GSM/V1.

GSM ARCHITECTURE
GSM/BSS/AR/V1.0

Preliminary

By
Sasken Technical Training Team

SASKEN COMMUNICATION TECHNOLOGIES

LIMITED

GSM Architecture

II

AR/V1.0

GSM ARCHITECTURE

Document number:

AR01

Document version:

GSM/BSS/AR/V1.0

Sasken Confidential. All rights reserved.

Note to Users Documentation related to restricted rights No part of this book may be
reproduced in any form, by mimeograph or any other means, without permission from
Sasken technical training team.

Sasken Confidential

GSM Architecture

III

Publication History

Issue V1.0
Compilation of AR01 course with dedicated six lessons to
GSM Architecture.

Sasken Confidential

GSM Architecture

IV

CONTENTS
GSM Architecture
CHAPTER I
1. GSM Network Overview

1.1 Introduction

1.2 GSM Network Components

CHAPTER II
2. Mobile Station (MS)

2.1 Functions of MS

2.2 Mobile Equipment (ME)

2.3 Subscriber Identity Module (SIM)

2.4 Mobile Identification Numbers

12

2.4.1 MSISDN

12

2.4.2 IMSI

13

2.4.3 TMSI

13

2.4.4 MSRN

13

2.4.5 IMEI

14

CHAPTER III
3. Base Station Subsystem (BSS)

15

3.1 Functions of BTS

16

3.2 BTS Configurations

18

3.3 Base Station Controller (BSC)

19

3.4 Transcoder/Rate Adaptation Unit (TRAU)

21

Sasken Confidential

GSM Architecture

CHAPTER IV
4. Network Switching Subsystem (NSS)

24

4.1 Mobile-services Switching Center (MSC)

25

4.2 Home Location Register (HLR)

27

4.3 Visitor Location Register (VLR)

29

4.4 Authentication Center (AUC)

33

4.5 Equipment Identity Register (EIR)

35

4.6 Interworking Function (IWF)

36

4.7 Echo Canceler (EC)

37

4.8 Billing Center

38

CHAPTER V
5. Operations and Maintenance System (OMS)

39

5.1 Overview

39

5.2 Network Management Center (NMC)

42

5.3 Operations and Maintenance Center (OMC)

43

5.3.1 OMC-R functions

44

5.3.2 OMC-S functions

45

CHAPTER VI
6. GSM Interfaces

47

6.1 Introduction

47

6.2 The Radio Interface (MS to BTS)

48

6.3 Abis Interface (BTS to BSC)

49

6.4 A Interface (BSC to MSC)

49

6.5 Interfaces between other GSM entities

50

6.6 Mapping of GSM layers onto OSI layers

50

Sasken Confidential

GSM Architecture

1. GSM Network Overview

1.1 Introduction
A connection between two people a caller and the called person is the basic
service of all telephone networks. To provide this service, the network must be able to set
up and maintain a call, which involves a number of tasks: identifying the called person,
determining the location, routing the call, and ensuring that the connection is sustained as
long as the conversation lasts. After the transaction, the connection is terminated and
(normally) the calling user is charged for the service he has used.
In a fixed telephone network, providing and managing connections is a relatively
easy process, because telephones are connected by wires to the network and their location
is permanent from the networks point of view. In a mobile network, however, the
establishment of a call is a far more complex task, as the wireless (radio) connection
enables the users to move at their own free will providing they stay within the
networks service area. In practice, the network has to find solutions to three problems
before it can even set up a call:

Figure 1 Information required by a Mobile communications network

In other words, the subscriber has to be located and identified to provide him/her
with the requested services. In order to understand how we are able to serve the
subscribers, it is necessary to identify the main interfaces, the subsystems and network
elements in the GSM network, as well as their functions.

Sasken Confidential

GSM Architecture

1.2 GSM Network Components

When operating with analog mobile networks, experience has shown that centralised
intelligence generates excessive load in the system, thus decreasing the capacity. For this
reason, the GSM specification, in principle, provides the means to distribute intelligence
throughout the network. In a GSM network, this decentralized intelligence is
implemented by dividing the whole network into three separate subsystems:
Network Switching Subsystem (NSS)
Base Station Subsystem (BSS)
Operations Maintenance Subsystem (OMS)
In order to ensure that network operators will have several sources of cellular
infrastructure equipment, GSM decided to specify not only the air interface, but also the
main interfaces that identify different parts. These are three dominant interfaces, namely,
an A interface between Mobile Switching Center (MSC) and the Base Station Controller
(BSC), an A-bis interface between BSC and the Base Transceiver Station (BTS), and an
Um interface between the BTS and Mobile Station (MS). These three interfaces are
shown in Figure 1.2.

User

BSS

MS

Public voice and

MSC

Data networks

SS7
Other
MSC

Um

Figure 1.2 GSM Interfaces

The network switching subsystem includes the equipment and functions related to
end-to-end calls, management of subscribers, mobility, and interface with the fixed

Sasken Confidential

GSM Architecture

PSTN. It consists of
MSCs,
Visitor Location Register (VLR),
Home Location Register (HLR),
Authentication Center (AUC), and
Equipment Identity Register (EIR).
The MSC provides call setup, routing, and handover between BSCs in its own
area and to/from other MSC; an interface to the fixed PSTN; and other functions such as
billing.
The HLR is a centralized database of all subscribers registered in a PLMN. There
may be more than one HLR in PLMN, but the individual subscriber has entry to only one
of them.
The VLR is a database of all mobiles, currently roaming in the MSCs area of
control. As soon as an MS roams into a new MSC area, the VLR connected to that MSC
will request data about the MS from the HLR. At the same time, the HLR will be
informed as to which MSC area the MS resides. If, at a later time, MS wants to make a
call, the VLR will have all the information needed for the call setup without having to
interrogate the HLR each time. Thus, VLR in one sense is a distributed HLR. VLR also
contains more exact information about the mobile location.
The AUC is connected to the HLR. The function of the AUC is to provide HLR
with authentication parameters and ciphering keys that are used for security purposes.
The EIR is the database where the International Mobile Equipment Identity
(IMEI) numbers for all registered mobile equipment are stored.
Some other components of the network are Echo Canceller, which reduces the
annoying effect caused by the mobile network when connected to a PSTN circuit; and the
network Interworking Function (IWF), which is the interface between MSC and other

Sasken Confidential

GSM Architecture

networks such as PSTN and ISDN.

The base station subsystem includes the equipment and functions related to the
management of the connections on the radio path, including the management of
handovers. It mainly consists of a BSC, BTS, and the MS. MS is traditionally listed as a
part of the base station subsystem even though it is always one end of the conversational
path and holds dialogues with the network switching subsystem for the management of
its mobility. The MS includes both the capabilities of network termination and user
termination.
The GSM system is realized as a network of radio cells, which together provide
complete coverage of the service area. Each cell has a BTS with several transceivers. A
group of BTSs controlled by one BSC. There are various configurations of BSC-BTS.
Some configurations are best suited for high traffic, and some are meant to serve
moderate-to-low traffic areas. A BSC controls such functions as handover and power
control. BSS and BTS together are known as a BSS, which is viewed by the MSC
through a single interface as being the entity responsible for communication with MSs in
a certain area. A BSS is associated with the radio channel management, transmission
functions, radio link control, and quality assessment and preparation for handover. BSS
ensures the coverage of N cells, where N can be one or more.
The Operational and Maintenance Center (OMC) subsystem includes the
operation and maintenance of GSM equipment and supports the operator network
interface. It is connected to all equipment in the switching system and to the BSC. OMC
performs GSMs administrative functions (for example, billing) within a country. One of
the OMCs most important functions is the maintenance of the country HLR. Depending
upon the network size, each country may have more than one OMC. The global and
centralized management of the network is provided by the Network Management Center,
while the OMC is responsible for the regional management of the network. A typical
GSM architecture is shown in Figure 1.3.

Sasken Confidential

GSM Architecture

Figure 1.3 Typical GSM architecture

Sasken Confidential

GSM Architecture

2. Mobile Station
The MS consists of two parts, the Mobile Equipment (ME) and an electronic
smart card called a Subscriber Identity module (SIM).
The ME is the hardware used by the subscriber to access the network. The
hardware has an identity number associated with it, which is unique for that particular
device and permanently stored in it. This identity number is called the International
Mobile Equipment Identity (IMEI) and enables the network operator to identify mobile
equipment which may be causing problems on the system.
The SIM is a card which plugs into the ME. This card identifies the MS
subscriber and also provides other information regarding the service that subscriber
should receive. The subscriber is identified by an identity number called the International
Mobile Subscriber Identity (IMSI).
Mobile Equipment may be purchased from any store but the SIM must be
obtained from the GSM network provider. Without the SIM inserted, the ME will only be
able to make emergency calls. By making a distinction between the subscriber identity
and the ME identity, GSM can route calls and perform billing based on the identity of the
subscriber rather than the equipment or its location.

Sasken Confidential

GSM Architecture

2.1 Functions of MS
The primary functions of MS are to transmit and receive voice and data over the
air interface of the GSM system. MS performs the signal processing functions of
digitizing, encoding, error protecting, encrypting and modulating the transmitted signals.
It also performs the inverse functions on the received signals from the base station. A list
of relevant functions includes the following:
Voice and data transmission
The MS supports the transmission of voice and data over the air interface.
Frequency and Time synchronization
In order to transmit voice and data signals, the mobile must be in synchronization
with the system so that the messages are transmitted and received by the mobile at
the correct instant. To achieve this, the MS automatically tunes and synchronizes
to the frequency and TDMA timeslot specified by the BSC. This message is
received over a dedicated time slot several times within a multiframe period of 51
frames. The exact synchronization will also include adjusting the timing advance
to compensate for varying distance of the mobile from the BTS.
Monitoring of power and signal quality of the surrounding cells for optimum
handover
The MS monitors the power level and signal quality, determined by the Bit Error
Rate (BER) for known receiver bit sequences (synchronization sequence), from
both its current BTS and up to six surrounding BTSs. This data is received on the
downlink broadcast control channel. The MS determines and sends to the current
BTS a list of the six best received BTS signals. The measurement results from MS
on downlink quality and surrounding BTS signal levels are sent to BSC and
processed within the BSC. The system then uses this list for best cell handover
decisions. Unlike analog cellular systems, the measurement of adjacent signal
levels by the MS rather than the base station has several benefits. Since the
processing requirements are distributed to all mobiles rather than being
concentrated to a small number of base stations, it provides freedom and
flexibility to solve the anomalous propagation problems.
Provision of location updates
MS keeps the GSM network informed of its location during both national and
international roaming, even when it is inactive. As long as the system is switched
on, it either provides the location update periodically or the system will force it to
provide its present location. The system notes in which national PLMN, MSC

Sasken Confidential

GSM Architecture

zone and BSC area the MS is currently located. This enables the system to page in
its present location area.
Equalization of multipath distortions
The MS includes an equalizer that compensates for multipath distortion on the
received signal. This reduces intersymbol interference that would otherwise
degrade the BER. The equalizer tap setting is derived on every frame by
comparing the received synchronizing sequence with the locally stored sequence
within the MS.
Display of short messages
The MS can store and display short received alphanumeric messages on the liquid
crystal display (LCD) that is used to show call dialing and status information.
These messages are limited to 160 characters in length.
Timing advance
A MS must be able to adjust continuously its transmit time in order to compensate
for the variation of distance between the MS and the BTS. Timing advance is
determined by the BTS. When the MS is on a dedicated channel, the required
timing advance is sent to the MS and the actual timing advance used is reported
by the MS.
2.2 Mobile Equipment
The ME is the only part of the GSM network which the subscriber will really see.
There are three main types of ME, these are listed below:
Vehicle Mounted
These devices are mounted in a vehicle and the antenna is physically mounted on
the outside of the vehicle.
Portable Mobile Unit
This equipment can be handheld when in operation, but the antenna is not
connected to the handset of the unit.
Handportable Unit
This equipment comprises of a small telephone handset not much bigger than a
calculator. The antenna is be connected to the handset.
The ME is capable of operating at a certain maximum power output dependent on its
type and use.
These mobile types have distinct features which must be known by the network,
for example their maximum transmission power and the services they support. The ME is
therefore identified by means of a classmark. The classmark is sent by the ME in its
Sasken Confidential

GSM Architecture

initial message.
The following pieces of information are held in the classmark:
Revision Level
Identifies the phase of the GSM specifications that the mobile complies with.
RF Power Capability
The maximum power the MS is able to transmit, used for power control and
handover preparation. This information is held in the mobile power class number.
Ciphering Algorithm
Indicates which ciphering algorithm is implemented in the MS. There is only one
algorithm (A5) in GSM phase 1, but GSM phase 2 specifies different algorithms
(A5/0A5/7).
Frequency Capability
Indicates the frequency bands the MS can receive and transmit on. Currently all
GSM MSs use one frequency band, in the future this band will be extended but
not all MSs will be capable of using it.
Short Message Capability
Indicates whether the MS is able to receive short messages.
Table 2.1
Mobile Power Class, Maximum Power Level

2.3 Subscriber Identity Module (SIM)

GSM subscribers are provided with a SIM card with its unique identification at
the very beginning of the service. By separating the subscriber ID from the equipment ID,
the subscriber may never own the GSM mobile equipment set. The subscriber is
identified in the system when he inserts the SIM card in the mobile equipment. This
provides an enormous amount of flexibility to the subscribers since they can now use any
GSM-specified mobile equipment. Thus with a SIM card the idea of Personal
Communication is already realized. The smart card SIM is portable between Mobile
Equipment (ME) units. A sample SIM card is shown in Figure 2.2.

Sasken Confidential

GSM Architecture

10

Figure 2.2 SIM

The SIM is a removable smart card and contains an integrated circuit chip with a
microprocessor, random access memory (RAM) and read-only memory (ROM). It is
inserted in the ME by the subscriber when he or she wants to use the ME to make or
receive a call. The most important parameters that a SIM holds are presented in Table
2.2. It should be noted that the list is not complete and that the SIM can also be used to
store, for example, telephone numbers.
Table 2.2
Data stored on a SIM

Sasken Confidential

GSM Architecture

11

Table 2.2 (continued)

Sasken Confidential

GSM Architecture

12

2.4 Mobile Identification Numbers

GSM uses a number of descriptors to identify subscribers, equipment, and fixed
stations/areas. Many are temporary and used to maintain the confidentiality of fixed
identities. An understanding of these descriptors is essential when considering GSM
exploitation. There are basically three numbers that identify the mobile subscriber,
namely, the IMSI, MS-ISDN, and the TMSI, which is a temporary identification number
that is assigned by the serving MSC/VLR combination. The TMSI is mainly used for
security reasons to avoid broadcasting the IMSI over the RF air interface, thereby making
it harder for eavesdroppers. The TMSI is supposed to be changed on a per-call basis as
recommended by GSM specifications. The following subsections describe the structure
of these identifications.
2.4.1 Mobile Subscriber ISDN Number (MSISDN)
MSISDN is the directory number of a mobile subscriber. It must be dialed after
the international prefix in order to obtain a mobile subscriber in another country. The
MSISDN is composed of the country code (CC) followed by the National Destination
Code (NDC) and the Subscriber Number (SN) , which shall not exceed 15 digits. It may
be noted that it is possible for one subscriber to have several MSISDNs in parallel on one
SIM. The different MSISDNs are used to address different services, for example, one
number for voice, another number for fax. The format of the MSISDN is shown in Figure
2.3.

Figure 2.3 Format of the MSISDN

Example: 49 171 5205787 is the directory number of a subscriber to the D1 network in

Germany. The country code (CC) identifies a country or region (e.g., 49 for Germany, 1
for the United States); the national destination code (NDC) identifies the PLMN (e.g.,
171 for the operator D1); and the subscriber number (SN) is a unique identifier within the
PLMN.

Sasken Confidential

GSM Architecture

13

2.4.2 International Mobile Subscriber Identity (IMSI)

As identifier for a GSM subscriber, the IMSI is part of the subscriber data stored
on the subscriber identity module (SIM) card. The IMSI uniquely identifies one
subscription worldwide and is derived from ITU-T Recommendation E.212. Its structure
is similar to the ISDN number, which is defined in ITU-T Recommendation E.164. The
IMSI is a 15-digit number and is composed of the mobile country code (MCC), the
mobile network code (MNC), and the mobile subscriber identification number (MSIN).
Note that in GSM, unlike other standards, the MSIN of the IMSI is not used as the
subscribers telephone number. To make subscriber tracking more difficult, the IMSI is
used only as an identifier when the temporary mobile subscriber identity (TMSI) is not
available, e.g., for initial system connections. Figure 2.4. shows the format of the IMSI.

Figure 2.4 Format of the IMSI

2.4.3 Temporary Mobile Subscriber Identity (TMSI)

TMSI is used to identify a mobile subscriber, like the IMSI. Unlike the IMSI,
however, the 4-byte-long TMSI has only temporary significance. The VLR assigns a
TMSI upon location registration for confidentiality purposes, so it is not required to
transfer the IMSI over the Air-interface frequently. Under certain conditions (such as
traffic disruption and malfunctioning of the system), the MSC can direct individual
TMSIs to provide the MSC with their IMSI. In all cases, a subscriber will always respond
to IMSI even if a TMSI has been assigned. Assignment and use of the TMSI is only
possible with active ciphering. The TMSI can take any value, except FF FF FF FFhex.
This value is reserved in case the SIM does not contain a valid IMSI. Since the TMSI has
only local significance (that is, within the VLR and the area controlled by the VLR), the
structure of this can be chosen by each administration in order to meet local needs.
2.4.4 Mobile Station Roaming Number (MSRN)
MSRN is a temporary identifier used for mobile terminating calls to route a call
from the gateway MSC to the serving MSC/VLR. The serving MSC/VLR is the
MSC/VLR in which area the subscriber currently roams. The VLR assigns the MSRN
when a request for routing information is received from the HLR. The MSRN is released

Sasken Confidential

GSM Architecture

14

after the call has been set up. Figure 2.5 shows the format of an MSRN. The MSRN is
used solely to route an incoming call and contains no information to identify the caller or
the called party.

Figure 2.5 Format of an MSRN

2.4.5 International Mobile Equipment Identity (IMEI)

Figure 2.6 shows the format of the IMEI. In contrast to the IMSI, the IMEI
identifies the mobile equipment rather than the subscriber. Another difference to the
IMSI is that it is not mandatory for the network operator to query the IMEI. The purpose
of the IMEI is to be a means for passive theft protection. When this functionality is active
in a network, the Equipment Identity Register (EIR) maintains information on stolen
mobile equipment in a black list, which makes stolen mobile equipment useless. It is
even dangerous for a thief to use stolen equipment, since its use reveals the users
identity, which comes with the SIM, to the network operator.

Figure 2.6 Format of the IMEI

The IMEI comprises the following:

A 24-bit-long type approval code (TAC). Before any mobile equipment can be
brought into service, it has to undergo a test to show that it complies with safety
regulations and functionality requirements. This process is called type approval,
and the requirements are specified by GSM.
An 8-bit-long final assembly code (FAC), which identifies the manufacturing
facility.
A 24-bit-long serial number.
A spare field, currently not used.

Sasken Confidential

GSM Architecture

15

3. Base Station Subsystem (BSS)

The GSM Base Station Subsystem is the equipment located at a cell site. It
comprises a combination of digital and RF equipment. The BSS provides the link
between the MS and the MSC. The BSS communicates with the MS over the digital air
interface and with the MSC via 2 Mbit/s links. The BSS consists of three major hardware
components:
The Base Transceiver Station BTS
The BTS contains the RF components that provide the air interface for a
Particular cell. This is the part of the GSM network which communicates with the
MS. The antenna is included as part of the BTS.
The Base Station Controller BSC
The BSC as its name implies provides the control for the BSS. The BSC
communicates directly with the MSC. The BSC may control single or multiple
BTSs.
The Transcoder/Rate Adapter Unit TRAU
The Transcoder is used to compact the signals from the MS so that they are more
efficiently sent over the terrestrial interfaces. Although the transcoder is
considered to be a part of the BSS, it is very often located closer to the MSC to
allow more efficient use of the terrestrial links.

Figure 3.1 BSS components

Sasken Confidential

GSM Architecture

16

3.1 Functions of BTS

Figure 3.2 BTS generic architecture and functions

A BTS is a network component that serves one cell and is controlled by a BSC. It
comprises radio transmission and reception devices, up to and including the antennas, and
also all the signal processing specific to the radio interface. A single transceiver within
BTS supports eight basic radio channels of the same TDMA frame. A list of functions
performed by BTS is as follows.
Encodes, encrypts, multiplexes, modulates and feeds the RF signals to the
antenna
The primary responsibility of the BTS is to transmit and receive radio signals
from a mobile unit over an air interface. To perform this function completely, the
signals are encoded, encrypted, multiplexed, modulated, and then fed to the
antenna system at the cell site.
Transcoding and rate adaptation
Transcoding to bring 13 Kbps speech to a standard data rate of 16 Kbps and then
combining four of these signals to 64 Kbps is essentially a part of BTS, though, it
can be done at BSC or at MSC. The voice communication can be either at a full or

Sasken Confidential

GSM Architecture

17

half rate over logical speech channel.

Time and frequency synchronization signals transmitted from BTS
In order to keep the mobile synchronized, BTS transmits frequency and time
synchronization signals over Frequency Correction Channel (FCCH) and
Broadcast Control Channels (BCCH).
Received signal from mobile is decoded, decrypted and equalized for channel
impairments
Frequency hopping controlled such that no two MSs in the same BSC area
are hopped together
Since the GSM signals are supposed to be frequency hopped, the control within
the cell is actually exercised such that no two subcribers hop to the same
frequency. Thus it is the responsibility of the BTS to make sure that hopping
signals are kept orthogonal within the BSC serving area.
Random access detection
Random access detection is made by BTS, which then sends the message to BSC.
The channel subsequent assignment is made by BSC.
Timing advance
Timing advance is determined by BTS. BTS signals the mobile for proper timing
adjustment.
Uplink radio channel measurements
Uplink radio channel measurements corresponding to the downlink measurements
made by MS has to be made by BTS.

Sasken Confidential

GSM Architecture

18

3.2 BTS Configurations

Figure 3.3 BSS configurations

A BSC may control several BTSs, the maximum number of BTSs which may be
controlled by one BSC is not specified by GSM. Individual manufacturers specifications
may vary greatly.
The BTSs and BSC may either be located at the same cell site co-located, or
located at different sites Remote. In reality most BTSs will be remote, as there are
many more BTSs than BSCs in a network.
Another BSS configuration is the daisy chain. A BTS need not communicate
directly with the BSC which controls it, it can be connected to the BSC via a chain of
BTSs. Daisy chaining reduces the amount of cabling required to set up a network as a
BTS can be connected to its nearest BTS rather than all the way to the BSC. Problems
may arise when chaining BTSs, due to the transmission delay through the chain. The
length of the chain must, therefore, be kept sufficiently short to prevent the round trip
speech delay becoming too long.
Other topologies are also permitted, including stars and loops. Loops are used to
introduce redundancy into the network, for example if a BTS connection was lost, the
BTS may still be able to communicate with the BSC if a second connection is available.

Sasken Confidential

GSM Architecture

19

Figure 3.4 BTS connection modes

3.3 Base Station Controller (BSC)

Figure 3.5 BSC general architecture and functions

The BSC provides the control for the BSS. Any operational information required

Sasken Confidential

GSM Architecture

20

by the BTS will be received via the BSC. Likewise any information required about the
BTS (by the OMC for example) will be obtained by the BSC. The BSC incorporates a
digital switching matrix, which it uses to connect the radio channels on the air interface
with the terrestrial circuits from the MSC. The BSC switching matrix also allows the
BSC to perform handovers between radio channels on BTSs, under its control, without
involving the MSC. The functions of BSC are as follows.
The BSC performs the Radio Resource (RR) management for the cells under its
control. It assigns and releases frequencies and timeslots for all MSs in its own
area.
The BSC performs the intercell handover for MSs moving between BTSs in its
control.
It also reallocates frequencies to the BTSs in its area to meet locally heavy
demands during peak hours or on special events.
The BSC controls the power transmission of both BSSs and MSs in its area. The
minimum power level for a mobile unit is broadcast over the BCCH.
The BSC provides the time and frequency synchronization reference signals
broadcast by its BTSs.
The BSC also measures the time delay of received MS signals relative to the BTS
clock. If the received MS signal is not centered in its assigned time slot at the BTS,
the BSC can direct the BTS to notify the MS to advance the timing such that
proper synchronization takes place.
The BSC controls the frequency hopping of all the BTSs and MSs in its area. It
establishes the hopping sequence for each BTS and directs the BTS to inform the
MSs under its control of the assigned sequence.
The BSC may also perform traffic concentration to reduce the number of
transmission lines from the BSC to MSC and its BTSs.
The BSC also provides interface to the Operations and Maintenance Center for
BSS.

Sasken Confidential

GSM Architecture

21

3.4 Transcoder/Rate Adaptation Unit (TRAU)

Figure 3.6 TRAU general architecture and functions

The TRAU is required to convert the speech or data output from the MSC (64
kbit/s PCM), into the form specified by GSM specifications for transmission over the air
interface, that is, between the BSS and MS (64 kbit/s to 16 kbit/s and vice versa).
The 64 kbit/s Pulse Code Modulation (PCM) circuits from the MSC, if
transmitted on the air interface without modification, would occupy an excessive amount
of radio bandwidth. This would use the available radio spectrum inefficiently. The
required bandwidth is therefore reduced by processing the 64 kbit/s circuits so that the
amount of information required to transmit digitized voice falls to a gross rate of 16
kbit/s. The transcoding function may be located at the MSC, BSC, or BTS.
The content of the 16 kbit/s data depends on the coding algorithm used. There are
two speech coding algorithms available and selecting which one to use depends on the
capabilities of the mobile equipment and the network configuration. The Full Rate speech
algorithm is supported by all mobiles and networks. It produces 13 kbit/s of coded speech
data plus 3 kbit/s of control data which is commonly referred to as TRAU data
(Transcoder Rate Adaptation Unit).

Sasken Confidential

GSM Architecture

22

Figure 3.7 TRAU reduces PCM links on a 4:1 ratio

The TRAU data on the downlink will be used by the BTS and therefore removed
from the 13 k of speech data before transmission on the air interface. the 13 kbit/s of
speech data is processed at the BTS to form a gross rate of 22.8 kbit/s on the air interface
which includes forward error correction. In the uplink direction the BTS adds in TRAU
data which will be used by the transcoder.
Enhanced Full Rate is an improved speech coding algorithm and is only supported
by Phase 2+ mobiles and is optional in the Network. It produces 12.2 kbit/s from each 64
kbit/s PCM channel. The TRAU data in this case is made up to 3.8 kbit/s to keep the
channel rate to and from the BTS at 16 kbit/s as for Full Rate. As with Full Rate the
TRAU data is used at the BTS and Transcoder.
For data transmissions the data is not transcoded but data rate adapted from 9.6
kbit/s (4.8 kbit/s or 2.4 kbit/s may also be used) up to a gross rate of 16 kbit/s for

Sasken Confidential

GSM Architecture

23

transmission over the terrestrial interfaces, again this 16 kbit/s contains a 3 kbit/s TRAU.
As can be seen from the Figure 3.7, although the reason for transcoding was to
reduce the data rate over the air interface, the number of terrestrial links is also reduced
approximately on a 4:1 ratio. When the TRAU is installed at the MSC site (see top
portion of Figure 3.8), a fullrate speech channel uses only 16 Kbps over the link from the
BSC to the MSC.
The specifications allow for the installation of the TRAU between the BTS and
the BSC. That requires, however, the use of 64-Kbps channels between the BSC and the
MSC and hence the use of more links (see bottom portion of Figure 3.8). This variant is,
therefore, used only infrequently. In fact, most of the time, the TRAU is installed at the
site of the MSC to get the most benefit from the compression.

Figure 3.8 Possible configurations where TRAU can be inserted in the BTS, BSC and MSC chain

Sasken Confidential

GSM Architecture

24

4. Network Switching Subsystem (NSS)

The Network Switching Subsystem (NSS) includes the main switching functions
of the GSM network. It also contains the databases required for subscriber data and
mobility management. Its main function is to manage communications between the GSM
network and other telecommunications networks.
The components of the Network Switching System are listed below:
Mobile-services Switching Centre MSC
Home Location Register HLR
Visitor Location Register VLR
Equipment Identity Register EIR
Authentication Centre AUC
InterWorking Function IWF
Echo Canceller EC
The location registers are database-oriented processing nodes which address the
problems of managing subscriber data and keeping track of a MSs location as it roams
around the network. Functionally, the Interworking Function and the Echo Cancellers
may be considered as parts of the MSC, since their activities are inextricably linked with
those of the switch as it connects speech and data calls to and from the MSs.
The subsystems are interconnected directly or indirectly via the worldwide SS7
network. The network topology of the NSS is more flexible than the hierarchical structure
of the BSS. Several MSCs may, for example, use one common VLR; the use of an EIR is
optional, and the required number of subscribers determines the required number of
HLRs.
Figure 4.1 provides an overview of the interfaces between the different network
elements in the NSS. Note that most interfaces are virtual, that is, they are defined as
reference points for signaling between the network elements.

Sasken Confidential

GSM Architecture

25

Figure 4.1 The NSS

4.1 Mobile-services Switching Center (MSC)

From a technical perspective, the MSC is just an ordinary Integrated Services
Digital Network (ISDN) exchange with some modifications specifically required to
handle the mobile application. That allows suppliers of GSM systems to offer their
switches, familiar in many public telephone networks, as MSCs. SIEMENS with its
EWSD technology and ALCATEL with the S12 and the E10 are well-known examples
that benefit from such synergy. A list of relevant functions performed by MSC includes
the following.
Paging

Specifically, the call-handling function of paging is controlled by MSC.

Coordination of call set up from all MSs in its jurisdiction
MSC coordinates the call set up of calls to and from all GSM subscribers operating in
its area.
Dynamic allocation of resources
The dynamic allocation of access resources is done in coordination with the BSS.
More specifically, the MSC decides when and which types of channels should be
assigned to which MS. The channel identity and related radio parameters are the
responsibility of the BSS.
Interworking function with different networks
The MSC provides the control of interworking with different networks.
Handover management
The MSC supervises the connection transfer between different BSSs for MSs, with an
Sasken Confidential

GSM Architecture

26

active call, moving from one cell to another. This is ensured if the two BSSs are
connected to the same MSC but also when they are not. In this latter case the
procedure is more complex, since more than one MSC is involved.
Billing for all subscribers based in its area
The MSC performs billing on calls for all subscribers based in its area. When the
subscriber is roaming elsewhere, the MSC obtains data for the call billing form the
visited MSC
Encryption
Encryption parameters transfer from VLR to BSS to facilitate ciphering on the radio
interface is done by MSC.
Signaling exchange between different interfaces
The exchange of signaling information on the various interfaces towards the other
network elements and the management of the interfaces themselves are all controlled
by the MSC.
Gateway to SMS
The MSC serves as a SMS gateway to forward SMS messages from Short Message
Service Centers (SMSC) to the subscribers and from the subscribers to the SMSCs. It
thus acts as a message mailbox and delivery system.
4.1.1 Gateway MSC (GMSC)
An MSC with an interface to other networks is called a gateway MSC. Figure 4.2
shows a PLMN with gateway MSCs interfacing other networks. Network operators may
opt to equip all of their MSCs with gateway functionality or only a few. Any MSC that
does not possess gateway functionality has to route calls to external networks via a
gateway MSC.
The gateway MSC has some additional tasks during the establishment of a mobile
terminating call from an external network. The call has to enter the PLMN via a gateway
MSC, which queries the HLR and then forwards the call to the MSC where the called
party is currently located.

Sasken Confidential

GSM Architecture

27

Figure 4.2 Functionality of the gateway MSC

4.2 Home Location Register (HLR)

Figure 4.3 HLR is a permanent database

Every PLMN requires access to at least one HLR as a permanent store of data.

Sasken Confidential

GSM Architecture

28

The HLR can best be regarded as a large database with access times that must be kept as
short as possible. The faster the response from the database, the faster the call can be
connected. Such a database is capable of managing data for literally hundreds of
thousands subscribers.
Within the HLR, subscriber-specific parameters are maintained, such as the
parameter Ki, which is part of security handling. It is never transmitted on any interface
and is known only to the HLR and the SIM, as shown in Figure 4.3.
Each subscriber is assigned to one specific HLR, which acts as a fixed reference
point and where information on the current location of the user is stored. To reduce the
load on the HLR, the VLR was introduced to support the HLR by handling many of the
subscriber-related queries (e.g., localization and approval of features).
Because of the central function of the HLR and the sensitivity of the stored data, it
is essential that every effort is taken to prevent outages of the HLR or the loss of
subscriber data.

Figure 4.3 Only the SIM and the HLR know the value of Ki.

The permanent data stored in an HLR includes the following.

IMSI: It identifies unambiguously the MS in the whole GSM system.
MSISDN: It is the directory number of the mobile station.
MS category specifies whether a MS is a payphone or not.
Roaming restriction (allowed or not).
Closed user group (CUG) membership data.
Supplementary services related parameters: Forwarded-to number, registration status,

Sasken Confidential

GSM Architecture

29

no reply condition timer, call barring password, activation status, supplementary

services check flag.
Authentication key, which is used in the security procedure and especially to
authenticate the declared identity of a MS.
The temporary data consists of the following.
RAND/SRES and Kc (data related to authentication and ciphering)
MSRN
VLR address, which identifies the VLR currently handling the MS
MSC address, which identifies the MSC area where the MS is registered
Message waiting data (used for SMS)
The permanent data associated with the mobile are those that do not change as it
moves from one area to another. On the other hand, temporary data changes from call to
call. The HLR interacts with MSCs mainly for the procedures of interrogation for routing
calls to a MS and to transfer charging information after call termination.

4.3 Visitor Location Register (VLR)

Figure 4.4 VLR is a temporary database

The VLR contains a copy of most of the data stored at the HLR. It is, however,

Sasken Confidential

GSM Architecture

30

temporary data which exists for only as long as the subscriber is active in the particular
area covered by the VLR. The VLR database will therefore contain some duplicate data
as well as more precise data relevant to the subscriber remaining within the VLR
coverage.
The VLR provides a local database for the subscribers wherever they are
physically located within a PLMN, this may or may not be the home system. This
function eliminates the need for excessive and time-consuming references to the home
HLR database.
The additional data stored in the VLR is listed below:
Mobile status (busy/free/no answer etc.).
Location Area Identity (LAI).
Temporary Mobile Subscriber Identity (TMSI).
Mobile Station Roaming Number (MSRN).
4.3.1 Location Area Identity (LAI)
Cells within the Public Land Mobile Network (PLMN) are grouped together into
geographical areas. Each area is assigned a Location Area Identity (LAI), a location area
may typically contain 30 cells. Each VLR controls several LAIs and as a subscriber
moves from one LAI to another, the LAI is updated in the VLR. As the subscriber moves
from one VLR to another, the VLR address is updated at the HLR. The format of the LAI
is shown in Figure 4.5. The shaded, one-digit field is a filler (1111bin). It extends the only
three-digit MCC to 2 bytes. That is not necessary for the two-digit (1-byte) MNC. The
actual location area code (LAC) is four digits long. The LAC is an identifier that can be
assigned by the network operator. All values, except 0000hex and FFFEhex, are allowed.
Those two values are reserved for cases when the LAI on a SIM has been deleted.

Figure 4.5 Format of the LAI

4.3.2 Temporary Mobile Subscriber Identity (TMSI)

The VLR controls the allocation of new Temporary Mobile Subscriber Identity
(TMSI) numbers and notifies them to the HLR. The TMSI will be updated frequently,
this makes it very difficult for the call to be traced and therefore provides a high degree
Sasken Confidential

GSM Architecture

31

of security for the subscriber. The TMSI may be updated in any of the following
situations:
Call setup.
On entry to a new LAI.
On entry to a new VLR.
4.3.3 Mobile Subscriber Roaming Number (MSRN)
As a subscriber may wish to operate outside its home system at some time, the
VLR can also allocate a Mobile Station Roaming Number (MSRN). This number is
assigned from a list of numbers held at the VLR (MSC). The MSRN is then used to route
the call to the MSC which controls the base station in the MSs current location.
The database in the VLR can be accessed by the IMSI, the TMSI or the MSRN.
Typically, but not necessarily, a VLR is linked with a single MSC. The GSM standard
allows, as Figure 4.6 illustrates, the association of one VLR with several MSCs.

Figure 4.6 The NSS hierarchy

The initial intentions were to specify the MSC and the VLR as independent
network elements. However, when the first GSM systems were put into service in 1991,
numerous deficiencies in the protocol between the MSC and the VLR forced the
manufacturers to implement proprietary solutions. That is the reason the interface
between the MSC and the VLR, the B-interface, is not mentioned in the specifications of

Sasken Confidential

GSM Architecture

32

GSM Phase 2. GSM Recommendation 09.02 now provides only some basic guidelines on
how to use that interface.
Table 4.1 lists the most important data contained in the HLR and the VLR.
Table 4.1
The Most Important Data in the HLR and the VLR

Sasken Confidential

GSM Architecture

33

4.4 Authentication Center (AUC)

Figure 4.7 Authentication center generates security related parameters

The Authentication Center (AUC) is a database that contains the secret

authentication key Ki of each subscriber and generates security-related parameters to
protect the network operator and subscribers against fraud.
The same Ki is to be found in the subscribers SIM card and is used to generate
these ciphering items named as triplets:
a RANDom number RAND,
a Signature RESponse SRES, using the A3 algorithm,
ciphering Key Kc, using the A8 algorithm and computed each time authentication
is performed.
Software keys Kc and SRES are never passed over the air interface. The two
algorithms A3 and A8 are operator dependent.
AUC will normally be co-located with the Home Location Register (HLR) as it will
be required to continuously access and update, as necessary, the system subscriber
records. The AUC/HLR centre can be co-located with the MSC or located remote from
the MSC. The authentication process will usually take place each time the subscriber
initializes on the system.

Sasken Confidential

GSM Architecture

34

4.4.1. Authentication Process

To discuss the authentication process we will assume that the VLR has all the
information required to perform that authentication process (Kc, SRES and RAND). If
this information is unavailable, then the VLR would request it from the HLR/AUC.
1) Triplets (Kc, SRES and RAND) are stored at the VLR.
2) The VLR sends RAND via the MSC and BSS, to the MS (unencrypted).
3) The MS, using the A3 and A8 algorithms and the parameter Ki stored on the MS
SIM card, together with the received RAND from the VLR, calculates the values
of SRES and Kc.
4) The MS sends SRES unencrypted to the VLR
5) Within the VLR the value of SRES is compared with the SRES received from the
mobile. If the two values match, then the authentication is successful.
6) If ciphering is to be used, Kc from the assigned triplet is passed to the BTS.
7) The mobile calculates Kc from the RAND, A8 and Ki on the SIM.
8) Using Kc, A5 and the GSM hyperframe number, encryption between the MS and
the BSS can now occur over the air interface .
The first time a subscriber attempts to make a call, the full authentication process
takes place. However, for subsequent calls attempted within a given system control time
period, or within a single system providers network, authentication may not be
necessary, as the data generated during the first authentication will still be available.
Note: The triplets are generated at the AUC by:
RAND = Randomly generated number.
SRES = Derived from A3 (RAND, Ki).
Kc = Derived from A8 (RAND, Ki).
A3 = From 1 of 16 possible algorithms defined on allocation of IMSI and creation
of SIM card.
A8 = From 1 of 16 possible algorithms defined on allocation of IMSI and creation
of SIM card.
Ki = Authentication key, assigned at random together with the versions of A3 and
A8.

Sasken Confidential

GSM Architecture

35

4.5 Equipment Identity Register (EIR)

The separation of the subscriber identity from the identifier of the MS also bears a
potential pitfall for GSM subscribers. Because it is possible to operate any GSM MS with
any valid GSM SIM, an opportunity exists for a black market in stolen equipment. To
combat that, the EIR was introduced to identify, track, and bar such equipment from
being used in the network.
Each GSM phone has a unique identifier, its IMEI, which cannot be altered
without destroying the phone. The IMEI contains a serial number and a type identifier.
Like the HLR or the VLR, the EIR basically consists of a database, which maintains three
lists:
(1) White List: contains those IMEIs that are known to have been assigned to valid
MSs. This is the category of genuine equipment.
(2) Black List: contains those IMEIs known to be stolen or to be barred for
technical reasons.
(3) Gray list: contains IMEIs of mobiles that have problems (for example, faulty
software, wrong make of the equipment). This list contains all MEs with
faults not important enough for barring.

Figure 4.8 Contents of the EIR.

The prices for mobile equipment have fallen dramatically due to the great success

Sasken Confidential

GSM Architecture

36

of GSM; consequently, the theft rate is low. Several GSM operators have decided not to
install the EIR or, at least, to postpone such installation for a while. If the EIR is installed,
there is no specification on when the EIR should be interrogated. The EIR may be
queried at any time during call setup or location update.

4.6 Interworking Function (IWF)

Figure 4.9 GSM to PSTN interface

GSM provides a wide range of data services to its subscribers. The GSM system
interfaces with the various forms of public and private data networks. It is the job of the
IWF to provide this interfacing capability. Networks to which IWF provides interface are
as follows.
PSTN
ISDN
Circuit-switched public data networks (CSPDN)
Packet-switched public data networks (PSPDN)
The IWF, which in essence is a part of MSC, provides the subscriber with access
to data rate and protocol conversion facilities so that data can be transmitted between
GSM Data Terminal Equipment (DTE) and a land-line DTE. It will also allocate a
modem from its modem bank when required. This will be the case when the GSM DTE

Sasken Confidential

GSM Architecture

37

exchanges data with a land DTE connected via an analog modem, through a narrowband
PSTN circuit.
The IWF also provides direct-connect interfaces for customer-provided equipment
such as X.25 PADs. In order to achieve this interconnection, the IWF has to convert
protocols between the GSM PLMN and the connecting network. Different protocol
conversions may be required for signaling and traffic messages. This may include data
rate adaptation and the addition of signaling bits reformatting. Additionally, as previously
stated, this may also require an audio modem for transmission through a narrowband
telephone link.

4.7 Echo Canceler (EC)

Figure 4.10 Generation of echoes at 4-wire to 2-wire interface

An EC is used on the PSTN side of the MSC for all voice circuits. Echo control is
required at the switch because the inherent GSM system delay can cause an unacceptable
echo condition, even on short distance PSTN circuit connections.
The total round trip delay introduced by the GSM system (the cumulative delay
caused by call processing, speech encoding and decoding etc) is approximately 180 ms.
This would not be apparent to the MS subscriber, but for the inclusion of a 2-wire to 4wire hybrid transformer in the circuit. This is required at the land partys local switch
because the standard telephone connection is 2-wire. The transformer causes the echo.
This does not affect the land subscriber.
During a normal PSTN land to land call, no echo is apparent because the delay is
too short and the user is unable to distinguish between the echo and the normal telephone
side tone. However, without the EC and with the GSM round trip delay added, the
effect would be very irritating to the MS subscriber, disrupting speech and concentration.

Sasken Confidential

GSM Architecture

38

The standard EC will provide cancellation of up to 68 milliseconds on the tail

circuit (the tail circuit is the connection between the output of the EC and the land
telephone).

4.8 Billing Center

The billing center is a system provided by the PLMN administration that collects
the billing data from the GSM network entities and applies that data to subscribers
accounts. The details of the billing centers operation are not addressed by GSM
specifications. Billing data is made of two parts: call records produced by MSCs and
event records produced by HLRs and VLRs. These event records are the results of the
number of times these databases are accessed due to mobility of the user, such as location
updates and the forwarding of the mobile-terminated calls. Whereas GSM recommends
that each MS involved in a call produce a separate call record, the initial MSC (anchor
MSC) involved with a call is assigned the role of collecting call record data from any
other MSCs that were involved in the call. When the call disconnects, the initial MSC
assembles the call data into a single, composite call record that is subsequently sent to the
billing center. In this way, calls that enter the PLMN through a gateway MSC can be
ticketed with only one call record. Mobile-originated calls switched from one MSC to
another, within the PLMN, before entering the PSTN, are also ticketed with a single call
record. Also, inter-MSC handover data can be included by the single record format.
The records are stored in a disk file as they are being generated. The file has a
fixed size; and when the file becomes full, it is automatically closed and a new one
opened. The complete file can be automatically transferred to the billing center using
X.25 communication links.

Sasken Confidential

GSM Architecture

39

5. Operations and Maintenance System (OMS)

5.1 Overview

Figure 5.1 The OMS and the GSM network.

The operations and maintenance system provides the capability to manage the
GSM network remotely. This area of the GSM network is not currently tightly specified
by the GSM specifications, it is left to the network provider to decide what capabilities
they wish it to have. The functions of the OMS can be divided into three broad
categories:

Fault management

Configuration management

Performance management
These functions cover the whole of the GSM network elements from the level of
individual BTSs, upto MSCs and HLRs.

Sasken Confidential

GSM Architecture

40

Fault management

Figure 5.2 Fault management

The purpose of fault management is to ensure the smooth operation of the

network and rapid correction of any kind of problems that are detected. Fault
management provides the network operator with information about the current status of
alarm events and maintains a history database of alarms.
The alarms are stored in the OMS database and this database can be searched
according to criteria specified by the network operator.
Configuration management

Figure 5.3 Configuration management

The purpose of configuration management is to maintain up-to-date information

about the operation and configuration status of network elements. Specific configuration
functions include the management of the radio network, software and hardware
management of the network elements, time synchronization, and security operations.

Sasken Confidential

GSM Architecture

41

Performance management

Figure 5.4 Performance management

In performance management, the OMS collects measurement data from individual

network elements and stores it in a database. On the basis of these data, the network
operator is able to compare the actual performance of the network with the planned
performance and detect both good and bad performance areas within the network.
The Operations and Maintenance System comprises two parts:
Network Management Centre (NMC)
The Network Management Centre (NMC) has a view of the entire PLMN and is
responsible for the management of the network as a whole. The NMC resides at the
top of the hierarchy and provides global network management.
Operations and Maintenance Centre (OMC)
The Operations and Maintenance Centre (OMC) is a centralized facility that
supports the day to day management of a cellular network as well as providing a
database for long term network engineering and planning tools. An OMC manages
a certain area of the PLMN thus giving regionalized network management.

Sasken Confidential

GSM Architecture

42

5.2 Network Management Center (NMC)

Figure 5.5 NMC

The NMC offers the ability to provide hierarchical regionalized network

management of a complete GSM system.
It is responsible for operations and maintenance at the network level, supported
by the OMCs which are responsible for regional network management. The NMC is
therefore a single logical facility at the top of the network management hierarchy.
The NMC has a high level view of the network, as a series of network nodes and
interconnecting communications facilities. The OMC, on the other hand, is used to filter
information from the network equipment for forwarding to the NMC, thus allowing it to
focus on issues requiring national co-ordination. The NMC can also co-ordinate issues
regarding interconnection to other networks, for example the PSTN.

Sasken Confidential

GSM Architecture

43

The NMC can take regional responsibility when an OMC is not manned, with the
OMC acting as a transit point between the NMC and the network equipment. The NMC
provides operators with functions equivalent to those available at the OMC.

5.3 Operations and Maintenance Center (OMC)

The objective of the OMC is to offer customer cost-effective support for the
centralized regional and local operational and maintenance activities required for a
cellular network. The main purpose of the OMC is to perform all operations and
maintenance functions on elements of the GSM PLMN system. In that sense it provides a
central network overview and supports the maintenance functions of different O&M
organizations. The OMC, in general, communicates through leased lines on the PSTN or
other fixed networks. The OMC message and data transfers can either be carried by SS7
or X.25 protocols. SS7 protocols are mostly used within the GSM PLMN for short and
medium length control message transactions through the PSTN or ISDN circuits. On the
other hand, X.25 may be used for large external data transfers such as software
downloading or subscriber database transfers from subscription centers.
At present, equipment manufacturers have their own OMCs which are not
compatible in every aspect with those of other manufacturers. This is particularly the case
between radio base station equipment suppliers, where in some cases the OMC is a
separate item and Digital Switching equipment suppliers, where the OMC is an integral,
but functionally separate, part of the hardware. There are two types of OMC.
OMC (R)
OMC controls specifically the Base Station System.
OMC (S)
OMC controls specifically the Network Switching System.

Sasken Confidential

GSM Architecture

44

5.3.1. OMC-R Functions

Figure 5.6 OMC-R Functions

The OMC-R is made up of servers and stations. Each WorkStation provides the
operating staff with a Graphical User Interface, called Human Machine Interface. The
server centralizes the O&M functions dedicated to the BSS network elements and thus
allows consistent management of the BSS network elements. The following O&M
functions are provided:
Security management: to manage user profiles in order to control the users access to
functions provided by the OMC-R.
Configuration management: to manage the resources to be supervised. Examples of
resources that can be managed: PCM links, SS7 and traffic channels on A interface, cells,
list of frequencies allocated in each cell, list of adjacent cells of a given cell, frequency
hopping laws implemented in the cells, TDMA frames.
Performance management: values of counters are collected from the BSS network
elements and reports are generated and displayed to the users. Thresholds can be defined
and associated with the counters to generate alarms for maintenance purposes.
Fault management: the OMC-R handles event reports received from the network
elements and related to anomalies. Alarm messages can be generated with a severity from
these reports by using criteria defined by the user.
The following internal functions are provided:

Sasken Confidential

GSM Architecture

45

Server administration: supervision, switch-over and backup of the servers and

stations.
Common functions: inter-user mail (running within an SMS-C server), management
and execution of commands file, calendar for the deferred or periodic execution of a
command or a command file, on-line help.
File transfer management: downloading and activation of the software releases
dedicated to TRAU, BSC, BTS is centralized via the OMC-R.
5.3.2. OMC-S Functions

Figure 5.7 OMC-S Functions

The Operation and Maintenance Center of the NSS part (OMC-S) may be able to
achieve different kinds of functions.
NSS configuration management:
BSCs, Location Areas, Cells.
Terrestrial links, etc.
Software configuration (downloading, file transfer).
MSRN and handover number management.
Fault management:
Detection.

Sasken Confidential

GSM Architecture

46

Presentation.
Re-configuration.
Performance management:
Traffic control.
Service quality monitoring.
Security management:
User profiles.
Session monitoring.
OMC-S operation:
System management.
OMN management.
File transfer operations.

5.4 Conclusions
With the standardization of A- and A-bis interfaces, the road toward a flexible, efficient
and cost-effective base station has been created. As a result, it has formed a competitive
equipment market and a future evolution of the individual network components. Thus, the
following points can be made.
Mobiles can now take their equipment anywhere in the world and get the GSM
service in the same way as if they were in their home PLMN.
Optimum choice of BSC and BTS can now be adopted for both rural and urban
areas.
Equipment manufacturers can independently develop MSC, BSC, and BTS
subsystems.
Equipment developed by different manufacturers can now be easily interfaced.

Sasken Confidential

GSM Architecture

47

6. GSM Interfaces
6.1 Introduction
One of the main purposes behind the GSM specifications is to define several open
interfaces, which then limit certain parts of the GSM system. Because of this interface
openness, the operator maintaining the network may obtain different parts of the network
from different GSM network suppliers. When an interface is open, it also strictly defines
what is happening through the interface, and this in turn strictly defines what kind of
actions/procedures/functions must be implemented between the interfaces.
The GSM specifications define two truly open interfaces within the GSM
network. The first one is between the Mobile Station and the BTS. This open-air interface
is appropriately named the air interface. It is relatively easy to imagine the need for
this interface to be open, as mobile phones of all different brands must be able to
communicate with GSM networks from all different suppliers.
The second interface is located between the MSC and the BSC. This interface is
called the A-interface. The system includes more than the two defined interfaces, but
they are not totally open, as the system specifications have not been completed when the
commercial systems were launched. The GSM system along with different interfaces is
shown in Figure 6.1.

Figure 6.1 GSM system and interfaces

Sasken Confidential

GSM Architecture

48

6.2 The Radio Interface (MS to BTS)

The Um radio interface (between MS and base transceiver stations [BTS]) is the
most important in any mobile radio system, in that it addresses the demanding
characteristics of the radio environment. The physical layer interfaces to the data link
layer and radio resource management sub layer in the MS and BS and to other functional
units in the MS and network subsystem (which includes the BSS and MSC) for
supporting traffic channels. The physical interface comprises a set of physical channels
accessible through FDMA and TDMA.
Each physical channel supports a number of logical channels used for user traffic
and signaling. The physical layer (or layer 1) supports the functions required for the
transmission of bit streams on the air interface. Layer 1 also provides access capabilities
to upper layers. The physical layer is described in the GSM Recommendation 05 series
(part of the ETSI documentation for GSM). At the physical level, most signaling
messages carried on the radio path are in 23-octet blocks. The data link layer functions
are multiplexing, error detection and correction, flow control, and segmentation to allow
for long messages on the upper layers.
The radio interface uses the Link Access Protocol on Dm channel (LAPDm). This
protocol is based on the principles of the ISDN Link Access Protocol on the D channel
(LAPD) protocol. Layer 2 is described in GSM Recommendations 04.05 and 04.06. The
following logical channel types are supported:
Speech traffic channels (TCH)
9 Full-rate TCH (TCH/F)
9 Half-rate TCH (TCH/H)
Broadcast channels (BCCH)
9 Frequency correction channel (FCCH)
9 Synchronization channel (SCH)
9 Broadcast control channel (BCCH)
Common control channels (CCCH)
9 Paging channel (PCH)
9 Random access channel (RACH)
9 Access grant channel (AGCH)
Cell broadcast channel (CBCH)
9 Cell broadcast channel (CBCH) (the CBCH uses the same physical
channel as the DCCH)
Dedicated control channels (DCCH)

Sasken Confidential

GSM Architecture

49

9 Slow associated control channel (SACCH)

9 Stand-alone dedicated control channel (SDCCH)
9 Fast associated control channel (FACCH)
The radio resource layer manages the dialog between the MS and BSS concerning
the management of the radio connection, including connection establishment, control,
release, and changes (e.g., during handover). The mobility management layer deals with
supporting functions of location update, authentication, and encryption management in a
mobile environment. In the connection management layer, the call control entity controls
end-to-end call establishment and management, and the supplementary service entity
supports the management of supplementary services. Both protocols are similar to those
used in the fixed wireline network. The SMS protocol of this layer supports the high level
functions related to the transfer and management of short message services.

6.3 Abis Interface (BTS to BSC)

The interconnection between the BTS and the BSC is through a standard
interface, Abis (most Abis interfaces are vendor specific). The primary functions carried
over this interface are traffic channel transmission, terrestrial channel management, and
radio channel management. This interface supports two types of communications links:
traffic channels at 64 kbps carrying speech or user data for a full- or half-rate radio traffic
channel and signaling channels at 16 kbps carrying information for BSC-BTS and BSCMSC signaling. The BSC handles the LAPD channel signaling for every BTS carrier.
The first three layers are based on the following OSI/ITU-T recommendations:
Physical layer: ITU-T Recommendation G.703 and GSM Recommendation 08.54
Data link layer: GSM Recommendation 08.56 (LAPD)
Network layer: GSM Recommendation 08.58
There are two types of messages handled by the traffic management procedure part of
the signaling interfacetransparent and nontransparent. Transparent messages are
between the MS and BSC-MSC and do not require analysis by the BTS. Nontransparent
messages do require BTS analysis.

6.4 A Interface (BSC to MSC)

The A interface allows interconnection between the BSS radio base subsystem
and the MSC. The physical layer of the A interface is a 2-Mbps standard Consultative
Committee on Telephone and Telegraph (CCITT) digital connection. The signaling
transport uses Message Transfer Part (MTP) and Signaling Connection Control Part

Sasken Confidential

GSM Architecture

50

(SCCP) of SS7. Error-free transport is handled by a subset of the MTP, and logical
connection is handled by a subset of the SCCP. The application parts are divided between
the BSS application part (BSSAP) and BSS operation and maintenance application part
(BSSOMAP). The BSSAP is further divided into Direct Transfer Application Part
(DTAP) and BSS management application part (BSSMAP). The DTAP is used to transfer
layer 3 messages between the MS and the MSC without BSC involvement. The BSSMAP
is responsible for all aspects of radio resource handling at the BSS. The BSSOMAP
supports all the operation and maintenance communications of BSS.

6.5 Interfaces between other GSM entities

Information transfer between GSM PLMN entities uses the MAP. The MAP
contains a mobile application and several Application Service Elements (ASEs). It uses
the service of the Transaction Capabilities Application Part (TCAP) of SS7. It employs
the SCCP to offer the necessary signaling functions required to provide services such as
setting mobile facilities for voice and non-voice application in a mobile network. The
major procedures supported by MAP are
Location registration and cancellation
Handover procedures
Handling supplementary services
Retrieval of subscriber parameters during call setup
Authentication procedures.
In Figure 6.2, protocols used between the GSM entities are given.

6.6 Mapping of GSM layers onto OSI layers

When an MS is switched on somewhere, it first has to determine whether it has
access to a PLMN. It initiates a location update to inform its home PLMN about its
current location in order to enable the routing of incoming calls to the subscriber. The
location of an MS is stored in a central database, the HLR of the PLMN where the
customer has purchased service. In addition to other user-specific information, the HLR
maintains the routing number to an MSC. The MSC is primarily responsible for
switching and mobility management (MM). Once connected to an MSC, a BSS
communicates with the MS via the radio interface. Each MS, positioned in a cell of a
BSS of an MSC, is registered with a specific database associated with the MSC and the
VLR. If a call to a GSM subscriber is generated from an external network, the call is
routed to a Gateway MSC (GMSC) first. This GMSC interrogates the HLR of the called

Sasken Confidential

GSM Architecture

51

Figure 6.2 Signaling protocols between GSM entities.

Sasken Confidential

GSM Architecture

52

subscriber to obtain the routing number of the visited MSC. The latter then initiates the
transmission of a paging message within each of its associated cells. If the called
subscriber answers, the BSS assigns a traffic channel to be used for the communication,
and the link is fully established.
During a call, the MS is allowed to move from cell to cell in the whole GSM
service area, and GSM maintains the communication links without interruption of the
end-to-end connection. The handover procedure in GSM is mobile assisted and
performed by the BSS. The MS periodically measures downlink signal quality and
reports it to its serving BTS, as well as to all cells in its neighborhood that are prospective
candidates for handover. Different handover types can be performed, changing either a
channel in the serving cell (i.e., the serving BTS remains the same) or changing the cell
inside the area controlled by a BSC; between two BSCs within a location area; or
between two location areas (i.e., MSCs).
The GSM protocol architecture for signaling and mapping onto the corresponding
OSI layers is shown in Figure 6.3. GSM uses out-of-band signaling through a separate
signaling network.
At the data link layer the radio interface of the MS uses LAPDm protocol. The
higher-layer protocols of GSM are grouped into the third layer. GSM layer 3 includes
functionality of higher OSI layers and OSI management, such as connection
management, subscriber identification, and authentication.
At the interface between BSC and MSC, the lower layers are realized by MTP of
SS7. It covers functionality of layer 1, layer 2, and part of layer 3 of the OSI reference
model. The MTP itself is layered into three levels. The two lower levels are mapped
directly onto the corresponding OSI layers, and level 3 covers the lower part of the OSI
network layer. The missing functionality of the higher part of the network layer is
provided by SCCP. The BSSAP serves primarily as a bridge between the radio resource
(RR) management and the MSC, handling for instance the assignment and switching at
call setup and handover processing. It therefore provides the functionality typically
provided by the transport layer, application layer, and network management of OSI.
The MSC is connected to the signaling network via SS7 and is responsible for
exchange of all information required for call setup, maintenance, and management.
TCAP contains functions to provide associations between two TCAP users as well as
protocols and services to perform remote operations. It is closely related to the Remote
Operation Service Element (ROSE) of the OSI application layer. Since TCAP directly
uses the services of SCCP, the transport, session, and presentation layers are null layers.
Hence, this part of SS7 is a typical example of a system using a reduced protocol stack
Sasken Confidential

GSM Architecture

53

Figure 6.3 Mapping of GSM onto OSI layers

where functions of different OSI protocol layers are incorporated into the remaining
layers. TCAP provides functionality of the OSI transport layer.
The call-related signaling between MSCs and external networks uses the ISDN
User Part (ISUP), while all GSM-specific signaling between MSC and location registers
is performed via the MAP. These protocols correspond to the OSI application layer,
although their functionality is mainly used to maintain network-level connections. It can
be noticed that the network complexity of telecommunication networks seems to yield
protocols that combine functionality distributed across the higher layers and management
part of the OSI protocol stack.

6.7 Conclusions
The design of a GSM system has been done with a view of providing compatible
interfaces between mobile-BTS, BTSs-BSCs and BSCs-MSCs. By standardizing A and
A-bis interfaces, the flexible, efficient, and cost-effective design of base station and
switching equipment have been achieved.

Sasken Confidential