GSM V6

Network Protocols and
Architectures of Mobile Radio

Systems
An introductory lecture for pre- and
postgraduate students of Electrical
Engineering.
GSM, WAP, GPRS, UMTS
11/6/2005
U.A.Hermann: GSM
The Motivation
The GSM Associations membership
consists of more than 690 second (400+ )
and third generation wireless network
operators and key manufacturers and
suppliers to the wireless industry. Its
members provide digital wireless
services to more than 1,319 mrd.
customers (April 2005) in over
191 countries today approximately
71% of the total digital wireless market
today. (source www.gsmworld.com, 11.2002)
11/6/2005
U.A.Hermann: GSM
The Motivation (continued)
GSM with its enhancements (GPRS,HSCSD,WAP,

CAMEL etc.) is the biggest technical system ever
designed by mankind (source GSM world conference
2000).
In terms of :
Mobiles produced per year: about 500 Mio. devices, more

items than watch industry.
Technological complexity: more R&D hours than Apollo, ISS, ..
Size/Investment: in terms of invested in infrastructure.
11/6/2005
U.A.Hermann: GSM
The Motivation (continued)

Nice to know:
In previously war thorn countries (like Afghanistan,

Yugoslavia) GSM was the first telecom infrastructure readily
and publicly available within 6 months. (biggest problems:
theft of BTSs, charging).
It is today cheaper to set up a wireless communication system

from the scratch, than a wire-line system.
Wireless systems have been instrumental for the deregulation

of telecom markets: Easy to establish competition between
operators, leading to massive price reductions
Speed of innovation (features, size of terminals, prices etc.)

are unprecedented in history. And it continues
11/6/2005
U.A.Hermann: GSM
1.Global System for

Mobile
Communications
(GSM)
[Mouly, Pautet 1992]
11/6/2005
U.A.Hermann: GSM
1.1. Introduction
Basic Requirements (as defined by CCITT in 1985)
Services
11/6/2005
The system shall be designed such that the mobile stations can be
used in all participating countries.
In addition to telephone traffic, the system must allow maximum
flexibility for other types of services, e.g. ISDN related services.
The services and facilities offered in PSTN/ISDN and other
public networks should as far as possible be available in the
mobile system. The system shall also offer additional facilities,
taking into account the special nature of mobile communications.
It should be possible for mobile stations belonging to the system
to be used on board ships, as an extension to the land mobile
service. Aeronautical use of GSM mobile stations should be
prohibited.
In addition to vehicle-mounted stations, the system shall be
capable of providing service for handheld stations and other
categories of mobile stations.
U.A.Hermann: GSM
1.1. Introduction
Quality of service and security
From the subscribers point of view, the quality for voice

telephony in the GSM system shall be at least as good as that
achieved by the first generation of 900 MHz analogue systems
over the range of practical operating conditions.
The system shall be capable of offering encryption of user

information but any such facility should not have a significant
influence on the costs of those parts of the system used by
mobile subscribers who do not require such facility.
11/6/2005
U.A.Hermann: GSM
1.1. Introduction
Radio frequency utilisation
The system concept to be chosen shall permit a high level of

spectrum efficiency and state-of-the-art subscriber facilities at a
reasonable cost, taking into account both urban and rural areas
and also development of new services.
The system shall allow for operation in the entire frequency
band 890 915 MHz and 935- 960 MHz.
The 900 MHz CEPT mobile communications system must coexist with earlier systems in the same frequency band.
Cost aspects
11/6/2005
The system parameters shall be chosen with a view to limit the

costs of the complete system, in particular the mobile units.
U.A.Hermann: GSM
1.1. Introduction
Network aspects
11/6/2005
The identification plan shall be based on the relevant CCITT

(Comit Consultatif International Tlphonique et Tlgraphique)
Recommendations.
The numbering plan shall be based on the relevant CCITT
Recommendations.
The system design must permit different charging structures and
rates to be used in different networks.
For the interconnection of the mobile switching centres and
location registers, an internationally standardised signalling system
shall be used.
No significant modification of the fixed public network must be
required.
The GSM system shall enable implementation of common coverage
PLMNs
Protection of signalling information and network control
information must be provided for in the system.
U.A.Hermann: GSM
1.2. Architecture
1.2.1. Overview
1.2.1.1. The three description axis
Static view (figure 1.2.-1.) :
11/6/2005
describes functions, which are fulfilled through the cooperation of several machines. A function is something to fulfil
an activity
Machine (here ) = an assembly of interconnected system
components, physically close to each other, working together to
perform identifiable tasks.
Function in technical literature often refers to some abstract
machine. So here its is used closer to the original meaning of the
word.
U.A.Hermann: GSM
10
1.2.-1 Two dimensional view of a network

Increasing
level of
abstraction
Physical grouping
(machine)
Distributed
functional plane
(field of cooperation)
Spatial distribution
Physical groupings (machines or entities) are represented by vertical blocks, whereas
co-operating functions are grouped in horizontal layers, each one corresponding to a
functional domain
U.A.Hermann: GSM
11/6/2005
11
1.2. Architecture
Dynamic view :
Describes the interworking of the system elements, based on events

and the way they trigger other events.
Systematic of description in this lecture (Figure 1.2.-2.) :

1.
2.
Description of the GSM system in terms of machines.

Description of the functional planes in detail. Role of each machine
in each plane,
3. Description of event sequences (dynamic view)
Additionally a stepwise , top down process of splitting the system into
subsystem is used
Architecture of GSM:
11/6/2005
Canonical architecture is described in the ETSI Recommendations

(the Standard)
Real architecture: depends on implementation aspects. Design
freedom for manufacturers is intentional !
U.A.Hermann: GSM
12
1.2.-2. The three axes of description

Static functional view
Static equipment view
Dynamic view
GSM functions can be described along several axes, each one from a different
and complementary viewpoint
11/6/2005
U.A.Hermann: GSM
13
1.2. Architecture
Systematic of the Standard:
11/6/2005
To describe the behaviour of the system at the interfaces

Leave the internals of machines open to design decisions of the
manufacturers.
The standard even describes interfaces between layers (even so they
are inside one machine) in order to avoid ambiguity . This does
however not constrain implementation
U.A.Hermann: GSM
14
1.2. Architecture
1.2.1.2. The borders of GSM (figure 1.2.-3.)
BSS= Base Station Subsystem,

In charge of providing and managing transmission paths between the mobile
stations and NSS machines (primarily MSC), including management of
radio interface.
NSS= Network and Switching Subsystem

In charge of managing the communications and connecting the mobile
station to the relevant networks or other mobiles. NSS is only indirectly
via BSS in contact with the mobiles.
OSS = Operation and maintenance sub-system

In charge of managing the GSM network.
11/6/2005
A interface = Interface between BSS and NSS
U.A.Hermann: GSM
15
Figure 1.2.-3 GSM subsystem organisation
Operator
OSS
BS
Mo S
bil
es
Us
ers
S
NS
nal s
ter
Ex twork
Ne
GSM
Following logically the three borders of the GSM domain, GSM can be defined
as composed of subsystems which interact between themselves and with the
outside world along with the black border lines shown
11/6/2005
U.A.Hermann: GSM
16
1.2. Architecture
1.2.2. Subsystems
1.2.2.1. Mobile station (= MS or mobile, figure 1.2.-4.)
Main Functions:
Terminal equipment: functions specific to the service, e.g. a fax

Mobile termination: all functions related to radio interface
Terminal adapter: in between, e.g. modem interface.
SIM (Subscriber Identity Module)
There is no personalisation need for the mobile equipment !
MS = Mobile Equipment + SIM
11/6/2005
U.A.Hermann: GSM
17
1.2.-4. Mobile station functional architecture
terminal
equipment
terminal
adapter
mobile
termination
The mobile station may be a standalone equipment for certain services

Or support the connection of external terminals, either directly or
through relevant adaptation functions
11/6/2005
U.A.Hermann: GSM
18
1.2. Architecture
1.2.2.2. Base Station Subsystem (= BSS, figure 1.2.-5.)
BTS= Base transceiver station:
Radio reception and transmission, incl. antenna, signal processing, etc.

A-bis interface to BSC
TRAU (= transcoder/rate adapter unit): data compression, part of BTS
but typically situated remotely at BSC of MSC.
BSC (= base station controller) :
All radio interface management through remote command to BTS and

MS.
Management of radio channels and handover.
Switching functionality
Abis interface not standardised for O&M functionality

11/6/2005
U.A.Hermann: GSM
19
1.2.-5. BSS components and interfaces

BSS
BTS
BSC
OSS
(q3-if)
Abis if
A if
NSS
Radio if
The base station sub-system consists of BTSs, situated on the antenna
sites, and of BSCs, each one in control of several BTSs
11/6/2005
U.A.Hermann: GSM
20
1.2.-5. BSS components and interfaces
The base station sub-system consists of BTSs, situated on the antenna

sites, and of BSCs, each one in control of several BTSs
11/6/2005
U.A.Hermann: GSM
21
1.2. Architecture
1.2.2.3. Network and switching sub-system (NSS, figure 1.2.-6.)
Main task= manage communications between GSM users and other telecom
network users.
MSC (Mobile services switching centre)= coordinate setting-up of calls
from and to GSM users. MSC interface to other nets may require a gateway
for adaptation (interworking functions or IWF)
One MSC controls several BSCs, with a traffic capacity of 1 10 Mio
subscribers.
HLR (Home Location Register)= database containing subscriber data.
AUC (Authentication Centre ) is a functional subdivision of the HLR.
VLR= (visitors location register), linked to one or more MSCs, temporarily
storing subscriber data for mobile currently located in the MSC area
11/6/2005
U.A.Hermann: GSM
22
1.2. Architecture
1.2.2.3. Network and switching sub-system (continued)
GMSC (Gateway MSC)= an incoming call is always first routed to the next
GMSC. This fetches routing information from the HLR and routes the call
to the visited MSC. GMSC needs not to be a MSC, but could be a general
interconnection point .
SS7 network as glue between the MSCs. STPs (Signalling transfer
points) are the connectors between MSC and external SS7 networks.
Transit exchanges (TE) may be used in order to route the outgoing calls as
close as possible to the destination
11/6/2005
U.A.Hermann: GSM
23
1.2.-6. Internal structure of the NSS

Control flow
User data flow
SS7
SS7
backbone
backbone
HLR
AUC
GMSC
PSTN, PSPDN,
ISDN
MSC/VLR
Here the VLR is integrated into the MSC. The fixed network between GMSC and
MSC/VLR as well as the SS7 net may or may not be part of the GSM network
11/6/2005
U.A.Hermann: GSM
24
1.2. Architecture
1.2.2.4. Operation Sub-System (figure 1.2.-7.)
OSS is typically very vendor dependent, as it is equipment dependent.
Cost sensitivity for operators: remote and automatic control of thousands of

BTSs plus BSCs and MSCs. (BTSs are processed via BSCs). The better the
O&M system is, the less numerous and less qualified personnel is needed
for operation!
TMN (Telecommunication Management Network) concept: all OMCs

compose a network which as a whole is connected to all traffic handling
machines.
OMC-R= Radio OMC=> functions: CM (configuration management),

FM (fault management), PM (performance management). One OMC-R
is in charge of several BSCs.
Different OMCs are for NSS, Voice Mail, SMS, transmission network etc.
11/6/2005
U.A.Hermann: GSM
25
1.2. Architecture
1.2.2.4. Operation Sub-System (continued)
Subscription Management= subscriber data management and charging.

Subscriber data management involves the HLR (= repository for subscriber
data) and the AUC (for security related data) plus distributed terminals at
points of sales. SIM initialisation and personalisation is done in this system.
Call charging: CDRs (Charge data records ) are produced in all switches.
Typically collection is done in a billing system close to HLR.
EIR (= equipment identity register) = database managing mobile equipment
(= ME) data, like IMEI (= international mobile equipment identity) for
tracking stolen mobiles and misbehaving mobiles.
11/6/2005
U.A.Hermann: GSM
26
1.2.-7. OSS Organisation

Network
operation and
maintenance
Subscription
management
and charging
SIM
Mobile equipment
management
The three main parts of OSS are:
Network operation and management of telecommunications machines. Subscription
management, charging and billing. Mobile equipment management
11/6/2005
U.A.Hermann: GSM
27
1.3. Functional Planes

1.3.1. Overview of GSM protocol architecture
Picture 1.3.-1 shows how the different machines of a GSM network
interact through the 4 planes of the respective protocols:
Transmission:
physical layer, digital signal processing, coding and

modulation.
Radio Resource Management: management of transmission resources, coping with
physical aspects of the movement of the user.
Mobility Management: Managing subscriber location data, confidentiality,
authentication .
Communication Management: consists of different, independent components
depending on the type of service
OAM:
Operation, Administration and Maintenance:
11/6/2005
U.A.Hermann: GSM
28
1.3. -1 General Protocol Architecture
BSC
MSC/VLR
HLR
GMSC
CM
Communication
Management
MM
Mobility
Management
RR Radio
Resource Man.
Trans
mission
OAM
11/6/2005
MS
BTS
BSC
U.A.Hermann: GSM
MSC/VLR
HLR
GMSC
29

1.3.2. Overview of Transmission
Tasks provided:
Carry user information
Carry signalling information
Included are:
Modulation, Demodulation
En- / De- Coding,
Multiplexing, Demultiplexing
Formatting of data
Sequencing
Error correction through repetition
Routing information
11/6/2005
U.A.Hermann: GSM
30

1.3.3. Overview of Radio Resource Management
Tasks provided:
Establish and release stable connections
Cater for mobile movement
Cope with limited radio resources. Radio resource sharing.
1.3.4. Overview of Mobility Management

Involved machines:
SIM inside mobile station
HLR
MSC/VLR
For security: AuC inside the HLR.
11/6/2005
U.A.Hermann: GSM
31
1.3.5. Overview of Communication Management

Consists of subdomains
Call Control
Involves MSC/VLR, GMSC, IWF, HLR
Management of circuit oriented services
Establishing, maintaining, releasing calls
Choice of routing path between users through switching network
Supplementary Services Management
Enables to configure services independently of call.
Short Message Services
11/6/2005
U.A.Hermann: GSM
32
1.4. Overview of Interfaces and Protocols

Protocol Stack on the Radio Interface:
RIL3-RR: Management of Radio Resources Radio Interface Layer 3
RIL3-MM: Signalling exchange between MS and NSS entities transparently for the
BTS and BSC.
RSM :
Radio Subsystem Management.
Inside NSS:
MTP: Massage Transfer Part are the protocols used for signalling in SS7.
TUP, ISUP, : call related signalling between MSCs and external networks.
MAP:
Mobile Application Part, group of non call related signalling of
different protocols between different entities.
TCAP:
Transaction Capabilities Application Part of SS7.
SCCP:
Signalling Connection Control Part of SS7
11/6/2005
U.A.Hermann: GSM
33
1.4.-1. Overview of GSM Signalling Architecture

MS
BTS
CM
Relay MSC MSC/VLR
RIL3-CC
MM
RR
Anchor
BSC
MAP/D
RIL3-MM
RIL3-RR
RSM
BSSMAP
HLR
MAP/E
TCAP
Layer 2
11/6/2005
LAPDm
LAPD
SCCP
MTP
U.A.Hermann: GSM
SCCP
MTP
SCCP
MTP
34
1.4.-2. Different MAP/x protocols between entities

MAP/F
MSC
MAP/D
VLR
MAP/E
MAP/H= for short message transfer

MAP/I= MS to HLR protocol
for Supplementary Services
MAP/G
VLR
MAP/I
MAP/D
U.A.Hermann: GSM
HLR
MAP/C
GMSC
MAP/D
MSC
11/6/2005
EIR
MAP/H
MAP/C
SMS
Gateway
35
1.5. Transmission
1.5.1. Basic Aspects of Transmission
To provide means of transmission between users: Connecting People
This means adaptation to different optimisation schemes on the successive
segments along the transmission way.
This requires translation functions between different transmission segments which
increases complexity.
GSM is a multi-service network, so it requires interconnection with various kinds
of external networks in order to provide consistent end-to-end services.
11/6/2005
U.A.Hermann: GSM
36
1.5. Transmission
1.5.2.
An End-To-End view of Data Transmission
Bearer Capabilities between the terminals are described.

Important: boundary between GSM network and the external network.
External networks may be:
ISDN or broadband ISDN (DSL)
PSTN (Public Switched Telephony Network)
PSPDN (Packet Switched Public Data Network)
CSPDN (Circuit Switched Public Data Network)
TCP/IP network
GSM uses two generic functions for interworking:
Network Interworking Function or IWF at the boundary of the GSM
network to the external network.
Terminal Adaptation Function of TAF performs adaptation between mobile
station and external terminal Equipment (TE), like a PC.
11/6/2005
U.A.Hermann: GSM
37
1.5.-1. Schematic of Data Transmission Planes

End-to-end
communication
Plane 1: end-to-end transmission between

terminals
Plane 2: TAF-IWF plane inside

GSM
GSM
TAF
Plane 3: generic GSM transmission

plane
11/6/2005
IWF External Network
MSC/VLR
U.A.Hermann: GSM
38
1.5. Transmission
1.5.2.1
The PSTN Case
Analogue audio MODEM needed on the network side, so only certain types are
supported by the Standard:
11/6/2005
Modem Type Rate
Mode of transmission
V.21
300 bit/sec
Asynchronous
V.22
1200 bit/sec
Asynchronous, synchronous
V.22bis
2400 bit/sec
Synchronous
V.23
1200 / 75 bit/sec
Asynchronous
V.26ter
2400 bit/sec
Synchronous
V.32
4800, 9600 bit/sec
Synchronous
U.A.Hermann: GSM
39
1.5. Transmission
1.5.2.1
The PSTN Case (continued)
Similar interworking problems as between ISDN and PTSN arose:

Difference between the user bit rate (e.g. 9600 bit/sec) and the carrying bit
rate (e.g. 12000 bit/sec.): between a Modem and the TE there are typically not
only 2 wires for data transmission (one in each direction), but also for clock and
modem control. Additionally multiplexing and demultiplexing of these control
signals is needed.
Asynchronous transmission: but GSM is basically synchronous, so an
adaptation between the data flows is needed.
Synchronous transmission: clock adaptation between the different clocking
systems is needed.
11/6/2005
U.A.Hermann: GSM
40
1.5.-2. Schematic Interconnection with PSTN

User
User
PSTN
3,1 kHz
Audio line
Audio
Modem
Digital/ Analogue
Audio
Modem
Analogue/Digital
a: PSTN user to PSTN User

User
User
PSTN
GSM
transmission
Audio
Modem
3,1 kHz
Audio line
Digital/ Analogue
Audio
Modem
Analogue/Digital
b) GSM user to PSTN user

11/6/2005
U.A.Hermann: GSM
41
1.5. Transmission
1.5.2.2
The ISDN Case
When the GSM core standard was developed in the late eighties, no one imagined
the success of internet, so the requirement of higher data rates in GSM was
prioritised lower, than the need for cost reductions in the infrastructure.
Basically ISDN offers with 64 kbit/sec a higher bit rate than GSM with only
9,6 kbit/sec.
So the GSM Rate Adaptation function uses a trick to simulate logically an
analogue terminal in a PSTN in order to facilitate the CCITT V.110 specified
capability of an ISDN modem to communicate with a slower analogue modem in
the PSTN (see next picture)
11/6/2005
U.A.Hermann: GSM
42
1.5.-3. Schematic Interconnection with ISDN

User
PSTN
3,1 kHz
Audio line
Audio
Modem
User
ISDN
Audio
Modem
analogue
RA
64 kbit/sec
Circuit
+V.110
RA
Digital/ Analogue
a: PSTN user to ISDN User

User
GSM
transmission
User
ISDN
RA
64 kbit/sec
Circuit
+V.110
RA
Analogue/Digital
b) GSM user to ISDN user

11/6/2005
U.A.Hermann: GSM
43
1.5. Transmission
1.5.2.3
The PSPDN Case
Two cases are implemented in GSM : dedicated PAD access and dedicated
packet access (see next picture). (PAD= Packet Assembler Disassembler)
A single number is needed from the user in order to address the receiver.
No specific subscription with the PSPDN is required for the GSM user.
From the PSPDN perspective, the subscriber is the GSM network, which again has
to dispatch and recover the charges from the GSM subscribers.
GSM interworks directly with PSPDN
Transmission between GSM and PSPDN does not necessarily make use of audio
modems (depending on operators)
The GSM IWF is aware, that it is a PSPDN access, and it interferes with the
transmission protocol, mainly to add the required identification of the PSPDN (not
the subscriber).
X.32 is a modification of X.25 allowing to transport the subscriber identification
11/6/2005
U.A.Hermann: GSM
44
1.5.-4. Schematic Interconnection with PSPDN

User
GSM
User
PSPDN
Modem
Modem
PAD
a) Dedicated PAD access to PSPDN from GSM

User
GSM
User
PSPDN
X.32 packet service

Modem
Modem
PH
b) Dedicated direct access to PSPDN from GSM

11/6/2005
U.A.Hermann: GSM
45
1.5. Transmission
1.5.4.
Transmission inside GSM

1.5.4.1. Speech
GSM full rate uses a 13 kbit/sec coding scheme by RPE-LTP (= Regular Pulse
Excitation Long Term Prediction) Codec.
Speech is transmitted in groups of 260 bit every 20 msec.
Discontinuous Transmission (= DTX) and Voice Activity Detection (= VAD)
DTX aims at increasing the efficiency of the radio interface by decreasing
the cochannel interference, by suppressing transmission in case no
information is transmitted.
VAD is created by the speech codec and indicates when silence is
transmitted.
Comfort noise is injected on the receiver site in order to improve the
subjective speech impression. Only one 20 msec frame is transmitted every
480 msec.
11/6/2005
U.A.Hermann: GSM
46
1.5. Transmission
1.5.4.2. Transcoder Rate Adaptation Unit (TRAU)
Speech data rate compression: TRAU compresses the 64 kbit/sec data rate of
ISDN to the 13 kbit/sec of GSM FR (Full Rate)
Functionally the TRAU is part of the BTS.
Practically most vendors situate it at the MSC in order to save transmission
capacity (see picture 1.5.-5.).
This creates some additional overhead for inband signalling between BTS and
TRAU:
Synchronisation: the speech encoded data stream does not contain
synchronisation information. This must be gained separately. On the air
interface this is provided by the general synchronisation . On the 2Mbit/sec
terrestrial line this is achieved by additional synchronisation bits.
11/6/2005
U.A.Hermann: GSM
47
1.5. Transmission
1.5.4.2. Transcoder Rate Adaptation Unit (TRAU), continued
Time alignment: in the downlink direction, transmission on the radio path can
start only, when a whole 20 msec block is received from the MSC. So there is an
optimum time relationship between the moment of the beginning of a block
transmission on the radio path and the end of the reception of a block on the 16
kbit/sec link. Otherwise an additional 20 msec delay would result.
Speech/Data and Full/Half Rate discrimination: inband information is needed
in order to control the TRAU.
Reception Quality: receiver (demodulator and decoder) in the BTS signals,
when the reception was under a quality threshold. Bad frames are ignored by
the speech transcoder.
11/6/2005
U.A.Hermann: GSM
48
1.5.-5 Positions of the TRAU

TRAU
MSC/VLR
BSC
TRAU
MSC/VLR
BSC
TRAU
MSC/VLR
BSC
16 kbit/sec transmission
64 kbit/sec transmission
11/6/2005
U.A.Hermann: GSM
physical site
49
1.5. Transmission
1.5.4.3.
Data
1.5.4.3.1.
Connection Types
Particular problem for radio transmission (as opposed to wire line

communication):high bit error rates, e.g. over 10-3.
GSM (like all transmission systems) had to find a compromise between
transmission quality, throughput and delay.
In GSM different compromise solutions had been developed in order to cater for
different sorts of applications.
Two categories:
T (Transparent) connections: FEC (Forward Error Correcting Code)
supplied by the radio interface. Derived from ISDN V.110. Path between
TAF and IWF is seen as a synchronous circle. User data rates between 600
bit/sec and 9600 bit/sec. Better protection for slower data rate.User data
rates below 2400 bit/sec are grouped into one category.
11/6/2005
U.A.Hermann: GSM
50
1.5. Transmission
1.5.4.3.1.
Connection Types (continued)
Performance versus rate in T mode:

User rate
Intermediate Rate Channel Type Residual Error Rate
9600 bit/sec
12 kbit/sec
Full rate (FR)
0,3%
4800 bit/sec
6 kbit/sec
Full rate
Half rate
0,01 %
0,3%
2400 bit/sec 3,6 kbit/sec
Full rate
Half rate
0,001%
0,01 %
The figures for residual error rates consider typical urban radio conditions with
frequency hopping
11/6/2005
U.A.Hermann: GSM
51
1.5. Transmission
1.5.4.3.1.
NT (Non Transparent Connections):

additional Error/Repeat scheme is used in case of bad reception.
The transmission on the GSM circuit connection is considered as a packet
data flow.
The throughput varies with the quality of basic transmission (the higher
the BER, the lower the throughput), as well as the delay.
Basic rates are 12000 bit/sec and 6000 bit/sec for 9600 kbit/sec (FR) and
4,8 kbit/sec (HR)
Bits are grouped in successive frames of 240 bit incl. redundancy bits to
allow the receiver to detect errors and start the repeat protocol called RLP
(Radio Link Protocol)
RLP is operated between TAF and IWF.
Problem of data rate: if the T mode already leads to a user rate of 9600
bit/sec with a 12000 bit/sec connection, where do so the additional bits for
the RLP protocol come from ?
11/6/2005
U.A.Hermann: GSM
52
1.5. Transmission
1.5.4.3.1.
NT (Non Transparent Connections):

Solution: bit steeling from e.g. start/stop protocol of the user or from the
low level protocol of the application, like the LAPB in case of an X.25
connection.
The main function of these protocols are framing, error correction by
retransmission and flow control, all functions as well fulfilled by RLP!
In both cases (Start/stop and LAPB) the idea is to replace them on the
GSM segment of the connection by the RLP and thereby apply more
efficient schemes for the radio connection instead of the stolen bits.
Consequence: RLP only works in some specific configurations, for which
GSM knows which low layer protocol is used.
So in total GSM offers several compromise solutions for the data transmission
depending on the parameters:
Delay / Quality of Service / Radio Spectrum Efficiency
11/6/2005
U.A.Hermann: GSM
53
1.5. Transmission
1.5.4.3.1.
Name
Quality of service
Delay (two-way, TAF-IWF)
TCH/F9.6, T
Low
330 ms
TCH/F9.6, NT
High
> 330 ms
TCH/F4.8, (T)
Medium
330 ms
TCH/F2.4, (T)
Medium
200 ms
TCH/H4.8, T
Low
600 ms
TCH/H4.8, NT
High
> 600 ms
TCH/H2.4(T)
Medium
600 ms
TCH/F = full rate channel , 13 kbit/sec raw bit rate.

The quality indications are only indicative in a statistical sense, as they depend
on the specific radio conditions.
11/6/2005
U.A.Hermann: GSM
54
1.5. Transmission
1.5.4.3.2. Basics of Rate Adaptation (Repetition of ISDN V110)
The RA0 Function:
An asynchronous data flow is a succession of characters, each typically
preceded by a start bit and terminated by a stop bit. On such a flow it is not
required that the bit edges fall with the regular clock.
In ISDN and GSM data transmission is however only synchronous, so RA0
has to transfer the asynchronous into an synchronous data flow, by delaying
bits till they are aligned with the clock .
In case of higher incoming than outgoing data rate stop bits may be skipped
at the sender and reinserted at the receiver.
The RA1 Function:
provides a bit flow at the intermediate rate of 8 kbit/sec or 16 kbit/sec,
according to the nominal rate to transport.
multiplexes between the auxiliary information (modem control plus other
signals) and the main data flow.
11/6/2005
U.A.Hermann: GSM
55
1.5. Transmission
The RA1 Function (continued):
For this synchronisation is required between multiplexer and demultiplexer.
Bit rates lower than 4800 bit/sec are increased by repeating each bit so many
times, till the required 4800 bit/sec are achieved.
The RA2 Function :
rate adapts the intermediate rate to 64 kbit/sec, by simply adding 6 or 7
bits to each 1 bit in an octet.
synchronous
Asynchronous raw rate,

e.g. 300 or 9600 bit /sec
Intermediate rate
(8 or 16 kbit/sec)
RA1
RA0
RA2
sampling
sync
fill
fill
64 kbit/sec
plug
11/6/2005
U.A.Hermann: GSM
56
1.5. Transmission
1.5.4.3.3.
GSM T Connections
The transmission path between the TAF at the mobile site and the IWF at the
Infrastructure site are equivalent to before sketched V.110 functionality (see next
picture)
Differences on the radio interface:
to limit as much as possible the information to be transmitted so that
the maximum part of the raw throughput can be devoted to optimised
redundancy, in order to maximise the transmission quality.
Synchronisation bits are removed, as GSM has its own synchronisation at
the radio interface which can be used to derive the V.110 synch.
Bits E1, E2, E3 indicating the transmitted data speed can be removed, as
this is part of GSM signalling
Resulting intermediate rates at GSM after the RA1 are 12 kbit/sec,
6 kbit/sec and 3,6 kbit/sec (= 2,4 kbit/sec data plus 1,2 kbit/sec auxiliary
data)
11/6/2005
U.A.Hermann: GSM
57
1.5. Transmission
Intermediate data rate
(3,6 , 6 or 12 kbit/sec)
Asynchronous raw rate,

e.g. 300 or 9600 bit /sec
Intermediate data rate

(8 or 16 kbit/sec)
synchronous
sampling
RA1
sync
fill
plug
TAF
RA1/RA1
RA0
BTS+TRAU
RA2
64 kbit/sec
fill
Adaptation functions RA0 (for asynchronous data only) and part of RA1
(called RA1) are performed in the TAF (inside the mobile station), whereas the
Complement of RA1 and RA2 are performed in the BTS/TRAU
11/6/2005
U.A.Hermann: GSM
58
1.6. The Radio Interface

This chapter is deliberately kept rather brief and intend to give an overview of the
aspects of channel coding, as these typically are dealt with in different lectures.
The radio interface has been the most important one, at least from the time and
effort of development, due to following reasons:
Compatibility requirement at the radio interface.
Spectral efficiency (Number of synchronous calls which fit into a given radio
spectrum)
Resistance to interference, which determines the frequency reuse factor.
Multiple access scheme will be described and the signal processing from bits to
radio waves.
GSM uses a mixture of FDMA and TDMA, with FH (=Frequency Hopping)
Medium Bandwidth = 200 kHz.
TDMA factor = number of calls on 200 kHz band is 8 (or 16 for Half Rate)
GMSK is the (classical) modulation scheme used.
11/6/2005
U.A.Hermann: GSM
59

1.6.1. The requirements
1.6.1.1. User Data Transmission
Most of the user services offered by GSM rely on 4 different transmission modes:
Speech, with 13 kbit/sec
Data with 12 , 6 or 3,6 kbit/sec raw data rate.
SMS uses a different package oriented service, which is derived from methods
used for transfer of signalling.
Traffic Channels
TCH/F (F= Full Rate) for 13 kbit/sec speech and 12, 6 or 3,6 kbit/sec data.
TCH/H (H= Half Rate) for 7 kbit/sec speech and 6 or 3,6 kbit/sec data.
11/6/2005
U.A.Hermann: GSM
60

1.6.1.2. Signalling
Is needed for e.g. call set up, call release, handover, authentication, etc.
Signalling in Connection with a Call is done by 2 different methods in parallel to
the user data stream:
SACCH= Slow Associated Control Channel:
Bidirectional channel carrying about 2 messages per second
Transmission delay= about half a second.
Used for non urgent procedures, like transmission of radio measurement
data needed for preparing handover.
No user data is lost, as the data/speech is compressed into the other time
slots of the TCH
FACCH= Fast Associated Control Channel:
For urgent/fast procedures like authentication or handover.
Is not an extra channel, but a particular use of the TCH: channel steeling
So user data is lost during a call, not at call set up or call termination.
Receiver can identify both uses by reading the stealing flag.
11/6/2005
U.A.Hermann: GSM
61

1.6.1.2. Signalling (continued)
Signalling outside a Call is done if a connection between MS and network is
established only for signalling purposes, like SMS, location update etc.
SDCCH= Stand alone Dedicated Control Channel or TCH/8 (eighth of a TCH/F)
Similar characteristic as a TCH, however lower rate.
TCH/8 also has an SACCH, so it perfectly looks as a TCH and could
theoretically be used as such for user data
1.6.1.3. Idle Mode

Idle Mode as opposed to Dedicated Mode is the phase, when the mobile is switched
on. But no radio communication is ongoing (hence none of the precious radio resource
is being used.
During idle the MS still has to listen to the BTS for Paging, measurement of radio
environment in order to choose the most suitable BTS to camp on, listen to the Cell
Broadcast (CB) SMS.
U.A.Hermann: GSM
11/6/2005
62

1.6.1.3. Idle Mode (continued)
Access Support
Downlink, unidirectional channels:
FCCH = Frequency Correction Channel: transmitted by the BTS for the mobiles
to synchronize their internal clock frequency.
SCH= Synchronisation Channel transmitted by the BTS for the MS to
synchronize its internal Clock (time synchronisation)
BCCH= Broadcast Control Channel= transmitted by the BTS to e.g. identify the
network to which a given cell belongs.
PAGCH= Paging and Access Grant Channel= PCH (Paging Channel) and
AGCH (Access Grant Channel). The partition between PCH and AGCH varies in
time.
Uplink, unidirectional channel:
RACH= Random Access Channel: used for the first access request of a MS. The
timing of this burst is chosen randomly, so there may be clashes between
mobiles
11/6/2005
U.A.Hermann: GSM
63

1.6.1.3. Idle Mode (continued)
Cell Broadcast Messages
CBCH= Cell Broadcast Channel
has half the capacity of a TCH/8
Constraints: it must be possible for a MS to listen to the CBCH in parallel to the
BCCH and PCH.
Terminology : What is a Channel

CCITT: a channel is an identified portion of an interface
GSM: confusion is created by using the term channel in two different ways:
Sometimes a specific resource , like TCH
Sometimes a specific usage of a resource, like FACCH
11/6/2005
U.A.Hermann: GSM
64

1.6.2. The Multiple Access Scheme
Burst= finite duration and major part of energy is in a finite part of the radio
spectrum
Slots= the central frequencies of the slots are positioned every 200 kHz
(FDMA aspect) and they recur every 15/26 msec (TDMA aspect).All slot time
limits are simultaneous in a given cell.
Bidirectional channels are separated by a frequency gap (45 MHz for GSM900 and 75 MHz for DCS-1800) and a time shift depending on the channel
type.
11/6/2005
U.A.Hermann: GSM
65

1.6.2.1. The Time Axis
Organisation of the time axis is always cyclic, but the length of cycles as well as
number of slots in a cycle varies according to the type of channel.
Each time slot has a number ( which is cyclic)
1.6.2.1.1. Dedicated Channel

TCH/F always goes together with its SACCH (sometimes called TACH/F ).
TACH/F consists of one slot every 8 BP (Burst Period)= 4,615 msec= 60/13 msec.
Time Slot Number (TN) = 0 7 allocated to different traffic channels
Cycle time of SACCH is one for 26 time slots
120 msec
(26)
01234567
BP
11/6/2005
8 BP = 4,615 msec
15/26 msec
U.A.Hermann: GSM
66

1.6.2.1.1. Dedicated Channel (continued)
120 msec period was chosen as a multiple of 20 msec (GSM Speech frame) and
fixed network frame (ISDN) to obtain synchronism.
So a burst period = 120 msec/ (26* 8 slots) = 15/26 msec
TACH/F 26 slot cycle includes 24 slots in which TCH/F bursts are sent , 1 slot on
which a SACCH burst is sent and one slot with no transmission (See next picture).
In order to spread the arrival of SACCH messages at the base station, the cycles of
two TACHs using successive slots are separated by 97 BP (= 12* 8 + 1 slot)
T T T T T T T T T T T T
0
1
T T T T T T T T T T T T S T T T T T T T T T T T T
T T T T T T T T T T T T
0
11/6/2005
T T T T T T T T T T T T S
4 5
T T T T T T T T T T T T S
9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25
U.A.Hermann: GSM
67

MS Tx
11/6/2005
MS Rx
U.A.Hermann: GSM
68

Coding follows cycles based on grouping 4 successive bursts. For the TCH/F a
cycle contains 6 times 4 bursts. However for the SACCH, the full cycle, taking into
account this grouping 4*4, lasts 4* 26* 8= 104* 8 BP= 480 msec.
Relationship between Uplink and Downlink:
From BTS point of view: Uplink time slot number is delayed by 3 BP against
Downlink.
This relationship is fixed, so Up- and Downlink channels have the same TN.
Due to this shift, the MS does not need a splitter between Transmitter and
Receiver.
Transmission
Reception
0 1 2 3 4 5 6 7
0 1 2 3 4 5 6 7
11/6/2005
U.A.Hermann: GSM
69

TCH/8
From the perspective of the time organisation many different kinds of TACH/8
exist:
Some grouped by 8 in order to form the equivalent of TACH/F = SDCCH *8
Others are grouped by 4 and combined with common channels to form
together the equivalent of TACH/H= SDCCH * 4
Common properties of all TACH/8:
All follow a cycle of 102* 8 BPs, where 8 slots are used for TCH/8 and 4 slots
are used for SACCH
Period 102 is different from period 104. This is because the Common
Channels follow a period of 51* 8 BPs.
The TACH/8 vary in their phase relations between the TCH slots and the
SACCH ones, as well between UL and DL
Considering the measurement reporting period as well, there are 12 different
schedulings for the TACH/8
11/6/2005
U.A.Hermann: GSM
70
1.6.-1 Time organisation of TACH/8

T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T S S S S S S S S S S S S S S S S
0
12
16
20
24
28
32
36
40
48
50
T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T S S S S S S S S S S S S S S S S
51
55
59
63
67
71
75
79
83
87
91
95
99
101
Grouping by 8 (each TACH/8 is marked with the same colour). During this cycle,
2 blocks of 4 slots are used for the TCH/8 and 1 block of 4 slots for the SACCH
T T T T T T T T
T T T
22
32
26
29
T T T T T T T T
51
Grouping by 4
11/6/2005
73
77
U.A.Hermann: GSM
80
T T T
83
T T T T T
36
39
T T T T T
87
90
S S S S S S S S
42
46
50
S S S S S S S S
93
97
101
71

1.6.2.1.2. Common Channel
General Organisation
11/6/2005
U.A.Hermann: GSM
72

1.6.2.1.2. Common Channel (continued)
General Organisation
All Common Channels are designed to be grouped together on the same
(Beacon) frequency in a few combinations
Their time definitions are therefore all based on the same cycle= 51* 8 BPs
This cycle and the cycle for the traffic channel (= 104* 8 BPs) were deliberately
chosen without a common divider!
The intention is that a MS in dedicated mode during its idle time slot (no.= 52)
shall listen to the beacon frequencies of neighbouring base stations in order to
prepare a potential hand over.
So the SCH and FCCH of neighbouring BTSs slide along the listening window
of the MS.
This synchronisation to the neighbouring BTSs is called presynchronisation
The TN= 0 of the FCCH is by definition!
FCCH
SCH
10
11/6/2005
20
U.A.Hermann: GSM
30
40
73

BCCH and PAGCH
Both are DL channels.
A BCCH/F uses 40 slots:
BCCH
PAGCH
12
22
32
42
A BCCH/T (T for third) uses 16 slots per 51* 8 BP, all with the same TN
BCCH
11/6/2005
PAGCH
12
U.A.Hermann: GSM
74

RACH
RACH is a UL channel.
The time organisation of a RACH/F is similar to a TACH/F in UL direction.
The RACH/H uses 27 time slots in a 51* 8 cycle and its capacity is therefore more
than half of a RACH/F.
RACH
14
36
45
Common Channel Combinations

Every cell broadcasts FCCH and SCH
Every cell supporting mobile access has BCCH, PAGCH and RACH. E.g. a microcell under an umbrella cell might not support access, but only be reachable via
handover.
11/6/2005
U.A.Hermann: GSM
75

In order to save spectrum, the common channels are always grouped together.
3 possible combinations are used, depending on traffic capacity of a given cell
Downlink channel structure for normal capacity cells:
FCH
SCH
0 1 2
BCCH
10
12
PAGCH/F
20
21
30
32
40
42
and the related uplink channel structure

RACH
11/6/2005
U.A.Hermann: GSM
76

For small capacity sites less capacity for paging and access grant might be used, so
that instead TACH/8 for additional signalling is combined:
FCH
SCH
0 1 2
BCCH
10
PAGCH/T
12
20
TACH/8 (used for signalling)
21
30
32
40
42
and the related uplink channel structure

RACH
11/6/2005
14
36
U.A.Hermann: GSM
45
77

For big capacity sites more capacity for paging and access grant might be used, so
that additional extension sets of PAGCH/F and RACH/F are used.
Each such extension set has an additional BCCH, but no FCH and SCCH, as they
must be unique in a cell.
The extension sets are for TN=2, 4 and 6, due to following reasons:
All common channels of one cell must use the same frequency.
Cells of very large radius may allow RACH bursts to overflow into the next
time slot. This would not be possible, if this slot is allocated.
The number of possible combinations should be limited in order to simplify
implementation.
CBCH
CBCH cycle = 8* 51* 8 BP (lasting about 2 sec), where 4* 4 time slots are used.
Allowed positions in the 51* 8 BPs cycle and allowed TNs are limited, so that the
MS can listen to BCCH and PAGCH.
2 different cases can be distinguished:
11/6/2005
U.A.Hermann: GSM
78

1.
2.
If the common channel is a small one with a PAGCH/H and a RACH/H, the
CBCH can use the same TN=0 and frequency as the the common channel.
For all common channel configurations: CBCH is on TN=0 (not for beacon
frequency), 1, 2 or 3 . The CBCH must than again be on a specific position in
the 51* 8 BP cycle, which would otherwise belong to a TCH/8. In this case the
MS in idle mode has to listen to the bursts of different TNs. This increases
scheduling complexity and is the only case where an idle MS has to listen to 2
time slots!
When a CBCH is used, the first block of the PAGCH in the 51* 8 cycle cannot
be used for paging.
Inside the 8* 51* 8 BP cycle, the CBCH can be seen as a half downlink TCH/8,
using 4 out of eight 4-burst blocks.
The 4 other blocks, i.e. the slots else used by the SACCH, and the uplink
corresponding slots are not used by the CBCH and cannot be used for anything
else. In case of congestion CBCH can be stopped and used for TACH/8
11/6/2005
U.A.Hermann: GSM
79

1.6.2.1.3. Channel Organisation in a Cell
In a cell one or more TRX (= Transmitter / Receiver) may be combined into

one BTS.
The combinations of logical channels on the frequencies is optimised for the
traffic capacity needed in a given cell
and optimized to use all available time slots.
Typical small capacity cell with only 1 TRX:
Medium Capacity Cell with e.g. 4 TRX:
TN0= FCCH, SCH, BCCH, PAGCH/T, RACH/H, 4 TACH/8

TN1 7= 1 TACH/F each.
One TN0 group: FCCH, SCH, BCCH, PAGCH/F, RACH/F
Twice 8 TACH/8
29 TACH/F
Large Capacity Cell with 12 TRX:
11/6/2005
One TN0 group: FCH, SCH, BCCH, PAGCH/F, RACH/F

TN= 2, 4 and 6 groups: BCCH, PAGCH/F, RACH/F
5 times 8 TACH/8
87 TACH/F
U.A.Hermann: GSM
80

1.6.2.1.4. Synchronisation Acquisition
Synchronisation is generally a key issue for all radio systems

Steps of initial synchronisation:
1.
2.
3.
4.
11/6/2005
MS listens after a predefined strategy for a BCCH carrier frequency (called beacon
frequency). Strategy may e.g. be to start listening for the last beacon frequency,
than for all beacon frequencies used by the home mobile operator and than for all
GSM frequencies. As the beacon frequency is not power controlled, but always
transmitted at full power, it should be easy to find
MS looks for a FCCH: as it is a pure sine wave, it is easy to detect. The
information derived is used to tune the synthesizer frequency and to roughly adjust
the clock to the TN0 boundaries.
As the SCH slots always come after the FCCH slot, they are easy to find and
decode. Inside the SCH the MS finds exact information about its slot number in the
8* 26* 51* 2049 BP clock
The MS reads the BCCH in order to obtain information about the BTS, the operator
etc.
U.A.Hermann: GSM
81

1.6.2.1.5. Frames (GSM Standard definitions)
TDMA Frame consists of 8 time slots, FN= TDMA Frame Number

26 or 51Multiframe= 26 or 51 TDMA frames= 26 or 51* 8 BPs
Superframe= 51* 26 TDMA frames = ca. 6,12 sec. This is the shortest period
for which the organisation of all channels is repeated.
Hyperframe= 2048* 51* 26* 8 BP = 12533,760 sec.= 3 h, 28 min. 53,760 sec
is a multiple of all cycles and the shortest period for freq.hopping and ciphering
Hyperframe= 2048 superframes= 3 h 28 min 53,760 sec.
Superframe = 26* 51 multiframes= 6,12 sec
0 1 2
24 25
26 multiframes=
120 msec
11/6/2005
0 1 2 3
48 49 50
51 multiframes= 235 msec

0
TDMA Frame= 4,615 msec
U.A.Hermann: GSM
82

1.6.2.2. The Frequency Axis
1.6.2.2.1. Available frequencies
GSM900=
890- 915 MHz (uplink) and 935- 960 MHz (downlink)
DCS1800= 1710- 1785 MHz (UL) and 1805- 1880 MHz (DL)
Extension Bands= 8 MHz directly under the original bands.
200 kHz carrier spacing between two channels.
1.6.2.2.2. Frequency Hopping (FH)
GSM uses slow FH as opposed to fast FH in military systems.

GSM hopping period = burst period.
Fast FH= quicker than modulation rate.
FH was introduced due to 2 reasons:
1. Compensate for Rayleigh fading in case of stationary or slowly moving mobiles: in
case of a fading hole at a certain place and frequency, there might not be a such a
hole at another, decoupled frequency. Typically decoupling is achieved at more
than 1 MHz frequency difference. FH gain is about 6,5 dB.
2. Interferer diversity: Interference by e.g. a nearby mobile is statistically distributed.
The system capacity is best for a given C/I, if the spread around the mean value is
as small as possible.
11/6/2005
U.A.Hermann: GSM
83

1.6.2.2.4. Hopping Sequences
In GSM 64 different FH sequences are foreseen. They are pseudo random with
exception of the first sequence (number= 0), which is one frequency after the other.
The FH sequences have each a Hopping Sequence Number (HSN) = 0 63.
For a set of n available frequencies in a given cell, GSM allows 64* n different hopping
sequences to be build, depending on which frequency of the given set is defined as the
starting frequency for the hopping sequence.
MAIO (Mobile Allocation Index Offset)= starting number of frequency in a set.
Properties:
2 channels with identical HSN, but different MAIO never use the same frequency
on the same burst.
2 channels with identical frequency lists, same TN but different HSNs interfere for
1/n of the bursts, as if the sequences were random.
Inside one cell, typically identical HSN, but different MAIOs are used in order to avoid
interference between mobiles.
In distant cells using the same frequency set, different HSNs should be used in order to
gain from interferer diversity.
11/6/2005
U.A.Hermann: GSM
84

1.6.2.2.5. The Case of Common Channels
Common Channels (FCCH, SCH, BCCH, PAGCH, RACH) never hop, in order to ease
initial synchronisation.
Extension sets of common channels are as well forbidden to hop.
Common Channels must always transmit at full power in order to allow MSs the
neighbour station monitoring of field strength. This again is needed by the mobiles in
order to prepare handover, I.e. measure field strength in order to find the best candidate
for a potential HO.
So if no information is to be transmitted, fill frames with predefined content are
transmitted.
This is why the BCCH frequency also is called beacon frequency.
Interesting case: in small cells (minimum would be only one TRX) still FH might be
required by the operator in order to gain on frequency and interferer diversity:
But TN= 0 with the common channels must not hop!
The other time slots should hop at least over 4, better 8 different frequencies in
order to gain the desired effects.
So the beacon frequency must be filled up with fill frames on each TN 0 which
has just hopped off to another frequency.
11/6/2005
U.A.Hermann: GSM
85

1.6.3. From Source Data to Radio Waves
The intention of this chapter is not to explain channel coding and modulation, as these
are topics covered by other text books and lectures, but rather how these technologies
had been applied on GSM. (for more on these subjects, see e.g. [Sklar- 1988]
The operations described here are standard for all transmission systems on the
transmitter side (and inversely on the receiver side):
Channel Coding: introduction of redundancy in order to enable error detection and

correction. In GSM e.g. a code word for full rate speech is 456 bits long
Interleaving: mixing up bits which are close to each other over several code
words. Since the error probability of successive bits in the modulated data stream is
highly correlated and channel coding performs better with decorrelated errors,
interleaving aims at decorrelating errors. After interleafing the block structure is
created: one block for one burst.
Ciphering: creates data confidentiality by applying a ciphering code, which is only

known by the BTS and the MS.
Burst Formatting: Adds some binary information (midamble) to the blocks in

order to help synchronisation and equalisation.
Modulation: transforms the binary signal into an analogue signal of the right
frequency.
11/6/2005
U.A.Hermann: GSM
86
1.6.-2. Sequence of operations from Speech to Radio Waves and back
11/6/2005
Digitizing and
Source Coding
Source
Decoding
Channel
Coding
Channel
Decoding
Interleaving
De-Interleaving
Burst Formatting
Burst Formatting
Ciphering
Deciphering
Modulation
Demodulation
U.A.Hermann: GSM
87

1.6.3.1.
The Bursts
Transmission time window = (576 + 12/13) sec.= ( 156+ ) bit
1.6.3.1.1. The Normal Burst
Tail
Information
58
Training
Sequence
26
Information
58
Tail
3
Guard time is determined by the signal envelope (see next figure): period during which
the signal is below 70 dB is about 30 sec.
In Uplink this guard time is used for MS tolerances and compensation of multipath
echo.
Training period in the middle is sometimes called midamble: minimum distance to
useful bits. Used for channel estimation, demodulation and equalisation.
8 different training sequences (TS) are defined. Different TS are used by BTS which use
same frequencies and are close enough to create interference.
The TS have been chosen for a sharp autocorrelation function with a high peak and a
low correlation with the other midambles.
The bits closest to the TS are the Stealing flags (=1 means stealing), indicating to the
decoder that a different decoding shall be used, as a FCCH is transmitted. In other
channels than TCH, these bits are ofU.A.Hermann:
no use. GSM
11/6/2005
88
1.6.-3 The Normal Burst

Level (dB)
+1
-6
correlation
+4
-1
16
-30
-70
or
-36
dBm
147 bits
10
10
7056 / 13
10
8 1 burst period (7500/13 sec.)
10
T (sec)
Figure 1.6.-3.a: time mask of a normal burst

Power level during guard time must be below
-70 dB or 36 dBm, whichever is higher.
11/6/2005
U.A.Hermann: GSM
-5
Figure 1.6.-3b. Autocorrelation

function of a GSM training
sequence
89

1.6.3.1.2. The Access Burst
Tail
7
Training Sequence
41
Information
36
Tail
3
The access burst is the only short burst in GSM.

Objective: to fit into the reception window of a BTS despite the signal delay
between MS and BTS due to speed of light.
Propagation delay is twice the signal way between BTS and MS. Only a MS more
than 35 km away from the BTS would miss the time window of the BTS. But this
is not allowed by the standard any way (exception: extended cells).
Longer training sequence and tail bits in the beginning in order to increase
demodulation and detection success probability: the BTS receiver does neither
know whether nor when and with which reception level and frequency error the
signal arrives!
Only one training sequence is specified, despite the fact that multiple sequences
would increase detection probability. Reason: keep its simple !
11/6/2005
U.A.Hermann: GSM
90
1.6.-4 The Access Burst

Level (dB)
+1
-6
Total Delay
+4
-1
BTS
-30
87 bits
MS
-70
or
-36
dBm
DL delay UL delay
10
10
4176 / 13
10
8 1 burst period (7500/13 sec.)
10
8
Figure 1.6.-4.a: An access burst has the

same ramping specification as a normal burst,
but the useful duration is much shorter
11/6/2005
time
T (sec)
U.A.Hermann: GSM
Figure 1.6.-3b. Time Delay of

Access Burst
91

1.6.3.1.3. The SCH Burst
Tail
Information
39
Training
Sequence
64
Information
Tail
39
The SCH burst is the first burst received by a MS.

Therefore its training sequence is longer (in order to ease demodulation).
Only one TS is used (the MS would not have a chance to know which one was
used, as it is not yet synchronised on the BTS).
1.6.3.1.4. The FCCH Burst (or Pure Sine Wave Burst)
All its bits are set to 0.

With the modulation technique this results in a pure sine wave, with frequency
1625/24 kHz higher than the carrier central frequency
11/6/2005
U.A.Hermann: GSM
92

1.6.3.2. Interleaving and Channel Coding
1.6.3.2.1 General principles of Interleaving
Interleaving is meant to decorrelate the relative position of bits respectively in the code
word and in the modulated radio bursts. (better performance of decoding is achieved, if
errors are randomised and not appearing burst wise)
b bits of a code word are spread into n bursts. The larger n, the better the transmission
performance but the longer the transmission delay.
Different compromises were found in GSM, depending on the channel usage.
1.6.3.2.2 General principles of Channel Coding
Channel coding intends to improve transmission quality, so it compensates for different

disturbances (noise at low reception level, interference, multipath propagation, Doppler
shift, )
In GSM several codes are concatenated:
11/6/2005
Block convolution codes: used with likelihood estimation data from demodulator. Good
results for error correction.
Fire code: used after convolutional decoder in order to cope with bursty, residual errors.
Simple parity code for error detection.
U.A.Hermann: GSM
93

1.6.3.2.3 Convolutional and Block Codes
Maximum degree of generator polynomial used by GSM is 4 .

In GSM such a simple code has been chosen (despite the fact, that
convolutional codes of larger degree are better), because the performance gain
is limited by the interleaving depth.
span of a code = length of sequence of coded bits, which must be
analysed to decode one information bit.
Little gain is obtained if span is greater than interleaving depth.
E.g. for 9,6 kbit/sec a span of 22 is optimum in GSM.
1.6.3.2.4. Fire Code
In GSM a shortened cyclic code is used.

Generator polynomial : (X23 + 1) ( x17 + X3 +1)
So the degree of the polynomial is 40 (= number of redundancy bits)
Errors of up to 11 bits can be corrected.
11/6/2005
U.A.Hermann: GSM
94

1.6.3.2.5 Parity Codes
Parity codes are linear block codes , derived (like the Fire code) from cyclic codes.
3 different codes are used:
For speech: a 3-bit redundancy code, enables detection of most important bits
of speech codec. Only one-error patterns can be detected, two or more errors
can not be detected.
For RACH: 6-bit redundancy code, used for error detection
X6 + X5 + X3 + X2 + X + 1 = (X + 1) (X5 + X2 + 1)
For SCH: 10-bit cyclic redundancy code, used for error detection
X10 + X8 + X6 + X5 + X4 + X2 + 1 = (X4 + X3 + X2 + X + 1) (X3 + X + 1) (X3 + X2 + 1)=
= (X5 + 1) (X7 + 1)
(X +1)(X +1 )
1.6.3.2.6. Decoding
GSM does (like most modern standards) not describe reception, but just transmission.
Only minimum performance criteria are given for receivers. Typically they are fulfilled by
maximum likelihood decoder (Viterbi) using soft decision input from the demodulator.
11/6/2005
U.A.Hermann: GSM
95

1.6.3.2.7 Example TCH/FS transmission mode
Input rate= 13 kbit/sec at full rate, 20 msec blocks with 260 bits.
Some bits are more sensitive to errors and therefore additionally protected:
78 bits unprotected
182 bits : protected by a convolutional block code
50 bits (category 1a) of the 182 are additionally protected by 3 additional redundancy
bits. The remaining 132 bits are category 1b.
Coding:
Category 1a bits are protected by a detection code with polynomial X3 + X + 1. If any

of these bits would be disturbed, only loud noise would be heard instead of speech. So
in case such errors are detected, the receiver speech codec either produces comfort
noise or a repetition of the last block.
Convolutional code: two convolutions without puncturing: D4 + D3 + 1 and
D4 + D3 + D +1, so 185 bits plus 4 tail bits add up to 378 bits. This plus 78 unprotected
bits adds up to 456 bit
11/6/2005
U.A.Hermann: GSM
96

1.6.3.2.7 Example TCH/FS transmission mode (continued)
Interleaving:
Full rate speech blocks are interleaved on 8 bursts: 456 bits of one block are split in 8
groups of 57 bits, each transmitted on a different burst. So each block carries
contributions from 2 successive speech blocks.
So 1 burst contains 116 bits of coded data:
57 bits from block B

1 stealing bit indicating whether this half burst is speech or FACCH
57 bits from block B+1
1 stealing bit indicating whether this half burst is speech or FACCH
11/6/2005
U.A.Hermann: GSM
97

1.6.3.3.
Ciphering
Ciphering is one of the main advantages of digital transmission as compared to

analogue.
In GSM several ciphering algorithms are used with different strengths, depending
on export regulations to particular countries.
All ciphering algorithms must be defined such, that they can be intercepted and
decoded on line by police or other state authorities.
Using a public key algorithm makes the system hard against normal
eavesdropping.
The ciphering itself is very simple: EXOR operation with a pseudo random
sequence and the 114 useful bits of a normal burst (I.e. without stealing flag)
Ciphering is applied to all normal bursts (speech, data , signalling).
Ciphering is only used on the air interface, so it ends in the BTS.
11/6/2005
U.A.Hermann: GSM
98

1.6.3.4.
Modulation
In GSM a GMSK (Gaussian Minimum Shift Key) with BT= 0,3 and a modulation
rate of 270 5/6 kbaud is used.
Demodulation is typically done by a Viterbi or a linear relaxation algorithm.
Formula:
Electrical field generated: E(t) = a(t) cos (0t + (t))
a(t) follows a ramping curve in order to avoid spurious emissions due to sharp
changes between emission and silence. Additionally a(t) is subject to power
Control.
0 is the respective centre frequency.
(t) = 0 + ki (t- iT) with infinite bit stream

ki = 1 if di = di-1,
ki = -1 if di di-1
(xT)= (G(x + ) G(x- ))
11/6/2005
U.A.Hermann: GSM
, di-1 , di, di+1,
99

1.6.3.4.
Modulation (continued)
(t)
/2
T =48 /13
ln(2)
=
=0.441684
2 0.3
x
G ( x) =x
1
e
2
t2
2 2
e
2
t2
2 2
t
-2T
-T
2T
Basically (t) is a smoothed /2 step in order to gain a more narrow spectrum.

GMSK is a compromise between spectrum efficiency (about 1 bit /Hertz) and
demodulation complexity.
The considerable spectral overlap considering the channel separation of 200 kHz
leads to the necessity of frequency planning, in order to separate geographically
Adjacent frequencies.
11/6/2005
U.A.Hermann: GSM
100

1.6.3.4.
Modulation (continued)
Properties of GMSK modulation in case the modulating bits di are constant ( all 0
or 1):
t
(t ) = 0 + (t iT ) = 0 +
2T
i
This is a sine wave of frequency
0 1
f1 =(
+ )
2 4T
Properties of GMSK modulation in case di is alternating ( 0, 1, 0 , 1, 0, ):

t
(t ) = 0 (t iT ) = 0
2T
i
This is a sine wave of frequency
0 1
f1 =(
)
2 4T
11/6/2005
U.A.Hermann: GSM
101

1.6.3.5.
Modulator , Demodulator
Most modulators have been implemented with an intermediate frequency at e.g.

72 MHz.
Demodulator is generally much more complex than modulator, due to

Variable attenuation, e.g. through shadowing
Multipath propagation (receptions of multiple copies of the original signal
shifted in time)
Noise and spurious signals, e.g. from other GSM emitter using the same or an
adjacent channel (= co-channel or adjacent channel interference)
The GSM Standard does not specify which demodulator implementation is to be
used, but requires certain minimum performance constraints. E.g. capability to
cope with two multipaths of equal power received at an interval of up to 16 sec.,
i.e. almost 4 bit periods.
To achieve this an equalizer is needed. Typically Viterbi maximum likelihood
estimation is implemented.
11/6/2005
U.A.Hermann: GSM
102
1.7. Signalling Transfer

Most functions in GSM are involving distant machines, which have to
communicate with each other
This chapter describes how these messages (or signalling information) are
transported from one machine to another.
The next chapter will describe, what these messages do, what they trigger etc.
Message sending is triggered by an event and message reception triggers again
other events.
A typical message consists of:
Message type= indication what reaction the message will trigger
Qualifying information= mandatory or optional parameters.
Tasks of transmission protocols (link layer functions):
Delimitation of bit streams.
Error protection
Organisation of message flows and
their routing.
11/6/2005
U.A.Hermann: GSM
103

1.7.1. Basics
In GSM each segment of the transmission path bears its own protocol. Why so
many different ones, if they all serve the same basic needs ?
Optimisation, especially on the radio path.
Reuse of existing protocols, especially CCITT Signalling System 7.
History: different interfaces were developed by different standardisation
groups
Messages may be exchanged between contiguous entities like:
BTS- BSC, BSC MSC, SIM ME (Mobile Equipment)
Exchange between NSS entities (MSC/VLR, GMSC, HLR/AuC, EIR) are typically
handled over intermediary nodes which are part of the worldwide SS7 network.
Physical lines between all NSS nodes would be excessive, expensive and not
necessary.
11/6/2005
U.A.Hermann: GSM
104

1.7.1. Basics (continued)
Relaying: messages between distant nodes are transported via relay nodes
between distant machines.
Relay nodes :
sometimes adapt messages (format , encoding etc.) to the interface
requirements,
route messages to the correct output directions,
But handle the data in a transparent way. Transparent data or message in
this context means: the relay node does not read or interpret the message (it
does not need to understand it)
Slightly more complex case:
Intermediate node is triggered by the reception of a messages from node A to
transmit a message to node B, containing part of the information carried by the
original message.
This is called Protocol Interworking
11/6/2005
U.A.Hermann: GSM
105

1.7.2. Linking
The 3 different protocols on link level have very similar functionality.
LAPD (= Link Access Protocol for ISDN D channel):
Adapted from ISDN
Between BTS and BSC
LAPDm
GSM specific, optimised for air interface
Between MS- BTS
Using FACCH or SACCH
MTP 2
Level 2 of SS7 protocol
Between BSC-MSC, MSC/VLR/HLR-SS7 network
11/6/2005
U.A.Hermann: GSM
106

1.7.2.1. Structuring in Frames
In signalling the atomic unit is the frame.
In MTP2 and LAPD a frame is (like in HDLC, from which both protocols are
derived) start and end with a flag.
Flag
(frame start)
01111110
Frame Content
Flag
(frame end)
01111110
To prevent false starts and ends, a mechanism (0 bit insertion after 5

consecutive 1) is introduced in order to disguise the flag pattern, if it appears inside
data.
Advantage of flag mechanism: frame content may have different length.
Difference on the air interface: for LAPDm the flag was not needed, as each frame
fits in one physical block of 23 octets length in case of TCH (FCCH signalling).
In case of SACCH, 21 octets are used, as 2 octets are needed for timing advance
and transmission power control)
11/6/2005
U.A.Hermann: GSM
107

1.7.2.1. Structuring in Frames(continued)
The effective information may be smaller, than 23 or 21 octets,
so a length indicator is introduced in each frame
and unused octets are filled with 00101011 (this was chosen in order to
avoid similarity with FCCH).
1.7.2.2. Segmentation and Re-Assembly

The maximum length of frames is generally limited to ease the dimensioning of
buffers in the system.
When the maximum length of a signalling message is exceeding the frame length,
than the message must be segmented and transmitted over several frames.
No segmentation needed on
A interface: maximum length of frames is limited to 272 information octets (plus 6
octets for frame control, excluding flags). So all messages have to fit into this size !
Abis : message limitation to 264 octets (excluding flags), which corresponds to
260 octets of upper layer information.
11/6/2005
U.A.Hermann: GSM
108

1.7.2.2. Segmentation and Re-Assembly (continued)
The maximum frame length at the air interface is too short (21 or 23 octets).
Therefore segmentation and message reassembly is defined for LAPDm.
More bit is signalling that further frames are coming.
Header and trailer of
each link frame
Upper layer message
Segmentation
Fill bits
1
1
time
1
1
Re-assembly
Upper layer message
11/6/2005
U.A.Hermann: GSM
109

1.7.2.3. Error Detection and Correction
Error Detection:
LAPD and MTP2 use the HDLC scheme,
consisting in adding 16 redundancy bits, called Frame Check Sequence (= FCS)
Generator polynomial= x16 + x12 + x5 + 1
LAPDm on the radio path does not need additional error detection, as this already
is part of the physical layer.
Purposes of error detection:
Information on the likelihood of residual errors in a frame, in order to ask for the
repetition of the frame
Link quality monitoring in order to trigger alarms, if certain thresholds are
exceeded.
Link Quality monitoring in SS7 :
SS7 links are always active. Special fill frames are send, if there is no information.
Link is declared out of order, if error rate exceeds e.g. 4* 10-3
11/6/2005
U.A.Hermann: GSM
110

1.7.2.3. Error Detection and Correction (continued)
Link Quality monitoring on the GSM radio path:
SACCH channel is used for quality monitoring.
A counter is incremented and decremented according to the validity of a block.
Link failure is reported, when the counter reaches Zero.
The initial value of the counter RADIO_LINK_TIMEOUT is set by operator.
Frame acknowledge and repetition function:
LAPD, LAPDm and MTP2 use backward error correction as HDLC:
Non-acknowledged mode: frames are transmitted once, whatever the outcome
at the receiver side.
Acknowledged mode, ensuring correction of erroneous frames by repetition.
The non-acknowledged mode is e.g. more adequate for recurrent measurement
messages send by mobiles, as a lost message does not harm and a repetition of an
old measurement value would not render the latest information.
11/6/2005
U.A.Hermann: GSM
111

Acknowledgement and repetition is based on a cyclic frame numbering:
In LAPD and LAPDm the acknowledgment is done by the receiver transmitting
the number of the expected next frame to the sender in the indicator N(R).
In MTP2 the number of the last frame correctly received is transmitted back to the
sender.
In any cases the sender repeats non acknowledged frames.
The total number of repetitions is limited in order to avoid endless loops.
Repetition is triggered by the
sender, if
it receives an acknowledgement for a frame
which is not the last
one send or
when it doesnt receive
an acknowledgement
after a certain time
11/6/2005
Sender
Supervision
timer
0
1
2
Timer
Expiry (1)
Timer
Expiry (2)
Receiver
1
2
U.A.Hermann: GSM
0 acknowledged
1 expected
lost
0 acknowledged
1 expected
2 acknowledged
3 expected
112

Window size (see next figure):
Size K of a sending window = number of frames which can at any given time be sent and not
yet acknowledged.
Window size K must be high enough to allow a sender to transmit messages without waiting
for the acknowledgment delay.
The frames of the sending window have to be stored at sender side till they are acknowledged.
Numbering Cycle
of LAPD and MTP2 = 128
of LAPDm = 8, in order to reduce the size of the frame header.
Window size of LAPDm = 1,
in order to simplify the protocol.
Window size 1 corresponds to a simple send-and-wait protocol.
In case of TCH/8 used for signalling, performance does not suffer from this
simplification, because this channel is of basically alternating nature.
In case of the other channels, transmission of signalling messages will be additionally
delayed when several frames are send in a row, due to window size = 1
11/6/2005
U.A.Hermann: GSM
113
1.7.-1 Window mechanism for acknowledgement

Sender
Receiver
0
7 0
1
Ack.0
7 0
1
1 lost
6
4 3 2
7 0
4 3 2
Frame 2 has been successful1 ly received, but the time window can not be changed, as
4 3 2
frame 1 is still missing.
6 7 0
1
5
When the ack. for frame 2
is received, the send window
is shifted from 1 to 3
7 0
1 Ack.2
4 3 2
4 3 2
Windows (here red figures) represent a sliding set of contiguous frames, which can be either:
sent and not yet acknowledged (sending window) , or
accepted for reception (receiving window) at a given moment
11/6/2005
U.A.Hermann: GSM
114

Acknowledge mode setting procedure:
Initialisation/resetting of context on both
sides of an interface in acknowledged mode.
SABM = Set Asynchronous Balanced Mode
UA = Unnumbered Acknowledge.
SABM
UA
0
1
2
Numbered frame
transmission
In LAPD exchange of upper layer information can only start after such an exchange.
In LAPDm : SABM carries a piggyback message which is repeated in UA answer.
Acknowledge mode release procedure:
Normal release of a link
No piggybacking is allowed
At any time an unacknowledged frame of info.
may be send.
When no frame is pending: fill frames are send
consisting of UI frames (Unnumbered Information)
11/6/2005
U.A.Hermann: GSM
Numbered frame
transmission
DISC
UA
0
115

1.7.2.4. Multiplexing
The link layer offers the possibility of multiplexing independent message flows on the same
channels:
Problem: ordering of frames between them is not guaranteed and
window mechanism applies to each flow in a separate manner.
Solution: each frame contains an address in order to separate the flows.
On LAPD this multiplexing is e.g. used for point-to-multipoint installations.
LAPDm: on the TACHs this multiplexing is provided as well, even so they are only Pointto-Point connections:
On the air interface two independent message flows can exist independently:
Transfer of signalling (SAPI= 0) and SMS (SAPI= 3).
Both are distinguished by SAPI (= Service Access Point Identifier), which are the link
identifiers transmitted in the protocol.
Not all channels are suitable for all combinations of the 2 SAPIs:
TCH/F
TCH/8
SACCH
Signalling (SAPI0)
Ack.mode
Ack. mode
Non-ack.mode
SMS (SAPI3)
Ack.mode
Ack. mode
11/6/2005
U.A.Hermann: GSM
116

1.7.2.4. Multiplexing (continued)
The only case on the air interface, where real independent message flows are transmitted
simultaneously with acknowledgment and repetition (see table): TCH/8
TCH/F was reserved for speech and data connections, no pre-emption for SMS
In consequence transmission of SMS is slow: 80 octets/sec or 600 bit/sec.
Multiplexing on Abis interface:
Additional to the radio signalling
Procedures, the Abis interface also carries
A flow dedicated to the operation and
Maintenance of the BTS
and Layer 2 management flow.
11/6/2005
SAPI Type of flow

0
62
63
U.A.Hermann: GSM
Radio signalling
Operation and maintenance
Layer 2 management
117

1.7.2.5. Flow Control
Processing and buffering capacities of implementations are typically sufficient to cope with
the maximum throughput of a given link.
However in case of resource sharing: the available resources are typically smaller than the
sum of the maximum capacities for each flow.
Flow control has to prevent, that the overall system capacity crashes to 0 due to an overload.
So flow control along the transmission line is need:
stop-and-go control using 2 commands
Provided by LAPD, MTP2 , not LAPDm
11/6/2005
U.A.Hermann: GSM
118

1.7.2.6. Summary: LAPD and LAPDm Frames
Frame Frame Type
Meaning
Role
SABM Unnumbered frames

DISC
UA
DM
UI
Set Asynch.Balanced Mode

Disconnect
Unnumbered Ackn.
Disconnect Mode
Unnumbered Information
1st frame to set-up acknowledged mode
Info. transfer frames
Information
Information Frame (ack.mode)
RR
supervisory frames
Receive Ready
you may go on (flow control)
first frame to release ack. Mode

Ack to e.g. the above 2 frames
Response indicating disconnected mode
Information frame (non-ack.mode)
Also used for acknowledgement
RNR
REJ
FRMR
Receive not ready

Reject
FRaMe Reject
you should stop (flow control)

Negative acknowledgement
Error back-reporting
RNR and FRMR are not used in LAPDm

11/6/2005
U.A.Hermann: GSM
119

1.7.2.6. Summary: LAPD and LAPDm Frames (continued)
TEI = Address for destination Terminal, because LAPD is point to multipoint
N(S) = number of frame (sending side)
N(R) = number of expected frame (receiving side) for numbered information
carrying frames.
LAPD
Start
Flag
SAPI
LAPDm
address
control
N(S)
TEI
11/6/2005
FCS
End
Flag
TEI = Address for destination Terminal
N(R)
Addr. Contr.
SAPI
information
information
N(S) N(R)
U.A.Hermann: GSM
120

1.7.3. Networking
Link protocols described before enable exchange between 2 entities, which are directly,
physically connected.
In many cases however application protocols involve entities, which are not directly
interconnected.
For this purpose different mechanisms are available:
Elementary links: are single links on the route between start and destination of a
message.
An elementary link may be used for a number of different network connections
between potentially different start and end points.
Routing is done by 2 different mechanisms:
Datagram: each message is analysed on its arrival
Virtual Circuit: the route is established by the first message and the following
messages follow the same route.
Multiple parallel connections between the same entities are generally possible.
Tags with addresses are used to discriminate between the different message flows
11/6/2005
U.A.Hermann: GSM
121

1.7.3.1
1.7.3.1.1.
Networking in the BSS

The Mobile Station Point of View
The MS addresses different network entities in its protocols, depending on the application
The addresses are used by the network for routing.
Several parallel user communications may be established at the same time between the MS
and MSC (e.g. indication of incoming call in case a call already is established).
Protocol Discriminator (= PD) is used in GSM to indicate the application protocol and
thereby to address to which destination a message is send on the infrastructure side.
PD
Function
Origin/destination
CC, SS
Call control management and

Supplementary services management
MS from/to MSC (and

HLR)
MM
Location and security management
MS from/to MSC/VLR
RR
Radio resource management
MS from/to BSC
The BTS is not in this table, as it does not terminate MS protocols.

PD is inserted by the originator as part of the application protocol and used by the receiver
(e.g. MSC or MS) to distribute the message to the right SW module.
11/6/2005
U.A.Hermann: GSM
122

1.7.3.1.1.
The Mobile Station Point of View (continued)
Discrimination between CC and SS messages of different user communications:
Done by TI= Transaction Identifier
Each transaction belongs to a communication.
TI is inserted by the originator (MSC or MS)
TI is used by receiver to relate a message to the right context.
1.7.3.1.2. Abis Interface
In principle the BTS can be considered as a remote radio link entity of the BSC.
Many different messages flow over the Abis IF, belonging to
BTS BSC communication,
Communication of MS with BSC, MSC, HLR etc.
Communication with TRXs (Transmitter/Receiver Unit) inside the BTS.

In order to reach different message destinations, each message on the Abis inteface
carries a message discriminator with complementary data. (see next table).
So there are 4 different message groups transmitted via the Abis interface
11/6/2005
U.A.Hermann: GSM
123

1.7.3.1.2. Abis Interface (continued)
Message discriminator +
complementary data
Communication
end nodes
Use
Radio Link Layer Mngmt. +

Channel reference +
Radio link reference
MS- BSC or
beyond
Relay of radio path messages

transparently through the BTS
Dedicated Channel Mngmt. +

Channel reference
BTS- BSC
Interworking for a given TACH
Common Channel Mngmt. +

Channel reference
BTS- BSC
Interworking for a given BCCH

or PAGCH/RACH
TRX management
BTS- BSC
Control of TRX status
The channel reference determines the MS to be addressed and contains additionally the
type of channel (TACH/F, TACH/8, BCCH, etc.) and time slot number.
radio link reference indicates the LAPDm link on which the message is to be send or
received. It discriminates between SAPI 0 and 3 and between TCH and SACCH .
11/6/2005
U.A.Hermann: GSM
124

1.7.3.1.2. Abis Interface (continued)
Messages on the Abis interface, for which the BTS acts as a transparent relay, are put into
an envelope of additional messages.
These messages are of the following types:
From BSC to BTS
From BTS to BSC
Use
ESTABLISH REQUEST ESTABLISH INDICATION

ESTABLISH CONFIRM
link establishment
DATA REQUEST
DATA INDICATION
acknowledged info. transfer
UNIT DATA REQUEST
UNIT DATA INDICATION
Non acknowledged
information transfer
RELEASE REQUEST
RELEASE INDICATION
RELEASE CONFIRM
Link release
ERROR INDICATION
Link error notification
11/6/2005
U.A.Hermann: GSM
125

1.7.3.1.3. A Interface between BSC and MSC
DTAP (Direct Transfer Application Part) = message flow to MSC.
BSSMAP ( BSS Management Part)= message flow to BSC.
SCCP (Signalling Connection Control Part) is an SS7 protocol, used to route messages to
particular MS or to BSC.
DTAP
BSSMAP
Distribution layer
SCCP
BSC
MSC/VLR
MTP 3
MTP 2
MTP 1
11/6/2005
U.A.Hermann: GSM
126

1.7.3.1.3. A Interface between BSC and MSC (continued)
MTP3 features/aspects:
Management of SS7 network ( traffic, channels and routers)
Routing of messages in an SS7 network. In GSM it is only used to route between BSC MSC
Redundancy: a linkset of redundant lines may be established for safety reasons.
Load sharing: between different lines of a linkset.
SCCP features/aspects:
In GSM only 2 out of several classes of services are used:
Basic connectionless mode (class 0):
Related to system management tasks, like reset or overload indication
Connection oriented mode (class 2):
Enables separate independent connections to be set up. This is used on A interface to
distinguish transactions with different MS.
Connection are only set up when needed and released when not needed any longer, e.g.
for handover, call set-up or location update.
BSC and MSC have to store a context per connection in order to be able to map
messages from/to BTS and the right radio channel
from/to MSC using a certain SCCP connection.
11/6/2005
U.A.Hermann: GSM
127

1.7.3.1.3. A Interface between BSC and MSC (continued)
DTAP / BSSMAP Discrimination
The distribution function on top of SCCP adds a small header to the application message
before transferring it to a given SCCP connection.
So all messages on the A interface bear a discrimination flag , indicating whether the message
is a BSSMAP or a DTAP message.
So the BSC acts as a transit node for DTAP messages between MS and MSC.
BSSMAP messages start or terminate in BSC.
1.7.3.1.4. Networking on MAP/E

Inter-MSC handover: if a handover transfers a MS from one MSC1 to a cell of another MSC2,
the original MSC1 stays as the anchor MSC in the connection.
The transport of messages between the 2 MSCs is done via MAP/E, which is part of the MAP.
In this case however the handling is very different, as the relay MSC acts as a transparent
router between MS and anchor MSC.
Only 2 MAP/E messages are needed (see next picture) PROCESS ACCESS SIGNALLING
and FORWARD ACCESS SIGNALLING.
11/6/2005
U.A.Hermann: GSM
128

1.7.3.1.4. Networking on MAP/E (continued)
The information fields of these messages contain the information exchanged between MS and
anchor MSC:
same information as on A interface when transported by a DTAP message or
on Abis when transported as a Radio Link Layer message or
on the radio interface
Message
From MS
PROCESS ACCESS
SIGNALLING
(message from MS)
Anchor
MSC
FORWARD ACCESS
SIGNALLING
(message to MS)
Relay
MSC
BSS
Message
To MS
As the MAP protocol is used, the relay MSC has to use TCAP in order to address the different
MS. Therefore the relay MSC has to maintain a context for each connection with a MS in order
to translate between SCCP references (towards BSC) and TCAP references (to anchor MSC)
11/6/2005
U.A.Hermann: GSM
129

1.7.3.1.5. Summary: Connections in the BSS
Structure of protocol used between MS and Anchor MSC for transport of signalling messages:
Relay
MSC
BSC
MAP/E
BTS
08.58
Mobile
Station
distribution
TCAP
SCCP
SCCP
MTP 3
MTP 3
LAPDm
LAPD
MTP 2
MTP 2
Radio
channels
64 kbit/sec ch.
MTP 1
MTP 1
Radio
interface
11/6/2005
Anchor
MSC
Abis
interface
A
interface
U.A.Hermann: GSM
E
interface
130

1.7.3.1.5. Summary: Connections in the BSS (continued)
The next picture shows the hierarchical organisation of message flows from MS to MSC:
Different links, transactions, connections,
Their identifiers, discriminators, addresses, references,
The hierarchies are shown as nested boxes.
4 different MS are having ongoing calls in parellel in this example.
For MSa all levels of detail are shown for
the 2 different calls in progress: TI= a and b on PD= CC, on SAPI=0
and 1 SMS transaction (TI= a on SAPI=3)
MSa and MSb use the same TRX, but different SCCP connections on the A interface
2 different TRXs are used in the BTS for the different calls.
11/6/2005
U.A.Hermann: GSM
131
1.7.-1 Connection Identifiers in the BTS

MS
BTS
BSC
Relay MSC
Anchor MSC
BSS MAP
PD= RR
PD= MM
TI= a
TI= b
MS a
PD=CC
DLCI: SAPI= 0
Link: SAPI= 0
Link: SAPI= 0
SCCP Ref: R1
TI= a
DLCI: SAPI= 3
DTAP
TCAP reference: T1
SCCP Ref: R2
TCAP reference: T2
Channel Id= N1
SCCP Ref: R3
TCAP reference: T3
Channel Id= N2
TRX: TEI= T2
SCCP Ref: R4
TCAP reference: T4
Link: SAPI= 3
MS b
MS c
MS d
Channel= C1
Channel Id= N1
Channel= C2
Channel Id= N2
Channel= C3
Channel= C4
Radio Interface
11/6/2005
TRX: TEI= T1
Abis Interface
U.A.Hermann: GSM
A Interface
E Interface
132

1.7.3.2. Networking in the NSS
SS7 standards are used .
Routing and addressing schemes are important, as roaming leads to messages exchanged
between
different networks,
operated by different companies,
in different countries.
1.7.3.2.1 The SS7 Network Protocols

2 network levels in SS7:
Lower level to build national networks: based on MTP3
Higher level for interconnecting all national nets to a global net: SCCP
Reason: it is much easier to manage routing tables covering one network (addressing of
entities owned by one company), than many foreign networks.
2 levels of addressing correspond to these 2 network levels:
SPC (= Signalling Point Code) is used in MTP on national level: each message contains
the SPC of the destination.
Global Title= higher addressing scheme for identifying any SS7 point worldwide.
In GSM it is used in SCCP for addressing of MAP messages between NSS entities.
11/6/2005
U.A.Hermann: GSM
133

1.7.3.2.1 The SS7 Network Protocols (continued)
2 different addressing schemes in SCCP:
If bound for a destination in the same national network: MTP addressing information is
sufficient. The SPC is included as the address at the SCCP level.
If bound for a destination in another national network: Global Title must be used:
Global Title may be any number without relation to SS7 (e.g. PSTN number (E.164), data
number (X.121), GSM subscriber number (IMSI, E.212), etc.)
It contains no routing information,
therefore at least at network border SCCP translation to derive the relevant MTP addr.
national network country A
GA
A
Signalling
Point
Signal Transfer
Point (STP)
Gateway SCCP
Function
11/6/2005
international SS7 network
A derives
SPC(GA)
national network country B
GB
Global title (for B)

GA derives
SPC(GA)
U.A.Hermann: GSM
GB derives
SPC(GA)
134

1.7.3.2.1 The SS7 Network Protocols (continued)
In GSM the SCCP address (whether global title or an SPC) includes a sub-address (= subsystem number), which identifies the type of target entity (= HLR, VLR, MSC, or EIR)
Gateway function : to establish the interworking between the two levels.
Gateway is part of the national network and the global SS7 network.
SCCP function in gateway node receives a message bound for an international destination
SCCP function determines from the global title the appropriate international node &
forwards message to this node, using international SPC as the MTP address
This scenario is repeated each time a gateway is passed, till the destination is reached.
SCCP is a datagram networking protocol: each message contains an SCCP address.
SPC addresses consist of :
Geographical zone indicator
Network indicator within the zone
Point indicator within the network.
In NSS the capability of SCCP to manage independent connections (as on A interface) is not
used
11/6/2005
U.A.Hermann: GSM
135

1.7.3.2.2. TCAP
On top of SCCP: MAP uses TCAP (= Transaction Capabilities Application Part)
TCAP is considered as an application protocol not transmission protocol.
TCAP provides means to distinguish different message flows.
TCAP in GSM can be modelled in 2 sublayers:
invoke
return result
Transaction sublayer
component
return error
Component sublayer on top
sub-layer
reject
Transaction sublayer manages transactions (= dialogues)

transaction
end-to-end.
sub-layer
This is an example for virtual machine approach to
Begin, continue,end
distinguish several independent flows in parallel on the
Abort, unit-data
same transmission means:
TCAP adds a transaction indicator to each message
This indicator relates all messages to their contexts.
So MAP does not need to consider how to link different exchanges concerning the same
context (e.g.. handover). This is done by TCAP.
11/6/2005
U.A.Hermann: GSM
136

1.7.3.2.2. TCAP (continued)
Many cases in MAP where important data are only sent once in a dialogue:
This information is than implicit for the rest of the dialogue.
The context is than created by
TCAP primitive: TC-Begin
TC-Continue
TC-End
Correlation of individual commands and responses in a dialogue is managed in Component
sub-layer:
Correlation between a request and answer issued by a MAP entity is not managed by
MAP, but by TCAP.
Consequence: MAP often does not specify a message name as an answer to a request.
This answer is simply contained in the Return Result or Return Error messages
linked by TCAP to the Invoke component containing the initial message.
This linking is done by the transaction indicator contained in each message.
E.g.: Radio Channel Acknowledgement is an answer to PerformHandover message.
Radio Channel Acknowledgement is carried in the Return Result component of the
TCAP PerformHandover operation.
11/6/2005
U.A.Hermann: GSM
137

1.7.3.2.2. TCAP (continued)
Grouping in TCAP:
Several operations belonging to the same dialogue can be grouped inside a TCAP
message.
E.g. result of one operation (e.g. acknowledgment of a subscriber authentication) while
invoking another one (e.g. start of ciphering)
TCAP syntax is ASN.1 (Abstract Syntax Notation 1)
11/6/2005
U.A.Hermann: GSM
138

1.7.3.3. Networking for Supplementary Services (= SS) Management
SS messages are transferred between MS and HLR.
The management of SS is performed by HLR, even though the service is normally fulfilled by
MSC/VLR HLR was chosen as the single point of control to ensure consistency of data
throughout the network.
SS communication between MS and HLR consists of two legs
BSS (carried as stand alone messages or as part of Call Control)
NSS using MTP, SCCP, TCAP
MSC/VLR acts as a relay between MS and HLR: e.g. analysing whether messages from
HLR must be transmitted to the MS or not.
MAP/I (see next picture ) is the application protocol between MS and HLR:
Between MS and MSC : its messages are carried encapsulated either inside CC messages
or inside messages using SS protocol discriminator.
Between MSC and HLR: SS7 stack is used (messages are distinguished from other
messages by message type).
11/6/2005
U.A.Hermann: GSM
139

1.7.3.3. Networking for SS Management
Messages belonging to different MS are distinguished on:
MAP leg: by use of TCAP,
A-Interface: by SCCP connection,
Air interface: by the radio channel.
Several SS management transactions may exist in
parallel. They are distinguished on:
MAP leg: by use of TCAP,
BSS leg: different TIs
MSC/VLR has to translate between both
11/6/2005
U.A.Hermann: GSM
HLR
MSC/VLR
MAP/I
RIL3- CC
.
.
.
.
.
TCAP
SCCP
MTP
140

1.7.3.4. Networking for Point-To-Point SMS
For SMS GSM may interwork with external networks
SMS are transported between MS and SM-SC (=Short Message - Service Centre)
SM-SC:
Not specified in GSM standard,
Possibly even outside a given GSM network.
SM-SC is connected to one or several MSCs, which act as gateways between GSM and
SM-SC, called
SMS-GMSC: in case of mobile terminating SMS
SMS-IWMSC (InterWorking MSC) : in case of mobile originating SMS.
Transportation specification:
Gateway to SM-SC : complete stack is not part of GSM standard.
MS to Gateway is part part of the GSM standard.
SM-TP (Short Message Transport Protocol) between MS and SM-SC is an end-to-end
protocol incl. features of an application protocol (see next picture)
11/6/2005
U.A.Hermann: GSM
141

1.7.-2. Protocol architecture for the transport of short messages in GSM
SM-SC
SM-TP
SM-RP
MAP/H
SM-CP
TCAP
SCCP
MTP
In the next chapters the BSSand the NSS- leg will be analysed.
As mobile originating (= MO) and

MSC/VLR
SMS-gateway
Mobile Terminating (MT) SMS use the
same mechanisms, but in opposite directions, only MO SMS is described.
11/6/2005
U.A.Hermann: GSM
142

1.7.3.4.1 BSS leg
The lower layers for message transfer have been described in chapter about linking:
Radio path: acknowledged-mode SAPI 3 on TCH/8 or SACCH
Relay protocol on Abis interface between BSC and BTS
DTAP on A interface
SM-CP (= Short Message Control Protocol) is a very small and simple protocol:
Command/answer procedure with 3 message types.
No reference to correlate messages, as operation is send and wait.
CP-Data message contains higher level information, like SMS itself, upper layer
acknowledgment or error report.
SMS-gateway
or
CP-Data
[RP-message]
CP-Error
(cause)
11/6/2005
or
CP-ACK
U.A.Hermann: GSM
or
SMS-gateway
143

1.7.3.4.1 BSS leg (continued)
SM-RP (= Short Message Relay Protocol) is managing references and addressing. Three
messages are defined:
RP-Data: carrying the message itself.
RP-ACK: transporting the acknowledgment
RP-Error: error indication.
Messages are correlated to each other by a 1 octet message reference: so it is possible to
send parallel messages on this level.
Addressing:
For MO SMS: in SM-RP RP-Data message the destination address is included.
For MT SMS: in SM-RP RP-Data message the origin address is included.
In each case it is the SM-SC address.
11/6/2005
U.A.Hermann: GSM
144

1.7.3.4.2 NSS leg
Between MSC and GMSC the short messages are transported like signalling messages:
Using SS7 stack supporting MAP (MTP, SCCP, TCAP)
On top of this the MAP/H: providing the same functions as SM-RP in the BSS leg.
The three messages of MAP/H can be directly mapped on SM-RP (see picture).
SMS-gateway
MSC VLR
RP-Data
message ref
Forward Short Message

(TCAP component reference)
Originator
TP-message
sm-RP-OA
sm-RP-UI
RP-ACK
message ref.
Forwarding Acknowledgement
RP-Error
message ref.
Forwarding Error
cause
11/6/2005
error type
U.A.Hermann: GSM
145
1.8. Radio Resource Management

Major difference between a radio mobile telecommunication network and a network
with fixed links:
Management of access resources:
In fixed systems a dedicated communication medium (wire) between
terminal and infrastructure.
In radio systems: communication medium (i.e. radio spectrum) is precious, so
only allocated for a call.
In ISDN e.g. a signalling channel is always ready for use by a terminal. In
GSM however the paging and the random access channels are the only lines
to the infrastructure in idle mode.
Handover:
Problem does not exist in fixed networks.
In radio systems: Complex measurements and decision procedures are required
to keep the quality of communication.
11/6/2005
U.A.Hermann: GSM
146
7 Layers Modell ISO - OSI
11/6/2005
HOST A
HOST B
Application
Application
Presentation
Presentation
Session
Session
Transport
Transport
Network
Network
Data Link
Data Link
Physical
Physical
U.A.Hermann: GSM
147

Basic concept of GSM: Anchor MSC
If a handover transfers a MS from one MSC to another, the original MSC stays in
control of the call.
Big advantage: single point of control for all aspects of the call, like e.g. charging.
Relay MSC: MSC next to BSC (even if there is only 1 MSC active)
Canonical architecture for each call:
Relay-MSC
BSC
MS
MSC VLR
BTS
11/6/2005
Anchor-MSC
MSC VLR
GSM
U.A.Hermann: GSM
Worldwide
telecom net
148

1.8.1. RR Functions
Items for analysis in this chapter:
Requirements of Radio resource Management
Distribution of tasks between involved machines
Properties of the transmission chain between MS and MSC.
Handover: Measurement and HO decision.
Management of transmission power,
Management of timing advance.
Management of the radio channels on the radio interface.
11/6/2005
U.A.Hermann: GSM
149

1.8.1.1. Concept of RR Sessions
For location updating, SMS transfer, SS management: an RR session consists of minimum:
Means to transmit signalling between MS and anchor-MSC.
Incl. a dedicated radio channel.
References to manage the session on the BTS-BSC and BSC-MSC interface.
BSS resources to monitor radio connection and to take handover decisions.
For circuit type user data, additionally
a complete circuit connection between MS and anchor-MSC
additionally to the signalling connection.
SAPI 0
link
MS
LAPD
connection
BTS
Radio Channel
11/6/2005
BSC
Terrestrial Channel TRAU

(16 kbit/sec.)
U.A.Hermann: GSM
SCCP
connection
Relay-MSC
MSC VLR
Terrestrial Channel
(64 kbit/sec.)
150

1.8.1.1. Concept of RR Sessions (continued)
Different characteristics of an RR-session, which may change during a session:
3 different, standard dedicated channels exist: TACH/8, TACH/H and TACH/F.
For data: different transmission modes.
Different ciphering algorithms.
Definition: An RR session is the period of time when a MS is in dedicated mode between 2
periods of idle mode.
An RR session can be used for several calls (so called CM transactions)
Begin and end of CM-transactions relate to usage of transmission, but are independent
of an RR session, which relates to the movement of the MS (handovers).
CM transactions
Anchor MSC
Relay MSC
BSC
BTS
RR-session
RR-connection
Intra-BSC inter-BTS handover or change

of channel on same BTS
11/6/2005
Inter-MSC handover
Inter-BSC handover
U.A.Hermann: GSM
151

1.8.1.1. Concept of RR Sessions (continued)
Context changes:
during an RR session the RR contexts in the MS and the anchor
MSC are permanently kept.
The contexts in the BTS, BSC and relay MSC are erased and
crated new again, each time there is an handover to a
New radio channel inside the same BTS.
A new BTS
New BSC,
New relay-MSC
So the anchor-MSC is the only stable element in the network
during an RR session.
11/6/2005
U.A.Hermann: GSM
152

1.8.1.2. Initialisation
Definition: Access = The transition of a MS from idle mode to dedicated mode.
Access is part of the initialisation process.
Access is the same, regardless, whether it is MO or MT. In MT case first a paging of the MS
by the BSS happens.
1.8.1.2.1. Access
Random Access of a MS:
Only 8 bit message content.
No MS ID in RACCH burst
No reason for access is signalled to BTS.
2 MS might independently send an RACH burst at the same time => BTS may be
unable to decode and answer.
Access of an MS ends with an initial channel assignment (called immediate assignment in
GSM): radio channel is allocated to be used by MS.
Access = initialisation of an RR session.
11/6/2005
U.A.Hermann: GSM
153

1.8.1.2. Initialisation (continued)
1.8.1.2.2 . Paging and Discontinuous Reception
Paging procedure:
Paging is triggered by an incoming call.
MSC/VLR requests BSS to page in certain cells (location area).
MSC provides identity of the subscriber.
BSC is managing the PAGCH: grouping and scheduling the paging messages,
repeating unanswered messages and sending initial assignment messages.
Paging channel may be subdivided into sub-channels :
In order to save battery capacity of MS: only to listen partially to a paging channel, not
all the time.
Trade off: slightly longer response times.
This is called DRX (= Discontinuous Reception), has nothing to do with DTX!
The PAGCH configuration is send on the BCCH (2 parameters):
there may be 4 to 81 sub-channels
The MS knows to which channel to listen, as the channels are by definition
mapped to the last 3 digits of the IMSI.
11/6/2005
U.A.Hermann: GSM
154

1.8.1.3. Transmission Management
In this chapter : details of management of the characteristics of an RR-session.
Characteristics depend on the chosen service:
Decision on characteristics by anchor MSC.
Transitions are coordinated by BSC. (e.g. according to type of data)
BSS manages cipher mode and DTX.
1.8.1.3.1. Transmission Mode Management
The set of possible transmission modes differs depending on the type of channel used on the
radio interface:
TACH/8
TACH/F
TACH/H
Signalling only
Signalling only
Speech
Data 3.6 kbit/s
Data 6 kbit/s
Data 12 kbit/s transparent
Data 12 kbit/s non-transparent
Signalling only
Speech
Data 3.6 kbit/s
Data 6 kbit/s transparent
Data 6 kbit/s non-transparent
11/6/2005
U.A.Hermann: GSM
155

1.8.1.3.1. Transmission Mode Management (continued)
Signalling only mode used for e.g.:
At the beginning of a call,
SMS
Location updating
Setting up of transmission mode:
mode is chosen by MSC depending on end-to-end service.
First the RR-session is established as a signalling only connection. The channel of
this connection is chosen by the BSC, typically an TACH/8
than after the transmission needs are clear, the MSC intervenes and changes the
channel type and transmission mode according to user requirements.
Task distribution between BSC and MSC:
MSC commands to BSS the channel type and transmission mode.
BSC chooses the exact channel and coordinates BTS and MS.
MSC selects the terrestrial circuits : between BSC or TRAU and MSC.
11/6/2005
U.A.Hermann: GSM
156

1.8.1.3.1. Transmission Mode Management (continued)
Procedure for transmission mode management:
Typically the initial TACH/8 channel for signalling has to be changed to the user
required channel (to TACH/F or TACH/H).
This is subsequent assignment: to change a radio channel used by an RR-session
without changing the cell.
mode modification procedure: if the type of channel is OK, but not the transmission
mode.
Handover: above changes may happen in the context of an handover.
Sometimes subsequent assignment is confusingly called intra-cell handover. GSM
convention however is to use the phrase handover in the context of actions due to
quality or load requirements (so the discrimination criteria is why is it done?)
11/6/2005
U.A.Hermann: GSM
157

1.8.1.3.2. Terrestrial Channel Management
BSC: is setting up and controlling terrestrial circuit from BTS to BSC.
Relay-MSC: is allocating terrestrial circuit from BSC or TRAU to Relay-MSC. MSC
signals the channel choice to BSC, so that BSC can set the right connection in its switching
matrix.
Anchor-MSC to Relay-MSC: initiated by Anchor-MSC using ISDN procedures for call
establishment.
TRAU: if the TRAU is on the MSC side of the BSC:
1. MSC chooses a circuit towards TRAU
2. Signalling between BSC and MSC
3. BSC controls set up of circuits between BTS and TRAU.
BSC
BTS
11/6/2005
Relay-MSC
TRAU
U.A.Hermann: GSM
MSC VLR
158

1.8.1.3.3. Cipher Mode Management
Ciphering criteria are determined by the operator (and by export regulations, different
ciphering are used in different countries)
Ciphering is independent from type of transported data.
RR-session is always clear text= unciphered, as the network does not yet know the user
identity.
Transition from clear text to ciphered mode
MSC is deciding:
Provides ciphering parameters (mode and user ciphering key Kc)
Commands change of mode from un-ciphered to ciphered.
BSC coordinates the change:
Synchronisation is important: if one entity would e.g. still send un-ciphered and
the other one expects ciphered data, an unrecoverable loss of connection happens,
BTS and MS are impacted.
11/6/2005
U.A.Hermann: GSM
159

1.8.1.3.4. Discontinuous Transmission (=DTX)
During DTX radio communication is reduced to a minimum in order to reduce radio
interference in the network.
DTX is optional, so it must be managed.
DTX is independently applied for both directions DL and UL.
DTX only in some transmission modes:
Speech and non-transparent data:
Not for transparent data: impossible to assess when a user doesnt need radio connection.
DTX is commanded by the MSC and managed/configured by the BSC.
Operator can/must optimize DTX behaviour by parameters (e.g. not for MS to MS calls due to
double clipping effect).
BTS derives its behaviour dynamically:
From MS (UL)
From TRAU or MSC/IWF in DL.
Change of DTX:
In UL the MSC can at any moment force MS to use or stop DTX.
In DL changes only possible, when transmission mode changes.
11/6/2005
U.A.Hermann: GSM
160
Figure 1.8.-1 Procedure for setting of DTX

Downlink DTX
BSC
DTX
decision
BTS
MS
MSC VLR
DTX settings
TRAU
Uplink DTX
BSC
DTX
settings
BTS
MS
DTX
decision
TRAU
MSC VLR
The basic setting, whether or not DTX is to be used, needs only be notified to
the transmitting end. The receiving unit doesnt need to know beforehand.
11/6/2005
U.A.Hermann: GSM
161

1.8.1.4. Handover Preparation
Handover has 3 phases:
Preparation: important/complex process with heavy impact on QoS & spectral efficiency
Decision:
Execution.
1.8.1.4.1. Handover Purposes

Rescue Handover:
Definition: Call would be lost, if cell is not changed.
So QoS is determining element
Call reestablishment: extreme form of rescue handover, where communication is lost and
MS attempts to recover with the serving cell.
Confinement HO:
Definition: a HO with the objective to minimize the global interference.
From interference point of view there is a best cell, particularly, if power control is used
Traffic HO:
Definition: a HO with the objective to unload an overloaded cell.
Used e.g. in case of a local hot spot cell, e.g. serving a football stadium.
Traffic HO increases interference and contradicts confinement HO!
11/6/2005
U.A.Hermann: GSM
162

1.8.1.4.2. Handover Criteria
Criteria for rescue HO:
Measurements from BTS and MS.
Transmission quality : Bit error Rate (= BER)
Signal level: RxLev.
Propagation delay: timing advance
Criteria for confinement HO:
Theoretically the UL and DL transmission quality between the MS and each neighbouring
cell should be known.
Practically: downlink path loss (RxLev) as measured by the MS is used typically.
Criteria for traffic HO:
MSC and BSC know load information of BTS
MSC dictates number of MS to be handed over.
BSC first selects those which are soon to be handed over to other reasons (e.g. rescue).
The HO algorithms are up to manufacturers and operators. Not specified in the standard.
11/6/2005
U.A.Hermann: GSM
163

1.8.1.4.2. Handover Criteria (continued)
Parameters for the HO decision process:
Static data, like e.g. maximum transmission power of
MS
Serving BTS
BTSs of neighbour cells
Real time measurements performed by MS:
DL transmission quality (raw BER)
DL reception level on current channel.
DL reception level from neighbour cells.
Real time measurements performed by BTS:
UL transmission quality (raw BER)
UL reception level on current channel.
Timing advance.
Traffic considerations, cell capacity and load
11/6/2005
U.A.Hermann: GSM
164

1.8.1.4.3. Measurements
Measurement reporting:
Minimum reporting rate in GSM = once per second.
MS reports for serving cell and up to 6 neighbour cells.
Measurement reporting of MS = 130 bit /s
Reports are carried on SACCH, which has 260 bit/s capacity.
So reporting frequency can be doubled, if no other signalling is ongoing on SACCH.
Even during DTX the measurement reports are transmitted.
Neighbour cells measurements:
Neighbour cell monitoring happens in MS between transmission of UL bursts and
reception of DL bursts.
The length of these measurement periods depends on the channel type. They are shortest
for TACH/F (see figure):
free intervals during which the
MS neither receives nor transmits
Time available for measurements
at MS
11/6/2005
transmit
About About
1 ms 2 ms
receive
U.A.Hermann: GSM
About
6 ms
165

1.8.1.4.3. Measurements (continued)
length of monitoring time:
From end of reception to start of transmission:
26 intervals of (2 BP ), BP (= Burst Period)= 577 s, = timing advance,
these intervals are too short
From end of transmission to start of reception :
24 small intervals of (4 BP + ), and one long interval of (12 BP + ),
This interval is due to the unused slot in the 26 slot cycle.
MS requirement : either switch synthesizer to new monitoring frequency in less than 1 ms or
use 2 frequency synthesizers
BTS requirement: beacon carrier must be transmitted all time on full power, even if no
user data are transmitted! => MS is able to find, synchronise on and measure BCCH carrier of
neighbour cells:
MS receives a list of beacon frequencies to be monitored from BTS.
MS pre-synchronizes on the FCCH and SCH of these beacon frequencies.
GSM requirement for easing HO: MS must constantly be pre-synchronized on all
neighbour BTS.
11/6/2005
U.A.Hermann: GSM
166

Mechanisms of pre-synchronisation:
Once every 26 slot cycles (= every 120 ms) on a TACH/F an idle slot (= long interval =
about 6 ms) gives a time window for the MS to perform neighbour station monitoring
(more often with TACH/8): MS looks for FCCH and subsequent SCH.
FCCH and TACH are sliding against each other, as they have different periods:
FCCH period of BTS= 51* 8 BP
TACH period of MS = 26* 2* 8 BP
So the FCCH cycle is shifted 8 BPs relatively to the TACH/F cycle between 2
successive idle slots.
The typical distance of 2 successive FCCH bursts is 80 BP, max. 88 BP.
A long interval lasts about 12 BP (reception is possible for 9 BPs, rest is used for
frequency stabilisation/setting) 11 successive long intervals (11* 26 slot cycles = about
1.2 s) are sufficient for the MS to find an FCCH on a beacon carrier. After each 26 slot
cycle the idle window of the MS is shifted 1 slot relatively to the 51 slot cycle of the
BTS
U.A.Hermann: GSM
11/6/2005
167

TACH/8 case:
Problem: TACH/8 and FCCH have both 51 * 8 BP cycle time
Phasing between TACH/8 and FACCH can be anything.
Solution: due to the structure of TACH/8, there are big gaps between the reception of
TACH/8 bursts, which may be used by the MS to listen to neighbour stations, so regardless
of the phasing, there will always be moments, when 1 of the FCCH bursts can be listened
to.
BSIC (=Base Station Identity Code):
Problem : it might happen, that a MS receives more than one beacon channel using a
given frequency (e.g. in boundary areas to neighbour countries or in case cell planning is
done with very few frequencies.
Solution: BSIC is transmitted in the SCH as
2
2
1
3 13
a colour code (like the colouring of maps),
so that BTS with same beacon frequency use
2
13 12
different BSICs.
3
11/6/2005
U.A.Hermann: GSM
168

BSIC is used for many cases, when distinction between cells is required:
MS gets from the BTS a list of beacon frequencies to be monitored.
In measurement report MS reports BSIC of the monitored cells.
Screening: network may indicate a subset of BSICs for which no reporting shall be
done, because the cells are blocked for handover.
Prevention of spurious reception of RACH bursts by the BTS: it might happen,
that 2 cells receive the RACH burst of the MS. To prevent this, the RACH burst is
exclusive-or-ed with the BSIC, so only the right cell decodes the burst
successfully.
In idle mode the MS reads the BSIC to make sure, that it is still monitoring the same
cell.
Between operators inside a given country there are no problems of undue overlapping of
beacon frequencies, as they have per definition disjoint frequency allocations.
Between operators of different countries with common borders, a NCC (= National
Colour Code or PLMN colour code) is proposed, which are the first 3 bits of the BSIC
11/6/2005
U.A.Hermann: GSM
169

PLMN permitted indication in the BCCH: a screening indicator telling the MS, for
which cells to report measurement results. It is an 8 bit indicator with one bit for each of
the 8 patterns of NCCs. By this reporting on the cells of a neighbour PLMN can be
blocked.
The measurement period:
Measurements are averaged over a measurement period, as single measurements are of
little value due to noise: raw BER are averaged and logarithm of reception levels.
Measurement period = period of message transmission on SACCH.
Uplink and downlink periods are simultaneous.
Measurement results of MS may be delayed up to half a second due to transmission delay.
In order to report UL and DL measurements synchronously to BSC, BTS buffers its own
measurements.
11/6/2005
U.A.Hermann: GSM
170

Interaction with DTX:
Under DTX, only a minimum of speech blocks are send in order to minimize interference.
In order to have some blocks to perform measurements on, it is required, that 12 bursts are
send in each reporting period:
4 SACCH bursts (forming a coding block)
8 bursts of TCH containing the SID (= SIlence Descriptor) frame in order to refresh
comfort noise.
(on TCH/8 only 8 bursts per measurement period are send DTX is not applicable )
2 sets of measurements are done by MS and BTS on TACH/F:
Full set of all 100 bursts (better due to longer averaging).
Subset of 12 bursts (available in case of DTX ).
For each measurement MS and BTS report whether DTX was used, so that the BSC
can discard the full measurement in this case.
11/6/2005
U.A.Hermann: GSM
171

The PWRC Indication:
Complication:
A frequency hopping TACH may use time slots (not TN= 0) on the beacon frequency
as one of the frequencies of the hopping sequence.
The beacon frequency must be transmitted with constant (full) transmission power.
Result: power control is only applied to a subset of the used bursts. This means
inaccurate reception level measurements.
Solution:
PWRC (PoWeR Control indicator) is send on connection level by the BTS.
Effect: MS discards reception level measurements on beacon frequency,
in case the following conditions are met:
Channel hops on at least 2 different frequencies.
1 of those frequencies = beacon frequency.
DL power control is used.
11/6/2005
U.A.Hermann: GSM
172

1.8.1.5. Power Control and Timing Advance
Power Control and timing advance are strongly interrelated with the RR management
functions.
1.8.1.5.1. Power Control
Objective of Power Control (like DTX) is to decrease interference (and to a smaller degree to
save battery power)
UL and DL power control can be applied independently from each other and for each MS.
UL power control:
Range: 20 30 dB, (depending on MS class)
Step:
2 dB
Minimum: 13 dBm (= 20 mW)
DL power control (manufacturer dependant):
Range: about 30 dB, (manufacturer dependant)
Step:
2 dB
Minimum: 13 dBm (= 20 mW)
Power control= network option, but mandatory for MS !
Power control = managed by BSS
11/6/2005
U.A.Hermann: GSM
173

1.8.1.5.1. Power Control (continued)
Algorithm and functional split of power control:
Manufacturer options: implementation in BTS or BSC.
BSS is in control and computes power levels based on own and MS measurements.
Strategy of control algorithm: minimise power till RxLev and RxQual are just acceptable.
Initial values:
Power level for random access= power for first transmission on dedicated channel= fixed
per cell and communicated to the MS in a cell via BCCH.
If MS max power is below, than MS transmits with full power.
Power control speed:
Max. 2 dB each 60 ms
so a big jump will not be completed before the next command arrives.
11/6/2005
U.A.Hermann: GSM
174

1.8.1.5.1. Power Control (continued)
Procedures:
MS transmits measurement results to BSC, maybe with pre-processing in BTS.
BSC commands transmission power to MS and BTS.
BSC indicates to MS power level for initial assignment and channel transition .
BSC indicates to BTS the initial power level when channel connection is initialised.
BSC
change of values
BSC
initial
values
BTS
BTS
measurements
11/6/2005
U.A.Hermann: GSM
MS
175

1.8.1.5.2. Timing Advance (= TA)
The Problem:
TDMA scheme of GSM does have very small guard bands (in time domain) between
subsequent bursts received by BTS.
Far away MS would therefore transmit into the subsequent reception time slot.
Solution: MS advances its transmission time (which at the first instance was derived from its
reception of RACCH bursts), by a time as commanded by BSS.
After dedicated connection has been established: BTS measures time offset of received bursts
and feeds TA via SACCH back to MS.
TA varies from 0 to 233 s, corresponding to max. 35 km cell radius, coding 0 63
Guard time for access bursts limits delay to 220 s.
Guard time between Tx and Rx for implementation of MS with only 1 synthesizer is limited
Extended Cells (coastal areas)= more than 580 s guard time by only using channels with even
TN. TN= 0 must be used for BCCH !
11/6/2005
U.A.Hermann: GSM
176

1.8.1.5.2. Timing Advance (= TA)
Different cases, depending on whether MS and BTS know the new TA up front:
1. MS and BSS know TA up front:
Happens e.g. at subsequent assignment.
MS just uses the old TA value.
BTS receives old TA value as the new one from BSC (BTS does not know, that
the old and new connection are to the same MS!)
2. Only MS, not BSS can assess new TA beforehand:
Happens if HO is done between synchronized BTSs.
MS measures difference between arrival times of bursts from the two BTS (part
of pre-synchronisation).
n
BTS 1
Tx BTS2
Tx BTS1
prop2
prop1
11/6/2005
BTS 2
prop1
prop2
= time difference
as measured by MS
= time offset
between 2 BTS
U.A.Hermann: GSM
177

1.8.1.5.2. Timing Advance (= TA) (continued)
3.
Arrival time offset at MS = transmission time offset between the two BTS ( propagation time 1 propagation time 2 ) (see green area in picture before)
Transmission time offset between 2 BTS = 0 by definition for synchronised BTSs
So MS can compute the new TA2 = TA1 2( prop1 prop2)
BTS cannot do this calculation: it does not know (prop1 prop2) .
so MS starts transmitting with TA= 0 before switching to normal transmission
with TA2. This enables BTS to assess the propagation times.
Neither MS nor BSS can calculate TA beforehand:
Happens at HO or initial assignment (= IA) between 2 non-synchronised cells.
So in both cases ( HO & IA) MS is not allowed to send normal bursts

immediately as in synchronised case. MS must first go through random access
sequence in order to allow BTS to calculate and signal TA.
So MS sends RACH burst with TA=0. BSS measures T (= 2 * prop.time)
Disadvantage: this procedure lengthens the HO process and the communication

interruption.
11/6/2005
U.A.Hermann: GSM
178

1.8.1.6. Radio Channel Management
Two aspects of managing the set of channels in a given cell:
Long term: determining and configuring the channel set up part of cell planning.
Short term: dedicated channel allocation management part of the dynamic control
processes.
Task allocation:
MSC just indicates channel type
BSC controls radio channel management
BTS executes commands of BSC
1.8.1.6.1. Cell Channel Configuration
Traffic management mechanisms allow operators to change channel configurations without

disturbing ongoing traffic.
Configuration of access channels:
Depending on the radio spectrum allocated to a cell, capacity requirements for access
channels vary (RACH, PAGCH)
11/6/2005
U.A.Hermann: GSM
179

1.8.1.6.1. Cell Channel Configuration (continued)
5 different access channel configurations:
The MSs are distributed

on the up to 4 different
carriers in 4 different
groups depending on
the channel structure
(see column 2).
MS finds this info on

the BCCH
CCCH
capacity
Number of
MS groups
RACH burst PAGCH message

Rate (bursts per rate
second)
(messages per second)
1/2 4 TACH/8 usable 1
114.7
12.7
216.7
38.2
433.4
76.5
650
114.7
866.7
152.9
(equiv. in TACH/F)
(other half only for
This access channel structure may change in time, problem : MSs listening to a given
channel
11/6/2005
U.A.Hermann: GSM
180

Organisation of PAGCH
PAGCH is organised in 2 parts on a CCCH:
Several paging sub-channels, each one allocated to a certain sub-population of MS.

Initial Assignment messages can be send as well on these sub-channels.
Possible sub-channel reserved exclusively for assignment messages.
PAGCH configuration is broadcast on BCCH to MS. So they know where to listen for calls.
PAGCH configuration may change dynamically, without MS to loose calls.
Traffic Channel configuration
Set of traffic channels may be changed dynamically in order to meet traffic demand.
E.g. one TACH/F may be changed to 8 TACH/8.
This is controlled by O&M or under BSC control.
Choice is open for manufacturer or/and operator
11/6/2005
U.A.Hermann: GSM
181

Changes in the Frequency Configuration
Frequencies allocated to a cell may change dynamically in time frequency redefinition

procedure
Changes in frequency allocation are even possible for FH. Specific mechanisms have been
developed:
Precisely synchronised change of frequency parameters to MS and BTS for all

connections
Precisely timed channel assignment: initial assignment or subsequent assignment for

HO.
MS view of frequency change: just a normal channel change.
BSS view: several MS and BTS have to be closely synchronised:
1. OSS informs BSC about required modification of frequency organisation.
2. BSC determines time for transition instant and makes sure all affected MS have time
to receive the related command.
In case of allocation of channels before the actual transition: MS are informed to
perform transition at the commanded time.
11/6/2005
U.A.Hermann: GSM
182

1.8.1.6.2. Dedicated Channel Allocation
Infrastructure chooses a given radio channel out of a pool of idle channels in 3 different
cases:
Initial assignment: MS is in idle mode and e.g. user wants a call or location update
happens.
Subsequent assignment: when a different channel is required due to change of

communication needs, e.g. from TACH/8 to TACH/F.
Handover.
Allocation Strategies
MS view is simple: channel assignments are just orders to start transmission & reception.
BSS view: first choice of channel by BSC, than transition.
Optimised algorithms for allocation:
E.g. whilst the telephone is ringing, a TACH/8 is sufficient, TACH/F can be allocated
when call is put through. So several strategies are possible
Very early assignment (VEA): allocate TACH/F at initial assignment, if usage of this
channel is probable.
11/6/2005
U.A.Hermann: GSM
183

1.8.1.6.2. Dedicated Channel Allocation
Early assignment (EA): allocate TACH/8 first, than TACH/F as soon as need for this
channel is clear.
Off Air Call Set Up (OACSU): TACH/8, till called party answers call, than switch to
TACH/F. Disadvantage: lower user comfort as time without contact is noticeable.
Trade offs:
VEA is fastest due to

highest bandwidth
OACSU is most economic

spectrum utilisation.
VEA is overkill for

location update.
TACH/F
TACH/8
TACH/F
TACH/8
Access
request
TACH/F
Full Call
information
Time
Called party
answers
Measures in case of overload:
Queuing (user gets voice message from operator)
Rejection (occupied tone).
11/6/2005
U.A.Hermann: GSM
184

1.8.1.6.2. Dedicated Channel Allocation (continued)
Queuing
Queuing strategies are left open to manufacturer and operator. GSM standard just
provides means (e.g. indications to be exchanged between entities).
Queuing depends on the conditions in which its is applied:
At initial assignment (IA) : queuing is not applicable, as there is a repetition
algorithm in IA, so a not answered request would be repeated.
Subsequent assignment:
Disadvantage: user perceives delay in call set up.
Advantage: user would otherwise be rejected.
Handover: complicated strategy, as in case of e.g. rescue HO, queuing might
lead to a connection break down.
Forceful termination of calls: pre-emption
11/6/2005
U.A.Hermann: GSM
185

Interference based channel allocation
BTS measures UL interference of idle channels noise level is known by BSS

BSS selects best channels first for allocation in order to minimise
interference.
Congestion due to interference:
Problem: traffic in one cell is interference in neighbour cell.
In case all channels in one cell are occupied, many channels in neighbour
cell might be unusable due to interference
So BSC must not take additional channels into usage, when allowed
interference level is reached.
This mechanism is used as dynamic channel allocation: one cell has more
channels than meaningful in terms of frequency planning, so that high
interference with neighbour cells is possible. That means in case of overload,
that this cell is stealing frequencies from neighbour cells.
11/6/2005
U.A.Hermann: GSM
186

Radio Channel Description
For frequency hopping the BSS needs to tell the MS which hopping sequence to use.
Problem: with 124 frequencies in GSM and 374 in DCS, there are almost an infinite
number of possible frequency combinations. Encoding of all these possible frequencies
would consume too many bits on the air interface.
Solution:
MAIO (= Mobile Allocation Index Offset) describes the starting point for the hopping
recurring function.
HSN (= Hopping sequence Number), 64 bit, describes which of a predefined set of

hopping frequencies to use.
Cell allocation: two step mechanism:
16 octets in GSM 900 transmitted on BCCH indicate which frequencies are used
in the respective cell.
When BSC sends a channel allocation message to a MS, only a subset of these
frequencies is allocated for FH (coded with 64 bit for 64 frequencies)
11/6/2005
U.A.Hermann: GSM
187

1.8.2. Architecture and Protocols
The BTS is the main performer of radio transmission. Its radio resource
functions are mainly controlled by the BSC.
The anchor MSC
decides, which properties of the transmission chain are to be used to fulfil a
given service.
performs subsequent inter-MSC handovers.
The relay MSC :
is in charge of subsequent inter-BSC handovers and
the circuits between itself and its BSC.
For all other functions the Relay MSC just is relaying messages.
11/6/2005
U.A.Hermann: GSM
188

1.8.2. Architecture and Protocols (continued)
Special aspects of handover:
Information needed for handover decision come from:
BTS: measurement values (as reported from MS and own measurements).
BSC: frequency planning and cell layout data.
BSC and MSC: traffic information
Basic split of tasks for HO decision:
BSS is managing radio resources and deciding to perform handover on a given
RR session.
MSC may however intervene on this HO decision based on radio criteria, if
there are traffic criteria.
11/6/2005
U.A.Hermann: GSM
189

Procedure:
BSC decision: outgoing (inter-BSC) HO is necessary.
BSC indicates several potential target cells to Relay-MSC (maybe managed by
different BSCs and MSCs)
Rescue HO: indicate several potential target cells, Confinement HO only 1
In case of several targets, the Relay-MSC may try one after the other or decide
based on its own traffic data.
For a cell controlled by another MSC: only 1 target cell at a time is proposed by
the old Relay-MSC to the Anchor-MSC.
Traffic HO:
MSC may force a BSC to handover a portion of its traffic to another cell.
BSC than selects the connections to be handed over and the target cell
(candidate enquiry procedure)
So in GSM there is a basic conflict between confinement and traffic criteria for HO
decision, as the related data are under control of different nodes.
11/6/2005
U.A.Hermann: GSM
190

Functional split inside the BSS. Two basic concepts:
Central processing of all handover relevant data in the BSC:
Advantage: Speed of HO decision, single point of control
Disadvantage: High processing load in BSC, high signalling load on Abis.
Pre-processing in the BTS:
Advantage: distribution of processing load, lower signalling load on Abis.
Disadvantage: complex, distributed algorithms for HO control
Solution: BTS/BSC split of HO architecture is not specified by GSM, but up to
the manufacturers. The GSM standard just foresees the mechanisms for both
solutions.
Protocols (see next picture):
BSC-BTS protocol: BSC configures the transmission path and BTS reports
measurements to the BSC. (specified in GSM Rec. 08.58 and therefore called
08.58 protocol or RSM (Radio Subsystem Management)
11/6/2005
U.A.Hermann: GSM
191

Protocol from BSC to Relay-MSC:
Is called BSSMAP (= BSS Management Application Part)
Used to carry requests for initial connection establishment and
any change in connection attributes as commanded by higher layers.
HO handling between Relay-MSC and BSC
Protocol between 2 adjacent MSCs: is part of MAP and called MAP/E
Relay-MSC
BTS
MS
RIL3-RR
BSC
RSM
Anchor-MSC
MSC VLR
BSSMAP
MSC VLR
MAP/E
TCAP
LAPDm
11/6/2005
SCCP
MTP
LAPD
U.A.Hermann: GSM
SCCP
MTP
192

1.8.3. RR Procedures
In this chapter temporal procedures and the dynamic processes between the different tasks
needed for RR management are described.
Following procedures will be analysed:
Creating an RR session.
Paging procedure
RR session, e.g. changing channel characteristics (type of channel, ciphering mode)
Handover execution, incl. call reestablishment.
Release procedure.
Handling of signal measurements,
Timing advance,
Power control
Frequency redefinition.
Broadcast on BCCH
Abnormal cases, like e.g. failures and collisions of events can not be dealt with here, even so
they typically consumed a large portion of the R&D effort.
11/6/2005
U.A.Hermann: GSM
193

1.8.3. RR Procedures
1.8.3.1. Initial Procedures: Access and initial assignment
Purpose of initial Procedures: transition of MS from idle to dedicated mode.
Initial assignment is always triggered by request from MS for 1 out of 3 reasons:
Location updating
Answering of paging
Reaction on user request (e.g. outgoing call, SS or SMS)
Access procedure is always the same:
MS -> BSS: RIL3-RR channel request message send on RACH
BSS -> MS: RIL3-RR immediate assignment (extended) message on PAGCH with
the channel allocated to the MS.
MS -> BSS: MS establishes the link layer for the signalling transfer on the newly
allocated channel. MS sends initial message with subscribers identity and reason
connection request.
11/6/2005
U.A.Hermann: GSM
194

1.8.3.1.1 Random Access
Problem : Access of MSs can not be scheduled random collisions of access bursts happen.
In case of collisions only some or none of the random access bursts might be possible to be
decoded correctly by BSS.
Collisions increase with traffic .
GSM uses slotted Aloha.
Access repetition in case of collisions is random and managed by BSS (transmitted on BCCH)
Tx-integer: random scheduling of each attempt over 3 to 50 slots.
Max retrans: up to 1, 2, 4 or 7 repetitions are allowed
Trade of between resistance to overload and QoS! This method is only for short peaks.
Overload control: all resources must fit to each other, e.g. RACH, PAGCH,TACH capacity.
Overload should cut traffic at the source, e.g. prevent RACH in case all TACHs are loaded.
RIL3-RR immediate assignment reject message prevents MS from access attempts
Blocking access for a class of MS: by mobile operators, the SIM cards distributed to
normal subscribers contain randomly chosen a class (1 out of ten). In case of overload
complete classes are rotationally blocked for a certain time (controlled by BSC).
11/6/2005
U.A.Hermann: GSM
195

1.8.3.1.1 Random Access (continued)
Additionally the following VIP classes are defined:
The corresponding users belong to one of the
special
classes 110 additionally and may access
access class
if one of their classes is allowed.
11
Emergency calls are treated separately, so that
they pass, even if the class is barred.
Neighbouring Cells: in case a MS is rejected in
one cell it may retry in the next (second best )
cell. Disadvantage: increase of interference.
Subscriber category
Left open to PLMN operator
12
Security services
13
Public utilities
14
Emergency services
15
PLMN staff
The BSS may as well forbid MS to retry in neighbour cells.

In case MS has repeated its channel request, BSS can not recognise this repetition, so
multiple channels are allocated to the MS. MS will take the first allocation, the other ones
remain idle for some seconds, till they are cleared by the BSS.
11/6/2005
U.A.Hermann: GSM
196

1.8.3.1.2 The contents of the RIL3-RR channel request message
Only 8 bits useful signalling information in the channel request message:
3 bit establishment cause:
answer to paging,
emergency call
Call re-establishment
User request
5 bit random discriminator.
The random discriminator is used by the BSS to discriminate 2 different MS
transmitting RACH messages at the same time.
11/6/2005
U.A.Hermann: GSM
197

1.8.3.1.3 The initial channel assignment
MS
Channel Request
Channel Required
BTS
frame number
delay
BSC
Channel Activation
Immediate Assignment
(or immediate assignment extended)
frame number
delay
Channel required message: contains estimation of transmission delay (for timing advance)
Timing advance is based on the delay estimation, the BSC indicates back to BTS (BTS can not
correlate the assignment of the BSC with the original request of the mobile).
Immediate assignment to MS via PAGCH contains:
Description of allocated channel.
Initial timing advance to be used by MS.
Initial maximum transmission power of MS.
Reference, so that MS can see whether the response of the BSS is the answer to its request:
Exact content of original channel request message + TDMA frame number
In order to get this message, MS must continuously decode all PAGCH messages in real time!
11/6/2005
U.A.Hermann: GSM
198

1.8.3.1.4 The initial message
After reception of initial assignment the addressed MS:
Modifies frequency and time characteristics to adapt to the assigned channel.
Transmission power level is adjusted.
Transmission starts with prescribed TA.
Than the new channel is ready for usage:
MS sends a link layer SABM frame for SAPI=0. The frame is for establishment of link
layer connection in acknowledged mode.
Problem: it might still be that
2 MS did an RACH at the same time,
with the same channel request message (same random number),
one was correctly decoded and answered by the BTS.
So both MS believe they got the same channel assigned!
Solution:SABM-UA contains unequivocal information identifying the MS.
If a MS receives UA with difference from the content of the SABM it send,
it has to leave the channel and start all over again (see next picture)
11/6/2005
U.A.Hermann: GSM
199

1.8.3.1.4 The initial message (continued)
MS1
MS2
SABM I1
I1
I2
SABM I2
UA
BTS
I1
MS2 leaves
= MS1 leaves
There are 4 initial messages depending on the reason why the access was triggered:
All contain the MS classmark: indicating key features of the MS, like max.
transmission power.
11/6/2005
U.A.Hermann: GSM
200

1.8.3.1.4 The initial message (continued)
Reason for access
Initial message
Response to paging
RIL3-RR paging response
Normal location updating,

Periodic location updating
IMSI attach
RIL3-MM IMSI detach
IMSI detach
RIL3-MM IMSI detach
All other cases (call set-up, short message transmission,
RIL3-MM CM service
request
supplementary service management, )
After initial message has been exchanged between BTS and MS (see previous picture):
BSC is informed in an RSM establish indication message.
MS classmark is stored in the BSS
BSC sets SCCP connection towards MSC: SCCP connection request
The initial message to MSC is carried in a BSSMAP complete layer 3 information
message, allowing MSC to trigger all necessary steps in upper layers.
With the establishment of the SCCP connection the MSC takes control
11/6/2005
U.A.Hermann: GSM
201

1.8.3.1.5 The Mobile Station Classmark
MS classmark contains information about MS capabilities.
A subscriber may at any time put the SIM into another mobile. Therefore the classmark has to
be signalled at the beginning of each new connection.
Parameters contained in classmark:
Revision level,
RF power capability
Encryption algorithm
Frequency capability
Short message capability
Class
GSM900
DCS1800
20 W
1W
8W
0,25 W
5W
2W
0,8 W
Revision level:
Upward compatibility handling for different revisions of the GSM Standard.
RF power capability:
Also called transmission power class: max. transmit power of MS.
GSM: Class 1 was probably never developed, class 4 is for most handhelds.
11/6/2005
U.A.Hermann: GSM
202

1.8.3.1.5 The Mobile Station Classmark (continued)
Encryption algorithm:
Indicates which ciphering algorithm is implemented
Ciphering is subject to strict export regulations.
Frequency capabilities:
GSM extension band;
SMS capabilities:
Little use, as all MS today are able to handle SMS.
RIL3-RR classmark change message: allows to change classmark during a RR session, e.g.
vehicle mounted MS with antenna amplifier is dismounted during a call.
11/6/2005
U.A.Hermann: GSM
203

1.8.3.2. Paging Procedures
Paging sequence:
Incoming call from the network side to the GMSC.
GMSC routes call to the MSC controlling a given location area (= LA) where the
subscriber is expected to be.
A LA may consist of 1 or more cells distributed between 1 or more BSC.
MSC sends BSSMAP Paging message to all BSCs of the respective LA.
Message contains:
Temporary IMSI (= International Mobil Subscriber Identity) or
IMSI (need for paging sub-channel in case of discontinuous reception).
List of cells for paging.
BSC sends Paging Command to the BTSs. This contains the paging sub-channel.
Paging repetition:
Paging repetition algorithm is up to manufacturer and operator.
Problem: BTS and BSC are best suited for managing repetitions as they manage the
physical resources (I.e. the PAGCH), but they cannot relate an answer of a MS to a paging.
The MSC can do this.
Solution: Stepwise repetition: BTS repeats e.g. 3 times automatically, than MSC
11/6/2005
U.A.Hermann: GSM
204

1.8.3.2. Paging Procedures (continued)
Page Mode:
PAGCH configuration may change at any time due changed traffic conditions.
Change may happen automatically as commanded by BSC or by the operator via OSS.
PAGCH configuration must be known to the mobiles BSC must first inform the
mobiles via broadcast, than wait some seconds and than change the PAGCH.
Page mode indicates to MS where they can find their pagings:
Normal page mode: pagings are only send on the sub-channel as defined by the
PAGCH configuration and the IMSI.
Full page mode: designed for dynamic change of PAGCH configuration. Indicates that
a page may not only come on the given sub-channel, but anywhere on the PAGCH of the
same timeslot!
next-but-one page mode: for sophisticated scheduling algorithms. The pagings for the
mobiles of the sub-channel n are additionally transmitted on sub-channel n+2. Useful in
case of temporary overload of a sub-channel or in case of a block has to be freed for
transmitting initial assignment messages.
11/6/2005
U.A.Hermann: GSM
205

1.8.3.3. Procedures for transmission mode + cipher mode management
The amount of different transmission modes expands as the GSM standard is enhanced with
new features (see table in 1.8.1.3.1.)
Another property of the transmission chain is the cipher mode.
At initial assignment the BSC selects the the transmission mode (TACH/8 or TACH/F) for
signalling.
Afterwards the transmission mode is changed according to the communication needs. This can
change during a communication as e.g. additional data channels are opened.
Transmission mode is changed by the assignment procedure.
MSC/VLR BSC: BSSMAP assignment request message containing the transmission
characteristics as commanded by MSC.
BSC MSC/VLR: BSSMAP assignment complete message acknowledgment after
successful change or in negative case BSSMAP assignment failure or BSSMAP queuing
indication in case BSC can not immediately follow the command.
11/6/2005
U.A.Hermann: GSM
206

1.8.3.3. Procedures for transmission mode + cipher mode management
(continued)
After receiving the BSSMAP assignment request message 3 different actions are possible
in the BSC:
1.
2.
3.
If both modes are the same: BSC sends back to MSC BSSMAP assignment complete
message without further action.
If both modes differ by type of information to be transmitted, but use the same type of
channel: BSC performs mode modify before acknowledging MSC request
If new mode requires a channel of different type from the one in use: BSC performs a
subsequent assignment procedure (= transfer of connection to a channel of the
required type) before acknowledgment.
The cases 2. and 3. are described in the next chapters.
11/6/2005
U.A.Hermann: GSM
207

1.8.3.3.1. The Mode Modify Procedure
Mode modify procedure consists of 2 parts:

1. Configuration of the transmission devices on infrastructure side (BTS, TRAU, BSC)
2. Configuration of MS.
No synchronisation means between these 2 parts are available short period of

inconsistent configuration.
BSC triggers reconfiguration of BTS and TRAU by RSM mode modify request to BTS:
BTS modifies its coding and decoding
BTS changes in-band information in the BTS-TRAU frames
TRAU reacts by modifying its data processing.
If new mode is speech, than synchronisation between TRAU and BTS is needed.
When chain is ready BTS answers the BSC by sending RSM mode modify
acknowledge
BSC triggers in parallel MS by RIL3-RR channel mode modify message:
Containing the new mode to be applied.
MS executes change and responds RIL3-RR channel mode modify acknowledge to

BSC via BTS
BSC alters the circuits between BTS and MSC, if needed. Additionally the connection to
different circuits in the TRAU is switched if necessary.
11/6/2005
U.A.Hermann: GSM
208
1.8.-1 The mode modify procedure

TRAU
MS
BSC
BTS
Mode modify request

m1 > m2
BTS / TRAU
configuration
m1 > m2
Mode modify acknowledge

channel mode modify
m1 > m2
channel mode modify acknowledge

m1 > m2 change of configuration from mode 1 to mode 2
MS
configuration
in-band control
BSC is in charge of configuring BTS / TRAU and MS. Order of configuration steps is up
to manufacturer. TRAU is configured through in-band signalling from BTS
11/6/2005
U.A.Hermann: GSM
209

1.8.3.3.2. The Subsequent Assignment Procedure
Subsequent assignment is necessary, if additionally to the mode modify another radio

channel is required (see figure 1.8.-2).
The whole operation is centrally controlled by BSC and similar to a HO. (note: the radio
transmission devices inside a BTS are independent and do not need to communicate!)
1st step of channel transfer: setting a new path in the infrastructure consist of
Allocation of new radio channel.
Activation of corresponding BTS device.
Allocation of TRAU if needed.
Switching to connect all terrestrial segments.

Activation of BTS is started by BSC with RSM channel activation message, containing:
Specification of the required transmission mode,
required cipher mode,
downlink DTX mode,
uplink DTX mode.

After reception of this message BTS starts:
in-band signalling with TRAU, to set basic transmission mode and DTX mode,
so synchronisation between BTS and TRAU starts.

11/6/2005
U.A.Hermann: GSM
210
1.8.-2 Activation of a new channel in the BTS

TRAU
MS
BSC
BTS
channel activation
Ch.
Ch.
channel activation acknowledge
Old
channel
assignment command
Error indication
Ch.
new
channel
assignment complete
Ch. Configuration of the equipment for the new channel
MS
configuration
in-band control
After activation handshake on Abis, BSC orders MS to change channel by RIL3-RR assignment
command message, which is is acknowledged by the MS on the new channel
11/6/2005
U.A.Hermann: GSM
211

1.8.3.3.2. The Subsequent Assignment Procedure (continued)
After BTS/TRAU are activated (i.e. BSC has received RSM channel activation ackn.)
BSC orders MS to perform transfer of channel by RIL3-RR assignment command.
Previous path is not yet released, so MS can fall back in case of problems by using
link establishment procedure on the old channel. So all old contexts would be reset.
MS after reception of RIL3-RR assignment command :
In case of timed assignment MS stays on the old channel till instant of change as
indicated by infrastructure,
else MS transfers immediately to new channel after RIL3-RR assignment command

even without acknowledging the corresponding frame on layer 2 on the old channel.
BTS, due to this lack of acknowledgment :
Repeats message on old channel, till it decides that a link failure has happened,
than BTS informs BSC about this, but BSC does not react, because it knows reason.
Problem: in both cases (successful or return to old channel) the interruption of the linklayer may result in leaving a message sent by MS in non-acknowledged state:
Solution: after the new link is established, MS sends an RIL3-RR assignment

complete message to BSC before any other message (or RIL3-RR assignment failure in
case of return to old channel). Than all messages waiting for transmission can be sent
(non-acknowledged ones and the ones arisen under the procedure)
11/6/2005
U.A.Hermann: GSM
212

1.8.3.3.2. The Subsequent Assignment Procedure (continued)
Problem of message duplication:
Message sent by MS before link interruption cannot be lost but may be duplicated.
In case of upper layer messages (MM or CC) duplication might be harmful.
So suppression of duplicated messages is done in the anchor MSC,
using the 1 bit sequence number (called N(SD) in the GSM Standard).
When 2 successive messages are received, the second one is discarded (done on RR
level).
This is performed in anchor MSC, as this is the only one stable during the
transmission.
11/6/2005
U.A.Hermann: GSM
213

1.8.3.3.3. The Change of Cipher Mode
During an RR-session the cipher mode may change on the air interface.
Problem: ciphering is applied to all transmitted information: signalling and data !
Change of ciphering is a signalling break with the possibility of message loss.
Solution: it would have been to complicated to require the BTS to decode with and without
ciphering at the same time. So a stepwise mechanism was developed:
Step 1: BTS transmits according to old mode and receives according to new mode.
Step 2: MS is fully in new mode (Rx and Tx)
Step 3: BTS is fully in new mode (Rx and Tx)
Critical period with loss for message loss is split in 2, however in no case a single message
loss can jeopardise the whole connection (see next picture):
From step 1 to 2: BTS to MS transmission works correctly: so a DL message

triggering step 2 can be repeated by infrastructure if necessary.
From step 2 to 3 : MS to BTS transmission is correct: so MS can retransmit the UL

acknowledgement message required after step 2 (is required for step 3).
Cipher mode change relies on link layer mechanism: repetition of messages after a given
time out period, if no acknowledgment from the other side was received.
11/6/2005
U.A.Hermann: GSM
214
1.8.-3 Cipher mode change: the 3 steps
BTS
MS
1
(Non ciphered)
(Non ciphered, repeated)
2
MS deciphers the
received flow and
ciphers for sending
BTS deciphers
the received flow
but sends in clear
(ciphered)
(ciphered, repeated)
(ciphered)
(ciphered, repeated)
Short interruption of signalling link
BTS deciphers the

received flow and
ciphers for sending
In order to avoid a break down of the signalling link due to a message loss during the critical
phase of cipher mode change, the procedure is cut in 3 steps
11/6/2005
U.A.Hermann: GSM
215

1.8.3.3.3. The Change of Cipher Mode (continued)
Command sequence for cipher mode setting (see picture below):
MSC decides on ciphering, than
BSC transmits an order to BTS, than
BTS manages this procedure,

because it is doing the ciphering and because the correct sequence is crucial.
MS
BTS
RIL3-RR ciphering
mode command
BSC
MSC VLR
1
RSM Encryption command
BSSMAP cipher mode command
(data indication)
RIL3-RR Ciphering
mode complete
Cipher mode complete
After reception of RIL3-RR ciphering mode complete the BTS fully switches to the
new mode
11/6/2005
U.A.Hermann: GSM
216

1.8.3.3.4. Discontinuous Transmission Modes
Generally a receiver does not need to know beforehand whether DTX is applied or not
no procedure exists to inform the receiver in MS or TRAU beforehand.
Downlink DTX:
is ordered by MSC to the BSC for each connection individually.
BSC configures BTS,
BTS configures TRAU.

On transmitting side, DTX results in:
some frames not being send
and modification of speech algorithm (i.e. sending of comfort noise frames)

Initial command for DTX is issued through a DL DTX indicator included in the message
used for management of the basic transmission mode:
From MSC: in BSSMAP assignment request
and for channel activation towards BTS in RSM channel activation.
TRAU is configured through an in-band indicator set by BTS.

On an already installed DL RR connection the DTX change can be done via an indicator in
RSM mode modify request message from the BSC to the BTS and
another indicator in BSSMAP assignment request of MSC towards BSC,
The MS needs not be warned in DL, so no procedure exists for this.

As a cell option (broadcast on BCCH) , the MS can be ordered to use UL DTX
11/6/2005
U.A.Hermann: GSM
217

1.8.3.4. Handover Execution
Handover= network commanded transfer of a MS in dedicated mode from one cell to

another.
HO procedure is very similar to the subsequent assignment procedure. Differences:
Fundamental difference is the change of cell.
Additionally timing advance is applied for HO,
some additional data specific to new cell are transmitted and
some limitations are valid
Another variant of HO is directed retry:
When a connection is initially established, the cell is chosen by MS,
however while in connected mode, the cell is determined by the network.
As the 2 selection algorithms are different, the resulting cell may be different as well.
When this happens and the initial channel is TACH/8, a HO directly to the TACH/F
in the right cell is faster than subsequent assignment to TACH/F in the old cell and
HO to the new cell.
This is called directed retry.
11/6/2005
U.A.Hermann: GSM
218

1.8.3.4. Handover Execution (continued)
HO has different variants according to 2 criteria:

1st criterion is related to the timing advance with two different cases:
Synchronised HO: MS is able to compute new TA because old and new cells are
synchronized.
Asynchronous HO: TA must be initialised at MS and BTS during HO.

2nd criterion concerns the location of switching point in the infrastructure:
Intra-BSC HO:
between two BTSs of same BSC
Intra-MSC, inter-BSC HO:

between 2 BTSs of different BSCs
Inter-MSC HO:
between 2 BTSs of different MSCs
original MSC stays as anchor MSC
HO always goes through 2 phases:
BSC-old triggers set of events which lead to the establishment of the new
communication path. After this is done, the MS gets a HO command.
MS accesses new channel. This triggers the switch of paths in infrastructure and
release of old path.
11/6/2005
U.A.Hermann: GSM
219

1.8.3.4.1 The Set-Up of the New Path
MS
Switching
point
BSC-old
phase 1
Decision
HO is required
phase 2
HO command to MS
Release of path
BSC-new
Start of path establishment

end of path establishment
and HO command to MS
The MS has accessed
the new cell
Allocation and activation

of radio channel
MS access to
new cell
MS
After decision of HO has been made by BSC-old, this is indicated to switching point.
Switching point must:
Establish terrestrial resources,
Signal to BSC-new in order to allocate radio resource
Provide all machines with HO related information, including:
Required transmission mode
Cipher mode
Identity of origin cell (in order to determine whether HO is synchronous or not).
MS classmark.
The details of HO execution sequence are described in the following steps:
11/6/2005
U.A.Hermann: GSM
220

1.8.3.4.1 The Set-Up of the New Path (continued)
From BSC-old to switching point (see next picture 1.8.-4)
Purpose of this exchange: transmission of information, that a HO is needed and towards

which cell
Different cases depending on the switching point:
1. BSC-old is switching point = BSC-new: internal step, no problem
2. MSC-old is switching point (BSC-old BSC-new):
BSC-old sends BSSMAP handover required message to MSC-old, containing

identities of target cell(s) and of the origin cell.
3. Anchor-MSC is switching point (and different from MSC-old):
BSC-old does same procedure as under 2. above.
MSC-old translates the message into MAP/E perform subsequent handover

message toward anchor MSC.
11/6/2005
U.A.Hermann: GSM
221
1.8.-4 HO requirement from the serving BSC to the switching point

Switching
point
BSC-old
HO is required
Start of path
establishment
HO command
to MS
End of path est. and

HO command to MS
MSC-old
BSC-old
A)
BSC-new
Anchor
MSC
(internal)
B)
BSSMAP handover required
C)
BSSMAP handover required
11/6/2005
MAP/E perform subsequent handover
U.A.Hermann: GSM
222

From switching point to BSC-new (see next picture 1.8.-5)
Purpose of this step:
Establish signalling path between switching point and BSC-new.
Establish circuit if needed.
Supply required information to all machines on the signal path.
Three different cases, depending on the switching point:

A. BSC-new = BSC-old = switching point:
Internal handling in BSC. BSC holds all required information.
B. MSC-new= MSC-old = switching point (BSC-new BSC-old):
11/6/2005
After reception of indication that HO is required: MSC-new establishes SCCP connection

to BSC-new
MSC-new transmits BSSMAP handover request message to BSC-new incl. information:
On both cells (origin and target cell),
Transmission mode (may be differ from the old connection)
Cipher mode (must remain unchanged)
Classmark
Reference to terrestrial channel between MSC-new and BSC-new if needed

U.A.Hermann: GSM
223

From switching point to BSC-new (see next picture 1.8.-5)
C. Anchor MSC is switching point and different from MSC-new.
More complex case several steps, as the new communication path may transit
through PSTN or ISDN.
standard inter switch procedures are used (e.g. TUP or ISUP). These
protocols can not convey GSM specific info they are just used for circuit set
up.
Than MAP/E procedures are used for HO signalling.
Anchor MSC provides the required info to MSC-new through MAP/E perform
handover message.
After reception:
MSC-new establishes SCCP connection with BSC-new
Allocates A-interface circuit, if needed
Transmits BSSMAP handover request message to BSC-new containing

same information as received in case b above.
11/6/2005
U.A.Hermann: GSM
224
1.8.-5 Start of path establishment at handover

Switching
point
BSC-old
HO is required
HO command
to MS
Anchor
MSC
BSC-new
Start of path
establishment
HO command to MS
MSC-new
A)
BSC-new
(internal)
BSSMAP handover request
B)
BSSMAP handover request
MAP/E perform handover
C)
11/6/2005
U.A.Hermann: GSM
225

From BSC-new back to the switching point (see next picture 1.8.-6)
Now BSC-new must allocate the radio channel: positive or negative answer is possible.
No queuing, because other machines wait for answer. Timers are running.
BSC exchanges RSM channel activation & RSM channel activation acknowledge with BTS
BSC-new builds and transmits RIL3-RR handover command to MS via switching point and
old resource, containing:
Decision, whether synchronous or asynchronous HO is used,
Chooses HO reference
Sets initial MS transmission power.
So BSC-new takes over control from this moment!
3 different cases are distinguished:

a. BSC- new is switching point:
At this point in time both terrestrial paths to old and new BTS are set up.
b. MSC-new is switching point:
BSC-new encapsulates the RIL3-RR handover command message in a

BSSMAP handover request acknowledge message.
Nothing else necessary, because the terrestrial path already is completely

established.
11/6/2005
U.A.Hermann: GSM
226

c. The anchor MSC is the switching point and differs from MSC-new:
BSC acts as case b above.
After reception of BSSMAP handover request acknowledge message, MSCnew inserts the included RIL3-RR handover command message in a new
envelope, the MAP/E perform handover command. This contains :
Telephony like number (provided by MSC-new) to allow Anchor MSC to

set up a normal circuit connection through ISUP or TUP.
Than MAP/E exchange on this circuit provides:
Information needed for circuit establishment and
carrying the RIL3-RR handover command back
which shall be send to MS via the old path.
11/6/2005
After reception of MAP/E perform handover result message, the

anchor MSC can set up communication to MSC-new.
U.A.Hermann: GSM
227
1.8.-6 end of path establishment at handover

Switching
point
BSC-old
HO is required
Start of path
establishment
HO command
to MS
Anchor
MSC
BSC-new

HO command to MS
MSC-new
BSC-new
A)
(internal)
B)
BSSMAP handover request ack
MAP/E perform handover ack
C)
11/6/2005
U.A.Hermann: GSM
BSSMAP handover request ack
228

Depending on implementation choices for the BSC the paths at this stage
may be linked in
a two ways conference bridge
So user data are transmitted to MS via both BTSs
Uplink flows are combined into a single one towards MSC

a one-way conference bridge
So user data are transmitted to MS via both BTSs

or not linked at all
Such a conference bridge improves HO performance, but not always
feasible.
BTS
BSC
BTS
11/6/2005
U.A.Hermann: GSM
MSC VLR
229

From the switching point (see next picture 1.8.-7)
Last step of first phase of handover execution: sending RIL3-RR handover command to
MS as shown in next picture.
The RIL3-RR Handover command message is carried unaltered over different interfaces in
a variety of different envelopes:
Interface between
Encapsulating message
BSC-new and MSC-new
BSSMAP handover request acknowledge
MSC-new and Anchor MSC
MAP/E perform handover result
Anchor MSC and MSC-old
MAP/E perform subsequent handover result
MSC-old and BSC-old
BSSMAP handover command
RIL3-RR handover command message identifies the new cell only via beacon frequency
and BSIC. The full cell identity will be read by the MS on SACCH later on.
11/6/2005
U.A.Hermann: GSM
230
1.8.-7 Sending back of Handover Command

Switching
point
BSC-old
HO is required
BSC-new
Start of path
establishment
HO command
to MS

HO command to MS
BSC-old
MSC-old
Anchor
MSC
(internal)
A)
B)
C)
11/6/2005
U.A.Hermann: GSM
MAP/E perform subsequent

handover acknowledge
231

The not successful alternatives
The HO as described before may fail, e.g. due to lack of radio or terrestrial resources.
In the failure case either
a failure message is carried all the way back from BSC-new to BSC-old or
a timer at BSC-old expires:
Subsequent handover failure
Anchor MSC
No radio resource available

Handover required
reject
MSC-old
MSC-new
handover failure
BSC-old
11/6/2005
BSC-new
U.A.Hermann: GSM
232

2 possibilities for recovery after failed HO:

1. New HO attempt to same cell after some time:
Failure indication goes all the way back to BSC-old.
All resources along transmission path, which had been allocated are released again.
BSC-old may later decide to retry.

2. HO attempt to another cell:
Same procedure as 1. Above however with different target cell, or
BSC-old provides MSC-old with an ordered list of target cells (e.g. in case of
rescue handover).
This list is not send to anchor-MSC, if MSC-old is the the switching point.
Upon reception of failure indication MSC-old will try targets on list one after another.
Only after all targets have been tried in vain, BSC-old gets failure indication.
Possibility of multiple cell choice is an option for BSSMAP handover required

message
Trade-off: multiple cell choice is better for speed, however cell allocation is better by
BSC-old in line with latest measurements.
11/6/2005
U.A.Hermann: GSM
233

1.8.3.4.2 MS access and the conclusion of the HO procedure
RIL3-RR handover command message to MS:
Before reception of this message: MS did not know anything of the HO preparation.
This message contains all information for transmission on the new channel.
(except cipher mode, because assumption is, that this remains unchanged).
Message indicates whether asynchronous or synchronous HO is applied.
MS reception from now on:
Due to pre-synchronisation: MS receiver synchronises quickly on new channel
Speech or data reception is now possible, if switching point uses conference bridge.
MS transmission from now on:
For synchronous HO:
For asynchronous HO (see next picture):
MS first sends some access bursts (RIL3-RR handover access)

Than normal transmission with pre-computed TA.
MS sends access bursts till it receives RIL3-RR physical information from BTS-new.
this contains the timing advance information. Then normal transmission starts.
RIL3-RR handover message is the only short access burst on a dedicated channel:
containing 8-bit HO reference as a reply to the reference send by BTS in RIL3-RR
handover command message as an additional check, that the right MS is accessing.
11/6/2005
U.A.Hermann: GSM
234
1.8.-8 Access in case of an asynchronous handover
BTS-new
MS
Handover
Access
Physical
Information
(Handover
Detection)
BSC-new
Anchor MSC
MSC-new
(Handover
Detect)
SABM
UA
Handover Complete
Handover
Complete
Send End
Signal
First after reception of RIL3-RR physical information message does MS switch to normal
transmission with the indicated TA.
Then SAPI0 is established on the new dedicated channel.
Then RIL3-RR handover complete Message is send.
11/6/2005
U.A.Hermann: GSM
235

1.8.3.4.2 MS access and the conclusion of the HO procedure (continued)
Option for manufacturer/ operator:
After reception of RIL3-RR handover access burst, BTS may send RSM handover
detection message to BSC.
BSC-new passes message on to MSC-new through BSSMAP handover detection

message. (not possible in case MSC-new is anchor MSC, as this information is not
carried on MAP/E protocol).
Effect of this mechanism: MSC may switch communication path, before complete
protocol is executed
The RIL3-RR physical information message:
= only message send autonomously by BTS

Reason: performance.
Message may be send several times (for efficiency reasons), till reception of a normal
burst from MS.
When MS is in transmission mode:
MS sets link layer to acknowledged mode for signalling: MS sends SABM, answered
by UA frame.
MS sends RIL3-RR handover complete message to switching point.

11/6/2005
U.A.Hermann: GSM
236

When MS is in transmission mode (continued):
Then switching point releases the old resources:
From anchor MSC to MSC-old: MAP/E send end signal result.
From MSC-old to BSC-old: BSSMAP clear command
Then BSC-old releases radio channel.
Release procedures at Abis-, A-interface and BTS are identical to RR-session

termination.
Handover complete indication triggers switching from old to new path, if not already
done after Access Detection on new channel. Why this 2 stage approach?
First stage :
shortens interruption time.
Second stage:
release of resources, so MS can not easily return to old channel !
Return to old channel in case of problems:
= similar to subsequent assignment,
only RIL3-RR handover failure message instead of RIL3-RR assignment failure.
BSC-old detects unsuccessful HO and transmits information up to MSC-old through

BSSMAP handover failure message (if applicable).
11/6/2005
Problem in case Anchor MSC is switching point: MAP/E protocol does not foresee
means/message to pass this failure information to Anchor MSC!
U.A.Hermann: GSM
237

Return to old channel in case of problems:
Solution: Anchor MSC reacts upon timer expiry and non reception of handover complete
message from BSC.
After detection of failure: switching point releases new path.

Then BSC-old has to decide upon further actions.
Intra-BSC HO:
Normally performed autonomously by BSC.
BSS implementation option not to involve MSC in selecting the best cell( if inside the
domain of this BSC).
BSSMAP handover performed message from BSC informs relay MSC about this
completed HO.
This can be relayed to anchor MSC (if it is different from relay MSC) by MAP/E
note internal handover.
11/6/2005
This message may may also be used in case of MSC-internal HO.

Sending of message depends on Operation & Maintenance setting.
U.A.Hermann: GSM
238

1.8.3.5. Call Re-Establishment
Call Re-Establishment = kind of mobile triggered HO

as opposed to the GSM concept of network controlled handovers !
General trade off between mobile and network triggered handover:
MS triggered HO is faster and better performing in micro- and pico-cell

environments
Network has better overview of network situation (e.g. resources, traffic, topology)
Call re-establishment has 2 parts:
1st part: very close to initial access. MS has leading role:
MS has to start from scratch after link loss.
Speed requirement: after link loss a timer in MSC is started in order to clear the
transmission path (which probably became obsolete) MS must be quick.
2nd part: consist in recovering of upper layer connections. Network has leading role.
Details of first part:
Cell choice: cells already known by MS, because MS is pre-synchronised (a new

synchronisation would take seconds).
Cell selection rule: cell with highest signal strength.

11/6/2005
U.A.Hermann: GSM
239

1.8.3.5. Call Re-Establishment (continued)
Details of first part: (continued)
MS must analyse radio criteria of selected cell (required by GSM Standard):
BCCH must be read
Cell must not be barred for call re-establishment (signalled as well in BCCH)
Then MS sends access request on RACH, in which
Call re-establishment is indicated as cause (so network knows urgency)
However no required channel (so network might always provide TACH/F).
Then MS sendsCM Re-Establishment Request:
with minimal information content: subscriber identity and classmark
Network has to find out everything else:
Cell with which connection was lost,

Identity of anchor MSC.
Required type and mode of channel.
Then MSC is running the recovery based on the known subscriber identity:
Find old context (if not lost due to timer expiry or correspondent who lost patience)
Then MSC starts assignment procedure & ciphering start procedure
11/6/2005
Telling BSC the type of required channel, mode etc.

Allocating BSC-MSC terrestrial path.
Maybe even authentication is started by MSC (additional delay!)
U.A.Hermann: GSM
240

1.8.3.5. Call Re-Establishment (continued)
Details of first part: (continued)
Then BSC performs:
needed procedures in BSC and MS,
like subsequent assignment, ciphering start, mode modification,
Then RIL3-MM CM service accept message can be send to MS.
or RIL3-MM CM service reject e.g. with cause call cannot be identified
Further complications dealt with in standardisation:
Recovery of several CM-transactions.
Connection loss during an ongoing procedure in any other layer
11/6/2005
U.A.Hermann: GSM
241

1.8.3.6. RR-Session Release (see figure 1.8.-9.)
When call is over and no RR-connection is needed any more:
normal release procedure is triggered by anchor MSC..
All resources are released and MS goes to idle mode.

If relay MSC anchor MSC:
Anchor MSC sends MAP/E Send End Signal Result to relay MSC
and releases circuit through ISUP release procedure.

Then BSSMAP Clear Command from relay MSC to BSC:
This message may be piggybacked on an SCCP Release message, releasing BSCMSC connection.
In this case BSC acknowledgement BSSMAP clear complete must be piggybacked

on SCCP release complete message.
Clearing action of BSC can be in parallel to this message.
11/6/2005
BSC orders MS back to idle with RIL3-RR Channel Release

MS disconnects signalling link.
BTS reports this disconnect by: RSM Release Indication message to BSC.
This clearing is secured by timers and repetitions against frame loss it must be avoided
to allocate a channel which is still used to a new MS !
First after BSC is sure MS has left, it deactivates BTS device and adds it to free resources
by RSM RF Channel Release / RSM Channel acknowledge exchange!
U.A.Hermann: GSM
242
1.8.-9 Normal release procedure of an RR session

Relay MSC
BSC
BTS
MS
Link disconnection:
DISC
UA
MSC/VLR
clear
command
clear
complete
channel release
Anchor MSC
MSC/VLR
send end
signal result
release
indication
RF channel
release
RF channel
release ack
Normal release is always triggered by anchor MSC

BSC manages return of MS to idle mode before releasing BSS resources.
11/6/2005
U.A.Hermann: GSM
243

1.8.3.6. RR-Session Release (continued)
Abnormal RR-session release:
In case radio connection with MS was lost, network must release its resources.
Mechanism:
Both in MS and BTS correctly received SACCH frames are counted.
(SACCH frames are regularly send twice per second in dedicated mode)
Counter increments (till max. value) in case of good SACCH frame reception
and decrements in case of no or damaged reception (SACCH frame loss).
At minimum threshold of counter the reception is considered broken.
In case of broken connection :
MS goes to idle mode.
BTS sends RSM Connection Failure message to BSC.

radio link counter
4
link assumed
broken
0
SACC frame decoded,

expected, but not decoded
SACCH blocks
11/6/2005
U.A.Hermann: GSM
244

1.8.3.6. RR-Session Release (continued)
Complication: uplink and downlink SACCH radio link counters do not expire at the same
time network might detect a broken link, whilst MS still is above counter threshold
MS might continue to transmit.
Solution: BSC commands BTS to stop transmission of SACCH: RSM Deactivate

SACCH message.
Monitoring of the uplink channel continues in BTS or BSC.
(if in BTS, than it reports back RSM Connection Failure Indication to BSC,
when UL channel is gone)
After link failure is detected: same A-interface exchange as in normal case.
11/6/2005
U.A.Hermann: GSM
245

1.8.3.7. Load Management Procedures
Load management procedures = Procedures in RR-plane to allow MSC and BSC to deal
with overload.
Procedures are available in 2 areas: RACH / PAGCH load and TCH load.
Load on common channels:
BTS is in charge to assess the load on RACH and PAGCH.
BTS to BSC message on load situation: RSM CCCH Load Indication
Conditions (thresholds, frequency, ) for this message are set by OSS.
Possible reaction by BSC upon reception of this message:
Change of RACH load control parameters on BCCH
Change assignment priority rules.
Load on traffic channels:
BSC knows/manages the dedicated channels .
Number of currently allocated TACHs can be signalled to MSC by BSSMAP

resource indication message.
MSC can ask for this information (due to many reasons) with BSSMAP Resource
Request
11/6/2005
U.A.Hermann: GSM
246

1.8.3.7. Load Management Procedures (continued)
MSC actions on overload:
Handovers are used for traffic management:
handover enquiry procedure in case overloaded cell has neighbour cells under
different BSC.
BSC responds with BSSMAP Handover Required message with appropriate

cause for each of a number of connections.
MSC sends BSSMAP Candidate Response message.
Precise measures of BSC are left for manufacturer and operator.
Problem : traffic balancing is in contradiction to interference and radio

optimisation!
General overload control:
The GSM standard describes messages to be exchanged for load control between
entities. Implementation is vendor/ operator dependant.
Basic principle of load control: control traffic at its source !
BTS to BSC case: BTS is normally designed to cope with simultaneous usage of all
radio channels. So only common control channels may be overloaded if traffic is
strongly deviating from standard traffic pattern, or if design was wrong.
11/6/2005
U.A.Hermann: GSM
247

1.8.3.7. Load Management Procedures (continued)
BSC to MSC:
only traffic on the Abis interface under the control of MSC are MS terminating
calls.
So MSC could decide to reject calls from the network side and not send paging.
Paging and the overloaded cells are however controlled by BSC
MSC to BSC: if MSC is overloaded, BSC can reduce MS originated traffic.
11/6/2005
U.A.Hermann: GSM
248

1.8.3.8. SACCH Procedures
The SACCH exists only in dedicated mode as a small associated control channel
Primarily for keeping the radio channel stable (power control, measurement reporting,
timing advance)
But as well for general information of the MS.
1.8.3.8.1. Radio Transmission Control
Power control and timing advance:
Commands from network are carried in L1-header (= physical layer in radio path
protocol architecture)
Send once per SACCH burst (= 2 times / second)
UL: similar coding as DL. Contains the two values used by MS at the end of the
measurement period (TA should be the same, Power Level might be different due to
the limited variation speed) .
TA is managed autonomously by BTS.
Transmission power is controlled by BSC (RSM MS Power Control and RSM BS

Power Control) messages.
11/6/2005
U.A.Hermann: GSM
249

1.8.3.8.1. Radio Transmission Control (continued)
Measurement results:
Send UL by MS at least once per second: RIL3-RR Measurement Report.
BTS generates at every measurement period (twice / sec.) a RSM Measurement

Result message to BSC.
This contains measurements of MS and BS.
BSC computes data for power control and HO preparation.
11/6/2005
U.A.Hermann: GSM
250

1.8.3.8.1. Radio Transmission Control (continued)
Design trade offs:
Measurement computing centralised in BSC is simpler and efficient, however it

induces heavy signalling load between BSC and BTS.
As an alternative the option of pre-processing in the BTS is left to the vendor.
6.3.8.2. General Information
Purpose of DL SACCH general info.: transmission of radio parameters, which are

particularly needed at the beginning of a channel connection. Information are similar to
information transmitted on BCCH , including:
Parameters to control the monitoring process:
List of frequencies to be monitored.
BSIC screening
BCCH frequency indication
Parameters for controlling the radio link failure detection (counter and threshold)
Requirements for application of UL DTX.
Further information (like full cell identity etc.)

11/6/2005
U.A.Hermann: GSM
251

6.3.8.2. General Information
In dedicated mode SACCH is always used in both directions for transmission (even if no
information is transmitted!): the other side must be able to do measurements and detect
radio link failure.
SMS in dedicated mode: are carried by SACCH .
L1 header
message:
downlink: system information or
SMS related information
uplink:
11/6/2005
U.A.Hermann: GSM
measurement report or
SMS related message
252

1.8.3.9. Frequency redefinition
Frequency Redefinition = process for changing frequency properties of a FH channel

synchronously between MS and BTS.
RIL3-RR Frequency Redefinition message is send to each concerned MS (includes

starting time and RF parameters) .
Between BTS and BSC message from O&M is used for setting RF parameters in BTS.
11/6/2005
U.A.Hermann: GSM
253

1.8.3.10. General Information Broadcasting
Data broadcast to MS in idle mode is done via BCCH.
BCCH is a low capacity channel:
23-octet every 0.235 seconds
Repetition rate : trade off between usage of BCCH resource and speed of information
for MS.
Different periods are used for different information.
1.8..3.10.1. Cell Selection Information
Information contained:
LAI: Location Area Identity
Cell Selection Parameters
RACH Control Parameters (for the Cell_Bar_Access): indicating whether the cell is
barred.
11/6/2005
U.A.Hermann: GSM
254

1.8..3.10.1. Cell Selection Information (continued)
Frequency of transmission:
2 out of 4 occurrences.
Cell_Bar_Access in every BACC message
Note: even if several BCCH time slots are used, MS in neighbour cells only listen to TN0 !
So repetition frequency on BCCH timeslots other than TN0 is not important.
Problem : Masking of BCCH by PAGCH subchannels:

MS in neighbour cells must listen to their paging subchannel and to the BCCH of
neighbour cells! If these transmit at the same time masking effect.
Solution:
Paging subchannel has half the rate of BCCH at worst only half the BCCH is
masked.
Cell selection information is not transmitted on every second message , but in pairs
(e.g. 11 00 11 00 )
At worst only every 2nd occurrence of cell selection information on BCCH is masked
11/6/2005
U.A.Hermann: GSM
255

1.8..3.10.2.
Information for Idle Mode Functions
Information for idle mode functions = used by MS once it has selected a cell to camp on
in idle mode.
Information contained:
Control Channel Description parameter contains:
Configuration of common channels: number of the time slots used for common
channels.
Parameters enabling MS to calculate its paging subchannel
Information about which neighbour cells to monitor: beacon frequencies of neighbour

BTSs contained in Neighbour Cells Description parameter.
Configuration for cell broadcast messages: CBCH Channel Description (and

CBCH Mobile Allocation) parameter tells whether CBCH (Cell Broadcast Channel)
is available and where.
Frequency of transmission: once every 4 messages (for all 3 types of parameters)
11/6/2005
U.A.Hermann: GSM
256

1.8..3.10.3.
Information Needed for Access
When needed for Location Updating or Call Re-establishment, this information is of time
critical nature.
So all information controlling access attempt is transmitted in each message (4/sec)
Control information for limiting access in RACH Control Parameter:
List of allowed access classes is contained on BCCH.
Flag allowing Call Re-establishment.
Parameter for controlling scheduling of access attempts and repetitions.
Cell Channel Description parameter:
= list of all frequencies for dedicated channels in the cell.
(information is needed at initial access in order to control FH. Without this information on
BCCH, the Channel Assignment message would need to contain this information, but it would
not fit in )
Broadcast 1/sec.
11/6/2005
U.A.Hermann: GSM
257

1.8..3.10.4.
Information for MS in dedicated mode
Some information on BCCH is first needed after access by MS.
Information contained in Cell Options parameter:
Parameter to control reporting on measurements (BSIC screening information

preventing to measure cells of forbidden PLMNs)
Power Control Indicator
Parameter controlling UL DTX.
1.8.3.10.5. Cell Identity
Cell Identity parameter transmitted on each 4th message (for network testing purposes,
no operative usage in GSM).
11/6/2005
U.A.Hermann: GSM
258
1.9. Mobility and Security Management

Aspects of Mobility Management :
How does the MS deal with changing environment? How to choose the right
cell and network?
How does the infrastructure manage subscriber location data, in order to
establish calls to GSM subscribers? How to get and update location
information.
Aspects of GSM security features, against:
Fraud (impersonating another user and thereby let him pay the bill)
Eavesdropping on the radio path
Both aspects involve same equipment (SIM and HLR) and interact.
11/6/2005
U.A.Hermann: GSM
259

1.9.1. Location Management
Technical consequences of of subscriber mobility:
Radio propagation: subscriber may leave coverage area.
Geographically limited subscription (e.g. no roaming allowed).
Different services when served by different networks.
Mobility management functions are determined by
Administrative aspects.
Radio propagation,
System behaviour (e.g. regarding congestion control).
The above aspects determine the way a mobile chooses the right network.
11/6/2005
U.A.Hermann: GSM
260

1.9.1.1. Factors determining the Service
In GSM the service observed by a subscriber may differ depending on his/her location, e.g.
HSCSD or GPRS may for a given PLMN (Public Land Mobile Network) only be
available in major cities.
In case of roaming again different operates will offer different services at different
prices.
3 different, basic levels of service:
Normal service: whatever user has subscribed to
Limited service: emergency calls only .
No service:
outside coverage area.
11/6/2005
U.A.Hermann: GSM
261

1.9.1.1.1. Administrative Aspects
The notion of PLMN:
= commercial coverage area of an operator (typically confined to a nation).
Corner stone of GSM due to competition between operators in the region.
Home PLMN= PLMN where user is subscribed to
Visited PLMN= other than home PLMN.
Roaming:
leads to complex system requirements and standardisation:
PLMNs must communicate between themselves.
Subscriber must use network compatible Mobiles and SIM cards (SIM roaming).
Subscription:
defines the set of services and access rights a subscriber has (e.g. no roaming)
The rights a user has in a visited PLMN might be different from home PLMN and are
subject to agreements between operators.
PLMN accessibility:
Regional or local access (different price structures) e.g. based on CAMEL (IN
network technology)
U.A.Hermann: GSM
11/6/2005
262

National roaming: e.g. for DCS-1800 operators without complete national coverage.
International roaming: if a subscriber is not allowed to roam in a foreign PLMN, the
Location Update will be rejected by the network.
PLMN selection:
When entering a new PLMN, the subscriber may choose manually or
automatically (as coded in the SIM) one out of several available visited PLMNs.
MS in idle mode only monitors neighbour stations as encoded on the frequency
list BCCH regularly. Other frequencies are scanned at greater intervals in an
overlap area, there might pass some time, before a roaming MS discovers its home
PLMN. (note monitoring in idle mode consumes battery power !)
1.9.1.1.2. Radio considerations
Radio aspects govern strongly the service which can be given in a particular cell.
In GSM a MS typically does initial access (e.g. answering a paging) in the cell on which it
camps (exception: directed retry)
cell selection criteria in idle mode are crucial, they are based on :
MS reception level (Rx lev and RX qual) of beacon frequency,
Maximum transmission power of MS
Several parameters as transmitted by BCCH.
11/6/2005
U.A.Hermann: GSM
263

1.9.1.1.3. System Load Control
Traffic overload in a particular cell : redirect traffic to neighbour cells.
Barr a cell: Cell_Bar_Access flag
Completely locks a cell for all mobiles (e.g. during repair or test) except for special test
mobiles.
Access class mechanism:
Some of the 10 standard user classes may be blocked in a rotating way fro a certain
period.
The MS are however still allowed to camp on this cell swap over of barred MS to
neighbour cells is prevented.
11/6/2005
U.A.Hermann: GSM
264

1.9.1.1.4. Paging and Location Areas (= LA)
In order to page a subscriber: infrastructure needs to know MS location.
In order to save signalling capacity: Cells are grouped into location areas. MS is only
paged in certain location areas.
MS must inform infrastructure when it changes location area and infrastructure must store
it: location update procedure.
Location areas: must be managed by a single MSC. One MSC may have several LAs.
Location updating:
Must be performed when MS enters new LA. Triggered by MS!
Part of location updating is the registration in the network.
The status of the registration is stored in the SIM.
After successful registration, the MS assumes normal service
Status after location updating:
Several outcomes of LA are possible.
11/6/2005
U.A.Hermann: GSM
265

1.9.1.1.4. Paging and Location Areas (= LA) (continued)
Several outcomes of LA are possible:
Successful registration or
Unsuccessful with a meaningful answer of the network (e.g. rejection)
Unsuccessful with a meaningless or no answer of the network.
3 possible meaningful negative outcomes:

1. Cell belongs to a PLMN not supported by the subscription :
Mechanisms are available: forbidden PLMNs list
So cell will not be tried again.
MS looks for cells of other PLMNs.

2. Location area not suitable because of regional subscription:
MS must stay in that cell, but only with limited service.

3. In case of national roaming - cell does not accept national roamers:
MS will not do further attempts in the cells of this LA,
but look for availability of home PLMN.
11/6/2005
U.A.Hermann: GSM
266

1.9.1.1.4. Paging and Location Areas (= LA) (continued)
If reject comes from home PLMN or PLMN connected with home PLMN:
Subscriber is deregistered in HLR, so he / she can not be called !

In other cases old HLR state remains and MS considers itself as deregistered
because there was no confirmation from the network upon location update .
Generally MS looks for other PLMNs after negative answer.
If no PLMN can be found: MS goes to limited service state.
There are many abnormal cases specified = cases where no reasonable answer can be
received by MS upon location update attempt.
In the first phase MS will try again a couple of times.
Then MS goes to a special state where it assumes no service.
From time to time MS will try location update in order to get out of this state
In this state MS does not reject a call attempt of the user, but tries a location update .
If this is not answered positively by a network, MS rejects call attempt.
11/6/2005
U.A.Hermann: GSM
267

1.9.1.2. Cell and PLMN Selection
1.9.1.2.1. PLMN Selection
The GSM Standard details PLMN selection, though it only affects the MS, because:
Users shall see similar behaviour if ME is exchanged.
PLMN selection shall not be biased by MS
Normal Case:
In normal service mode MS only looks for cells of serving PLMN.
Change of PLMN only possible, if:
User decides so and starts PLMN selection.
Serving PLMN no longer covers area.
PLMN selection is either by
Automatic mode
or manual mode.
Common aspect for both access modes:
Home PLMN: always first try to log on home PLMN after power on, even if
abroad.
List of forbidden PLMNs (as learned from access attempts) is stored on non
volatile section of SIM. U.A.Hermann: GSM
11/6/2005
268

1.9.1.2.1. PLMN Selection (continued)
Forbidden PLMN means: user may still select manually and it is still allowed for
emergency calls.
Other MS stored PLMN list :
Storage of location areas, which have been rejected access due to national
roaming limitations.
Cells of these LA (or PLMN if all LAs rejected access) can not be accessed.
List is deleted when MS is switched off or SIM removed.
Manual Mode:
User may select all PLMNs even forbidden ones (which might be useful after change
of subscription, when previously forbidden PLMN is now allowed).
Translation of network code is done in ME. So if there is a new network and the
ME is old, possibly only some strange code is displayed.
If PLMN access failed: new list of PLMNs is presented to user
11/6/2005
U.A.Hermann: GSM
269

1.9.1.2.1. PLMN Selection (continued)
Automatic Mode:
Selection out of Found PLMN list in order as encoded in Preferred PLMN list
on SIM.
User may edit this list of preference. Else list is put into SIM by operator.
User can force automatic PLMN selection at any moment.
If no preferred PLMN can be found: procedure as defined by ME vendor.
Limited service case:
Only emergency call is possible.
Cell selection by MS is independently done from PLMN or LA: by strongest signal.
MS keeps on to seek for available PLMNs at certain intervals.
Limited service case in home PLMN:
Only possible in case of regional subscription.
MS will try each new location area of home PLMN,
but no other PLMN, till home PLMN has disappeared (roaming case)
The No Service Case: MS regularly scans all 124 GSM carriers (374 DCS carriers).
11/6/2005
U.A.Hermann: GSM
270

1.9.1.2.2. Cell Selection
Radio criteria decide for cell selection: maximise transmission quality:
Based on
Level of received signal on beacon frequency,
Maximum transmission power of MS
Some cell specific parameters transmitted by BCCH.
Definition of C1 Criterion:
C1 := (A- Max.(B, 0))
A:= Received Level Average pl
B:= p2 Maximum RF power of the mobile station
p1= RXLEV_Access_Min (broadcast on BCCH)
p2= MX_TXPWR_MAX_CCH (broadcast on BCCH)
(all values expressed in dB)
p1 = between 110 dBm and 48 dBm

p2= between 13 dBm and 43 dBm (different between DCS and GSM).
P2= max transmit power for MS on RACCH (29 43 dBm allowed for MS!)
11/6/2005
U.A.Hermann: GSM
271

1.9.1.2.2. Cell Selection (continued)
Cell selection strategy (for neighbour cells or PLMN):
Only cells with positive C1 are taken into account.
Between several cells: cell with best C1 is chosen.
Consequence, C1 determines:
Coverage limit of each cell in isolation: outside the area with positive C1 the
cell does not exist for MS!
The boundary between 2 adjacent cells for selection in idle mode is determined
a the place where C1= C1
Boundary with all adjacent cells determining a second cell limit , usually inside
area delimited by C1= 0.
Figure:
2 cells with there C1= 0 limits and the
(dashed) line with C1A = C1B
A
11/6/2005
Due to different transmit powers of MS

classes, different cell limits exist for them.
Operator optimises cell boundaries by

adjusting p1 and p2.
U.A.Hermann: GSM
272

Criteria other than C1:
Disadvantage of above C1 definition: due to radio effects (e.g. shadowing) C1 varies

quickly, sometimes randomly MS would often change cell !!
As this is unacceptable a hysteresis function was introduced:
C1 for each cell is biasedby a handicap added to the C1.
Handicap = Cell Reselect_Hysteresis parameter broadcast on BCCH

individually for for each cell.
Applied specifically if different cells belong to different location areas !
Consequence: Cell boundaries are not the same, depending whether MS goes
from cell A to cell B or vice versa !
b
Boundaries between cell A and B depend on the
a
c
11/6/2005
requirement fro a mobile to perform location

updating:
a: Cell A and B belong to different LAs and MS is
in B
b: Cell A and B belong to same LAs
c: Cell A and B belong to different LAs and MS is
in A.
U.A.Hermann: GSM
273

The cell selection algorithm:
Aim of cell selection: in order to get normal service, the MS must camp on one of
the cells fulfilling the following conditions:
A valid SIM must be inserted and the subscriber must b eregistered in the LA
the cell belongs to;
Criterion C1 for the cell must be higher than 0;
Cell must not be barred.

And if there are several cells fulfilling above criteria:
The chosen cells C1 must be higher than the C1 of any other cell found by the
MS in the same LA.
The chosen cells C1 must be higher than the C1 of any other cell found by the
MS in different LAs of the same PLMN, corrected by the handicap factor.
Note: better cells in PLMNs other than the one the MS is registered in are not taken
into account! PLMN selection is only triggered if MS leaves coverage area or if
triggered by user.
11/6/2005
U.A.Hermann: GSM
274

Cell selection in normal service state:
MS receives a list (from BCCH) of beacon frequencies of neighbouring cells.
MS tunes receiver on these frequencies, gets synchronisation information,
decodes broadcast information.
MS checks whether cell is barred and reads identity of LA, radio parameters (for C1)
Only cells of the right PLMN are taken into account.
All this is in parallel to the listening to the PAGCH of the current cell.
If there is better cell in another LA (considering the bias):
MS changes to this cell.
MS tries immediate location update in order to be reachable in the new LA.
Cell selection at switch on time:
First PLMN to look for after power on is home PLMN.
MS looks for non-barred and C1 positive cells.
Typically MS stores in non-volatile sector of SIM the neighbour frequencies of the

last (home) PLMN for quicker frequency scan.
If none of these frequencies can be found, all GSM/DCS frequencies have to be

searched lengthy process !
11/6/2005
U.A.Hermann: GSM
275

If chosen cell belongs to LA as stored in SIM: MS goes directly to normal service,

maybe with IMSI attach/detach
else MS starts with Location Update.
If no cell was found in home PLMN, MS looks for other PLMNs.
Cell selection at PLMN Change:
E.g. if MS has moved out of serving PLMN area and cell selection starts
automatically or if user triggered it.
Similar process as for switch on, but MS has no frequency information to analyse
all frequencies:
Search whole GSM/DCS spectrum
Select 30 strongest beacon frequencies.
Analyse information on respective BCCHs:
Which PLMN?
Barred or not?
Radio parameters for C1 computation.
Establish list of acceptable PLMNs (found list)
Compare with preferred list and access acceptable candidate PLMN.

11/6/2005
U.A.Hermann: GSM
276

Cell selection in limited service mode:
E.g. subscriber Is not entitled to normal service in any found PLMN.
Normal cell selection is performed , however without location updating.
Cell with best C1 is camped on (but without bias)
MS continues to search whole spectrum for acceptable PLMN.
11/6/2005
U.A.Hermann: GSM
277

1.9.1.3. Architecture for Location and Mobility Management
HLR: permanently stores subscriber data, e.g. present position (target MSC/VLR) for
mobile terminating calls.
VLR: stores temporarily subscriber data for the time a MS is in its area.
VLR is normally part of an MSC: MSC/VLR.
MSC: routes page to particular LA.
Consequence: Subscriber data are copied from HLR to VLR each time a MS registers
Advantage of architecture: signalling load between visited MSC and HLR is limited
11/6/2005
U.A.Hermann: GSM
278

1.9.1.3.1. Functions of location management
Home Location Register (HLR):
HLR may be one or several distributed machines
HLR has no switching functionality.
HLR is not a simple database (with store and retrieve), but actively managing
subscriber data, e.g.:
Tell old VLR to delete subscriber record, if subscriber is registered under a new
VLR.
Visitor Location register (VLR)
VLR may manage subscriber data for one or several MSC.
VLR may be physically distinct from MSC.
3 different architectural concepts:

1. HLR / VLR as a single distributed database: VLR exists only in order to
distribute/minimise signalling load.
2. Opposite view - VLR is just fulfilling ancillary tasks of MSC (implemented by
most manufacturers)
3. VLR as own , independent unit with its own tasks.
11/6/2005
U.A.Hermann: GSM
279

1.9.1.3.1. Functions of location management (continued)
Mobile Station (MS) role on mobility management:
Canonical work split between Mobile Equipment (ME) and SIM:
Non-volatile memory of SIM holds all user related data (incl. mobility related),
ME not.
Manufacturers are however free to put user specific data in ME
Volatile data (e.g. forbidden location area for national roaming or list of beacon
frequencies) are kept in ME.
SIM Card role on mobility management :
SIM is a passive information container for:
Update status (= result of last LA updating attempt)
Location area identity
function: avoid location update after power on, if MS still is registered.
List of beacon frequencies (of home PLMN or last serving PLMN)
Forbidden PLMN list (Ordered list of the last 4 entries).
Preferred PLMN list (Typically supplied by the service provider. User may edit
this list)
11/6/2005
U.A.Hermann: GSM
280

1.9.1.3.2. MM Protocols
For HLR must be able to communicate with all VLR in the world MAP/D (part of
SS7) is used.
SIM ME interface: limited to simple read, write, delete commands.
RIL3-MM
MAP/D
HLR
MSC/VLR
MS
SIM-ME
SIM
11/6/2005
U.A.Hermann: GSM
281

1.9.1.4. The Location Updating Procedures
1.9.1.4.1 The Basic Procedures
Normal reason for change of LA: MS moved into another cell belonging to a different LA
Process of location information updating:
MS identifies need for location update.
(1) MS notifies MSC/VLR, to which the new cell belongs.
This MSC/VLR may be the same, if it controls both LAs or a new one.
If it is a new one: MSC/VLR notifies HLR (2), which notifies previous VLR (3).
4
HLR
old MSC/VLR
1
5
new MSC/VLR
MS
11/6/2005
U.A.Hermann: GSM
282

1.9.1.4.1 The Basic Procedures (continued)
In case data base update did not work out due to some failures: special procedures are
executed to correct the failed database.
In order to cover those cases, following elementary procedures are defined:
Updating of MSC/VLR storage at the request of the MS.
Updating of HLR storage at request of MSC/VLR.
Cancellation of a subscriber record in MSC/VLR at request of HLR.

MS to MSC Location Updating Procedure:
Location Update Request is carried by RIL3-MM Location Updating Request

message: contains information to identify subscriber.
MSC/VLR may respond on its own, if the user is already registered there.
MSCVLR may answer with :
RIL3-MM Location Updating Accept or
RIL3-MM Location Updating Reject.

with a suitable cause
11/6/2005
U.A.Hermann: GSM
283

MSC to HLR Location Updating Procedure:
Procedure is used if,
MS asks for registration under new MSC/VLR
or HLR had a failure and asks MSC/VLR for confirmation of subscriber

locations.
Request is send by MAP/D Update Location message from MSC/VLR, containing:
Subscriber identity,
Routing data to send up a mobile terminating call (i.e. SS/ address of

MSC/VLR, not precise location area).
If subscriber is entitled to normal service:
HLR updates its memory and
triggers a location cancellation in the previous MSC/VLR.
HLR sends MAP/D Update Location result to MSC/VLR.
If subscriber is not entitled: HLR puts Location unknown in its memory.
Than MSC/VLR puts subscriber into its database and HLR provides further
subscriber data by MAP/D Insert Subscriber Data message.
11/6/2005
U.A.Hermann: GSM
284

HLR to MSC/VLR Location Cancellation Procedure:
Location cancellation from HLR to MSC/VLR consist of MAP/D Cancel Location

message
And acknowledgment in MAP/D Cancel Location Result from MSC/VLR.
1.9.1.4.2 Periodic Updating and Database Failure Recovery
An HLR or MSC/VLR may suffer failure and database damage. Recovery:
From secure backup.
But if the backup might no longer up to date, several additional recovery

mechanisms are foreseen:
Marking of insecure information in the database and
additionally information to all other databases (which share information).
These mark the information as well as insecure
No direct attempt is made to restore the inconsistency. Else system overload!

11/6/2005
U.A.Hermann: GSM
285

1.9.1.4.2 Periodic Updating and Database Failure Recovery (continued)
No direct attempt is made to restore the inconsistency. Else system overload!
Than an insecure subscriber record is corrected, when some event happens

Periodic location updating has been introduced as a means to ensure restoration of
databases:
periodicity is adjusted by operator and broadcast: trade off between signalling

load and time interval when a MS might not be reachable.
MS start periodic LA.
MSC/VLR Failure
After failure MSC/VLR restores all records from backup and marks them as insecure.
Then MAP/D Reset is send to all HLRs for which it has subscribers in its memory.
MSC/VLR will notice that an MS is missing in its database, when service is requested for
an unknown MS.
MS does call set-up and MSC/VLR notices missing entry in its database.
ThenMSC/VLR enforces new location update by a call rejection with the failure
cause IMSI unknown in VLR.
11/6/2005
U.A.Hermann: GSM
286

If MS calls from a different LA than registered in VLR record is simply corrected

In case of MS terminating call: VLR notices problem if service request from HLR
for a MS which is not in its table:
VLR enters subscriber into its database and
asks HLR for subscriber information: MAP/D Send Parameters message .
After reception of MAP/D Send Parameters answer the LA addresses are

still missing.
So MSC/VLR pages to all cells in all LAs !
Problem: If MS is in VLR1 area, but HLR imagines, that it is in VLR2 area:
Error will be corrected in VLR1 and HLR, when MS performs periodic location
update
Error un VLR2 will be corrected by internal house keeping, if e.g. no periodic

location update appeared after a given time.
11/6/2005
U.A.Hermann: GSM
287

HLR Failure
Problem: HLR is not necessarily contacted in case of location updates or MS

originated calls.,
Solution:
HLR sends MAP/D Reset to all VLRs for which it has entries in its back up
files.
MSC/VLR marks the corresponding records as to be marked with HLR,
so the next radio contact with the corresponding MS triggers location

updating from MSC/VLR to HLR.
11/6/2005
U.A.Hermann: GSM
288

1.9.1.4.3
The IMSI Attach and Detach Procedures
Purpose of this procedure: when a MS is switched off, paging attempts to this MS are in
vain, load network resources and are not paid for !
Solution: when MS is switched off MS Detach is performed
MS Attach is performed, when the MS is switched on again in the same location area.
Else a normal location update is performed.
Detach information is stored in the VLR, so HLR will still try to establish a call till it
receives the rejection from the VLR.
So call forwarding can be applied by VLR or HLR as a network option.
Support of Attach/Detach is a network option as well.
AT IMSI Detach MS just sends RIL3-MM IMSI Detach and does not wait for an
acknowledge.
When MS is switched on again in the same LA, it performs IMSI Attach (which is
practically identical to Location Update)
11/6/2005
U.A.Hermann: GSM
289

1.9.2. Security Management
1.9.2.1. The requirements
2 goals of security on the air interface:
Protecting the network against unauthorised access (and users against fraudulent
impersonation)
Protecting privacy of users.
Unauthorised access is prevented by authentication:
A secure check, whether the subscriber identity provided by the MS corresponds to the
SIM.
Importance: when subscriber is roaming, the visited network can not check the
subscribers ability to pay his telephone bill.
Privacy is achieved by:
Ciphering of user data,
Ciphering of signalling to prevent third party from knowing who is calling/called.
Preventing eavesdropper from tracing mobiles by using temporary identities.
Security measures are only used on the air interface. Inside the infrastructure all
communication is clear text !
All security is handled by the operator. The subscriber has no choice.
GSM specification leave open many options of applying security (e.g. different ciphering)
11/6/2005
U.A.Hermann: GSM
290

1.9.2.2. The Functions
Ki
RAND
Ki
RAND
1.9.2.2.1. Authentication
PIN : is only checked locally versus the PIN stored in
the SIM. No radio transmission, as this would be to
risky against eavesdropping.
RAND= random figure ( one out of 2128- 1) as
question which is asked by the network.
A3
A3
SRES
MS
SRES
Network
Equal ?
SRES = Signed RESponse as an answer to that cryptographic question.

A3 is secret algorithm. Each operator may use his own:
A3 is a trap door function, i.e. easy to compute SRES out of Ki and RAND, but
difficult the other way around: to compute Ki out of RAND and SRES.
Ki is the secret authentification of a subscriber stored in a secure area of the SIM. Ki may be of
any format and length .
A broken authentification key is more critical than a broken communication ciphering !
11/6/2005
U.A.Hermann: GSM
291

1.9.2.2. The Functions
1.9.2.2.2. Encryption
Kc
(64 bits)
Frame number
(22 bits)
Either all (speech/data and signalling) or

nothing is encrypted due to simplicity.
Ciphering and deciphering = EXOR
between 114 bit of burst and 114 bit generated
by A5 algorithm
Ciphering key Kc is agreed between MS and BTS.
Frame nr
(22 bits)
A5
A5
S2
S1
(114 bits) (114 bits)
S1
(114 bits)
Kc
(64 bits)
ciphering
deciphering
MS
S2
(114 bits)
deciphering
+ ciphering
BTS
Uplink and downlink use different deciphering sequences S1 and S2.

Frame number representation is a concatenation of 3 values (T1, T3, T2). The resulting cycle is
the hyper-frame, lasting about 3,5 hours (if a call ever lasts that long!).
Kc is controlled by signalling means and typically changes with each call Kc does not need
as strong a protection as Ki, e.g. Kc can be read from SIM.
11/6/2005
U.A.Hermann: GSM
292

1.9.2.2.2. Encryption (continued)
A5 is specified on international level, as it must be implemented in each MS and BTS in order
to support roaming.
Several A5 algorithms are implemented (depending e.g. on export regulations for different
countries)
Level of protection (hardness) depends on the computing power needed to break Kc based
on FN and 114 bit ciphering sequence
Key Management:
Kc is agreed between MS and network prior to encryption during authentication process.
Kc is then stored in non volatile part of the SIM and in MSC/VLR = dormant key.
If authentication happens, while transmission already is ciphered, the active key for the
running ciphering is not affected, but the new dormant key is stored for use at the next
transmission between clear mode and cipher mode.
11/6/2005
U.A.Hermann: GSM
293

1.9.2.2.2. Encryption (continued)
A8 algorithm is used to compute Kc.
Ki
RAND
A8
Ki
RAND
A8
RAND is same as for authentication.

A8 is again operators choice and not part of GSM
standard.
Kc
MS
Kc
Network
Kc is limited to max. significant 64 bit. Insignificant

bits are filled up with 0.
A3 and A8 are always running together and often implemented as a single algorithm.
11/6/2005
U.A.Hermann: GSM
294

1.9.2.2.3. User Identity Protection
Encryption can only be initiated after the identity of the subscriber has been signalled on the
radio channel.
This would be a security loop hole, as it would allow to eavesdrop on this initial part of the
signalling exchange.
TMSI (Temporary Mobile Subscriber Identity) has been introduced as an alias in order to
avoid this clear text identification of IMSI.
TMSI is agreed beforehand between MS and network during protected (i.e. ciphered)
signalling !
11/6/2005
U.A.Hermann: GSM
295

1.9.2.3. Architecture and Protocols
SIM and AUC (typically part of HLR) store Ki and perform A3 and A8 computation.
Ki is written during card initialisation into SIM under tight control of operator.
Ki is only accessed internally in SIM during Kc and SRES computation.
Functions of MSC/VLR:
To initiate authentication,
Decision when to switch to cipher mode.
Comparison of SRES provided by MS with SRES provided by AUC
Storage of dormant Kc
Management of TMSI.
Security management functions are performed by the same protocols as location management
(plus some additional ones), see next figure.
MAP/G is a small protocol to transfer subscriber data between 2 MSC/VLRs.
11/6/2005
U.A.Hermann: GSM
296
1.9.-1 Security Management Protocols
RIL3-MM
MAP/D
HLR
MSC/VLR
MS
SIM-ME
MAP/G
AUC
SIM
MSC/VLR
11/6/2005
U.A.Hermann: GSM
297

1.9.2.4. The Signalling Mechanisms
1.9.2.4.1. Authentication and Encryption Key Management
2 different procedures:
Real time authentication procedure and Key setting procedure between MS and
MSC/VLR.
Procedure for transporting security related data between HLR/AUC and MSC/VLR.
The MS MSC Procedure
Authentication procedure between MSC/VLR and MS:
RIL3-MM Authentication Request message from visited MSC/VLR to MS.
Run GSM Algorithm message containing RAND from MS to SIM and shortly after
Get Response message from MS to SIM, which is answered
with SRES and Kc from SIM.
Kc is stored back in SIM and
RIL3-MM Authentication Response from MS to MSC/VLR giving SRES for checking.
11/6/2005
U.A.Hermann: GSM
298

1.9.2.4.1. Authentication and Encryption Key Management (contd)
Dealing with inconsistencies of dormant Kc:
MSC/VLR provides CKSN (= Ciphering Key Sequence Number) which is stored in SIM
together with Kc.
CKSN is given back to MSC/VLR at initial access.
If this is not consistent with stored CKSN in MSC/VLR a new authentification
procedure is needed before ordering cipher mode.
The MSC-HLR Procedures

Standard allows to do A3/A8 computation in MSC/VLR or in AUC.
Security breach: if computation in MSC/VLR, than the Ki would be transmitted via SS7
network to another switch. Additionally 2 or more operators would need to share A3/A8 !!!
Computation in AUC requires transmission of (RAND, Kc, SRES) via SS7. Typically
MSC/VLR stores several such triplets for use after roaming subscriber did first location update.
After each call a new triplet (use and throw away) is used
11/6/2005
U.A.Hermann: GSM
299

1.9.2.4.2. User Identity Protection
TMSI is allocated on LA basis . TMSI code = TMSI + LA code = TIC.
If MS does location updating attempt in new LA TMSI plus LAI is transmitted ! The new
MSC/VLR than asks the old one via MAP/G for the subscriber records
TIC = 4 octets length, which is shorter than IMSI (consisting of 15 digits coded in 9 octets), so
radio spectrum is saved.
TMSI is allocated to a MS when it registers 1st time in an LA and
released, when MS leaves LA.
TMSI allocation can either be done by a stand alone procedure or in conjunction with a
location updating between MS and MSC/VLR:
MS:
Location Updating request
MSC/VLR
Location Updating Accept
or
Location Updating request

Location Updating Accept
TMSI Reallocation Command

TMSI Reallocation Complete
11/6/2005
TMSI Reallocation Complete

U.A.Hermann: GSM
300

1.9.2.4.2. User Identity Protection (continued)
In the combined procedure: TMSI is part of the RIL3-MM Location Updating Accept.
TMSI Cancellation is normally implicit in MS
upon allocation of new TMSI or
upon location updating accept.
Explicit cancellation:
By sending IMSI in RIL3-MM Location Updating message. This is understood by MS
as a cancellation of previous TMSI.
TMSI is stored in the subscriber record in the VLR, not in HLR:
Record is deleted upon location cancellation by HLR
Problem in case of data base crash:
TMSI might be inconsistent and not allocated to the paged subscriber or (worse) to
another subscriber.
Solution: Network uses a procedure asking MS for its full IMSI:
RIL3-MM Identity Request and RIL3-MM Identity Response from MS.
Used e.g. if authentication failed or a MS calls with unknown TMSI.
11/6/2005
U.A.Hermann: GSM
301

1.9.3. Miscellaneous MM Functions
Generic Mobile Originating CM-Transaction Establishment
Why is this procedure needed:
The initial message of the MS can only be unciphered, as the decision to cipher is made
by the network.
However the MS has to give enough information to the network to make the decision to
cipher or not
Solution:
MS sends RIL3-MM CM Service Request message to the network.
Based on this message th enetwork may start authentication (RIL3-MM Authentication
Request message) or
answer with RIL3-MM CM Service Accept message or
by starting the ciphering mode setting procedure (RIL3-RR Ciphering Mode
Command message )
or by a rejection: RIL3-MM CM Service Reject message
An equivalent mobile terminated procedure does not exist, as the network decides to apply
ciphering before starting any upper layer procedure.
11/6/2005
U.A.Hermann: GSM
302

1.9.3. Miscellaneous MM Functions (continued)
Upper Layer Synchronisation:
Requirement: No MM or CC procedure may be started during a location updating procedure
in a location area different from the one in which the MS was previously registered till
RIL3-MM Location Updating Accept message has been received.
Reason: A subscriber must be correctly registered, before accessing any network service.
Infrastructure Activity Monitoring:

Problem:
Radio channel release is done by the infrastructure.
But due to a signalling failure the MS might be unaware, that the channel had been
released.
Solution:
MS goes automatically back to idle mode without sending any message to the network, if
there had been no CM-transaction for a given period (T3240 watchdog timer).
11/6/2005
U.A.Hermann: GSM
303

1.9.3. Miscellaneous MM Functions (continued)
Re-Establishment
Problem:
A MS might loose contact to the network whilst some service is ongoing.
Normally handover should salvage this situation.
But if HO is too slow (e.g. steep propagation loss) there might be a chance to resume
contact in the next cell
Solution:
Re-establishment is very similar to MS triggered handover.
The initial message of the MS is RIL3-MM CM Re-Establishment Request.
Than the network uses the same procedures as the for CM establishment:
RIL3-MM CM Re-Establishment Accept or
RIL3-MM CM Re-Establishment Reject.
The feature is optional for networks, but mandatory for mobiles.
If the feature is used in the network, the call context must be kept a little after contact
loss.
11/6/2005
U.A.Hermann: GSM
304
1.10. Communication Management

Managing calls is a standard task of all communication systems:
So GSM reused many concepts of existing ISDN protocols
and has to interwork with existing telecom networks.
GSM is seen as an access network to the global telecom network.
However the ISDN signalling was extended by the concept of the gateway MSC.
The key issues of Communication Management are how to
set up,
maintain and
terminate
a communication
So the questions are:
What is a communication,
What are its attributes
What are the key functions of call management.
11/6/2005
U.A.Hermann: GSM
305

1.10.1. Basics of Communication Management
Definition: A communication is a temporary relationship between
telecommunication users for the purpose of exchanging information.
A communication makes use of a transmission chain established through networks
between users.
A communication is by essence a distributed object existing over distances.
Cooperative management of the machines along the transmission line is needed .
Attributes of a communication may be static (initialized at the beginning of the
communication) or dynamic (changing during the call) .
11/6/2005
U.A.Hermann: GSM
306

1.10.2. Call Control
1.10.2.1. Routing of Mobile terminating calls
MSISDN:
Number of a mobile phone, is part of the ISDN numbering plan, consisting of e.g
.
National
Country Code
CC
e.g.: +49
destination Code
NDC
172
Subscriber number
1234567
A MT call does not go directly to a MS, but MSISDN points to a HLR, where the
subscription is held.
The HLR holds the location information of the mobile.
So a call is separated in 2 phases: before and after interrogation of HLR.
2 different cases, depending on where second part of the call goes through:
PSTN or ISDN (described here) or through data networks (not described here)
SMS is handled differently from .
11/6/2005
U.A.Hermann: GSM
307

1.10.2.1. Routing of Mobile terminating calls (continued)
First part (Interrogation phase) of call :
Routing is done as for any ISDN number : with tables in the switches.
A call from an external network is routed to the next GMSC.
GMSC runs request-answer procedure with HLR.
HLR answer contains:
Identity of subscriber (for billing)
Information for the next routing: routing number pointing to the called subscriber
in present location (or a third user in case of forwarding).
Second part of call (after interrogation) is directly switched from GMSC to MSC/VLR
Directory
number
MT Call
Directory
Number
HLR
Routing
number
GMSC
Routing
number
11/6/2005
U.A.Hermann: GSM
MSC VLR
308

1.10.2.1.1. Who pays What ?
Principle 1: Calling User pays.
Principle 2: In case of Call Forward or Roaming (= treated like Call Forward), the called
party pays the forwarded part of the call.
Reason: The caller can/shall not know where the called party is.
Principle 3: The subscriber is always charged by his operator.
Consequence: in case of roaming the guest network and the transit networks (if any)
charge the home operator of the subscriber.
Principle 4: Network operators dont charge directly against each other, but indirectly via a
neutral Clearing House
Example: (see next picture)
Roamer A from home network in Netherlands calls from Spain
Roamer B from home network in Germany, whilst roaming in France
Payment:
Roamer A is charged from his home PLMN for a Call from Spain to Germany.
Roamer B is charged from his home PLMN for a Call from Germany to France.
11/6/2005
U.A.Hermann: GSM
309
Figure 1.10.-1 Roaming Example
HLR
HLR
MSC/VLR
MSC/VLR
11/6/2005
U.A.Hermann: GSM
310

1.10.2.1.2. The GMSC Function
Main Functions of GMSC:
Point of interconnect to which mobile terminated calls are routed.
Generation of toll tickets (CDR= Charge Data Record) for 2nd part of call.
GMSC Requirements:
Switching capacity: GMSC may be independent from the radio access function
provided by the PLMN. It can be implemented as part of any network through which
calls are routed.
Special SW for e.g. creating toll tickets for the second part of calls.
Holding a table linking MSISDNs with HLRs. This table may or may not contain
foreign HLRs
Interrogating HLR for subscriber position.
GMSC may fulfil its gateway function only for one Home PLMN or more PLMNs
Topological trade offs:
The more GMSCs and the closer the net of GMSC less tromboning = leading a
MT call to a remote GMSC and than back again to a called subscriber who is close to
the calling party!
U.A.Hermann: GSM
11/6/2005
311

1.10.2.1.2. The GMSC Function (continued)
Topological trade offs: (continued)
Problem: (see next figure 1.10.-2)
Charging for the second branch of a call depends on position of GMSC.
So if GMSC is not in home country, a part of the second leg of the call has to be
charged to the calling party.
Example: Here the call leg from the country where the call originated to the home
country of the called subscriber. If the called MS again is roaming abroad, this third leg
of the call would have to be charged against the called party !
Solution/Compromise:
Practically always the GMSCs are in the home PLMN and only interrogating the HLR
for their own home PLMN.
So if the called subscriber belongs to a foreign PLMN, the MT call is routed to a
GMSC in her/his home country.
Consequence/disadvantage: tromboning, if called foreign subscriber is in the country
of the calling party.
So in most cases the networks are not optimised for routing, but for simplified billing
of foreign roamers!
2 call segments left: from calling party to home PLMN, from home PLMN to
visited PLMN
11/6/2005
U.A.Hermann: GSM
312
1.10.-2 Charging Principles of MT calls
Home
PLMN
HLR
d
C
GMSC
MSC VLR
local
exchange
d
MSC VLR
a
Calling party
pays for a, b, c, d
11/6/2005
Called party
pays for c
Visited
PLMN
U.A.Hermann: GSM
313

1.10.2.1.2. The GMSC Function (continued)
Charging : each GMSC is collecting the CDRs for the subsequent parts of the call.
Only way to avoid additional costs of roaming subscribers due to tromboning:
Immediately to terminate the call and called mobile roamer is calling back or
Supplementary Service Barring of Incoming Calls when Roaming outside the home
PLMN country .
Country A
switch
Country B
trombone
home
PLMN
switch
GMSC
switch
MSC VLR
Visited
PLMN
11/6/2005
HLR
U.A.Hermann: GSM
314

1.10.2.1.3. Where does the routing information come from
MSISDN
= directory number used to call subscribers.
MSISDN is part of E.164 numbering plan.
MSISDN consist of :
CC= Country Code (e.g. 49 for Germany)
NDC= National Destination Code (e.g. 171 for D1)
Subscriber number.
MSRN
= Mobile Subscriber Roaming Number
Routing number used on the second leg of an incoming call from GMSC to visited
MSC.
MSRN is invisible for users and solely used between switches.
MSRN is not allocated permanently to a subscriber.
IMSI: contains MCC= Mobile Country Code, which has the same function as the CC of
MSISDN.
11/6/2005
U.A.Hermann: GSM
315

1.10.2.1.3. Where does the routing information come from (continued)
Problem:
How does the GMSC know the MSRN to point to the visited MSC of the roaming
subscriber?
Solution: (see next figure 1.10.-3)
The HLR record contains the MSRN or the address of visited MSC/VLR.
If only the visited MSC address is available HLR has to first interrogate the visited
MSC/VLR to obtain the MSRN
The MSC/VLR chooses a roaming number from a pool of free numbers and links it
temporarily with the IMSI.
Typically the MSRN is allocated on a call per call basis in order to limit consumption
of directory numbers
11/6/2005
U.A.Hermann: GSM
316
1.10.-1 The provision of MSRN

MSISDN IMSI, VLR number,
HLR
MSISDN
1
2
MSRN
IMSI
MSRN
MSISDN
MSRN
GMSC
MSC VLR
MSRN IMSI
11/6/2005
U.A.Hermann: GSM
317

1.10.2.1.4. The Problem of Multi Service
GSM offers different bearer services as speech, fax, data, The kind of required
service is automatically signalled e.g. between ISDN and GSM (so far so good)
Problem: How can the required service be signalled via the (old and still widely spread)
PSTN (e.g. calling party uses analogue phone connection or PSTN is used as transit
network)?
Solution:
1. GSM Subscriber is first called via speech channel and than switches manually to
e.g. fax, or alternatively
2. A GSM subscriber gets as many MSISDN, as different services she/he subscribes
to.
Relationship between the different numbers is held in HLR.
VMSC is informed in the procedure of getting the MSRN.
VMSC than switches the correct bearer service
11/6/2005
U.A.Hermann: GSM
318

1.10.2.1.6. Impact of Call Forwarding
There are 2 different cases of call forwarding:
HLR is able to decide to forward a call as the result of an interrogation, the

GMSC gets back the forwarded to number
MSC/VLR does call forward,
This is the most efficient forwarding and should be preferred.

It happens e.g. in case of CFU (= Call Forward Unconditional) has been activated
via Supplementary Services.
e.g. for Call Forwarding on not Reachable (= CFNRc) if the HLR did not know
about the situation and therefore forwarded to the MSC/VLR, which tries in vain to
get hold of the MS
or this situation arose in case the MS did IMSI Detach and the operator has
chosen the network option not to transmit this status back to the HLR.
or in case of Call Forwarding on no Reply (= CFNRy)
Consequence:
For the calling party there is no difference.

For the called subscriber in case of roaming: big additional bill for call leg to foreign
PLMN!
Way out: install unconditional Call Forward in Case of Roaming
11/6/2005
U.A.Hermann: GSM
319

1.10.2.2. Architecture
Procedures of Call Management are described in this chapter and for this purpose:
Different entities and

protocols involved.
Main actors of Call Control are:
Mobile Station
Network and Switching Subsystem

(GMSC, MSC/VLR, IWF, HLR)
External network
HLR
RIL3-CC
MSC VLR
MAP/C
MAP/D
GMSC
Protocols used :
MS- MSC: RIL3-CC used to convey user requests between MS and network and
co-ordinate service provisioning.
GMSC-HLR: MAP/C. Enables GMSC to interrogate HLR, to get routing

information for incoming calls.
HLR- MSC/VLR: MAP/D. Mainly protocol for Mobility Management.
From MSC to external networks: TUP (= Telephone User Part) and ISUP (= ISDN User
Part)
of SS7
U.A.Hermann: GSM
11/6/2005
320

1.10.3. Supplementary Services
Generally Supplementary Services can be
Activated
Deactivated
Evtl. Parameters may be set (e.g. forward-to number)
Parameters may be interrogated
SS interact with call handling, e.g.
Call forwarding,
Call waiting
Call hold
11/6/2005
U.A.Hermann: GSM
321

1.10.4. Short Messages
SMS is packet oriented, so no end-to-end connection is required.
SMS may go on in parallel to a call .
SMS is asymmetric: MT SMS is considered as a different service from MO SMS .
Short message communication is always between a user and an SM-SC. So the ultimate
destination of the message is not relevant for the GSM infrastructure, but only for the SMSC.
11/6/2005
U.A.Hermann: GSM
322
1.11. Network Management

What does a network operator do in order to operate his net ?
Defining/Managing locations (=> cellular planning) and capacities of
infrastructure
Procurement, installation, linking of machines.
Configure machines => configuration management.
Fault handling => fault management.
Tuning and optimizing the network => performance management
Management of subscribers and their data.
Billing and charging.
The OSS (=Operation Subsystem) is supporting the operator in these tasks:
These tasks are not particular for GSM, but usual for many kinds of telecom
operations.
TMN (= Telecommunications Management Network) => architecture of the
OSS
11/6/2005
U.A.Hermann: GSM
323

1.11.1. Subscriber Management
Subscription = entitlement to obtain services from the network.
Certain activities have to be performed to manage subscriptions
Billing and charging:
CDRs (=Charge Data Records) have to be created and managed in order to
calculate call charges.
Additional aspect compared to fixed networks: Due to roaming inter-PLMN
billing and accounting has to be done.
Charging information is exchanged between networks.
11/6/2005
U.A.Hermann: GSM
324

1.11.2. Maintenance
Fault management includes:
minimisation of loss of service quality due to failure.
Detect failures
Report failures accurately.
Restore operational state of the failed network entity
Typical failure causes:
Limited lifetime of electronic components: with millions of components in a net with e.g.
10.000 BTS even a component lifetime of many years leads statistically to many faults per
day!
External impacts: lightning, electricity break down, storm, accident,
SW errors: SW complexity is so high, that a complete testing, particularly of all load,
overload and abnormal cases is impossible.
Aspects of maintenance:
Preventive maintenance and testing (e.g. self test, test loops etc.) to minimize failures.
Watch dogs, performance monitors, drive tests etc. to detect failures.
Automatic
recovery: switch to redundant
HW,
U.A.Hermann:
GSMrestart of SW, etc.
11/6/2005
325

1.11.3. Mobile Station Management
Defective MS might disturb the network and other users.
Measures:
Preventive approach: type approval : to prevent badly designed MS to enter service.
Curative approach: to identify faulty mobiles, inform users, bar services
11/6/2005
U.A.Hermann: GSM
326

1.11.4. System Engineering and Operation
Activities of system engineering:
Calculate capacity requirements,
Determine/Select locations.
Dimension & design interconnecting network (backbone network)
Configure system, parameter setting (e.g. handover parameters, routing tables etc.)
Cost effectiveness:
Adapt network configuration to the traffic and
to quality of service requirements.
Network planning= multidimensional, time variant optimisation problem !
Market forecasts needed in order to prepare net to expected traffic load.
A network is a living and growing object undergoing many changes as technologies
develops (e.g. from GSM to GPRS) change management required.
Planning:
Cellular planning as particular task for mobile networks.
Planning of switching and transmission systems as standard task.
11/6/2005
U.A.Hermann: GSM
327

1.11.5 Architecture and Protocols
Operation & Maintenance has to be done from remote and centralized machines:
Due to cost and efficiency reasons a typical German GSM net is managed from
10- 12 OMCs (Operation and Maintenance Centres) and central 1 NMC (=
Network Management Centre) for e.g. night time concentration.
Typical OMC tasks:
Change parameters,
Download SW
Start tests
Receive alarms, etc.
TMN is about
the machines designed for these tasks
and the networks and protocols between the machines
11/6/2005
U.A.Hermann: GSM
328
Bibliography
[Mouly, Pautet 1992]: Michel Mouly, Marie-Bernadette
Pautet : The GSM System for Mobile
Communications, 1992.
[Hildebrand - 2002]: Friedhelm Hildebrand: GSM and
UMTS, the Creation of Global Communication, Wiley
[Sklar - 1988]: Bernard Sklar: Digital Communications
Fundamentals and Applications , Prentice Hall
11/6/2005
U.A.Hermann: GSM
329

GSM V6

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

GSM V6

Uploaded by

Copyright:

Available Formats

Network Protocols and

Architectures of Mobile Radio

The Motivation (continued)

GSM with its enhancements (GPRS,HSCSD,WAP,

Mobiles produced per year: about 500 Mio. devices, more

The Motivation (continued)

In previously war thorn countries (like Afghanistan,

It is today cheaper to set up a wireless communication system

Wireless systems have been instrumental for the deregulation

Speed of innovation (features, size of terminals, prices etc.)

1.Global System for

Quality of service and security

From the subscribers point of view, the quality for voice

The system shall be capable of offering encryption of user

Radio frequency utilisation

The system concept to be chosen shall permit a high level of

The system parameters shall be chosen with a view to limit the

The identification plan shall be based on the relevant CCITT

Static view (figure 1.2.-1.) :

1.2.-1 Two dimensional view of a network

Describes the interworking of the system elements, based on events

Systematic of description in this lecture (Figure 1.2.-2.) :

Description of the GSM system in terms of machines.

Canonical architecture is described in the ETSI Recommendations

1.2.-2. The three axes of description

Static equipment view

Systematic of the Standard:

To describe the behaviour of the system at the interfaces

1.2.1.2. The borders of GSM (figure 1.2.-3.)

BSS= Base Station Subsystem,

NSS= Network and Switching Subsystem

OSS = Operation and maintenance sub-system

A interface = Interface between BSS and NSS

Figure 1.2.-3 GSM subsystem organisation

Terminal equipment: functions specific to the service, e.g. a fax

SIM (Subscriber Identity Module)

There is no personalisation need for the mobile equipment !

MS = Mobile Equipment + SIM

1.2.-4. Mobile station functional architecture

The mobile station may be a standalone equipment for certain services

BTS= Base transceiver station:

Radio reception and transmission, incl. antenna, signal processing, etc.

BSC (= base station controller) :

All radio interface management through remote command to BTS and

Abis interface not standardised for O&M functionality

1.2.-5. BSS components and interfaces

1.2.-5. BSS components and interfaces

The base station sub-system consists of BTSs, situated on the antenna

1.2.-6. Internal structure of the NSS

User data flow

Cost sensitivity for operators: remote and automatic control of thousands of

TMN (Telecommunication Management Network) concept: all OMCs

OMC-R= Radio OMC=> functions: CM (configuration management),

Subscription Management= subscriber data management and charging.

1.2.-7. OSS Organisation

1.3. Functional Planes

physical layer, digital signal processing, coding and

1.3. -1 General Protocol Architecture

1.3. Functional Planes

1.3. Functional Planes

1.3.4. Overview of Mobility Management

1.3. Functional Planes

1.3.5. Overview of Communication Management

1.4. Overview of Interfaces and Protocols