WMC GSM Part1

Personal and Mobile
Communications
Lecture 6
GSM
Global System for Mobile communication
GSM: Overview
GSM - Global System for Mobile
❍ Several first generation analog cellular systems in Europe but
incompatible - limited roaming
❍ formerly: Groupe Spéciale Mobile (founded 1982)
❍ now: Global System for Mobile communication
❍ Pan-European standard (ETSI, European Telecommunications
Standardisation Institute; 1987-1989)
❍ simultaneous introduction of essential services in three phases
(1991, 1994, 1996) by the European telecommunication
administrations
seamless roaming within Europe possible
❍ today many providers all over the world use GSM (more than
184 countries in Asia, Africa, Europe, Australia, America)
❍ more than 2000 million subscribers
❍ more than 80% of all digital mobile phones use GSM
Personal and Mobile Communications – GSM
GSM: Overview
Objectives:
❍ Broad offering of speech and data services
❍ Compatible with wireline networks, eg, ISDN
❍ Automatic roaming and handoff
❍ Highly efficient use of frequency spectrum
❍ Support for different types of mobile terminal
equipment (eg, cars, portable handsets)
❍ Digital signaling and transmission
❍ Low cost infrastructure and terminal equipment
Personal and Mobile Communications – GSM 6-4

07.04.2007
Performance characteristics of GSM
Communication
❍ mobile, wireless communication; support for voice and data
services
Total mobility
❍ international access, chip-card enables use of access points of
different providers
Worldwide connectivity
❍ one number, the network handles localization
High capacity
❍ better frequency efficiency, smaller cells, more customers per
cell
High transmission quality
❍ high audio quality and reliability for wireless, uninterrupted
phone calls at higher speeds (e.g., from cars, trains)
Security functions
❍ access control, authentication via chip-card and PIN

07.04.2007
GSM: Mobile Services
GSM offers
❍ several types of connections
voice connections, data connections, short message
service
❍ multi-service options (combination of basic services)
Three service domains
❍ Bearer Services
❍ Telematic Services
❍ Supplementary Services
bearer services
MS
transit source/
TE MT GSM-PLMN network destination TE
R, S Um (PSTN, ISDN) network (U, S, R)
tele services

07.04.2007
Bearer Services
Telecommunication services to transfer data between
access points
Specification of services up to the terminal interface (OSI
layers 1-3)
Traditionally it includes data access to PSTN/ISDN and
packet switched data network
Different data rates for voice and data (original standard)
❍ data service (circuit switched)
synchronous: 2.4, 4.8 or 9.6 kbit/s
asynchronous: 300 - 1200 bit/s
❍ data service (packet switched)
synchronous: 2.4, 4.8 or 9.6 kbit/s
asynchronous: 300 - 9600 bit/s

07.04.2007
Tele Services I
Telecommunication services that enable voice
communication via mobile phones
All these basic services have to obey cellular functions,
security measurements etc.
Offered services
❍ mobile telephony
primary goal of GSM was to enable mobile telephony offering
the traditional bandwidth of 3.1 kHz
❍ Emergency number
common number throughout Europe (112); mandatory for all
service providers; free of charge; connection with the highest
priority (preemption of other connections possible)
❍ Multinumbering
several ISDN phone numbers per user possible

07.04.2007
Tele Services II
Additional services
❍ Non-Voice-Teleservices
group 3 fax
voice mailbox (implemented in the fixed network
supporting the mobile terminals)
electronic mail (MHS, Message Handling System,
implemented in the fixed network)
❍ Short Message Service (SMS)

alphanumeric data transmission to/from the mobile
terminal using the signaling channel, thus allowing
simultaneous use of basic services and SMS

07.04.2007
Supplementary services
Services in addition to the basic services, cannot
be offered stand-alone
Similar to ISDN services besides lower bandwidth
due to the radio link
May differ between different service providers,
countries and protocol versions
Important services
❍ identification:forwarding of caller number
❍ suppression of number forwarding
❍ automatic call-back
❍ conferencing with up to 7 participants
❍ locking of the mobile terminal (incoming or outgoing
calls)

07.04.2007
Architecture of the GSM system
GSM is a PLMN (Public Land Mobile Network)
❍ several providers setup mobile networks following the
GSM standard within each country
❍ components
MS (mobile station)
BS (base station)
MSC (mobile switching center)
LR (location register)
❍ subsystems
RSS (radio subsystem): covers all radio aspects
NSS (network and switching subsystem): call forwarding,
handover, switching
OSS (operation subsystem): management of the network

07.04.2007
GSM: Architecture
OMC, EIR,
AUC
HLR
GMSC
NSS fixed network
with OSS
VLR MSC MSC

VLR
BSC
BSC
RSS

07.04.2007
GSM: Architecture

07.04.2007
GSM: elements and interfaces
radio cell
BSS
MS MS
Um radio cell
RSS BTS MS
BTS
Abis
BSC BSC
A
MSC MSC
NSS VLR VLR signaling

HLR GMSC
ISDN, PSTN
IWF
PDN
O
OSS EIR AUC OMC

07.04.2007
GSM: system architecture
radio network and fixed
subsystem switching subsystem partner networks
MS MS
ISDN
PSTN
Um MSC
BTS Abis
BSC EIR
BTS
SS7
HLR
BTS VLR
BSC ISDN
BTS MSC
A PSTN
BSS IWF
PSPDN
CSPDN
System architecture: radio subsystem
network and
Components
radio
subsystem ❍ MS (Mobile Station)
Switching subsystem
❍ BSS (Base Station Subsystem):
MS MS consisting of
BTS (Base Transceiver
Um Station):
sender and receiver
Abis
BTS BSC (Base Station Controller):
BSC MSC
BTS controlling several transceivers
Interfaces
❍ Um : radio interface
❍ Abis : standardized, open
A interface with
BTS
BSC MSC 16 kbit/s user channels
BTS ❍ A: standardized, open
BSS interface with
64 kbit/s user channels

Radio subsystem
The Radio Subsystem (RSS) comprises the cellular mobile network
up to the switching centers
Components
❍ Base Station Subsystem (BSS):
Base Transceiver Station (BTS): radio components including
sender, receiver, antenna - if directed antennas are used
one BTS can cover several cells
Base Station Controller (BSC): switching between BTSs,
controlling BTSs, managing of network resources, mapping
of radio channels (Um) onto terrestrial channels (A
interface)
BSS = BSC + sum(BTS) + interconnection
❍ Mobile Stations (MS)

07.04.2007
Radio subsystem - BSS
Base Station Subsystem
❍ It is the wireless point of contact of the network with users
❍ It forms Radio Access Network (RAN)
❍ It translates between the air interface and the wired
infrastructure protocols
❍ The two network segments need different protocols because
the difference of the nature of wireless links
Unreliable, bandwidth limited, supports mobility
❍ Speech Conversion
The MS generates radio-efficient 13 kbps digitized voice packets using
speech coder. The backbone PSTN requires 64 kbps PCM digitized voice.
The BSS converts 13 to 64 kbps code.
❍ Signaling
The multi-tone frequency signaling is used in POTS in the wired backbone,
whereas GSM performs several packet exchange to establish a call. The
signaling conversion takes place at the BSS

07.04.2007
The base station subsystem (BSS)
An MS communicates with a base transceiver station (BTS) via the
radio interface, Um.
A BTS performs all the transmission and reception functions
relating to the GSM radio interface along with a degree of signal
processing.
BTS can be considered to be a complex radio modem that takes the
up-link radio signal from an MS and converts it into data for
transmission within the GSM network, and accepts data from the
GSM network and converts it into a radio signal that can be
transmitted to the MS..
The BTSs are used to form the coverage cells in GSM and it is their
position that determines the network’s coverage and capacity.

07.04.2007
Although a BTS is concerned with transmission and reception over
the radio interface, it plays only a minor role in the way the radio
resources are allocated to the different MSs.
Instead, the management of the radio interface is performed by a
base station controller (BSC).
The management functions include the allocation of radio channels
to MSs on call set-up, determining when a handover is required and
identifying a suitable target BTS and controlling the transmitted
power of an MS to ensure that it is just sufficient to reach its
serving BTS.
BSCs vary from manufacturer to manufacturer, but a BSC might
typically control up to 40 BTSs.

07.04.2007
In addition to its processing capacity, a BSC will also have a limited
switching capability, enabling it to route calls between the different
BTSs under its control.
The interface between a BSC and an associated BTS is known as the
A-bis interface and it is fully defined by an open, or public,
specification.
This allows a network operator the freedom to procure their BSCs
and BTSs from different equipment manufacturers.
The BTS and BSC are collectively known as the base station
subsystem (BSS).

07.04.2007
Radio subsystem - BSS
Tasks of a BSS are distributed over BSC and BTS
BTS comprises radio specific functions
BSC is the switching center for radio channels
F u n c tio n s BTS BSC
M a n a g e m e n t o f ra d io c h a n n e ls X
F re q u e n c y h o p p in g (F H ) X X
M a n a g e m e n t o f te rre s tria l c h a n n e ls X
M a p p in g o f te rre s tria l o n to ra d io c h a n n e ls X
C h a n n e l c o d in g a n d d e c o d in g X
R a te a d a p ta tio n X
E n c ry p tio n a n d d e c ry p tio n X X
P a g in g X X
U p lin k s ig n a l m e a s u re m e n ts X
T ra ffic m e a s u re m e n t X
A u th e n tic a tio n X
L o c a tio n re g is try , lo c a tio n u p d a te X
H andover m anagem ent X

07.04.2007
Radio subsystem – The Mobile station
Terminal for the use of GSM services
The MS is composed of two distinct functional entities, the
subscriber identity module (SIM), which is a removable
smart card containing information that is specific to a
particular subscriber, and the mobile equipment (ME),
which is essentially the mobile phone itself without the
SIM.
A mobile equipment (ME) comprises several functional
groups, as shown below;
❍ MT (Mobile Terminal)
❍ TA (Terminal Adapter)
❍ TE (Terminal Equipment)
TE TA MT
Um
R S

07.04.2007
The Mobile Equipment (ME)
The first functional block is the mobile termination (MT) and this
carries out all the functions relating to the transmission of
information over the GSM radio interface. MT offers common
functions used by all services the MS offers. MT is the end-point of
the radio interface (Um).
The second is the terminal equipment (TE) and this performs
functions that are specific to a particular service, for example a fax
machine. The TE does not handle any functions that are specific to
the GSM system.
The third functional block is the terminal adapter (TA), which is
used to ensure compatibility between the MT and the TE. TA hides
radio specific characteristics. For example, a TA would be required
to interface between an ISDN-compatible MT and a TE with a
modem interface.

07.04.2007
The Subscriber Identity Module (SIM)
SIM (Subscriber Identity Module) is a smart card (‘credit-card’
sized or smaller in the case of some handheld units) which can be
used by a subscriber to personalize an ME.
In GSM terminology, the term MS refers to the combination of a

SIM and an ME.
The SIM has an area of non-volatile memory which is used to store

information specific to a particular subscriber and this includes the
subscriber’s unique international mobile subscriber identity (IMSI)
number.
This number is used to identify each individual subscriber within the

GSM network and it consists of not more than 15 decimal digits.

07.04.2007
The mobile station (MS)
The first three digits of the IMSI form the mobile country code
(MCC) and this is used to identify the country of the particular
subscriber’s home network, i.e. the network with which the
subscriber is registered.
The next two digits of the IMSI form the mobile network code
(MNC) and this identifies the subscriber’s home PLMN within the
country indicated by the MCC.
The MNCs are allocated by a relevant authority within each country.
The subscriber will always be billed through her home network, even
when she incurs call charges on other networks.
The remaining digits of the IMSI are the mobile subscriber
identification number (MSIN) which is used to uniquely identify
each subscriber within the context of their home PLMN.
IMSI is unique to each individual subscriber and it may also be used
to determine the subscriber’s home network.
07.04.2007
The mobile station (MS)
The SIM will also contain the subscriber’s secret authentication key,
Ki, the authentication algorithm, A3, and the cipher key generation
algorithm, A8. They are used to implement the security features of
GSM and they are stored in the SIM under heavy protection.
Inserting a SIM card into an ME effectively personalizes the
equipment to the particular subscriber. Any incoming calls for the
subscriber will be routed to the ME and any charges incurred using
the ME will be billed to the subscriber’s account.
The use of the SIM card allows the subscriber complete freedom to
switch between different networks without the need to exchange or
reprogram the ME itself.
The interface between the SIM and the ME is fully defined in the
specifications and is referred to as the SIM–ME interface. This
ensures compatibility between the SIMs and MEs of different
manufacturers..
07.04.2007
Network and Switching Subsystem
network fixed partner
subsystem networks Components
MSC (Mobile Services Switching Center):
ISDN IWF (Interworking Functions)
PSTN
MSC
ISDN (Integrated Services Digital Network)
PSTN (Public Switched Telephone Network)
EIR PSPDN (Packet Switched Public Data Net.)
CSPDN (Circuit Switched Public Data Net.)
SS7
HLR
Databases
HLR (Home Location Register)
VLR VLR (Visitor Location Register)
MSC ISDN EIR (Equipment Identity Register)
IWF PSTN
PSPDN
CSPDN

Network and Switching Subsystem
NSS is the main component of the public mobile network
GSM
❍ switching, mobility management, interconnection to other
networks, system control
Components
❍ Mobile Services Switching Center (MSC)
controls all connections via a separated network to/from a
mobile terminal within the domain of the MSC - several BSC can
belong to a MSC
❍ Databases (important: scalability, high capacity, low delay)
Home Location Register (HLR)
central master database containing user data, permanent
and semi-permanent data of all subscribers assigned to the
HLR (one provider can have several HLRs)
Visitor Location Register (VLR)
local database for a subset of user data, including data
about all user currently in the domain of the VLR

07.04.2007
Mobile Services Switching Center
The MSC (mobile switching center) plays a central role in
GSM
❍ switching functions
❍ additional functions for mobility support
❍ management of network resources
❍ interworking functions via Gateway MSC (GMSC)
❍ integration of several databases
Functions of a MSC
❍ specific functions for paging and call forwarding
❍ termination of SS7 (signaling system no. 7)
❍ mobility specific signaling
❍ location registration and forwarding of location information
❍ provision of new services (fax, data calls)
❍ support of short message service (SMS)
❍ generation and forwarding of accounting and billing
information
07.04.2007
The mobile services switching centre (MSC)
The MSC is concerned with the routing of calls to and from the
mobile users. It possesses a large switching capability that varies
between manufacturers, but a typical MSC will control a few tens
of BSCs and it will have a capacity of several tens of thousands of
subscribers.
The MSC is similar to the switching exchange in a fixed network.
However, it must include additional functions to cope with the
mobility of the subscribers, e.g. functions to cope with location
registration and handover.
The GSM specifications use the term MSC area to describe the
part of a network that is covered by a particular MSC and its
associated BSCs and BTSs.

07.04.2007
The mobile services switching centre (MSC)
The interface between the MSC and BSS is known as the A
interface and it is fully defined in the specifications, giving the
network operator the freedom to choose their MSCs and BSCs
from different manufacturers.
The interface between different MSCs is called the E interface.
The network operator may also select one or a number of MSCs to
act as gateway MSCs (GMSC). As its name would suggest, the
GMSC provides the interface between the PLMN and external
networks.
In the event of an incoming call from another network, the GMSC
communicates with the relevant network databases to ensure that
the call is routed to the appropriate MS.

07.04.2007
The GSM network databases
In a commercial network, like GSM, means are required for charging
and billing subscribers, maintaining accurate subscription records
and preventing fraudulent network access.
In a cellular network where subscribers are free to roam throughout
the coverage area, the network must also possess some way to track
MSs so that it is able successfully to route incoming calls to them.
All of these functions are supported using a combination of
databases or location registers.
The home location register (HLR) is used to store information that
is specific to each subscriber.
It will contain details of a particular user’s subscription, e.g. the
services to which they have access, and some information relating to
the location of each subscriber, e.g. the details of the MSC area
within which the subscriber is currently registered.

07.04.2007
The information contained within the HLR may be accessed using
either the subscriber’s IMSI or mobile station international ISDN
(MSISDN) number, which is essentially the subscriber’s telephone
number.
Every GSM subscriber will have an entry in the HLR of their home
network.
The interface between an HLR and an MSC is called the C interface.
Another GSM database that is very closely associated with the HLR
is the authentication centre (AuC).
The AuC is used to store information that is concerned with GSM’s
security features, i.e. user authentication and radio path encryption.
It will contain the subscriber’s secret Ki key and the A3 and A8
security algorithms.
The AuC will only ever communicate with the HLR and it does this
using the H interface.

07.04.2007
Another important database used in the GSM system is the visitor
location register (VLR).
A VLR is associated with one or a number of MSCs and it contains
information relating to those subscribers that are currently
registered within the MSC area(s) of its associated MSC(s).
The area that is served by a particular VLR is termed the VLR area.
The main function of the VLR is to provide a local copy of the
subscriber’s information for the purposes of call handling and it
removes the need to continually access the HLR to retrieve
information about a particular subscriber.
This becomes important in a system such as GSM where
subscribers may use networks in countries other than the country
of their home network.

07.04.2007
The VLR also contains information that enables the network to
‘find’ a particular subscriber in the event of an incoming call.
The process of locating a subscriber is facilitated by subdividing
the network’s coverage area into a number of location areas (LAs),
each consisting of one or a number of cells or sectors.
The VLR will contain the details of the location area in which each
subscriber is registered.
In the event of an incoming call, an MS will be paged in each of the
cells within its location area and this means that the MS may move
freely between the cells of a location area without having to
inform the network.
However, when an MS moves between cells belonging to different
location areas, it must register in the new area using the location
updating procedure.

07.04.2007
Where a subscriber moves between location areas controlled by
different VLRs, its details are copied from the HLR to the new
VLR. The HLR will also ensure that the subscriber’s details are
removed from the old VLR.
The interface between the HLR and the VLR is called the D
interface and the interface between an MSC and its associated
VLR is called the B interface. An interface also exists between
different VLRs and this is termed the G interface.
The introduction of the SIM card in GSM means that tracking a
subscriber no longer implies the tracking of a piece of equipment,
and vice versa.
For this reason the equipment identity register (EIR) has been
introduced to allow the network operator to track stolen and
malfunctioning MEs.
Each ME is assigned a unique 15-digit international mobile
equipment identity (IMEI) at the point of manufacture.
07.04.2007
The EIR is used to store three different lists of IMEIs.
The white list contains the series of IMEIs that have been
allocated to MEs that may be used on the GSM network.
The black list contains the IMEIs of all MEs that must be barred
from using the GSM network. This will contain the IMEIs of stolen
and malfunctioning MEs.
Finally, the network operator may also use a grey list to hold the
IMEIs of MEs that must be tracked by the network for evaluation
purposes.
During an access attempt or during a call, the network has the
ability to command an MS to supply its IMEI at any time.
If the IMEI is on the black list or it is not on the white list, the
network could terminate the call or access attempt and the
subscriber will be sent an ‘illegal ME’ message.

07.04.2007
Once an MS has failed an IMEI check it will be prevented from
making any further access attempts, location updates or paging call
responses. However, this MS may still be used to make emergency
calls.
The IMEI check is performed within the EIR and the IMEI is
passed to the EIR by the MSC that is currently serving the MS.
The results of the IMEI check are then returned by the EIR to
the relevant MSC.
The interface between the EIR and the MSC is termed the F
interface.

07.04.2007
The management of GSM networks
From an operator’s viewpoint, an effective network management
system is an important part of any telecommunications network.
It is essential for the network operator to be able to identify
problems in the network at an early stage and correct them quickly
and efficiently.
It is also important for the network operator to be able to make
changes to the network configuration with a minimum of effort and
without affecting the service provided to its subscribers.
The OSS (Operation Subsystem) enables centralized operation,
management, and maintenance of all GSM subsystems
Operation subsystem (OSS) contains: operations and maintenance
center (OMC), network management center (NMC), and
administration center (ADC) . These network elements work
together to monitor, control, maintain, and manage the network.

07.04.2007
The management of GSM networks
Operation and Maintenance Center (OMC)
❍ The OMC provides the means by which the operator manages
the network.
❍ OMC enables different control capabilities for the radio
subsystem and the network subsystem
Each OMC will typically be in charge of a subsystem, e.g. the BSS
or the Network Switching Subsystem, NSS (i.e. the MSC, HLR,
VLR, etc.)
The NMC is concerned with the management of the entire network
and it generally has a wider operational role than an OMC.
The ADC is concerned, as its name would suggest, with the
administrative functions required within the network.

07.04.2007
The GSM Radio Interface
The radio interface provides the means by which an MS
communicates with the BTSs of a GSM network whilst it
moves within the coverage area.
The performance of the radio interface, and particularly its
ability to provide acceptable speech links in the face of co-
channel interference from other users within the system,
acutely affects the overall capacity of a cellular system.
The main features of the GSM radio interface include the
modulation scheme and the carrier frequencies used in
GSM, the construction of the TDMA bursts, or packets, and
the way in which these may be demodulated in the presence
of inter-symbol interference (ISI) caused by the radio
channel and the modulation process itself.

07.04.2007
The GSM Radio Interface
The GSM radio interface also specifies the coding,
interleaving and ciphering processes that occur before
transmission of user information.
These processes are different for speech information, user
data (e.g. fax transmissions) and signaling information.
Further, GSM radio interface defines the different
channels that are available in GSM and the manner in which
the radio resources are allocated to each of the channels.
These various function and processes enable to effectively
build up the radio interface as a ‘bit pipe’ where data are
applied to the transmitter and the same data, possibly with
a certain number of errors, are recovered at the receiver.

07.04.2007
GSM Operation for Speech

07.04.2007
The GSM modulation scheme
The modulation scheme used in GSM is Gaussian minimum shift
keying (GMSK) with a normalized bandwidth product, BT, of 0.3
and the modulation symbol rate is around 271 kb/s. .
The GMSK is based on a simpler modulation scheme known as
minimum shift keying (MSK) in which the carrier amplitude
remains constant and the information is carried in the form of
phase/frequency variations.
A logical ‘1’ will cause the carrier phase to increase by 90o over
a bit period and a logical ‘0’ will cause the carrier phase to
decrease by the same amount.
This phase change is produced by instantaneously switching the
carrier frequency between two different values, f1 and f2,
according to the input data and, therefore, MSK is a special
case of Binary FSK modulation.

07.04.2007
The frequencies f1 and f2 are given by
f1 = fc + Rb/4, f2 = fc - Rb/4
where Rb is the modulation symbol rate (≈ 271 kb/s in GSM) and fc
is the nominal carrier frequency.
In MSK, the carrier frequency, fc, is never transmitted.
MSK requires instantaneous changes in the carrier frequency and,
consequently, the modulated spectrum is, in theory, infinitely wide.
The spectrum of an MSK modulated signal may be compressed by
filtering the modulating baseband pulses to produce much
smoother changes in frequency, thereby compressing the
bandwidth of the modulated signal.
The type of filter used has a Gaussian impulse response and the
resulting modulation scheme is called Gaussian MSK or GMSK.

07.04.2007
The relative bandwidth of the Gaussian filter defines the
spectrum compression that is achieved, i.e. a smaller filter
bandwidth results in a narrower modulated spectrum.
Unfortunately, the Gaussian filter also introduces ISI whereby
each modulation symbol spreads into adjacent symbols.
The BT product (T is the bit period and B is the 3 dB filter
bandwidth) is the relative bandwidth of the baseband Gaussian
filter and in GSM it is set to 0.3.
This effectively means that each bit is spread over (or has an
effect on) three modulation symbols. The resulting ISI must
be removed at the receiver using an equalizer.
GMSK is most attractive for its excellent power efficiency.

07.04.2007
The GSM power classes
The specifications define five classes of MS for GSM900 and two
classes for DCS1800 based on their output power capabilities.
These classes are shown in Table-6.1. The typical handheld units
are Class 4 for GSM900 and Class 1 for DCS1800 and the typical
GSM900 vehicular unit is Class 2.
Each MS has the ability to reduce its output power in steps of 2
dB from its maximum down to a minimum of 5 dBm (3.2 mW) for a
GSM900MS and 0 dBm (1 mW) for a DCS1800MS in response to
commands from a BTS.
This facility is used to implement up-link power control, whereby
an MS’s transmitted power is adjusted to ensure that it is just
sufficient to provide a satisfactory up-link quality.
This process is used to conserve MS battery power and also
reduce the up-link interference throughout the system.

07.04.2007
Table-6.1: Mobile Station Power Classes
Power Class Maximum Output Maximum Output
Power GSM900 Power DCS1800
1 20 W (43 dBm) 1 W (30 dBm)
2 8 W (39 dBm) 0.25 W (24 dBm)
3 5 W (37 dBm)
4 2 W (33 dBm)
5 0.8 W (29 dBm)

07.04.2007
In Phase 1 of the GSM specifications, eight classes of GSM900
BTS were defined, with maximum output powers ranging from
2.5 W up to 320 W, and four classes of DCS1800 BTS were
defined with maximum output powers ranging from 2.5Wup to
20W.
Three low power BTS classes were included in Phase 2 for each
system and these are termed micro-BTSs, as they are intended
for use in smaller cells, e.g. micro-cells. The BTS classes defined
in Phase 2 of the specifications are summarized in Table-6.2.
The actual output power of the BTS may be adjusted in at least
six steps of around 2 dB to allow a fine adjustment of the
coverage by the network operator.
The BTS output power may also be adjusted by up to 15 steps,
each of 2 dB, to allow power control to be implemented on the
down-link.
07.04.2007
Table-6.2: BTS Power Classes
BTS Power Class Maximum Output Power Maximum Output Power
GSM900 DCS1800
1 320—(<640) W 20—(<40) W
2 160—(<320) W 10—(<20) W
3 80—(<160) W 5—(<10) W
4 40—(<80) W 2.5—(<5) W
5 20—(<40) W -
6 10—(<20) W -
7 5—(<10) W -
8 2.5—(<5) W -
Micro-BTS 1 (>0.08)—0.25 W (>0.5)—1.6 W
Micro-BTS 2 (>0.03)—0.08 W (>0.16)—0.5 W
Micro-BTS 3 (>0.00)—0.03 W (>0.05)—0.16 W

07.04.2007
The GSM radio carriers
GSM uses a combined time division multiple access (TDMA) and
frequency division multiple access (FDMA) scheme.
The available spectrum is partitioned into a number of bands, each
200 kHz wide (known as an RF carriers).
Each of these bands may be occupied by a GMSK modulated RF
carrier supporting a number of TDMA time slots.
The RF carriers are paired to allow a simultaneous data flow in
both directions, i.e. full duplex (Frequency Division Duplex –FDD).
The GSM900 frequency bands defined in Phase 1 of the
specifications are 890 MHz to 915 MHz for the up-link (i.e. MS to
BTS) and 935MHz to 960MHz for the down-link (i.e. BTS to MS),
respectively.
In Phase 2 of the specifications an extension frequency band has
been added to allow GSM900 operators to provide more capacity in
urban areas.

07.04.2007
GSM FDD/FDMA
f
960 MHz 124
935.2 MHz 1 200 kHz
20 MHz
915 MHz 124
1
890.2 MHz
t

07.04.2007
GSM uses 124 frequency channels, each of which

uses an eight-slot TDM system

07.04.2007
GSM FDMA
1 2 3 4 … 124
200 KHz
Carrier Spacing
100 KHz BW = 25 MHz

guard band Downlink Frequency Band: 890-915 MHz
Downlink Frequency Band: 935-960 MHz
Bc = 200 KHz
Bg = 100 KHz
Number of Channels = 124
Data rate for each carrier = 270.833 kbps
Bit time = 3.69 µs
Slot time (or burst time) = 577 µs
Number of bits/slot = 156.25 bits
Burst Types: 1. Normal Burst (NB)
2. Frequency Correction Burst
3. Synchronization burst
4. Random Access Burst (RAB)

07.04.2007
For this reason, the frequency bands described above are
sometimes called the primary GSM900 bands (P-GSM900). The
extended GSM900 bands (E-GSM900) are 880 MHz to 890 MHz
and 925 MHz to 935 MHz for the up-link and down-link,
respectively.
In the case of the DCS1800 system, the Phase 2 specifications
define the 1710 MHz to 1785 MHz frequency band for the up-link
transmissions and the 1805MHz to 1880 MHz frequency band for
the down-link transmissions.
There is a guard band of 200 kHz at the lower end of each
frequency band and it is likely that the RF channels at either end
of the allocations will not be used.
Each RF carrier frequency pair is assigned an absolute radio
frequency channel number (ARFCN).

07.04.2007
In addition to the frequency separation between the duplex
carriers, which is 45 MHz for GSM900 and 95 MHz for DCS1800,
the down-link and up-link bursts of a duplex link are separated by
three timeslots.
This removes the necessity for the MS to transmit and receive
simultaneously.
Where the propagation delay between the MS and BTS is very
small, the MS will receive a down-link burst from the BTS, retune
to the up-link frequency and transmit an up-link burst three
timeslots later.
Each duplex carrier supports a number of timeslots that are 15/26
ms (≈577 µs) in duration.
These are arranged into TDMA frames consisting of eight time
slots with a duration of 60/13 ms (≈4.615 ms).

07.04.2007
GSM TDMA
TDMA frame = 4.615 ms
Timeslot 0 1 2 3 4 5 6 7
Frequency 1 Ch 1 Ch 2 Ch 3 Ch 4 Ch 5 Ch 6 Ch 7 Ch 8
: :
: :
ARFCN – Absolute Radio Frequency Channel Number

07.04.2007
Radio interface - physical channels
TS0 Typically used for signaling TS1

Carrier00
Carrier T S S T T T T T T S S T
Carrier11
Carrier T T T T T T T T T T T T
TS2 Physical channel = time slot TS2

Carrier22
Carrier33
Frame of length 8 time slots

Time Slot

07.04.2007
Each timeslot within a TDMA frame is numbered from zero to
seven and these numbers repeat for each consecutive frame.
The time slot and frame durations are derived from the fact that
26 TDMA frames are transmitted in 120 ms.
The TDMA frame duration is 120/26 ms or 60/13 ms and the

timeslot duration is 120/26x8 ms 0r 15/26 ms.

07.04.2007
GSM FDD - FDMA/TDMA
935-960 MHz
124 channels (200 kHz)
downlink
y
nc
e
qu
890-915 MHz
fre
124 channels (200 kHz)

uplink
higher GSM frame structures
time
GSM TDMA frame
1 2 3 4 5 6 7 8
4.615 ms
GSM time-slot (normal burst)

guard guard
space tail user data S Training S user data tail space
3 bits 57 bits 1 26 bits 1 57 bits 3
546.5 µs
577 µs

GSM FDD - FDMA/TDMA

07.04.2007
The GSM TDMA Slot Format
Each 200-kHz frequency band is divided into 8 channels defined by
repetitive time slots. A time slot is at the lowest level and contains
the following fields:
❍ Tail bits - allow synchronization of transmissions from mobile
units
❍ Encrypted bits – 114 plaintext bits are encrypted into 114
encrypted bits, which are then placed into two 57-bit fields
❍ Stealing bit – indicates whether block contains data or is
“stolen” for urgent control signaling
❍ Training sequence
Used to adapt parameters of receiver to the current path
propagation characteristics and to select the strongest signal in
case of multipath propagation
A known bit pattern that differs for different adjacent cells
Enables the mobile units and base stations to determine that the
received signal is from the correct transmitter instead of a
interfering transmitter
❍ Guard bits – used to avoid overlapping with other bursts
07.04.2007
GSM Air Interface

07.04.2007
The GSM bursts
Each GSM RF carrier supports eight timeslots and the data are
transmitted in the form of bursts that are designed to fit within
these slots. The GSM specifications define five different bursts
as shown in Figure.
The normal burst (NB) is the most commonly used burst in GSM.
It consists of a 26-bit training sequence surrounded by two 58-bit
information blocks. Three tail bits are added at the beginning and
the end of the burst.
The total duration of the burst is 148 bits leaving a guard period
equivalent in duration to 8.25 bits.
The training sequence is used to ‘sound’ the radio channel and
produce an estimate of its impulse response at the receiver.
This estimate is used in the demodulation process to equalize the
effects of multi-path propagation.

07.04.2007
GSM Data Bursts

07.04.2007
The GSM bursts
The frequency correction burst (FB) is used by the MS to
detect a special carrier which is transmitted by every BTS
in a GSM network.
This carrier is called the broadcast control channel (BCCH)
carrier and it acts as a form of beacon and MSs will search
for BCCH carriers to detect the presence of a GSM
network.
The frequency correction burst is also used by MSs as a
frequency reference for their internal time bases.
Every bit in the frequency correction burst (including the
tail bits) is set to zero and, after GMSK modulation, this
results in a pure sine wave at a frequency around 68 kHz
(1625/24 kHz) higher than the RF carrier centre frequency.
07.04.2007
The GSM bursts
The synchronization burst (SB) carries 78 bits of coded data
formed into two blocks of 39 bits on either side of a 64-bit
training sequence.
As its name suggests, this burst carries details of the GSM frame
structure and allows an MS to fully synchronize with the BTS.
The synchronization burst is the first burst that the MS has to
demodulate and, for this reason, the training sequence is extended
to 64 bits.
This extended sequence provides a larger autocorrelation peak
than the 26-bit sequence of the normal burst. It also allows larger
multi-path delay spreads to be resolved.
All synchronization bursts use the same training sequence for bit
number 42 to bit number 105 in the burst. The arrangement of the
training sequence is as shown below.
An MS can use this training sequence to synchronize to the BTS
transmissions to within a quarter-bit accuracy.

07.04.2007
The GSM bursts
The fourth GSM burst is the access burst (AB). This
consists of a 41-bit training sequence followed by 36
information bits.
The access burst is used by the MS to access the network
initially and it is the first up-link burst that a BTS will have
to demodulate from a particular MS.
As with the synchronization burst, the training sequence is
extended to ease the demodulation process. The number of
tail bits at the beginning of the burst is increased to eight.
The tail bits at the end of the burst are all set to zero.
The AB is much shorter than the other bursts and this
results in a large guard period of 68.25 bit periods.

07.04.2007
The GSM bursts
This guard period is included to compensate for the
propagation delay between the MS and BTS.
Once a duplex link has been established, a closed loop timing
advance mechanism is activated to ensure that the MS up-
link bursts arrive at the BTS within the correct time slots.
However, this is not possible on the AB. Accordingly, a guard
period of 68.25 bit periods, equivalent to 252 µs, allows the
MS to be up to 38 km from the BTS before its up-link
bursts will spill into the next time slot.
As a result of its small size, the AB carries relatively little
information and this has an impact on the access procedure.

07.04.2007
The GSM bursts
The fifth type of burst is the dummy burst (DB) and is similar to
the NB in that it has the same structure and uses the same
training sequences.
The main difference between the DB and the NB is that the
information bits on either side of the training sequence are set to
a predefined sequence in the DB.
The DB is used to fill inactive time slots on the BCCH carrier,
which must be transmitted continuously and at a constant power.
The RF output spectrum of the transmitted signals in a TDMA
system is not only determined by the modulation process, but also
by the switching transients that occur when the bursts of RF
energy are transmitted.
The switching transients tend to widen the spectrum of the
transmitted signal, although this effect can be reduced by ramping
the output power up and down when transmitting a burst, instead
of just keying the transmitter on and off.
07.04.2007
The GSM bursts
The information transmitted in the burst must not be
affected by the process of power ramping, which is
performed at the beginning and end of the time slot.
As already mentioned, the active part of an NB is 148 bit
periods in duration. The useful part of a burst in all cases is
one bit period shorter than the active part and it begins
halfway through the first bit period.
During that part of the burst when information is
transmitted, the amplitude of the modulated RF signal must
stay approximately constant.
The power ramping mask, namely the variation in transmitted
power with time is used for the GSM bursts.

07.04.2007
The GSM receiver
Although the GSM specifications do not define the manner in
which the transmitted information should be recovered at the BTS
or MS receiver, the bursts have been specifically designed with
the Viterbi equalizer in mind.
The Viterbi equalizer is used to recover the information from each
GSM burst in the presence of the ISI caused by the radio channel
and the GMSK modulation process.
The received waveform will contain ISI caused by the radio
transmission channel and the GMSK modulation process.
At the receiver the burst is demultiplexed to give the training
sequence and the data bits. The training sequence is used to
estimate the impulse response of the radio channel in the channel
estimator.
The performance of each GSM receiver is tested such that a
minimum performance standard may be maintained across all GSM
type-approved equipment.

07.04.2007
The GSM receiver performance
The performances of the MS and BTS receivers are specified by
defining a maximum allowable BER for each of the different GSM
channels for a given set of radio channel conditions.
As the GSM system has been designed to operate in many
different environments, from rural to dense urban, it is important
that the specifications reflect this by specifying the performance
of the MS and BTS receivers over a wide range of different
operational environments.
To this end, the GSM specifications define four different channel
models and these are used to specify the performances of the MS
and BTS receivers. Each channel model consists of a number of
independently fading impulses, or paths, at different time delays.
In practice, the mobile radio channel cannot be separated into its
different paths; however, the channel models have been defined in
this manner so that they may be easily implemented in wideband
channel simulators for equipment testing.
07.04.2007
GSM Physical and logical channels
When an MS and a BTS communicate, they do so on a specific pair
of radio frequency (RF) carriers, one for the up-link and the other
for the down-link transmissions, and within a given time slot in
each consecutive TDMA frame.
This combination of time slot and carrier frequency forms what is
termed a physical channel.
One RF channel will support eight physical channels in time slots
zero through to seven.
The data, whether user traffic or signaling information, are
mapped on to the physical channels by defining a number of logical
channels.
A logical channel will carry information of a specific type and a
number of these channels may be combined before being mapped
onto the same physical channel.
Um interface: various logical channels are mapped to physical
channels
07.04.2007
GSM Logical Channels
3 groups of logical channels, TCH, CCH and CBCH
TCH – Traffic Channel - used to carry voice or data traffic
CCH – Control Channel - used for control functions
CBCH – Call Broadcast Channel - used for broadcast functions
Logical traffic channels = full rate (TCH/F) at 22.8 kb/s or half
rate (TCH/H) at 11.4 kb/s
Physical channel = full rate traffic channel (1 timeslot) or 2 half
rate traffic channels (1 timeslot in alternating frames)
Full rate channel may carry 13 kb/s speech or data at 12, 6, or 3.6
kb/s
Half rate channel may carry 6.5 kb/s speech or data at 6 or 3.6
kb/s
07.04.2007
GSM Logical Channel Structure
TCH CCH CBCH
TCH/F TCH/H
BCH CCCH DCCH
FCCH SCH BCCH PCH AGCH RACH ACCH SDCCH
SACCH FACCH

07.04.2007
GSM Radio interface - logical channels
Traffic
Trafficchannels
channels Control
Controlchannels
channels(for
(forsignaling)
signaling)
TCH/F
TCH/F
Broadcast
Broadcast Common
Commoncontrol
control Dedicated
Dedicated
TCH/H
TCH/H
SCH
SCH PCH
PCH SDCCH
SDCCH
AGCH
AGCH
FCCH
FCCH SACCH
SACCH
bidirectional
downlink
uplink BCCH RACH FACCH
BCCH RACH FACCH

07.04.2007
Traffic channels
GSM defines two types of traffic channel (TCH).
The full-rate TCH allows speech transmission at 13 kb/s and
in the specifications it is termed a TCH/FS channel to show
that it is a full-rate TCH carrying speech information.
The full-rate TCH also allows user data transmission at the
primary user rates of 9.6, 4.8 and 2.4 kb/s, referred to as
TCH/F9.6, TCH/F4.8 and TCH/F2.4, respectively.
A full-rate TCH will occupy a complete physical channel, i.e.
one timeslot in each TDMA frame and on each up- and down-
link carrier.

07.04.2007
Traffic channels
The half-rate TCH allows speech transmission at around 7
kb/s (TCH/HS) and data at primary user rates of 4.8 and
2.4 kb/s, called TCH/H4.8 and TCH/H2.4, respectively.
The half-rate channel uses one timeslot in every other
TDMA frame, on average, and this means that each physical
channel can support two half-rate TCHs.
The half-rate channel is primarily intended to support the
GSM half-rate speech coder.
The TCHs always use the normal burst.

07.04.2007
Control channels
Control channels carry signaling information between an MS
and a BTS.
There are several forms of control channels in GSM, and
they can generally be divided into four categories according
to the manner in which they are supported on the radio
interface and the type of signaling information they carry.
The broadcast channels are used to broadcast
synchronization and general network information to all the
MSs within a cell.
Signaling information is carried between an MS and a BTS
using associated control channels during a call, while stand-
alone dedicated control channels are employed outside of a
call.
Finally, the common control channels are used by an MS
during the paging and access procedures. .

07.04.2007
Broadcast channels
Broadcast channels are transmitted in the down-link
direction only, i.e. they are only transmitted by the BTS.
The frequency correction channel (FCCH) is the simplest
GSM logical channel because all its information bits are set
to zero.
The FCCH consists solely of frequency correction bursts
which consist of an all-zero bit pattern.
After GMSK modulation, these bursts produce a pure sine
wave at a frequency of around 68 kHz (1625/24 kHz) above
the carrier frequency.
The FCCH is used by the MS in the initial stages of BTS
acquisition to correct its internal frequency sources and
recover the carrier phase of the BTS transmissions.

07.04.2007
Broadcast channels
The synchronization channel (SCH) contains full details of its own
position within the GSM framing structure. We will examine this
framing structure in the next section.
Using the information supplied on the SCH, an MS can fully
synchronize its frame counters with those of a BTS.
The SCH information is transmitted using synchronization bursts.
In addition to the frame synchronization information, the SCH also
contains a six-bit base station identity code (BSIC).
An MS is required to measure the received signal strength of a
special beacon carrier, termed the BCCH carrier. This carrier is
transmitted at a constant power by each of the MS’s neighboring
BTSs.
This information is reported to the network where it is used to
determine whether the MS is connected to the most appropriate
BTS or whether it should be switched to a more suitable BTS.

07.04.2007
Broadcast channels
The broadcast control channel (BCCH) is used to broadcast
control information to every MS within a cell.
This information includes details of the control channel
configuration used at the BTS, a list of the BCCH carrier
frequencies used at the neighboring BTSs and a number of
parameters that are used by the MS when accessing the BTS.
The cell broadcast channel (CBCH) is used to transmit short
alpha numeric text messages to all the MSs within a particular
cell.
These messages appear on the MS’s display and a subscriber
may choose to receive different messages by selecting
different pages, similar to the way the teletext system works
on broadcast television.
The BCCH and the CBCH both use the normal burst.

07.04.2007
Associated control channels
When an MS is engaged in a call, a certain amount of signaling
information must flow across the radio interface in order to
maintain the call.
For example, an MS will continually report the received level
of the BCCH carriers of its neighboring BTSs. This type of
signaling is supported using logical control channels which
occupy the same physical channel as the traffic data.
Non-urgent information, e.g. measurement data, is
transmitted using the slow associated control channel
(SACCH).
This channel is always present when a dedicated link is active
between the MS and BTS, and it occupies one timeslot in
every 26.
SACCH messages may be sent once every 480 ms, i.e.
approximately every 2 s.

07.04.2007
Associated control channels
More urgent information, e.g. a handover command, is sent
using time slots that are ‘stolen’ from the traffic channel.
This channel is known as the fast associated control channel
(FACCH) because of its ability to transfer information
between the BTS and MS more quickly than the SACCH.
A FACCH signaling block is used to exactly replace a single (20
ms) speech block and a complete FACCH message may be sent
once every 20 ms.
Both the SACCH and FACCH use the normal burst and they
are both up-link and down-link channels.

07.04.2007
Stand-alone dedicated control channel
In some situations, signaling information must flow between a
network and an MS when a call is not in progress, e.g. during a
location update.
This could be accommodated by allocating either a full-rate or half-
rate TCH and by using either the SACCH or FACCH to carry the
information.
This would, however, be a waste of the limited radio resources since
the data transfer requirements of a process such as location
updating are far less than those of speech transmissions.
For this reason, a lower data rate channel has been defined which
has around one-eighth of the capacity of a full-rate TCH. This
channel is known as a stand-alone dedicated control channel
(SDCCH).
The channel is termed ‘stand-alone’ because it may exist
independently of any TCH, and it is termed ‘dedicated’ because it is
only used by one particular MS, i.e. dedicated to a particular MS.

07.04.2007
Stand-alone dedicated control channel
In some ways the SDCCH is similar to a TCH since they are both
used to provide a dedicated connection between a BTS and an MS.
The SDCCH also has an associated SACCH. Since the SDCCH
always carries signaling traffic there is no frame stealing and
consequently it does not need an FACCH.
Alternatively, one could argue that the SDCCH is constantly in the
FACCH mode.
The SDCCH operates on both the up-link and down-link and the
normal burst is always used. .

07.04.2007
Common control channels
The common control channels may be used by any MS within a cell.
The paging channel (PCH) is a down-link only channel that is used by
the system to page individual MSs, e.g. in the event of an incoming
call.
There are two different PCHs, a full-rate PCH and a reduced rate
PCH, for use in cells with a limited capacity.
The normal burst is always used on the PCH.
The access grant channel (AGCH) shares the same physical
resources as the PCH, i.e. a particular time slot may be used by
either channel, though not simultaneously.
The AGCH is used by the network to grant, or deny, an MS access to
the network by supplying it with details of a dedicated channel, i.e.
TCH or SDCCH, to be used for subsequent communications.
The AGCH is a down-link only channel and it uses the normal burst.

07.04.2007
Common control channels
The random access channel (RACH) is an up-link only channel that is
used by an MS to initially access the network, e.g. at call set-up or
prior to a location update.
It is termed ‘random’ because there is no mechanism to ensure that
no more than one MS transmits in each RACH time slot and there is
a finite probability that two mobiles could attempt to access the
same RACH at the same time.
This could result in neither access attempt being successful as the
two signals collide at the BTS.
If an MS receives no response from the BTS, it will attempt to
access the BTS again after waiting a certain period of time.
If this period of time was the same for every MS, then once a
collision occurs between two MSs, it will continue to occur for every
subsequent access attempt. Therefore the delay between access
attempts is randomized to reduce the likelihood of collisions at the
BTS.
The MS will always transmit access bursts on the RACH.
07.04.2007
Select the channel with
Power On Scan Channels, highest RF level among
monitor RF levels the control channels
Scan the channel for the

FCCH
Select the channel with NO

next highest Rf level from Is
the control list. FCCH detected?
YES
Scan channel for SCH
NO
Is
SCH detected?
YES
Read data from BCCH

and determine is it BCCH?
From the channel data NO Is

update the control channel the current BCCH
list channel included? YES
Camp on BCCH and

start decoding
07.04.2007
Mapping logical channels onto physical channels
The various logical channels may be combined in one of six
different ways, before being mapped onto a single physical
channel.
The simplest mapping is the full-rate traffic channel
(TCH/F) and its SACCH.
When combined these channels fit exactly into a single
physical channel.
Note that the mapping between the TCH and the physical
channel is the same regardless of whether the TCH is used
to carry speech or user data.
A single physical channel will also support two half-rate
traffic channels (TCH/H) and their SACCHs or eight
SDCCHs and their associated SACCHs.

07.04.2007

07.04.2007
The basic broadcast and common control channel combination
consists of a single FCCH, SCH and BCCH on the down-link, along
with a full-rate PCH and a full-rate AGCH.
The up-link is entirely dedicated to the RACH, and for this reason
we shall term this a full-rate RACH.
This type of channel configuration is generally used in medium
capacity or large capacity cells where the access capacity of a full-
rate PCH, AGCH and RACH channel is justified.
This control channel combination may only occur on time slot zero
of a carrier.
The carrier that supports these channels at a BTS is called the
BCCH carrier and it will be unique within each cell, or sector, i.e.
each BTS will only have one BCCH carrier.
In smaller capacity cells, i.e. cells with a smaller number of RF
carriers, the capacity of the full-rate PCH, AGCH and RACH may
not be justified.

07.04.2007

07.04.2007
For this reason, a second combination of the access channels is
employed.
The down-link continues to support an FCCH, SCH and BCCH;
however, the rate of the down-link PCH and AGCH is reduced to
around one-third of their full rate.
The extra slots that have been created as a result of this rate
reduction on the down-link are used to support four SDCCHs and
their associated SACCHs.
The SDCCHs will also occupy a number of up-link slots and the
number of timeslots allocated to the RACH on the up-link is
reduced accordingly.
This will effectively halve the number of time slots allocated to
the RACH.
Again, this control channel combination may only occur on time slot
zero of the BCCH carrier.

07.04.2007
The final control channel combination is defined for use in large
capacity cells where the access capacity of a single PCH, AGCH and
RACH is insufficient.
This combination consists of a BCCH and a full-rate PCH and AGCH
on the down-link and a full-rate RACH on the up-link.
This channel combination may only occur on slot two, or slots two
and four, or slots two, four and six of the BCCH carrier.
Note that each BTS must only transmit a single FCCH and SCH
and, consequently, these channels are not included in the extension
channel set.
Each extension set contains its own BCCH for two reasons.
Firstly, the BCCH contains information that applies only to the
RACH occupying the same time slot within the TDMA frame, and
secondly, it is easier for the MS to monitor bursts occurring on
the same physical channel.

07.04.2007
The GSM frame structure
The basic TDMA frame structure employed in GSM specifies
that each carrier supports eight timeslots, and a physical
channel occupies one timeslot in each frame.
The TDMA frame represents the lowest layer in a complex
hierarchical frame structure.
The next level in the GSM frame structure, above the
TDMA frame, is the multiframe which consists of 26 TDMA
frames in the case of the full-rate and half-rate traffic
channels, or 51 frames for all of the other logical channels.

07.04.2007
GSM normal burst: 156.25 bits (0.577 ms)

33 57
57encrypted
encryptedbits
bits 11 26
26training
trainingbits
bits 11 57
57encrypted
encryptedbits
bits 33 8.25
8.25
traffic or signaling info in burst?
TDMA frame (4.615 ms):

TS7
TS7 TS0
TS0 TS1
TS1 TS2
TS2 TS3
TS3 TS4
TS4 TS5
TS5 TS6
TS6 TS7
TS7 TS0
TS0 TS1
TS1
TDMA multiframe: SACCH

11 22 33 44 55 66 77 88 99 10
10 11
11 12
12 13
13 14
14 15
15
Idle
= 26 TDMA frames (in case of TCH) 23
23 24
24 25
25 26
26

07.04.2007
The frame structure for a full-rate traffic channel (TCH/F)
occupying time slot one in each TDMA frame is shown in Figure.
The first 12 time slots in each TDMA frame of the multiframe, i.e.
zero to 11, are used by the TCH/F itself.
The next time slot is used by the SACCH.
The next 12 timeslots in each TDMA frame of the multiframe are
used by the TCH/F, and the remaining timeslot in TDMA frame 26
not used for transmission, and for this reason it is termed an ‘idle’
time slot. .
This may be applied to both the up-link and down-link by noting
that there is an offset of three burst periods between the frame
timing on the up-link and down-link.
The traffic multiframe is exactly 120 ms in duration and this
defines many of the time periods that are used in GSM, e.g. 1
TDMA frame = 120 ms/26 ≈ 4.615 ms.

07.04.2007
Traffic multiframe structure

07.04.2007
Traffic Channel Structure for Full Rate Coding
Slots 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2
Bursts for Users allocated in Slot

1 2 3 4 5 6 7 8 9T 10 11 12 13 14 15 16 17 26
T T T T T T T T T T T T S T T T T I
T = Traffic
S = Signal( contains information about the signal strength in
neighboring cells)

07.04.2007
Traffic Channel Structure for Half Rate Coding
Slots 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2
Burst for one users

1 2 3 4 5 6 7 8 9T 10 11 12 13 14 15 16 17 26
T T T T T T S T T
Bursts for another users allocated in alternate Slots

1 2 3 4 5 6 T7 8 9T 10 11 12 13 14 15 16 17 26
T T T T T T T T S
=

07.04.2007
The organization of the half-rate traffic channel (TCH/H) is
a little more complicated than the TCH/F.
The half-rate traffic channel (TCH/H) uses alternate slots
in a multiframe; this way, two TCH/H can be accommodated
within the one TCH/F.
Figures on next slides show that the next level in the frame
structure above the multiframe is the superframe, and in
the case of the TCH/F and the TCH/H consists of 51
multiframes.
The duration of a superframe is 6.12 s.
The final level in the frame structure is the hyperframe and
this consists of 2048 superframes and has duration of
around 3.5 h.

07.04.2007
GSM Frame Hierarchy
2048 super frames: Hyper frame (3 hr 28 min 53.76 s)
51 traffic or 26 control multi frames: Super frame (6.12 s)
26 traffic frames: Multi frame (120 ms) 51control frames: Multi frame (235.4 ms)
8 slots: Frame (4.615 ms)
156.25 bits: Burst (0.577 ms)

07.04.2007
GSM hierarchy of frames
hyperframe
0 1 2 ... 2045 2046 2047 3 h 28 min 53.76 s
superframe
0 1 2 ... 48 49 50
6.12 s
0 1 ... 24 25
multiframe
0 1 ... 24 25 120 ms
0 1 2 ... 48 49 50 235.4 ms
frame
0 1 ... 6 7 4.615 ms
slot
burst 577 µs

07.04.2007
The frame structure for a control channel set on timeslot zero is
shown in Figure on next slide.
In this case the multiframe consists of 51 TDMA frames and lasts
around 235 ms.
All channels, except the TCH/F and TCH/H, use the 51-frame
multiframe.
There are four different control channel combinations and each of
these uses the 51-frame multiframe.
Figure shows the basic control channel arrangement that would be
present on time slot zero of the BCCH carrier.
The down-link multiframe is subdivided into five groups of 10 time
slots with a single idle slot at the end.
The first timeslot of each of the groups is assigned to the FCCH
and contains the frequency correction burst.
Similarly, the second time slot of the group is assigned to the SCH
and contains a synchronization burst.

07.04.2007
Traffic multiframe structure

07.04.2007
In the first group, the four timeslots following the FCCH and SCH
slots are assigned to the BCCH.
The remaining down-link timeslots, except the idle burst at the
end of the multiframe, are assigned to the PCH and AGCH.
The PCH/AGCH timeslots may be assigned to either channel on a
block-by-block basis, where a block consists of four timeslots
(defined by the interleaving block size).
Each block will contain sufficient information for the MS to
identify the channel, i.e. PCH or AGCH.
On the up-link, all timeslots are assigned to the RACH.
We note that the four timeslots following the BCCH slots shown in
Figure may also be assigned to the BCCH. In this case these four
slots will be assigned to either the BCCH, PCH or AGCH on a block-
by-block basis.

07.04.2007
The control channel superframe consists of 26 multiframes
and is 6.12 s in duration.
This is exactly the same length as the traffic channel
superframe.
The superframe represents the smallest time cycle for
which the traffic channel and control channel relationships
are repeated, and for this reason the multiframe structure
in use on each physical channel may only change at
superframe boundaries.
Figures 2.14 and 2.16 show that the hyperframe provides the
final level in the GSM frame structure for both the traffic
and control channels.
It consists of 2048 superframes and lasts for around 3.5 h.
Each of the 2715648 timeslots in the hyperframe has a
unique number and this is used in the ciphering and
frequency hopping algorithms.

07.04.2007
Registration
MS BTS BSC MSC VLR HLR
1. Channel Request
2. Activation Response
3. Activation ACK
4. Channel Assigned
5. Location Update Request
6. Authentication Request
7. Authentication Response
8. Authentication Check
9. Assigning TMSI
10. ACK for TMSI
11. Entry for VLR and HLR
12. Channel Release

07.04.2007
Mobile Originated Call
1, 2: connection request
3, 4: security check VLR
5-8: check resources (free 3 4

circuit) 6 5
PSTN GMSC MSC
9-10: set up call 7 8
2 9
1
MS BSS
10

07.04.2007
Mobile Terminated Call
1: calling a GSM subscriber
2: forwarding call to GMSC 4
3: signal call setup to HLR HLR
5
VLR
8 9
4, 5: request MSRN from VLR 3 6 14 15
6: forward responsible calling 7
PSTN GMSC MSC
MSC to GMSC station 1 2
7: forward call to 10 10 13 10
16
current MSC BSS BSS BSS
8, 9: get current status of 11 11 11
MS
11 12
10, 11: paging of MS 17
12, 13: MS answers MS
14, 15: security checks

16, 17: set up connection

07.04.2007
MTC/MOC
MS MTC BTS MS MOC BTS
paging request
channel request channel request
immediate assignment immediate assignment
paging response service request
authentication request authentication request
authentication response authentication response
ciphering command ciphering command
ciphering complete ciphering complete
setup setup
call confirmed call confirmed
assignment command assignment command
assignment complete assignment complete
alerting alerting
connect connect
connect acknowledge connect acknowledge
data/speech exchange data/speech exchange

07.04.2007
GSM Channel Use Example
MS BTS BSC MSC
1. Channel Request (RACH)
2. Channel Assigned (AGCH)
3. Call Establishment Request (SDCCH)
4. Authentication Request (SDCCH)
5. Authentication Response (SDCCH)
6. Ciphering Command (SDCCH)
7. Ciphering Ready (SDCCH)

8. Send Destination Address (SDCCH)
9. Routing Response (SDCCH)

10. Assign Traffic Channel (SDCCH)
11. Traffic Channel Established (FACCH)
12. Available/Busy Signal (FACCH)
13. Call Accepted (FACCH)
14. Connection Established (FACCH)
15. Information Exchange (TCH)
07.04.2007
Example: Incoming Call Setup
MS ↓ BSS/MSC ------ Paging request (PCH)
MS ↑ BSS/MSC ------ Channel request (RACH)
MS ↓ BSS/MSC ------ Immediate Assignment (AGCH)
MS ↑ BSS/MSC ------ Paging Response (SDCCH)
MS ↓ BSS/MSC ------ Authentication Request (SDCCH)
MS ↑ BSS/MSC ------ Authentication Response (SDCCH)
MS ↓ BSS/MSC ------ Cipher Mode Command (SDCCH)
MS ↑ BSS/MSC ------ Cipher Mode Compl. (SDCCH)
MS ↓ BSS/MSC ------ Setup (SDCCH)
MS ↑ BSS/MSC ------ Call Confirmation (SDCCH)
MS ↓ BSS/MSC ------ Assignment Command (SDCCH)
MS ↑ BSS/MSC ------ Assignment Compl. (FACCH)
MS ↑ BSS/MSC ------ Alert (FACCH)
MS ↑ BSS/MSC ------ Connect (FACCH)
MS ↓ BSS/MSC ------ Connect Acknowledge (FACCH)
MS ⌦BSS/MSC ------ Data (TCH)

07.04.2007

WMC GSM Part1

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

WMC GSM Part1

Uploaded by

Copyright:

Available Formats

Personal and Mobile

Personal and Mobile Communications – GSM 6-4

Personal and Mobile Communications – GSM 6-5

Personal and Mobile Communications – GSM 6-6

Personal and Mobile Communications – GSM 6-7

Personal and Mobile Communications – GSM 6-8

❍ Short Message Service (SMS)

Personal and Mobile Communications – GSM 6-9

Personal and Mobile Communications – GSM 6-10

Personal and Mobile Communications – GSM 6-11

VLR MSC MSC

Personal and Mobile Communications – GSM 6-12

Personal and Mobile Communications – GSM 6-13

NSS VLR VLR signaling

OSS EIR AUC OMC

Personal and Mobile Communications – GSM 6-14

Personal and Mobile Communications – GSM

Personal and Mobile Communications – GSM 6-17

Personal and Mobile Communications – GSM 6-18

Personal and Mobile Communications – GSM 6-19

Personal and Mobile Communications – GSM 6-20

Personal and Mobile Communications – GSM 6-21

Personal and Mobile Communications – GSM 6-22

Personal and Mobile Communications – GSM 6-23

Personal and Mobile Communications – GSM 6-24

In GSM terminology, the term MS refers to the combination of a

The SIM has an area of non-volatile memory which is used to store

This number is used to identify each individual subscriber within the

Personal and Mobile Communications – GSM 6-25

Personal and Mobile Communications – GSM

Personal and Mobile Communications – GSM 6-29

Personal and Mobile Communications – GSM 6-31

Personal and Mobile Communications – GSM 6-32

Personal and Mobile Communications – GSM 6-33

Personal and Mobile Communications – GSM 6-34

Personal and Mobile Communications – GSM 6-35

Personal and Mobile Communications – GSM 6-36

Personal and Mobile Communications – GSM 6-38

Personal and Mobile Communications – GSM 6-39

Personal and Mobile Communications – GSM 6-40

Personal and Mobile Communications – GSM 6-41

Personal and Mobile Communications – GSM 6-42

Personal and Mobile Communications – GSM 6-43

Personal and Mobile Communications – GSM 6-44

Personal and Mobile Communications – GSM 6-45

Personal and Mobile Communications – GSM 6-46

Personal and Mobile Communications – GSM 6-47

Personal and Mobile Communications – GSM 6-48

2 8 W (39 dBm) 0.25 W (24 dBm)

5 0.8 W (29 dBm)

Personal and Mobile Communications – GSM 6-49

Personal and Mobile Communications – GSM 6-51

Personal and Mobile Communications – GSM 6-52

935.2 MHz 1 200 kHz

Personal and Mobile Communications – GSM 6-53

GSM uses 124 frequency channels, each of which

Personal and Mobile Communications – GSM 6-54

100 KHz BW = 25 MHz

Personal and Mobile Communications – GSM 6-55

Personal and Mobile Communications – GSM 6-56

Personal and Mobile Communications – GSM 6-57

ARFCN – Absolute Radio Frequency Channel Number