
Call Release
2 - PSTN Initiated
1
BSS 1 1

3 3 REL
MSC 2
4 BSC 4 PSTN
RLC
5 6
BTS 5

1
2
Purpose:
informs the mobile
then releases radio
and network resources.

On hook

154
Mobile Originated Call
• Request for Service
• Authentication
• Ciphering
• Equipment Validation
• Call Setup
• Handovers
• Call Release

155
Mobile Terminated Call
• Paging
• Authentication
• Ciphering
• Equipment Validation
• Call Setup
• Handovers
• Call Release

156
 Mobile Terminated Call
MS

Paging HLR
BTSTMSI Paged
Assignment CMD
(=TCH) on SDCCH on PCH BSC VLR

Query for
*RESP
MS
Allocate
Page tunes
SDCCHon SDCCH VLR info
MS Ch. REQ
* Assgn CMP Connect traffic Ch.to trunk AuC
over
( TMSI
over AGCH
RACH + LAI) frees SDCCH Query VLR GMSC
BTS
* Phone rings Page
Page RES Reply
Assgn CMP for LAC and (MSRN)
Assign. REQ
Paging TMSI
the area
(+TMSI) EIR
Route
toNetwork
MSC Alerting
MSC
BSC
PSTN
BTS

Land to
Mobile call
(MSISDN)

Authentication and Ciphering procedure done as seen in Location Updation 157

 TOPICS
• GSM CONCEPTS
• GSM SYSTEM ARCHITECTURE
• IDENTITIES USED IN GSM
• GSM CHANNELS
• GSM RADIO LINK
• MOBILITY MANAGEMENT
• CALL MANAGEMENT
• RADIO RESOURCE MANAGEMENT

158
Radio Resource Management
• Establish maintain and release stable connections
between MS and MSC
• Manage Limited Radio and Terrestrial resources
• Handover process is the sole responsibility of the RR
Layer
• Functions of RR layer are performed by MS and BSC
and partly by MSC

159
Radio Resource Management

• Power Control
• Hand over Control
• Discontinuous Transmission
• Frequency Hopping

160
Power Control

BTS commands MS at different

distances to use different power levels
so that the power arriving at the BTS’s Rx is
approximately the same for each TS

- Reduce interference
- Longer battery life

161
 Handover
Means to continue a call even a mobile crosses
the border of one cell to another
Procedure which made the mobile station really
roam
Handover causes
RxLev (Signal strength , uplink or downlink)
RxQual (BER on data)
O & M intervention
Timing Advance
Traffic or Load balancing

162
Handover Types
• Internal Handover (Intra-BSS)
– Within same base station - intra cell
– Between different base stations - inter cell
• External Handover (Inter-BSS)
– Within same MSC -intra MSC
– Between different MSCs - inter-MSC

163
 Handover Types
GMSC
MSC

BSC

BSC

C-3
BSC
MSC

C-4 C-1 C-2 BSC

164
Intra BSC handover HO performed

HO required
Activate TCH(facch)
with HoRef#
BSC
Acknowledges and
alloctes TCH (facch) if
1. Check for HO passed
2. Channel avail in new BTS

BTS 2 Periodic Measurement

Reports (SACCH)
Periodic Measurement
Reports

MS tunes into new frequency

and TS and sends HO message to
new BTS (facch)
HO cmd with HoRef#
Receives new BTS data(FACCH)

Release TCH

Cell 2
Periodic Measurement
Reports (SACCH) BTS 1

Cell 1
165
 Frequency plan and importance of BCCH
B5 Sectored
B6 antennas
B4
ample frequency plan:
adcast frequencies : B3
B7
Broadcast channels = 48-62 B1
Hopping channels = 32-46 B8 B2

B12 MS ( monitoring the

B9 broadcast radio B1 in ‘idle
B10 mode’ )

B11

F0 F1 F2 F3 F4 F5 F10 F11 F50

F S B B B B ….. F S ….. ….. I

• F,S,B exist in time slot 0 of each frame

166
What information does Broadcast Control
channel (BCCH) contain?

 Serves as a Beacon for the Cell

 Country Code (CC) and the Network Code (NC)
 Location Area Identity (LAI)
 List of neighboring cells which should be monitored
by MS
 List of frequencies used in the cell
 Cell identity

Back 167
Location Updates
Location Updates can be classified
into two:

Periodic Location Updates:

This occurs as per the timer set by the network
operator. If the MS does not perform this update
the MSC marks the MS as ‘Detached’ on the VLR.

Location Update on a handover:

This occurs if during a handover the MS is moved
into a new Location Area Code (LAC).

168
1. The MS is monitoring the BCCH and has all the decoded
information stored on the SIM ( including the LAC)
2. As soon as the mobile is on a TCH it sends the signal
strength indication on the corresponding SACCH
3. The BSC monitors the signal strengths and on analysis
sends a ‘handoff request’ on FACCH. The handoff process is
completed on the FACCH.
4. After the completion of call, the MS starts monitoring the
BCCH again. On finding the LAC (stored on SIM) and that
decoded from the BCCH to be different , the MS requests a
‘Location Update’ through SDCCH.

Back 169
 Discontinuous
Transmission
• Discontinuous Transmission(DTX) allows the
radio transmitter to be switched off most of the
time during speech pauses.
• A Silence Indicator Block is transmitted at
500bps, which generates a comfort noise
• Down Link interference is decreased.
• Up link battery is saved

170
Frequency Hopping
• Frequency Hopping permits the dynamic switching of
radio links from one carrier frequency to another.
• Base Band Hopping
– At the BTS each the timeslot is shifted to another
transceiver, which is transmitting at the hop
frequency. User will be connected to different
Transceivers depending on hop sequence.
• Synthesis Hopping
– At the BTS transceiver changes the frequencies used.
The user will be connected to only one transceiver.
• Decreases the probability of interference
• Suppresses the effect of Rayleigh fading
171
Add-on to GSM network
Enhanced : rate for GSM Evolution
Data
PCU; Packet• Segmentation/re-assembly
EDGETelecommunication and
is an enhancementStandards scheduling
of GPRS and CSD technologies.
• Universal
Radio channelMobile
• Based access control and management
Innovative Service on Architecture
the current GSM technology
: VHE Concept - -providing
same TDMAtheframe
us
• •Transmission
Wireless Data
error
structure, detection
same and retransmission.
bandwidth (200 kHz).
• the
Powersame look and feel of its personalized services independent of
control
network • Uses
andmobility 8-PSK modulation instead of GMSK. Surf the Internet while on the move
terminal.
SGSN: GPRS Requires good propagation conditions.
High• Convergence
Data Application
Global
• •Encryption
Speed
Allows
User• Data
public/private
Circuit :Switched Data Telecom/Datacom,
Fixed/Mobile,
upto 48 kbps (EGPRS) and upto 28.8
Rate:14.5kbps kbps
W@P (ECSD) :on
Gateway
• Charging
•SMS Mobile every
Use multiple radio
-numeric
Multimedia channel
timeslots
driven (max=8),
market. • Adaptation of the information to the mobile
GGSN : Data:
•
160
Interface to
EDGE the PDN,
helps
characters
Internet
GSM-Only operators to compete with UMTS. of the
•User henceRate
Wideband
Data max : rate
bearers
9.6kbps=- 2GHz
115.2kbps.
band ( 5 MHz per carrier), •-max. 2Mbps
Compression UMTS
data
UMTS
One Needs
time a duplexor
slotrate
over in
the air MS for
interface • Buffering of the information
Max user data : 21.4 kbps
simultaneous Tx and Rx
Dynamic rate adaptation to suit the radio conditions at EDGE
EDGE
that time ( 9.05 kbps, 13.4 kbps, 15.6 kbps 21.4 kbps)

GPRS
GPRS

HSCSD
HSCSD
SIM WAP
WAP
SIM Circuit Switched technology
Toolkit
Toolkit
GSM
GSM Packet Switched technology
DATA
DATA
Technology for Applications
Internet
W F Mobile Network Time
W@P Service
@ o W@P Gateway
P n 98 99 2000 2001
e 172
 References
• Wireless and Personal Communication Systems. Vijay.K.Garg and
Wilkes
• Overview of the GSM System and Protocol Architecture, IEEE Comm.
Magazine, Moe Rahnema.

• The GSM System for Mobile Communications- Michel Mouly & Marie-
Bernadette Pautet
• Overview of the GSM Comm- John Scourias.

173
 Coverage or Traffic Limitations
TRAFFIC-
LIMITED
AREA COVERAGE-
(10000 LIMITED
subscribers AREA
per km2) (-75 dBm
at cell edge)

COVERAGE-
LIMITED
AREA
(-70 dBm
at cell edge)

174
 Erlang Concept
Erlang is the unit of statistical resource use

Average number of busy channels

during the period of observation
(usually, the peak hour).

Erlang B
At any time, more than 1 user may request the same resource simultaneously. The use of such a
resource is associated with a blocking rate.

Erlang C
When more than 1 user request at the same time, instead of rejecting the extra calls, there is a
queuing system.

175
 Different Types of Cells
EXTENDED-CELL: CONCENTRIC-CELL:
macro cell with system coverage macro cell with system coverage
extension ( 120 km) for coasts... limitation inside another macro

MACRO-CELL:
antenna radiating ‘above’ roofs
---> Wide Coverage ( 35 km)

• High sensitivity to
interference
• Requires "secured"
Frequency reuse pattern

PICO-CELL:
Antenna inside building
---> Very small coverage
MICRO-CELL:
Antenna ‘below’ the roofs
---> small coverage
• High isolation from
interferences
• A few Frequencies
intensively reused

176
Cell Patterns

177
Cell Sectorization

TRI OMNI BI
Omnidirectional Site Antennas
Bi and Trisectorial Site Antennas
 Link Budgeting

Calculation of the maximum coverage range of each cell in a specific

environment.

Definition of planning tools parameters.

Based on the path loss calculation between the MS and the BS in both ways.

This calculation considers:

• RF parameters of MS and BS,

• system parameters (diversity gains...),
• propagation parameters (shadowing),
• physical installation parameters (antenna height),
• environment classification.

- What is the maximum EIRP?
- What are the losses in
transmission and reception?
- Is diversity used?
EIRP:Equivalent Isotropic Radiated Power
- Beyond which distance the
communication will cut off?
- Is indoor coverage
guaranteed?
- Is frequency hopping used?
- What is the minimum
equivalent sensitivity?
- What is the maximum
equivalent output power?
- What are the body losses?
 Link Budget Parameters
• Overview
Standard conf. DLNA conf. Propagation Parameters:
- Incar, Indoor penetration factors
Antenna Gain
- Frequency 900, 1800, 1900 MHz
Rx Sensitivity - Antenna Height
- Environment

Radio Link Design Parameters:

Common cable Losses
Overlapping margin
Rx Sensitivity
Specific Tx Cable
Losses
Antenna Gain
Combiner losses
Rx Sensitivity
Tx PA Output
Power Tx PA Output Power

Rx Diversity Gain MS
Base Station

Duplexer Other factors for MS

Combiner Body Losses
Common cable losses
Power Amplifier

DLNA:Diversity Low Noise Amplifier

 Link Budget Parameters
• BTS TX Power Amplifier

2.5W PA 25W PA 35W PA 20W PA 30W PA

S2000E
S8000 Indoor
GSM 900 S2000L S4000 Indoor S4000 Indoor S2000H
S8000 Outdoor
S4000 Outdoor

S2000E S4000 Indoor

DCS 1800 S2000L S4000 Indoor S2000H S8000 Indoor
S4000 Outdoor S8000 Outdoor

S2000E
S2000H
PCS 1900 S2000L S8000 Outdoor
S4000 Indoor
S4000 Outdoor
 Link Budget Parameters
• Combiners

H2D
D
D
4.5
4.5dB
dBLoss
Loss 4.9
4.9dB
dBLoss
Loss
Hy/2 C C C C

TX TX TX TX TX TX

2-Way
2-WayHybrid
HybridCombiner
Combinerwith
withDuplexer
Duplexer 4-Way
4-WayCavity
CavityCombiner
Combinerwith
with
Duplexer
Duplexer
allows Synthesized Frequency Hopping allows Baseband Frequency Hopping
 Link Budget Parameters
• Cable Losses

At the BS, for a 7/8” foam dielectric coaxial cable:

• 4 dB/100 m (900 MHz),

• 6 dB/100 m (1800 MHz),

• Common cable losses for 40 meters: 2.5 dB (900 MHz) and 3.5 dB (1800 MHz).

Jumpers (up and down the feeder)

• 0.5 dB (800 MHz),

• 1 dB (1800 MHz).
 Link Budget Parameters
• BTS Antenna Gain

Omnidirectional antenna

Default 6.5° V with 11 dBi gain

Directional antenna for trisectorial site

Default 65° H / 6.5° V with 18 dBi gain

 Link Budget Parameters
• Mobile Station Parameters

900 MHz 1800/1900 MHz

TX PA Output
33 dBm (2W) 30 dBm (1W)
Power

RX Sensitivity -102 dBm -100 dBm

-2 dBi for Handheld

Antenna Gain
2 dBi for Car Kit

Common Cable 0 dB for Handheld

Loss 2 dB for Car Kit

3 dB for Handheld
Body Loss
0 dB for Car Kit
 Link Budget Presentation
Parameters
Antenna Gain (65 °)
18 dBi Frequency 1800 MHz
Jumper Loss Base Height 40.0 m
0.5 dB Mobile Height 1.5 m
Environment Urban
Feeder Loss
3 dB
Penetration Factor 15 dB
Sensitivity Body Loss 3 dB
-110 dBm

Antenna Gain
Coupling system -2 dB
Outdoor Minimum Field
Cable Loss
95%: -80 dBm 0 dB
Tx loss
4.5 dB Coverage Range RX TX
95%: 810 m
Output Power
RXm RXd 30 dBm

Sensitivity
-100 dBm
Max TX Output Power
Options
44.8 dBm
Rx Diversity Gain: 5 dB
Mobile
Base Station Overlapping Margin: 0 dB
189
 Link Budget Calculation
Exercise 1: S8000 INDOOR: OPERATING FREQUENCY 1800
MHz
  BTS MS
30.00 W (44.8 1.00 W (30.0
BODY LOSSES 3.0 dB
TX OUTPUT POWER dBm) dBm)
COMBINER LOSSES 5.0 dB None OVERLAPPING
MARGIN 0.0 dB
RX SENSITIVITY -110.0 dBm -102.0 dBm
RX SENSITIVITY +
INDOOR PENETRATION
DIVERSITY -115.0 dBm None FACTOR 18.0 dB
COMMON CABLE
LOSSES 3.0 dB 0.0 dB
ANTENNA GAIN 18.0 dBm -2.0 dBm

190
 Fading
Example of Field Strength Variation for GSM 1800
-10

-20 Zoom on
Short Term Fading
-30 Measurement
Free Space
Field Strength (dBm)

 /2
-40
±2m
-50

-60

Long Term Fading

-70

-80

-90
0 500 1000 1500 2000 2500 3000 3500 4000 4500 5000
-100
Distance (m)
Clutters
Thank you

193
Mobile Station (MS)
• Hand portable unit

• Contains Mobile Equipment(ME) and

Subscriber Identity Module (SIM)

194