Introduction To GSM: Technology

ROOT 2 technology
Introduction to GSM
ROOT 2 technology Limited 2001
ROOT 2 technology
Introduction to GSM
This document is provided for training purposes only. Every effort has been made to ensure this document is as complete and as accurate as possible, but no warranty or fitness is implied. Root 2 Technology Limited has neither liability nor responsibility for any loss or damages caused to any person or entity arising from the information contained in this document.
Root 2 Technology and the Root 2 Logo are trademarks of Root 2 Technology Limited, all other trademarks are property of their respective owners
This document is copyright protected and must not be copied, reprinted or reproduced by any means mechanical, electrical or electronic or stored in any electronic retrieval system without the express written permission of the copyright holders Root 2 Technology Limited.
ROOT 2 technology
Introduction to GSM
Course Aim
The aim of this course is to provide the delegate with an understanding of the functionality and operation of a GSM Network. To explore interconnections between Mobile and Fixed network, studying signalling and al call establishment procedures.
ROOT 2 technology
Introduction to GSM
Course Objectives
On completion of this course of instruction the delegate will have gained an understanding of: In Module 1 - An Introduction to GSM Features In Module 2 - The GSM Network In Module 3 - GSM Terrestrial Interfaces In Module 4 - The Radio Air Interface In Module 5 - Air Interface Optimisation In Module 6 - Call and Handover Proceedures
ROOT 2 technology
An Introduction to GSM Features
Module Objectives
On completion of this module of instruction the delegate will have gained an understanding of: -
Discuss the history surrounding the birth of GSM Explore the reasons for using Cellular Networks List the GSM Cell structures Explain the GSM Frequency spectrums Discuss why Frequency reuse is adopted Define Interference occurring within GSM Networks Explore the reasons for using Cell sectorisation Compare the Noise differences with Analogue and Digital sources List the reasons for using TDMA Identify what Security GSM adopts Discuss the Services available with GSM
ROOT 2 technology
The Birth of GSM

When the acronym GSM was first used in 1982, it stood for Groupe Speciale Mobile, a committee under the umbrella of Conference Europeenne des Postes et Telecommunications (CEPT), the European standardization organisation. The task of GSM was to define a new standard for mobile communications around the frequency range of 900MHz using digital technology. In the course of time, CEPT evolved into a new organisation called, the European Telecommunications Standard Institute (ETSI), however, this did not alter the task of GSM. The goal of GSM was to replace the existing analogue purely national networks, already overloaded, and thus expensive technologies of the member countries with an international standard. In 1991, the first GSM systems were ready and brought into so-called friendly operation. During the same year the acronym GSM was changed with focus to the international standard being called, Global System for Mobile Communications. The year 1991 also saw the definition of the first derivative of GSM, the Digital Cellular System 1800 (DCS 1800), translating the GSM system into the 1800 MHz frequency range. By 1992, many European countries had operational networks, with GSM starting to attract a worldwide interest. The following factors were major contributors to the success of GSM:
PSTN MSC
BSS MS
MS
MS BSS MS MS BSS BSS BSS (Public switched telephone network) (Mobile service switching centre) (Base station system) MS (Mobile station) (Cell coverage area) MS BSS
1. The liberalisation of the monopoly of telecommunications in Europe during the 1990s and the resulting competition, which consequently lead to lower prices. 2. The knowledge base and professional approach within the Groupe Speciale Mobile, together with the active cooperation of the industry; 3. The lack of competition; For example, in the United States and Japan, competitive standards for mobile services started being defined only after GSM had already been established. GSM also offered additional advantages over the existing analogue networks for both subscribers and network operators. It gave subscribers mobility, flexibility and convenience, whilst giving operators the flexibility of network expansion, increased revenue/profit margins, efficiency and easier re-configuration of networks if required. These areas will be discussed later in the course. GSM networks comprise of three main components, the Mobile services Switching Centres (MSC), Base Station Systems (BSS) and the phone itself known as a Mobile Station (MS). There are other network elements that will be discussed later.
ROOT 2 technology Limited 2001 Page 6 of 6
ROOT 2 technology
Cellular Technology
The GSM network is a Cellular Network, meaning that the network comprises of many hundreds of cells. A Cell covers an area in which an MS communicates with the network. If the MS for whatever reason is not located within a cell, then no communication is possible and the MS cannot make or receive calls. You may have seen this when you have no signal on your own MS. Cells are provided by the BSS and are controlled by a Base Station Controller (BSC). The BSS contains one BSC and multiple cells, depending on network configuration, planning and the surrounding terrain. Each cell in turn is controlled by a Base Transceiver Station (BTS), which relays information to the controlling element of the BSS, the BSC. The cells are normally drawn as hexagonal, but in practice they are irregularly shaped, this is as a result of the influence of the surrounding terrain, or of design by the network planners.The number of cells in any given geographical area is determined by the total number of MS subscribers whom operate within that given area, allowing also for roaming of additional MS subscribers in and out of that given area and the physical layout of the area (hills, forests, buildings etc). The maximum cell size for GSM is approximately 70 km in diameter BTS dependant though on the terrain over BTS BTS which the cell will cover and other factors such as the power of the MS and BTS BTS the number of MS subscribers. In GSM, BTS the maximum power that an MS transmits is approx 8 Watts, many though BTS transmit at much lower power levels such 300 m - 70 km as 1 Watt. Power will be discussed later as health and safety issues have become a major issue regarding radiation transmission. The higher the power, the larger the cell size. For example, if a cell Terms that you may have heard of site was placed on the top of a hill, with no obstruction, then the radio waves will referring to cell size, Macro for large cells, Micro and Pico for smaller cells. travel much further than that of a cell site in the middle of a city, with high-rise buildings causing obstructions. Generally large cells are employed in the following areas:
TRX TRX TRX TRX TRX TRX TRX
1. Remote areas. 2. Coastal regions. 3. Areas with few MS subscribers. Smaller cells are used where there is a requirement to support a large number of MS subscribers, in a small geographical region, or where a low transmission power is required to reduce the possible effects of interference. Small cells cover areas of approximately 200 m and upwards. Typical uses of small cells being: 1. Urban areas. 2. TX power requirements. 3. High number of MS subscribers. There is no correct answer for cell choice when configuring a GSM network. Network providers would like to use large Macro type cells to reduce installation and maintenance costs, but realise that this would restrict MS subscriber access and quality of the service that they could offer. Terrain, transmission power, size of coverage area all have to be taken into account when planning cell size, along with one other key element to the network, that of Frequency Allocation. All of these factors inevitably lead to the network being configured with a mixture of both large and small cells.
ROOT 2 technology
Frequency Allocation
The frequency spectrum is extremely congested, with only narrow slots within the total spectrum being allocated for cellular communications. The list below shows the number of frequencies and total spectrum allocated to GSM, Extended GSM 900 (EGSM), GSM 1800 (Digital Communications System 1800) and PCS 1900 (Personal Communications System). The GSM spectrum is split into Radio Frequency (RF) carriers half allocated to transmission Uplink and the others receiving Downlink. GSM being a Duplex network (having the ability to transmit and receive information simultaneously) has to have a frequency allocated in both the uplink and downlink to achieve this.These uplink and downlink frequencies are linked together forming a pair and are given the name Absolute Radio Frequency Channel Number (ARFCN). This pairing gives GSM its duplex operation.
Down link
GSM 900 Uplink 890 - 915 MHz Downlink 935 - 960 MHz EGSM Uplink 880 - 915 MHz Downlink 925 - 960 MHz GSM 1800 (DCS 1800) Uplink 1850 - 1910 MHz Downlink 1930 - 1990 MHz
870
937
Up link
892 960
100K
935 915 45 MHz
100K
937 Freq.
100K 100K
GSM 900 MHz spectrum
892 Freq.
For successful duplex operation within GSM, the uplink and downlink frequencies have to be separated by a specific range, dependant on the frequencies used. If this separation is not present, duplex operation will fail due to interference problems incurred over the air interface from other frequencies. Frequency separation can be seen below. For each cell in a GSM network at least one ARFCN must be allocated, more can be allocated by the network to increase capacity to the network, increasing the number of subscribers. The RF carrier is divided into eight Time Division Multiple Access (TDMA) timeslots, allowing each RF carrier the capability of supporting up to eight simultaneous telephone calls. Later in the course we will see that although possible, network signalling and messaging is required, therefore reducing the overall number of timeslots per RF carrier to six or seven and reducing the number of simultaneous calls possible. Unlink the PSTN network, where every telephone is connected via a pair of fixed wires on a permanent basis, the MS only connects to the network over the air interface when required and it is possible to have a single RF carrier supporting many more mobile stations than its eights available timeslots. It is possible for a single RF carrier to support around twenty mobile stations, obviously though not all of these mobile subscribes could make a call at the same time. Therefore without the MS actually knowing, it shares the same physical resources of the network with other mobile stations, but at different times.
ROOT 2 technology
Frequency Re-use
One of the limitations with GSM is the actual number of ARFCN that are allocated to individual networks. The entire GSM spectrum has to be allocated between all operators within a country i.e. within the United Kingdom the spectrum is split between four main operators Vodafone, BT Cellnet, Orange and One2One. In addition, with increased subscribers requiring access operators have to adopt two key features of implementation in order to elevate these problems, those being Frequency Re-use and Cell Sectorization. The cells that we have talked about so far are known as Omni-directional Cells. This is a cell site that typically has one antenna and is allocated a single ARFCN. It covers a large geographical area with limited access to subscribers. One antenna requires an ARFCN, so the more antennas that a site has, the more ARFCN required. The problem with employing omnidirectional cells throughout the whole of the network, is that when the number of MS increases in the same geographical area, the operator has to increase the number of cells to cater for the increased requirement of traffic. To increase the number of cells within a given geographical area increases the risk of interference. As we make omni-directional cells smaller and increase the number used, we introduce Co-Channel and Adjacent Channel Interference, both degrading the networks performance.
3 / 9 Configuration
4 / 12 Configuration
Co-Channel Interference occurs when RF carriers of the same frequency are transmitting in close proximity to each other, the transmission from one RF carrier interferes with the other carrier. Adjacent Channel Interference occurs when the RF source of a nearby frequency interferes with the RF carrier. To gain an increase of capacity within the geographical area we employ a technique called Sectorization. Sectorization divides single cells into a number of cells, with each cell having its own allocated ARFCN and acting independently. Each cell uses directional antennas as to not interfere with its neighbours. Sectorization has advantages: Firstly, we now concentrate all of the antennas energy into a smaller area 60, 120 or 180 degrees rather than 360 degrees, increasing signal strength which is beneficial for built up areas and in building coverage. Secondly, as the cells are focused covering a much smaller geographical area, it allows us to implement a much closer frequency re-use pattern, allowing greater capacity access for subscribers. When planning the frequency re-use pattern the network planner must take into account how often to use the same frequencies whilst determining the size of each individual cell. If the planner miss calculates either of these co-channel or adjacent channel interference may occur.
ROOT 2 technology
Cell Sectorization
For GSM each carrier has a separation of 200 KHz, so adopting re-use as to not interfere with surrounding sells a separation of 400 KHz minimum must be used. An example of this is shown. GSM specifications state that for optimum performance a separation of 800 KHz should be used. Unfortunately, due to the number of ARFCN that an operator is allocated it is extremely difficult to implement using 800 KHz and typically you will only find spacing of around 400 KHz. For GSM each carrier has a separation of 200 KHz, so adopting re-use as to not interfere with surrounding sells a separation of 400 KHz minimum must be used. An example of this is shown. GSM specifications state that for optimum performance a separation of 800 KHz should be used. Unfortunately, due to the number of ARFCN that an operator is allocated it is extremely difficult to implement using 800 KHz and typically you will only find spacing of around 400 KHz. When planning the frequency re-use pattern, the network planner must take into account how often to use the same frequencies whilst determining the size of each individual cell. If the planner miss calculates either of these co-channel or adjacent channel interference may occur. In GSM each carrier has a separation of 200 KHz,
360 degree cells

Omni Cell Site 1 Transmit/Receive Antenna
Site 120 degree cells Cell Cell Site Cell Cell Cell Cell Site Cell 60 degree cells Cell Cell
6 Cell Site 6 Transmit/Receive Antenna 3 Cell Site 3 Transmit/Receive Antenna
Variations in cell configurations lead to increased subscriber capacity, increased re-use patterns and the geographical size of cell coverage areas.
so adopting re-use as to not interfere with surrounding sells a separation of 400 KHz minimum must be used. An example of this is shown. GSM specifications state that for optimum performance a separation of 800 KHz should be used. Unfortunately, due to the number of ARFCN that an operator is allocated it is extremely difficult to implement using 800 KHz and typically you will only find spacing of around 400 KHz. The diagram above illustrates how, by sectoring a site we can fit more cells into the same geographical area, therefore increasing the number of MS subscribers that can gain access. The sectorization of sites typically occurs in densely populated areas, or where there is a high demand of mobile subscribers, such as residential or business areas.
ROOT 2 technology
Flexibility and Compatibility

Cellular communications networks provide both the subscriber and network many advantages over a standard telephone network. There are though still drawbacks. Compatibility The rapid deployment of early analogue cellular networks during the early 80s resulted in many different types of networks being incompatible with one another. The requirement for a common standard between mobile communications networks was therefore obvious, and an executive body GSM, was set up to co-ordinate the complicated task for standardization of mobile communications networks. Through this standardization, GSM networks have grown throughout many European countries, in co-operation with one another, along with other countries around the world. An additional advantage on offer to networks being, manufactures produce equipment of higher quality, all being compatible with GSM networks, therefore producing a competitive and aggressive pricing market. This in turn, results in lower pricing structures for the MS subscriber and the operators themselves. Noise Robustness With analogue mobile communications such as Analogue/American Mobile Phone Service (AMPS), Total Access Communication Network (TACS) or Nordic Mobile Telephone Service (NMT), the MS used analogue waveforms (radio signals), to communicate between the network. Although analogue radio signals give an excellent form of communication, they are extremely vulnerable to noise interference; an example being your home radio. Noise interference is produced by. A powerful or nearby source (a vehicle ignition system, a lightning bolt). Another transmission system (co-channel or adjacent interference). House hold appliances (kettle, television etc). Background radio noise (because the required signal is too weak for transmission). To combat noise, GSM communicates to the network using Digital waveforms. By using digital waveforms, we have the ability to include sophisticated error correction and detection software, giving digital signals the ability to withstand more errors incurred from noise as they are transmitted across the air interface. Due to digital transmission over the GSM air interface, the operator can provide a usable signal in harsh RF environments, where analogue systems would fail. It also leads to improved frequency re-use patterns, increasing a networks subscriber access capability.
Noise Interference
Page 11 of 11
ROOT 2 technology
Increased Capacity
With the analogue air interface, every connection to the network required one RF carrier. Old analogue systems typically used Frequency Division Multiple Access (FDMA) rather than Time Division Multiple Access (TDMA) in GSM. As we have already discussed, TDMA has eight timeslots for transmission, where FDMA has only one, limiting control and more importantly, the number of subscribers that can simultaneously access the network. FDMA networks required a greater number of equipments, per cell, if capacity of the network was to increase. This made network expansion expensive and time consuming as many sites had to be configured and retuned manually, making the analogue system extremely inflexible. GSM equipment however, overcomes many of these issues due to it being controlled primarily by its software. The reconfiguration of the network can be implemented quickly, with minimum manually intervention, and by using TDMA, expansion can be implemented
Increased Capacity FDMA requires up to eight times the equipments than that of a TDMA network.
FDMA
TDMA
Timeslots
with less equipment. In addition, GSM has standardised interfaces between network components, such as Signalling System No.7 (C7). Therefore, along with the radio equipment, upgrades to the entire network can be implemented with minimum disruption, time delay and cost. A key feature of GSM is that it offers the flexibility of International Roaming. This permits the MS subscriber to travel to foreign countries with GSM networks, and use their phones as if they were at home. If chosen too, a subscriber can choose only to take their Subscriber Identity Module (SIM) that we will discuss later, and hire a phone whilst travelling abroad. GSMs use of a digital air interface makes it more resilient to interference than historical analogue interfaces. It allows users on the same frequency or nearby frequencies to be co-located in closer geographical areas, decreasing the size of cells, making better use of ARFCN available within the re-use pattern. As GSM progresses, Multi-band networks and mobile phones now operate, operating within both frequency spectrums of 900 MHz and 1800 MHz/1900 MHz. In order for this the mobile must be capable of working in dual band mode, to the user however this is transparent. Multiband operation, allows the network greater flexibility in planning as it increases the number of frequencies available for the re-use pattern. It reduces interference and considerably increases the networks available or potential MS subscriber capacity.
ROOT 2 technology
Security and Services

Security was a major problem encountered with analogue networks. In some networks, it was virtually non-existent and the unscrupulous were quick to recognise this. It was estimated that in some of the earliest networks, 20% of phone calls were stolen. Extensive measures have been taken within GSM to substantially increase security from both theft of calls and theft of the physical phone itself. With GSM, both the mobile phone equipment and the subscriber are identified, using separate identities, the mobile phone equipment being, International Mobile Equipment Identity (IMEI) and the subscriber, International Mobile Subscriber Identity (IMSI). Both of these identities are stored within the network and will be discussed later in the course. In addition to these identities, the GSM air interface supports Frequency Hopping; a process where the MS transmits on a different frequency each time it communicates with the network, making it extremely difficult for a hacker to listen to a specific call. Although frequency hopping is used as an aid to security, it is also employed to optimise network performance, to counter interference aiding to cell quality and capacity.GSM offers an enhanced range of services compared to those available with analogue networks, ranging from data transmission options, fax and a wide range of supplementary options. When services were specified for GSM, current land PSTN services had to be taken into consideration, with the services made available based upon three factors: The level of service provided by the network. The level of service purchased by the subscriber. The capabilities of the subscribers mobile equipment. Speech services involve the transmission of speech information making up the basic service that a network would offer. Telephony provides normal MS originated / terminated voice calls. Short Message Service (SMS) provides the transmission of an acknowledged short message from a service centre to the MS. Short Message Cell Broadcast provides the transmission of a short message to all MS within a cell area. Data services provide the ability to transmit text files, images, messages and fax over the GSM network. Data rates available range from 2.4 kbit/s, 4.8 kbit/s, 9.6 kbit/s and 14.4 kbit/s. In addition to supporting data transmission, GSM provides Group 3 Fax transmission. Supplementary services are additional services to a basic telecommunications service, where an operator will charge extra for use of them. Number Identification the receiving party requests that the number be shown. Call Barring where incoming or outgoing calls can be barred. Call Forwarding where calls can be forwarded to another number if the MS does not answer, as an example. Multi-party provisions for conference calling.
Page 13 of 13
ROOT 2 technology
Key Points
Flexibility and Compatibility Subscriber - Mobility, Flexibility, Convenience. Network Provider - Network Expansion Flexibility, Revenue/Profit margins, Efficiency and easier to Re-Configure. Cellular Technology Large cells are employed in the following areas: 1. Remote areas. 2. Coastal regions. 3. Areas with few MS subscribers. Typical uses of small cells being: 1. Urban areas. 2. TX power requirements. 3. High number of MS subscribers. Increased Capacity The RF carrier is divided into eight Time Division Multiple Access (TDMA) timeslots, allowing each RF carrier the capability of supporting up to eight simultaneous telephone calls. Uplink and downlink frequencies are linked together forming a pair and are given the name Absolute Radio Frequency Channel Number (ARFCN). To combat noise, GSM communicates to the network using Digital waveforms. Frequency Allocation GSM 900 Uplink 890 - 915 MHz Downlink 935 - 960 MHz EGSM 900 Uplink 880 - 915 MHa Downlink 925 - 960MHz GSM 1800 Uplink 1850 - 1910 MHz Downlink 1930 - 1990 MHz Frequencies separated with 200 KHz spacing both uplink and downlink. (374 ARFCN available) (174 ARFCN available) (124 ARFCN available)
Page 14 of 14
ROOT 2 technology
The GSM Network
Module Objectives
Identify the GSM Network Configuration Discuss the functions of the Mobile Station List Mobile Station configurations Explore the characteristics of the SIM Explain the operation of the BSS Discuss the functions of the BTS List BTS configurations Discuss the functions of the BSC Discuss the functions of the XCDR Explain the operation of the NSS Explain the operation of the MSC Discuss the functions of the HLR Discuss the functions of the VLR Identify the requirements for GSM Network Databases
ROOT 2 technology
The GSM Network
Network Configuration
As already discussed, the GSM network comprises of many different components (illustrated below), all being part of two core systems, the Network Switching System (NSS), to which the Operations and Maintenance System is interfaced, and the Base Station Subsystem (BSS). The illustration shows only one occurrence of each component, but in reality, the network will consist of multiple components. The component groups being. The Mobile Station (MS) consisting of the Mobile Equipment (ME) and the Subscriber Identity Module (SIM). The Base Station Subsystem (BSS) provides the radio air interface between the MS and the network. The Network Switching System (NSS) consisting of the Mobile Switching Centre (MSC) and associated system control elements. Here interconnections between other networks such as the PSTN are controlled. The Operations and Maintenance System enables the network the ability to control, configure and maintain the network from a central location.
NMC
Operations & maintenance system
VLR
HLR AUC
Network Switching System MSC OMC

IWF EC
EIR
XCDR
PSTN
BSC BTS ME Base Station System SIM Interface/connection Mobile Station
Typical GSM Network Architecture consisting of the two core systems, the Network Switching System (NSS) and Base Station Subsystem (BSS).
Each network component communicates over an Interface, being specified by GSM standards, enabling a network the flexibility to use multi-vendor equipments (not being restricted to one product manufacturer).
Page 16 of 16
ROOT 2 technology
The GSM Network
The Mobile Station (MS)

The Mobile Station (MS) consists of two separate components, the Mobile Equipment (ME) and an electronic smart card known as the Subscriber Identity Module (SIM) card. The ME is the physical hardware, the phone that the subscriber uses to access the network. This hardware has an identity number associated to it, unique to every mobile phone, called the International Mobile Equipment Identity (IMEI), enabling the network to identify individual MEs. The SIM card interfaces directly with the ME (it is not limited to one ME therefore being transferable between different MEs). This module identifies the mobile subscriber, identifying the services available to that subscriber, and again is a unique identity. This identity is called the International Mobile Subscriber Identity (IMSI). Regarding purchasing of these two components, the ME can be purchased from many stores, but the SIM has to be purchased directly from, or an agent of the mobile network itself. By using these two separate components, GSM has the flexibility of being able to raise a bill against the individual subscriber using the IMSI, rather than the IMEI of the ME (remembering that any one can use a ME, making it difficult to identify the individual subscriber making a call). The ME is the only component of the network that a subscriber is physically likely to see. There are three main types available to a subscriber. Vehicle Mounted these devices are installed within a vehicle and have their antenna mounted to the outside of the vehicle. Portable Mobile Unit this equipment maybe hand held, but the unit uses an external antenna, not the antenna of the device itself. Hand Portable Unit the more commonly used device, the everyday mobile phone. Each ME is identified by a Class Mark, that informs the network of the MEs maximum power output, services it is able to support and frequency capabilities. This information is transmitted to the network in the MEs initial message (when the ME is turned on). Class Mark information;
1006
Revision Identifies GSM phase specifications. (GSM currently has progressed through three phases 1, 2 and presently 2+) RF Power The maximum power that the ME can transmit at. (GSM handset power transmission ranges from 8 Watts through 5 Watts, 2 Watts and 0.8 Watts) Ciphering Algorithm (Security) Indicates the type of algorithm that the ME uses. (Phase 1 used only an A5 algorithm, with Phase 2 using A5/0 A5/7 algorithms) Frequency Phase 2 and 2+ have the ability of transmitting in all GSM frequency ranges. Short Messaging (SMS) Phase 2 onward provides SMS for subscribers.
ROOT 2 technology
The GSM Network
Subscriber Identity Module (SIM)

As previously mentioned, the SIM smart card interfaces directly into the ME giving an individual subscriber their unique identity. The SIM contains several identities utilised by the network for billing, locating and controlling the MS. The International Mobile Subscriber Identity (IMSI) the unique identifier of an individual subscriber. Only ever transmitted to the network when the phone is initialised (turned on) or on request by the network. The Temporary Mobile Subscriber Identity (TMSI) an identity allocated to the subscriber by the network on initialisation. This identity is used in replacement to the IMSI for added security and is changed periodically by the network. Location Area Identity (LAI) an identity allocated to a BSS, used by the network for paging purposes (locating the whereabouts of the MS). Subscriber Authentication Key (Ki) used by the network during the authentication process (registration on a network), and added security of transmission over the air interface.
IMSI
MSISDN
LAI
Ki TMSI SERVICES
SIM
IMEI
The Mobile Station International Services Digital Network number (MSISDN) the actually mobile telephone number, comprising of a Country Code, Network Code and Station Code e.g. 0044 773 675432. Most information held on the SIM is protected, some information though inconstantly updated by the network, the LAI for example. As the MS roams throughout the network this identity will change, therefore being updated. The SIM itself has been designed with high degrees of added security, some being imposed by the user in allocating a password Personal Identity Number (PIN), similar to a pin code with a credit card. The SIM card can also store addition information such as charging records if the operator makes the services available. It also is responsible for algorithm calculations during the authentication process.
ROOT 2 technology
The GSM Network
Base Station Subsystem (BSS)

The Base Station Subsystem (BSS) is the GSM system that provides and controls the physical radio air interface (communication between the MS and the NSS). It consists of three major network components. The Base Transceiver Station (BTS) this provides the physical radio air interface connection between the MS and the GSM network. The Base Station Controller (BSC) the BSC is the controlling element of a BSS. It controls all BTS that are present within a BSS, therefore controlling the air interface even though it does not physically provide the connection to the MS. The Transcoder (XCDR) is used to reduce the rate at which traffic (voice/data) is transmitted across the air interface and will be discussed later in the course.
Base Station SubSystem Switching SubSystem
Normally the size of a BTS is defined by the number of RF carriers, some of the larger ones having upto 24 carriers
Transcoder
2Mbt x n
Base Station Controller
2Mbt x n
SIM
Mobile Station
Base Station Site
The BSC provides the control for the BSS with functions being: Controls all BTS within the BSS. Switches traffic and signalling information between BTS and the NSS. Connects Terrestrial Circuits and channels on the air interface. Controls handover performed by the BTS under its control. Any operational information required by the BTS will be forwarded under the control of the BSC, likewise information required by the NSS about/from the BTS will be obtained by the BSC. The BSC connects radio channels from the air interface, to terrestrial circuits between the BSS and the MSC via the use of a Digital Switching Matrix. It also uses this matrix to perform handover between the BTS under its control without involving the MSC. Handover will be covered later in greater depth. The BTS provides the following functions of the BSS. Channel Coding / Decoding. Timing advance, dependant on the MS location within the given geographical area. Measurement reporting. Power control, paging, frequency hopping, traffic channel management and encryption are also functions of the BTS/BSC.
ROOT 2 technology
The GSM Network
BSS Configurations
The maximum number of BTS that a BSC can control is not specified within GSM, but individual specifications of manufacturers equipment do vary. The BTS maybe located at the same site as a BSC being Co-located, or located at a different site, Remote. It is common to find most BTS remotely configured due mainly to their being a larger number of BTS within the network compared too BSC. A BSS is configured using various topologies, Daisy chaining, Hub Spoke and Loop being a few. The Daisy Chain a BTS need not communicate directly with its controlling BSC, but via another BTS or chain of BTS equipment. Daisy chaining reduces the number of connections required within a network and is cheap to implement, but can lead to transmission delay through the BSS.
HUB & SPOKE

BSS
BTS
BSS
BTS
TRX
BTS
TRX
BTS BTS
LOOP
Topologies have both advantages and disadvantages when used within Networks.
BTS
TRX
BTS
TRX
BTS
TRX
DAISY CHAIN
The Loop these increase the redundancy of connectivity within a network as each BTS has a least two paths for communicating to the BSC. Hub Spoke a method used when initially commissioning a network. This topology reduces connections but decreases network redundancy, as a great deal of emphasis is place on the reliability of hub elements.
Page 20 of 20
ROOT 2 technology
The GSM Network
Network Switching System (NSS)

The Network Switching System (NSS) controls the GSM network, carrying out the physical switching functions, authentication procedures used for security and overall Mobility Management (MM). Its main function is to manage communications between the GSM network and other telecommunications networks.The NSS comprises of many different components, being; Mobile Switching Centre (MSC) Home Location Register (HLR) Visitor Location Register (VLR) Equipment Identity Register (EIR) Authentication Centre (AUC) Inter Working Function (IWF) Echo Canceller (EC)
The diagram shows a typical NSS interconnection. Note: - only one of each component is shown where in reality, the GSM network will have multiple components.
HLR Operations & maintenance system
AUC
NMC
EIR
Network Switching Sub system (G)MSC OMC PSTN

IWF
VLR
The Mobile Switching Centre (MSC) The main function of the MSC is to provide all switching functions, the same as any telephone network switch. However, because of the additional complications involved in the control and security aspects of the GSM network and the wide range of subscriber features offered the MSC has to be capable of fulfilling many additional functions. The MSC carries out different functions depending upon its location within the GSM network (as discussed earlier a GSM network will comprise of more than one MSC). If the MSC provides an interface between the GSM network and the PSTN, it is known as a Gateway Mobile Switching Centre (GMSC). Here additional network components such as the EC and IWF are located providing speech and data connections between the MS and adjoining networks. Both the IWF and EC can be considered as part of the MSC due to their functionality being required for switching.
Page 21 of 21
ROOT 2 technology
The GSM Network
Home Location Register (HLR)

The MSC provides services for all MS located within a given geographical area. Its provides all switching required for mobile terminated and originating calls. One MSC is capable of providing service cover for a region with approximately one million inhabitants (not all will connect to the network simultaneously though). Functions of the MSC are listed below. Call Processing includes control of voice/data call setup, inter-BSS and inter-MSC handover, and MM for all subscribers within its given geographical area. Operation and Maintenance management of databases and monitoring of traffic measurements for GSM operation centres. Inter-working manages interfaces between the GSM network and connecting networks such as the PSTN. Billing collects call billing data relating to MS terminated and originating calls. Home Location Register (HLR) The HLR is a database that contains references for mobile subscribers. Various identification numbers and addresses are stored along with individual authentication codes for each mobile subscriber. Subscriber information is entered into the database by the network provider upon subscriber registration, some information however, is dynamically allocated and updated continuously by the GSM network. HLR information consists of: Subscriber ID, IMSI and MSISDN MS VLR location, Mobile Subscriber Roaming Number (MSRN) MS Status, On or Off Authentication Key and AUC functionality Supplementary service information (Call forward number if activated) Permitted supplementary services (International roaming) The HLR is the master database for all subscribers to the GSM network, with data being accessed by all MSCs and VLRs within the network. Due to the amount of subscriber data the GSM network often has more than one HLR, although there is only one mobile subscriber record per subscriber. Each HLR handles a portion of the data with each subscriber being allocated to a specific HLR. The data is accessed by use of either the IMSI or MSISDN, allowing components of the home GSM network or other networks access to this information.
SUBSCRIBER PROFILE IMSI IMEI MOBILE STATUS TRIPLETS SERVICES MSRN MSISDN
HOME LOCATION REGISTER
Page 22 of 22
ROOT 2 technology
The GSM Network
Visitor Location Register (VLR)

Like the HLR the Visitor Location Register (VLR) is a database, but instead of providing permanent storage of data it only provides temporary storage. The data exists for only as long as the MS is active within the given VLR area. It is therefore possible that duplicate information can be present as well as the more precise data relevant to a subscriber. The VLR provides a local database for subscribers wherever they are geographically located within the GSM network, whether being their home network or visiting network. The function of the VLR eliminates the requirement of constant communication with the HLR for subscriber references, reducing setup times and cost to the operator. Additional data stored in the VLR: Mobile status, busy/free/no answer etc Location Area Identity (LAI) Temporary Mobile Subscriber Identity (TMSI) Mobile Station Roaming Number (MSRN) Location Area Identity (LAI) cells within the GSM network are grouped together into geographical areas with each area being assigned an identity, a Location Area Identity, containing up to 30 cells. A VLR controls several LAIs, so as a subscriber roams within the network the LAI will be updated within the VLR, therefore informing the network of the subscribers location. When required, the VLR address will be updated within the HLR. Temporary Mobile Subscriber Identity (TMSI) this identity is allocated by the VLR to use in replacement of the IMSI (by reducing the number of times that an IMSI is transmitted over the air interface, a GSM network increases a subscribers security). The TMSI is updated frequently, making it extremely difficult to trace calls, again providing a high standard of security. The TMSI is updated when: During Call setup On entry to a new LAI On entry to a new VLR area Mobile Station Roaming Number (MSRN) this number is used for routing calls from an external network to an MS via the GMSC. The MSRN identifies the current MSC/VLR area that a subscriber is connected too, therefore switching the call through the correct MSC. (Typically there will be a VLR co-located with each MSC within the GSM network, often being referred too as an MSC/VLR area.)
Page 23 of 23
ROOT 2 technology
The GSM Network
Security Databases
Equipment Identity Register As we have already discussed each MS has two identities, one of which being the IMEI. The Equipment Identity Register (EIR) is a centralized database that stores the IMEI of all subscribers on the GSM Network. The database concentrates on the physical ME, and not the subscriber whom may be using it to make or receive calls. The EIR database comprises of three database lists being a specific IMEI list or range of IMEI numbers. White List this contains IMEI numbers of MEs that have been allocated to a valid subscriber, that have not been reported stolen nor refused network services. Black List contains a list of IMEI numbers that have been bared by other networks, reported stolen, or denied access for what reason to network services. Grey List this list contains IMEI numbers that do not fall into either of the other two catogories. E.g. limited services, hardware problems or customer payment delays. The Database is continuously updated by network programmers and by the network obtaining information from a central database to which all networks can be connected (not all networks are connected though). EIRs are remotely accessed by an MSC/VLR during the authentication process. If the IMEI number is found in the black list the associated MS will not be permitted access to the network, or any other network containing the same EIR database information. Authentication Centre The Authentication Centre (AUC) is a processing database that provides the GSM Network with security keys for the authentication procedure called Triplets, and is generally co-located with the HLR, as it is continuously requested to produce new authentication keys for mobile subscriber records. The authentication procedure will be discussed later in the course. Interworking Function The Interworking Function (IWF) provides a GSM Network the capability of interfacing with private or public data networks. It consists of a bank of modems that act as the GSM Data Communication Equipment (DCE), exchanging data with a Data Terminal Equipment (DTE), an MS in the GSM network. It has two main functions: Data Rate Adaption provides data rate conversions (increasing / decreasing data speeds) for access to / from the GSM Network. Protocol Conversion ensures the correct protocol (communication tool) is used. Certain networks may require additional IWF functionality, dependant on the type of network too which it is connected.
WHITE LIST IMEI.xxx.xxx IMEI.xxx.xxx IMEI.xxx.xxx IMEI.xxx.xxx IMEI.xxx.xxx IMEI.xxx.xxx IMEI.xxx.xxx
EQUIPMENT IDENTITY REGISTER
BLACK LIST IMEI.xxx.xxx IMEI.xxx.xxx IMEI.xxx.xxx IMEI.xxx.xxx IMEI.xxx.xxx IMEI.xxx.xxx IMEI.xxx.xxx
GREY LIST IMEI.xxx.xxx IMEI.xxx.xxx IMEI.xxx.xxx IMEI.xxx.xxx IMEI.xxx.xxx IMEI.xxx.xxx IMEI.xxx.xxx
Page 24 of 24
ROOT 2 technology
The GSM Network
Module 2 Key Points

GSM Network Components The Mobile Station (MS) consisting of the Mobile Equipment (ME) and the Subscriber Identity Module (SIM). The Base Station Subsystem (BSS) provides the radio air interface between the MS and the network. The Network Switching System (NSS) consisting of the Mobile Switching Centre (MSC) and associated system control elements. Here interconnections between other networks such as the PSTN are controlled. The Operations and Maintenance System enables the network the ability to control, configure and maintain the network from a central location. SIM Card Identities The International Mobile Subscriber Identity (IMSI) The Temporary Mobile Subscriber Identity (TMSI) Location Area Identity (LAI) Subscriber Authentication Key (Ki) The Mobile Station International Services Digital Network number (MSISDN) BSS Components The Base Transceiver Station (BTS) The Base Station Controller (BSC) The Transcoder (XCDR) NSS Components The Mobile Switching Centre (MSC) Home Location Register (HLR) Visitor Location Register (VLR) Equipment Identity Register (EIR) Authentication Centre (AUC)
Page 25 of 25
ROOT 2 technology
GSM Terrestrial Interfaces
Module Objectives
Explore the differing Terrestrial Interfaces used within GSM Discuss PCM Theory Explain the structure of a 2Mbit Trunk List the reasons for using ITU-T CCS No.7 Signalling Explain the uses of CCS No.7 Protocols Discuss the Link Access D Channel Protocol Explain why LAPDm is used accross the Um Interface Explore transmission rates accross the various GSM Interconnections
ROOT 2 technology
Terrestrial Interfaces
The terrestrial interfaces comprise of all of the connections between the GSM network components, apart from the Um or air interface. They are shown in the diagram below connecting the various components together. The interfaces are the message transport mediums for GSM, all complying with ITU-T specifications (International Telecommunications Union - Telecoms). The use of these standards provides the flexibility that can be seen today within multi-platform GSM networks. The terrestrial interfaces transport all of the messages throughout the system that are required to perform system functions. They transport all data for software up and downloads, the collection of statistical information and messages required for O&M operations (Maintenance and Control). The standard interfaces used within GSM are: PCM 2 Mbit Links Signalling System No.7 - (ITU-T SS7 or CCS7) LAPD Protocol - Link Access Protocol Data (D Channel) X.25 - (Packet Switch Data for OMC interface)
4-7
X.25 Applications C7 Applications
3 2 1
OSI LAYERS
X.25 MTP (C7) LAPB
Abis LAPD
2 Mbit Trunks
VLR EIR
B F
HLR
H
AUC
MSC
Um
Abis
BSC
BTS
OMC
Um A C E
LAPDm BSSAP MAP ISUP
Abis B D H
LAPD MAP C7 C7
Page 27 of 27
ROOT 2 technology
2 Mbit/s PCM 30 Trunks

The 2 Mbit PCM 30 Trunk is the primary layer 1 transport medium used within GSM. It complies too the international standard CCITT (ITU-T) Recommendation G.704; Gives functional characteristics of interfaces associated with: Network Nodes and PCM Multiplexing equipment. G.704 is generally held to describe the frame structure and alignment of 2.048Mbit/s services, however the recommendation also covers 1.544Mbit/s services and higher order services. The recommendation also covers the codes for frame and multiframe alignment, transmitted within Timeslot 0. Then diagram below shows a breakdown of 2 Mbit Frame.
8 Bits
Control TS 0
Signalling TS 16
Frame Duration = 0.125ms
ITU-T G.704 Frame Structure
TS 0 1 - 15 16 17 - 31
Use Frame Alignment/Error Checking/Signalling Traffic Voice/Data Signalling Traffic Voice/Data
The 2 Mbit Frame comprises of 32 Timeslots. Each Timeslot is 64Kbits in size, resulting in a total frame size of 2.048Mbits. Each 2 Mbit frame provides thirty channels for the transmission of speech, data or control information. The control information may contain C7, LAPD or X.25 formatted information. It is typical to find Timeslot 16 used for signalling information, but any timeslot can be used for this purpose. Some operators choose to use Timeslot 1 for signalling purposes. Timeslots are also referred to as D and B Channels (D Channel for signalling and B Channel for Traffic). If the 2Mbit frame is using C7 signalling, the D Channel can support signalling for 480 B Channels. If using Channel Associated Signalling (CAS), the D Channel can only support signalling for one frame (30 B Channels).
ROOT 2 technology
C7 Signalling
The following message protocols are used to communicate between the different GSM components. For external connections, the MSC performs all call signalling functions by using the Telephone User Part (TUP), or for interfacing the ISDN, the ISDN User Part (ISUP). Between the MSC and BSC, the Base Station System Management Application Part (BSSMAP) is used. The Direct Transfer Application Part (DTAP) is used to send messages between the MSC and the MS. The Mobile Application Part (MAP) is used between the MSC and the VLR, EIR and HLR. The diagram below shows the breakdown of how the C7 protocol stack is configured.
Acronyms: BSSAP BSSMAP DTAP ISUP MAP SCCP TUP TCAP Base Station System Application Part Base Station System Management Application Part Direct Transfer Application Part ISDN User Part Mobile Application Part Signalling Connection Control Part Telephone User Part Transaction Capabilities Application Part
MAP TUP ISUP TCAP BSSAP
SCCP
3 2 1
C7 LAYERS
MTP Level 3 MTP Level 2 MTP Level 1
2 Mbit Trunks
Page 29 of 29
ROOT 2 technology
Link Access Protocol D Channel

Because of the specific format of the signalling and control information being passed over the 2 Mbit links between the BSC and remotely sited BTS, a different type of interface is required. GSM uses Link Access Protocol D Channel for this operation. The GSM specifications for the Abis interface are not completely standardised, as per ITU-T G.704 for 2Mbit links. This unfortunately means that one manufactures range of equipments will not necessarily work with anothers. As we have already discussed, the functionality of the BTS is governed by the BSC, generally leading to BSS selection comprising of a sole manufactures equipment range.
Flag
Flag
0 - 260 Octets
Address
Control
Information
FCS
LAPD
SAPI TEI N(S) N(R)
0 - 21 Octets
Address
Control
Information
LAPDm
SAPI N(S) N(R)
There is a limitation on the amount that can be transmitted across the air interface. With using the normal LAPD format 260 272 octets of information can be sent. Due to the restrictions GSM uses the LAPDm format, having a maximum length of 23 octets. The 23 octets formation is used for TCHs and a 21 Octets format for SACCH. The LAPDm format does not require flags as it uses the already synchronised path air interface. In addition it does not require a Frame Check Sequence (FCS). The Service Access Point Identifier (SAPI) is used to identify the information being transmitted, Signalling or Short Message Services (SMS). In short, 0 = Signalling information, 3 = SMS, 62 = O&M and 63 = Layer 2 Management. (62 and 63 are dedicated for use by the BTS.) N(S) related to the frame number being sent and N(R) corresponding to the next expected frame within the transmission sequence.
Page 30 of 30
ROOT 2 technology
Interconnections
The Interface between the BSC and MSC uses the standardised ITU-T CCS7 interface, referred to as the A Interface. The interface supports the following connections: BSC - MSC, BSC - BTS and MSC - MS Operations and Maintenance Interface All call processing functions These interfaces are commonly transported on a 2 Mbit/s link.
MSC
MTL
OMC- R BSC
OML (X.25)
LAPD
LAPD
BTS
BTS
BTS
Each 2 Mbit link provides 32, 64Kbit/s channels or Timeslots. Timeslot zero is always used for control and frame alignment purposes, with one other being used for signalling, typically Timeslot 16 and the remainder, used for traffic. The signalling protocols used with a GSM Network are: LAPD 1 x 64Kbit/s timeslot CCS7 1 x 64Kbit/s timeslot (BSSAP, MAP, TCAP, SCCP, MTP) X.25 1 x 64Kbit/s timeslot (Used between the BSC and OMC) CCS7 is used for transmission between the MSC and BSS, dependent upon the type of signalling required, will depend on which signalling part is used. (DTAP is used for the transfer of messages between the MSC and MS, a subset of BSSAP.)
Page 31 of 31
ROOT 2 technology
Module 3 Key Points

Standard GSM Interfaces: PCM 2 Mbit Links Signalling System No.7 - (ITU-T SS7 or CCS7) LAPD Protocol - Link Access Protocol Data (D Channel) X.25 - (Packet Switch Data for OMC interface) PCM 30 The 2 Mbit Frame comprises of 32 Timeslots. Each Timeslot is 64Kbits in size, resulting in a total frame size of 2.048Mbits. Each 2 Mbit frame provides thirty channels for the transmission of speech, data or control information. The control information may contain C7, LAPD or X.25 formatted information. C7 Protocols BSSAP BSSMAP DTAP ISUP MAP SCCP TUP TCAP LAPD There is a limitation on the amount that can be transmitted across the air interface. With using the normal LAPD format 260 272 octets of information can be sent. Due to the restrictions GSM uses the LAPDm format, having a maximum length of 23 octets. The 23 octets formation is used for TCHs and a 21 Octets format for SACCH. Interfaces The signalling protocols used with a GSM Network are: LAPD 1 x 64Kbit/s timeslot CCS7 1 x 64Kbit/s timeslot (BSSAP, MAP, TCAP, SCCP, MTP) X.25 1 x 64Kbit/s timeslot (Used between the BSC and OMC) Base Station System Application Part Base Station System Management Application Part Direct Transfer Application Part ISDN User Part Mobile Application Part Signalling Connection Control Part Telephone User Part Transaction Capabilities Application Part
Page 32 of 32
ROOT 2 technology
The Radio Air Interface
Module Objectives
Explain Modulation Techniques Discuss the reasons for using TDMA Frames Explore Physical Channels used within GSM List the Logical Channels Explain the Broadcast Control Channel Explore all Common Control Channels Explore all Dedicated control Channels Define Mobile Access Explain channels used for Handover Examine the GSM Burst List the GSM Burst Types Identify the requirement for using Multi Frames Define GSM Timing Discuss the Speech Encoding process Discuss the GSM Authentication Procedure
ROOT 2 technology
Modulation Techniques
There are three methods of modulating a signal so that it can be transmitted over an air interface. Amplitude Modulation (AM) Amplitude modulation is the most basic form of modulation, where the information is transmitted through variations in a waveforms amplitude. AM is very susceptible to interference from noise, which leads to poor transmission quality over larger distances. Frequency Modulation (FM) Frequency modulation is slightly more complicated to implement than AM, due to the information being transmitted through variations in a waveforms frequency. FM provides a greater tolerance to noise than AM. Phase Modulation Phase modulation provides the best tolerance to noise but remains complex in implementing and is rarely used when transmitting analogue signals. As we have already discussed, GSM utilises digital transmission over the air interface. Digital signals can use any of the above methods of modulation, but unlike analogue, phase modulation being the most tolerant to noise can easily be implemented in GSM. Phase modulation does not suffer the same set backs when transmitting digital signals and is known as Phase Shift Keying (PSK) when applied to digital signals.
Digital signals must be converted prior to tramsmission over a normal telephone network
A carrier signal
Is modulated by the digital output from a data terminal equipment to produce Amplitude change Amplitude modulation
Frequency change Frequency modulation
or
Phase change
Phase modulation
Phase Shift Keying (PSK) Although phase modulation provides a high tolerance to noise, there are problems with using this form of modulation. Digital signals are transmitted in the form of logic 0 and logic 1 (On or Off), two states completely opposite to one another. These states are referred to as Phases. When the signal changes phase abruptly, high frequency components are produced causing distortion when the signal is received, requiring greater bandwidth. GSM has limited available bandwidth, so utilisation has to be in the most efficient way possible. The use of PSK in its most basic form is not a viable option, so GSM utilises a more complex form of PSK called Gaussian Minimum Shift Keying (GMSK). Gaussian Minimum Shift Keying (GMSK) With GMSK, the phase change does not occur instantaneously as within PSK. GMSK introduces a transition period, increasing the time in which the phase change has to occur, therefore drastically reducing high frequency components and distortion. A Gaussian Digital Filter is used for this operation.
Page 34 of 34
ROOT 2 technology
Physical Channels
A GSM carrier comprises of one complete Time Division Multiple Access (TDMA) frame. Each frame is broken down into eight equal segments called Timeslots, that are arranged in sequential order from 0 7 (as can be seen from the diagram). The TDMA frame (Carrier) is transmitted continuously and lasts for a time period of 4.615ms. Therefore each timeslot lasts for an approximate time period of 577 microseconds. Each MS telephone call occupies one timeslot (0 7) within the frame until the call is terminated, or handover occurs. Due to there being a limited number of timeslots available within the frame, it limits the number of simultaneous MS users to seven, as timeslot zero is required for controlling elements. In order for the system to work correctly, timing of timeslot transmissions to and from the MS is critical. The MS or BTS must transmit information relating to a call, by using the allocated timeslot, at exactly the right moment.
7 6 5 4 3 2 1 0 7 6 5 4 3 2
TDMA Frame
1 0 7 6 5 4 3
2 1 0
TDMA frame is transmitted continuously. Each MS is allocated an individual Timeslot for a call, transmitting information within a burst.
T RS BU
lot es im 1T
Failure to do this will result in the information being lost, or corruption of consecutive timeslots. This information is transmitted in the form of a burst. Each burst occupying its allocated timeslot within successive frames, provides GSM with the physical channel for carrying logical channels between the MS and BTS.
Page 35 of 35
ROOT 2 technology
Logical Channels
There are two main groups of logical channels, traffic channels and control channels. Traffic Channels The Traffic Channel (TCH) is the channel used within GSM to carry speech and data information. There are two TCHs available for use with GSM; Full Rate Speech working at 13Kbit/s and Half Rate speech at 6.5Kbit/s. For Data transmission, TCHs working at 2.4Kbit/s, 4.8Kbit/s, 9.6Kbit/s and 14.4Kbit/s are available. Control Channels Control channels as named, are the channels used within GSM for controlling the air interface. There are three groups. Broadcast Control Channel (BCCH) Common Control Channel (CCCH) Dedicated Control Channel (DCCH) Broadcast Control Channel Group
Um Interface
DCCH
CCCH Control Channels BCCH TCH Traffic Channels
The Broadcast Control Channel (BCCH) is transmitted in the downlink only (from the BTS to the MS). The BCCH transmits information from the network regarding the MSs present location and surrounding cells. The BCCH also contains information relating to Synchronisation (SCH) and frequency (FCH). Common Control Channel Group The Common Control Channels are transmitted in both uplink and downlink directions. The group consists of the following channels. Random Access Channel (RACH) Paging Channel (PCH) Access Grant Channel (AGCH) Cell Broadcast Channel (CBCH) Dedicated Control Channel Group Dedicated Control Channels are allocated to individual MS for the purpose of call setup and subscriber validation. The group consists of the following channels. Stand-alone Dedicated Control Channel (SDCCH) Associated Control Channels (ACCH)
ROOT 2 technology
Broadcast Control Channel

The Broadcast Control Channel (BCCH) is continuously transmitted by the BTS on the BCCH carrier. The MS monitors the BCCH periodically (at least once every 30 seconds) when it is not associated in making or receiving a call, to obtain the following information. Location Area Identity (LAI) List of surrounding cells that the MS monitors for handover purposes Frequency information Power control information Access Control for Paging Note: Additional information is transmitted within the BCCH. The BCCH is transmitted at a constant power, with its signal strength being monitored by the MS. The MS uses this power monitoring to identify if handover is required (covered later in the course). Because of the importance of the BCCH carrier, if no traffic requires transmitting, a dummy burst will be transmitted to ensure continuity over the air interface. Frequency Correction (Control) Channel (FCCH) This channel is frequently transmitted within timeslots on the BCCH carrier allowing the MS to tune its frequency to that being transmitted by the associated BTS. Synchronisation Channel (SCH) The Synchronisation Channel is utilised to enable the MS to synchronise with an associated TDMA frame over the air interface. Synchronisation is key to the success of the air interface and is therefore essential when making or receiving a call. The MS will monitor the BCCH carrier from surrounding cells, storing information from the six strongest cells. Again for the purpose of handover, if the MS should roam within the network, it has the necessary information stored to move between cells with ease and quickly resynchronise with the new cell.
Um Interface
BCCH
FCCH SCH
LAI BSIC DTX CBCH
Broadcast Control Channel
Page 37 of 37
ROOT 2 technology
Common Control Channels

The Common Control Channel (CCCH) is responsible for transferring controlling information between all MS within a BTS area. This control is necessary for implementing Call Origination and Paging functions. Random Access Channel (RACH) The Random Access Channel is used by the MS to gain access to the network. It is only used in the uplink, when the MS requests to initiate a call or responds to a PCH sent by the network.
Um Interface
RACH
PCH CBCH AGCH
Common Control Channel
Paging Channel (PCH) The Network uses the Paging Channel in order to contact an MS (paging can be performed using either the IMSI, TMSI or IMEI identities). Access Grant Channel (AGCH) This is used by the BTS to assign a Dedicated Control Channel to an MS, in response to the receipt of a RACH from the MS. The MS will then move to the DCCH in order to proceed with the call set-up, or to respond with requested information, regarding Location Area Updates or Short Messaging Services (SMS). Cell Broadcast Channel (CBCH) This channel is used by the network to transmit broadcast messages to all MSs within a given cell. Although this channel really uses a DCCH to transmit the messages, it is considered a CCCH as all MS within the given cell can receive that message. All MS frequently monitor both the BCCH and CCCH within their associated cell, both being transmitted constantly on the carrier by the BTS.
ROOT 2 technology
Dedicated Control Channels

Dedicated Control Channels (DCCH) are used to convey specific information over the air interface. GSM uses a Stand-alone Dedicated Control Channel (SDCCH) to pass information across the air interface, working in both directions between the BTS and MS. This SDCCH carries information for call setup, the authentication process, location updating and SMS. Associated Control Channels These channels are associated with either the SDCCH or a TCH. They are used to carry information associated with handover whilst a simultaneous process is being carried out by either an SDCCH or a TCH.
Um Interface
SDCCH SACCH FACCH
Dedicated Control Channels
Slow Associated Control Channel (SACCH) This channel is used to convey power and timing information in the downlink and passes Receive Signal Strength Indications (RSSI) and link quality reports from the MS in the uplink. SACCH is also used for the handover procedure when the MS is idle (not involved in a physical call). Fast Associated Control Channel (FACCH) The FACCH is used to perform handover and also authentication when an MS is involved in a physical call (having been allocated a TCH). It is transmitted within the burst of the TCH, containing specific information that is required for the handover procedure. All of the control channels are required for system operation and have to share timeslots over the air interface just like MSs using the limited TCHs. By sharing the timeslots, it allows efficient passing of control information without wasting valuable capacity that can be used for carrying additional call traffic. We therefore organise the limited timeslots over the air interface to carry either control or traffic information.
ROOT 2 technology
GSM Burst Format

The diagram below shows the format of a GSM burst. It consists of differing elements dependant upon the burst in use. The elements described below form a Normal Burst, used for transmitting Voice Call and Data information.
Info Field There are two info fields within the normal burst. Each field contains 57 Bits of information (Voice call or Data). If during the call procedure handover is required, FACCH steals one of these info fields (all 57 Bits) to transmit the specific information required.
Stealing Flags These flags comprise of a single bit each and indicate whether call or FACCH information is present within the information field.
0 1 2
TDMA Frame
156 Bits (0.577ms) 148 Bits

GUARD PERIOD 4
INFO
TRAINING SEQUENCE
INFO
GUARD PERIOD
TAIL BITS
STEALING FLAGS
TAIL BITS
Training Sequence This is used by the receiver to estimate the quality and transfer characteristics of the physical path (air interface) between the MS and BTS. The training sequence consists of 26 Bits of information. Tail Bits The tail bits act as flags, identifying the beginning and end of the burst. Guard Period This period is designed to allow both the BTS and MS additional time to receive and decode the transmitted burst. The timeslot allows 0.577ms for the burst to be successfully transmitted, where actually the physical burst only requires 0.546ms. This difference in time relates to 8 Bits or 0.031ms time difference between actually burst transmission and the actually time available. This 8 Bit guard period can be transmitted at either the beginning, the end or in both areas of the burst format.
ROOT 2 technology
Burst Types
The diagram below shows the five types of burst employed over the GSM air interface. All bursts, whatever type, consist of 156 Bits of information allowing them successful transmission within the allotted 0.577ms timeslot. The burst is a sequence of information bits transmitted by network components, where the timeslot is the specific period of time that the burst must arrive in order to be successfully decoded. Normal Burst - the normal burst carries traffic and control channels both up and downlink apart from those listed below. Frequency Correction Burst - carries the FCCH in the downlink only, to correct the frequency of the MS. Synchronisation Burst - carries the SCH in the downlink only, to synchronise timing of the MS with the BTS and therefore Network.
156 Bits (0.577ms)

TAIL BITS INFO (57) TRAINING SEQUENCE (26) INFO (57) TAIL BITS
TAIL BITS
FIXED BITS (142)
TAIL BITS
TAIL BITS
ENCODED (39)
SYNCHRONISATION SEQUENCE (64)
ENCODED (39)
TAIL BITS
TAIL BITS
FIXED BITS (57)
TRAINING SEQUENCE
FIXED BITS (57)
TAIL BITS
TAIL BITS
SYNCH SEQUENCE (41)
ENCRYPTED BITS (36)
GUARD PERIOD (68.25)
TAIL BITS
Dummy Burst - this burst is transmitted to fill unused timeslots on the BCCH carrier (downlink only), to retain continuity over the air interface. Access Burst - this burst is much shorter in duration than the other bursts described. It has an increased guard period due to the time of transmission being unknown. When an Access Burst is transmitted, the BTS does not know the exact location of the MS, so therefore cannot accurately identify the timing of the message. The use of the larger guard period counters this problem.
ROOT 2 technology
Multiframes and Timing

As we have discussed there are eight timeslots within each TDMA frame, enabling eight physical channels to share an RF carrier, where in addition, each physical channel may be shared by a number of logical channels. In order to understand how the sharing of logical channels is achieved, we have to introduce Multiframe structures. The 26 Frame Multiframe - Call Traffic The diagram below shows the relationship between the timeslot allocated to an MS for the duration of a call, the TDMA frame and 26 Frame Multiframe. (The timings shown are not exact timings but are approximate timings) The 26 Frame Multiframe comprises of 26 frames, containing information from consecutive timeslots on the associated TDMA frames. Frame No 12 (actually the 13th) on the multiframe is always reserved for SACCH, passing network information between the MS and BTS.
0.577ms
BURST
TDMA Frame
4.615ms
26 FRAME MULTIFRAME E 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
IDLE
SACCH
120ms
Frame No 25 is always set to idle, acting as a flag indicating the end of the previous or beginning of the next multiframe. The multiframe follows a pattern of, 12 bursts of traffic, 1 burst of SACCH, 12 bursts of traffic and finally 1 idle frame. Each TDMA frame lasts for duration of 4.615ms, there the total duration of the multiframe is 120ms (the duration of 26 TDMA).
Page 42 of 42
ROOT 2 technology
51 Frame Multiframe
The 51 Frame Multiframe is slightly more complicated than the 26 Frame Multiframe as it is associated with the control channels. The multiframe structure can vary, depending on the type of control channel and network functionality requirements. The 51 Frame Multiframe is constructed from 51 consecutive frames, from TDMA frame timeslot zeros. The diagram shows the breakdown in the downlink, of a BCCH/CCCH multiframe. As can seen, each timeslot zero contains differing information.
T/S 0S OF TDMA FRAMES
51 FRAME MULTIFRAME
0 10 20 30 40 50
BCCH CCCH
CCCH CCCH
CCCH CCCH
CCCH CCCH
CCCH CCCH
FCCH
SCH
235.365 ms
IDLE
Starting at frame 0 of the 51 frame structure, T/S 0 is occupied by FCCH, T/S 1 by SCH and the following four timeslots 2-5, by the BCCH. Timeslots 6-9 are allocated to CCCH traffic, that is for either PCH or AGCH information. Then follows in timeslots 10 and 11, a repeat of the frequency and synchronisation bursts, four further CCCH burst and so on. The final timeslot, T/S 50, is the last timeslot in the multiframe and is always set to idle. This idle frame acts as a flag, indicating the next frame received is the start of a new 51 Frame Multiframe.
Page 43 of 43
ROOT 2 technology
Speech Channel Encoding

To protect the logical channels from transmission errors that may be introduced over the air interface, various coding schemes are utilised. The coding and interleaving schemes used depend on the type of logical channel being encoded. All logical channels require a form of Convolutional Encoding, but due in addition to varying standards of protection required, these coding rates differ. Speech Channel Coding Speech is divided into 20ms periods, comprising of 260 bits of information. After the encoding and interleaving procedure, 456 bits are transmitted within 8 bursts, therefore reducing reproduction problems should interference cause problems over the air interface. Data Channel Encoding Data transmission are spread over 22 bursts. The reason being, that every bit of data information is vitally important, so by increasing the number of bursts used, we can minimise interference aspects incurred over the air interface.
CLASS 1 50 BITS
CLASS 2 132 BITS
CLASS 3 78 BITS
PARITY CHECKING
NO PARITY CHECKING
50
132
78
CONVOLUTIONAL ENCODING 378 78
456 BITS
Over the air interface speech or data is transmitted at a rate of 22.8 Kbit/s (456 Bits every 20ms). Speech information is grouped into three groups depending on its sensitivity and importance. Class 1 - These 50 bits carry the most sensitive information, and if corrupted can lead to speech intelligibility. If errors are found within these bits, generally the entire block is ignored. These bits pass through a parity check where 3 additional bits are added. Class 2 - Here 132 bits are not parity checked. These bits are important, but not as important as the 50 Class 1 bits. These 132 bits are combined with the Class 1 bits, with an additional 4 tail bits being added (for decoding purposes) prior to the convolutional encoding process. Class 3 - These bits are the least sensitive bits that do not require encoding.
As can be seen from the diagram, after the convolutional encoding proceed, the Class 3 bits are added to the combined and encoded Class 1 and 2 bits, to produce 456 bits.
Page 44 of 44
ROOT 2 technology
GSM Authentication
One of the major drawbacks with analogue systems was the ease that an air interface transmission could be compromised. GSM uses an Authentication Centre (AUC) Database for providing a networks security elements. It provides the network the ability to monitor a users access rights for call setup, location updating and activation of supplementary services. When a subscriber first purchases a phone from a provider, the network Ki key will be allocated to their IMSI. On initial setup (first activation), the Ki will be opened and only then is susceptible to copying.
RAND Ki
RAND A3 Algorithm SRES
HLR
AuC
A8 Algorithm Kc
TRIPLET
TRIPLET
MSC/VLR
RAND SRES RAND
BTS
RAND
Ki
RAND A3 Algorithm SRES
SRES
SIM
A8 Algorithm
Kc
TRIPLET
Triplets Triplets are produced by the AUC for use throughout the authentication procedure. They consist of three separate elements, the Random Number (RAND), a Signed Response (SRES) and a Key Code (Kc). The AUC produces these triplets through the use of two algorithms, an A3 and an A8, both of which are matched with the same algorithms on the SIM. Due to both network algorithms being assigned to the AUC and Network SIM cards, when the RAND used by the AUC in producing the Triplet is passed to the MS for authentication, the MS in turn should produce the same Triplet results. The MS produces the triplet and returns either the SRES or Kc (depending on request) to the VLR, where results are processed and authentication granted. If the results differ, the MS will not be granted access.
Page 45 of 45
ROOT 2 technology
Module 4 Key Points

Modulation Types Amplitude Modulation (AM) Frequency Modulation (FM) Phase Shift Keying (PSK) Gaussian Minimum Shift Keying (GMSK) Control Channels Broadcast Control Channel (BCCH) Common Control Channel (CCCH) Dedicated Control Channel (DCCH) BCCH Location Area Identity (LAI) List of surrounding cells that the MS monitors for handover purposes Frequency information Power control information Access Control for Paging GSM Bursts Normal Burst Frequency Correction Burst Synchronisation Burst Dummy Burst Access Burst Multi Frames The 26 Frame Multiframe - Call Traffic The 51 Frame Multiframe - Signalling Authentication Triplets are produced by the AUC for use throughout the authentication procedure. They consist of three separate elements, the Random Number (RAND), a Signed Response (SRES) and a Key Code (Kc).
Page 46 of 46
ROOT 2 technology
Air Interface Optimisation
Module Objectives
Explain the requirement for Timing Advance Discuss Timeslot allocation List GSM elements associated with Power Control Describe DRX and its uses Explore Multipath Fading Discuss Antenna Diversity Explain GSM Equalisation Define Frequency Hopping and reasons for its use
ROOT 2 technology
Transmission Timing Advance

To simplify the design of the MS, by it not having to transmit and receive information simultaneously, GSM offsets the timing between TDMA frames. GSM specifications state that a timing offset of three timeslots must be incorporated. The diagram below shows an example of this. Timing advance is not required on the BTS due to being configured for simultaneous transmission and reception. The synchronisation of TDMA frames is critical due to bursts having to be transmitted and received within real time timeslots allocated to them. The further that the MS is from the BTS the longer it takes for the burst to be transmitted between them. The BTS caters for this problem by instructing the MS to advance its timing (to transmit earlier) to compensate for this increased delay.
FRAME 1
DOWNLINK 0 1 2 3 4 5 6 7 BTS - MS
UPLINK 0 MS - BTS 1 2 3 4 5 6 7
3 TS OFFSET
FRAME 1
3
TIMING ADVANCE
Timing advance information is sent to the MS twice every second using the SACCH (the 13th frame on the 26 Frame Multiframe). This advance is superimposed upon the timeslot offset, again being shown in the diagram. If the network is configured for a maximum cell size with a radius of approximately 35km, the maximum timing advance will be approximately 0.233ms.
Page 48 of 48
ROOT 2 technology
MS Power Control
One of the main factors restricting the physical size of the MS is its battery. The battery must be large enough to hold sufficient power to maintain calls for a period of time prior to the MS requiring a recharged. The demand has increased for smaller, lighter phones, therefore leading to the requirement of smaller and lighter batteries. Within GSM, several features are utilised, two of which being Power Control and Discontinuous Reception. Power Control
0.8 Watts 0.8 Watts
1 Watt
A B C
Power control
BTS
2 Watts
1.4 Watts
This is a feature of the air interface, allowing the network not only to compensate for the timing distance, but additional to allow the MS to control its power output in comparison to the distance required for successful transmission to the BTS. The closer the MS is to the BTS, the less power required to transmit that distance, therefore increasing the MSs battery life. In addition to saving power, by reducing in accordance to distance it aids in the reduction of air interface interference (reducing co-channel and adjacent channel interference). Both Uplink and Downlink power setting can be controlled, typically though the BTS will transmit at a continuous power setting. (A BTS controls multiple MS so by adjusting power settings to compensate for an individual MS it could seriously affect others.) The BSS controls the power of both the MS and BTS. It monitors the receive power of both the MS and BTS, with reports being sent to the BSS, adjusting power setting accordingly.
Page 49 of 49
ROOT 2 technology
Discontinuous Reception
Discontinuous Reception (DRX) allows the MS to switch off when information being transmitted is not intended for it. By the MS monitoring the BCCH, the FCCH and SCH, the MS is exactly aware of the frame number and format, and can identify where the information relevant is being transmitted. With the MS knowing this information, it can switch off through the time period where the information being transmitted is not meant for its reception, again saving on battery life. When DRX is used, the BCCH informs the MS of which Paging Group it is to listen too. This Paging Group may appear at the same time during every multiframe, or once during a series of multiframe transmissions. (The Network specifies multiframe transmission.)
235.365 ms
BCCH
C0
C1
C2
C3
C4
C5
C6
C7
C8
MS Paged during C1 once every 235ms
Or
C5 on Combined Multiframes
BCCH
C0
C1
C2
C3
235 ms
C4
C5
C6
C7
C8
BCCH
C9
C10
C11
C12
470 ms
C13
C14
C15
C16
C17
BCCH
C18
C19
C20
C21
705 ms
C22
C23
C24
C25
C26
BCCH
C0
C1
C2
C3
C4
C5
C6
C7
C8
MS Paged once every 705ms
DRX may only be used when the MS is in an idle state, not physically making or receiving a call.
Page 50 of 50
ROOT 2 technology
Multipath Fading
Multipath Fading results from a signal travelling to a receiver over a multiple number of routes. This can be caused by, the signal being reflected off of objects such as buildings, or its path being altered by atmospheric pressures, such as weather. Received signals will therefore arrive at differing times and possibly out of phase with one another. On arrival at the receiver, the signals combine either constructively or destructively. The worst possible effect will be that the received signals arrive 180 out of phase with each other, therefore cancelling each other out. If this happens the result is zero signal. Within the GSM frequency bands, a distance of approx 15cm may be all that is required to alternate from a good, to a bad signal. To over come this variation, GSM adopts several techniques to counter Multipath Fading.
Equalisation Diversity Frequency Hopping Interleaving Channel Coding
Buildings
Mulitiple Paths
MS
BSS
As the MS moves, the exact phase of the receive path will change. With this constant change, the combination of received signal strength will also change, continuously. The diagram shows an example of differing routes that a signal may take in travelling from a BTS to an MS. Each of the paths has suffered a varying number of losses through transmission; hence a variation in received signal amplitudes.
Page 51 of 51
ROOT 2 technology
Equalisation
Due to signal distortion caused through multipath fading, a receiver cannot be sure exactly when a burst will arrive. To aid in identification, a Training Sequence Code is transmitted at the centre of each burst. This is a set combination of bits, known by both the transmitter and receiver. When a burst of information is received, the equaliser searches for the training sequence code to identify how distorted it has become. It will then be able to identify through comparison, how distorted the remainder of the burst has become and identify the most probable signal outcome. There are eight different Training Sequence Codes used within GSM, numbered 0 to 7. Nearby cells, although operating on the same frequency will use different training sequence codes, therefore reducing additional air interface interference by disregarding foreign bursts.
NORMAL BURST
GUARD PERIOD
INFO
TRAINING SEQUENCE
INFO
GUARD PERIOD
TAIL BITS
STEALING FLAGS
TAIL BITS
=> 10 Wave Lengths
COMBINER
Diversity
Intelligent Result of Combiner
Diversity As we have discussed, signals arrive at an antenna from multiple paths. The signals are therefore received in different phases and at different strengths, meaning some signals will combine to produce strong signals and others, subtract producing weak or no signal. When diversity is implemented within GSM, two receive antennas are used. These two antennas are placed several wavelengths apart, ensuring that there is minimum correlation between the two receive paths. The two received signals are combined at the BTS, producing the most intelligent and strongest signal possible from the two received signals (one from each of the receive antennas).
Page 52 of 52
ROOT 2 technology
Frequency Hopping
Frequency Hopping is used within GSM to limit the effects caused by multipath fading. It allows the MS to change the ARFCN used for each transmission (every 4.615ms), using the same timeslot, but different carrier. This provides a high degree of immunity to interference, due to interference averaging, as well as providing protection against signal fading. Interference Averaging assumes that radio channel interference does not exist on every allocated ARFCN due to the MS changing to a new ARFCN every 4.615ms or frame. Therefore, the overall communication received only experiences interference part of the time.
ARFCN 41
ARFCN 44
ARFCN 47
HSN - ARFCN Sequence order
BSS
MAIO - Sequence start position
All mobile subscribers can use frequency hopping, which is controlled by the BSS. The BSS provides the MS with two identities, a Hopping Sequence Number (HSN), the order in which the MS hops through the available ARFCNs and a Mobile Allocation Index Offset (MAIO), the start point within the ARFCN hopping sequence. Not all cells support frequency hopping, so networks are configured for frequency hopping and allocated cells.
Page 53 of 53
ROOT 2 technology
Module 5 Key Points

Timing Advance The synchronisation of TDMA frames is critical due to bursts having to be transmitted and received within real time timeslots allocated to them. The further that the MS is from the BTS the longer it takes for the burst to be transmitted between them. The BTS caters for this problem by instructing the MS to advance its timing (to transmit earlier) to compensate for this increased delay. Power Control Both Uplink and Downlink power setting can be controlled, typically though the BTS will transmit at a continuous power setting. (A BTS controls multiple MS so by adjusting power settings to compensate for an individual MS it could seriously affect others.) Discontinuous Reception (DRX) Discontinuous Reception (DRX) allows the MS to switch off when information being transmitted is not intended for it. Multipath Fading GSM utilises the following processes to limit Multipath fading: Equalisation Diversity Frequency Hopping Interleaving Channel Coding
Page 54 of 54
ROOT 2 technology
Call and Handover Proceedures
Module Objectives
On completion of this module of instruction the delegate will have gained an understanding of: Mobile to PSTN Call Discuss the Mobile to PSTN call procedure Explain key stages of the procedure
PSTN to Mobile Call Discuss the Mobile to PSTN call procedure Explain key stages of the procedure
Inter BSS Handover Discuss the procedure taken during a GSM Handover Explain key stages of the procedure
Location Updates Discuss the procedure for Location Updates Explain key stages of the procedure
Authentication Procedure Explore the procedure and reasons for Authentication
ROOT 2 technology
Mobile to PSTN Call

1. The MS requests service by sending a RACH to the BSS. The BSS then assigns a Dedicated Control Channel, SDCCH to the MS by using an AGCH. 2. The request for service (Call Request message - CR) is passed to the MSC, which in turn relays the message to the VLR (At this stage the VLR can initiate the authentication process if required where it will obtain parameters for the HLR). 3. The MSC then sends a Call Complete Message (CC) to the BSS for set up initiation, which in turn notifies the MS to proceed with the call. 4. The MSC accesses the PSTN with an Address Request Message (AR). The PSTN negotiates with the called number and responds with an Address Complete Message (AC).
AR
CR CC
PSTN
AC TCH
RACH AGCH
SDCCH SDCCH SDCCH TCH
MSC
SDCCH TCH FACCH
BSS
5. The MSC informs the BSS to assign a TCH to the MS for the call. 6. Upon completion of this allocation the TCH is connected between the MS and called number, where billing of the call commences. 7. Throughout the duration of the call, FACCH is used to monitor the status of the TCH in case a Handover is required.
Page 56 of 56
ROOT 2 technology
PSTN to Mobile Call

1. The PSTN through the use of C7 Messaging contacts the GMSC with an MSISDN. 2. The GMSC passes the MSISDN to the HLR and responses with an MSRN (the identity of the MSC/VLR area to which requested MS is attached). 3. The controlling MSC then informs the BSS to page the MS using a PCH. 4. The MS responds to the PCH with a RACH. The BSS then assigns a Dedicated Control Channel, SDCCH to the MS by using an AGCH. 5. Upon completion of this proceed (including authentication if required), the MSC sends an Address Complete Message (AC) to the PSTN.
GMSC HLR/VLR
MSISDN MSRN MSRN MSISDN
PSTN
AC ANS
PCH
TCH
RACH AGCH SDCCH
MSC
SDCCH TCH FACCH
BSS
6. The MSC then informs the BSS to assign a TCH to the MS for the duration of the call. 7. The PSTN sends an Answer Message (ANS) to the MSC confirming connection. 8. The TCH is then connected and the call is established. 9. Throughout the duration of the call, FACCH is used to monitor the status of the TCH in case a Handover is required.
ROOT 2 technology
Inter BSS Handover

While the MS is involved in a call (i.e. has a TCH allocated), it is continuously compiling measurements and reporting to the BSS. 1. When a Handover is required, typically due to low Receive Signal Strength Indication (RSSI), the originating BSS (oBSS) notifies the MSC. 2. The MSC then targets the new BSS (nBSS) for the MS, through its TMSI. 3. The nBSS assigns a new TCH for the MS to use and passes relevant information back to the MSC.
1. HO Required
SACCH FACCH
oBSS
4. Clear Down
FACCH FACCH
2. HO Request Info
MSC
3. HO Complete
SACCH
nBSS
Inter BSS Handover
4. The MSC, via the oBSS orders the MS to change to the nBSS using FACCH. 5. The nBSS communicates with the MS Using FACCH to establish full connection. 6. Once all necessary information has been transferred the MSC is informed and Handover is complete. 7. The MSC now sends a Clear Down command to the oBSS, freeing the radio resource for another MS to use (The channel is not cleared until the nBSS can fully accommodate the MS). 8. Upon completion, the MS continues to periodically measure the RSSI values and reports to the nBSS.
ROOT 2 technology
Location Update
1. A location update occurs when an MS detects that it has entered a new location area (LAI). The LAI is transmitted on the BCCH. If this occurs, the MS will be assigned an SDCCH by the BSS, for the duration of the update procedure. 2. Once an SDCCH has been assigned, the MS will transmit a Location Update Message (LU) to the MSC. 3. When the MSC receives this message it sends the new LAI and current TMSI to the VLR. (This information will also be sent to the HLR if it is the first update transmitted by the MS.)
VLR
LAI TMSI TMSI
RACH AGCH
LU UA UC
SDCCH
MSC
SDCCH SDCCH
BSS
SDCCH
MS Location Update
4. The VLR can now assign a new TMSI (if required) to the MS. Its transmits a location Update Accept Message (UA), containing the new TSMI and LAI to the MS. 5. When the MS has successfully received and stored the updated information, the MS responds with an Update Complete Message (UC) to the MSC. 6. The MSC informs the VLR that the update has been successful. 7. The MSC finally informs the BSS to release the SDCCH.
Page 59 of 59
ROOT 2 technology
Authentication Procedure
The authentication procedure maybe executed in addition to switch on, for call setup, location updating or applications for other services i.e. International roaming. 1. The VLR initiates the authentication process by sending an authentication message to the MSC, along with the associated RAND. 2. The MSC then sends the RAND to the BSS, which in turn sends it to the MS attached to a AGCH. The AGCH carries the RAND and information regarding the SDCCH that the MS will use to respond. 3. The MS responds to the request using the SDCCH passing the SRES.
VLR
RAND
SRES
RAND
SRES
AGCH
Complete
MSC
SDCCH
SDCCH
BSS
MS Authentication
4. The SRES is passed to the VLR via the MSC, where authentication will be confirmed. 5. If authentication is successful the MS will be able to continue with its request for service as an example. 6. If authentication fails, the HLR will be updated, the MS will be denied its request and service will be refused.

Introduction To GSM: Technology

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Introduction To GSM: Technology

Uploaded by

Copyright:

Available Formats

ROOT 2 technology

ROOT 2 technology Limited 2001

ROOT 2 technology Limited 2001

ROOT 2 technology Limited 2001

ROOT 2 technology Limited 2001

An Introduction to GSM Features

ROOT 2 technology Limited 2001

An Introduction to GSM Features

The Birth of GSM

An Introduction to GSM Features

An Introduction to GSM Features

935 915 45 MHz

GSM 900 MHz spectrum

An Introduction to GSM Features

An Introduction to GSM Features

360 degree cells

An Introduction to GSM Features

Flexibility and Compatibility

ROOT 2 technology Limited 2001

An Introduction to GSM Features

An Introduction to GSM Features

Security and Services

ROOT 2 technology Limited 2001

An Introduction to GSM Features

ROOT 2 technology Limited 2001

The GSM Network

ROOT 2 technology Limited 2001

The GSM Network

Operations & maintenance system

Network Switching System MSC OMC

ROOT 2 technology Limited 2001

The GSM Network

The Mobile Station (MS)

The GSM Network

Subscriber Identity Module (SIM)

The GSM Network

Base Station Subsystem (BSS)

Base Station Controller

Base Station Site

The GSM Network

HUB & SPOKE

ROOT 2 technology Limited 2001

The GSM Network

Network Switching System (NSS)

HLR Operations & maintenance system

Network Switching Sub system (G)MSC OMC PSTN

ROOT 2 technology Limited 2001

The GSM Network

Home Location Register (HLR)

HOME LOCATION REGISTER

The GSM Network

Visitor Location Register (VLR)

ROOT 2 technology Limited 2001

The GSM Network

WHITE LIST IMEI.xxx.xxx IMEI.xxx.xxx IMEI.xxx.xxx IMEI.xxx.xxx IMEI.xxx.xxx IMEI.xxx.xxx IMEI.xxx.xxx

EQUIPMENT IDENTITY REGISTER

BLACK LIST IMEI.xxx.xxx IMEI.xxx.xxx IMEI.xxx.xxx IMEI.xxx.xxx IMEI.xxx.xxx IMEI.xxx.xxx IMEI.xxx.xxx

GREY LIST IMEI.xxx.xxx IMEI.xxx.xxx IMEI.xxx.xxx IMEI.xxx.xxx IMEI.xxx.xxx IMEI.xxx.xxx IMEI.xxx.xxx

The GSM Network

Module 2 Key Points

ROOT 2 technology Limited 2001

GSM Terrestrial Interfaces