M900/M1800 GSM SYSTEM

BSC Training Document

OMA0000 GSM Fundamentals

Huawei Technologies CO., Ltd.

Training Center

Contents
1 GSM FUNDAMENTALS..........................................................................................................................................3

1.1 BASIC CONCEPTS OF CELLULAR MOBILE SYSTEM ......................................................................................................3

1.2 GSM NETWORK COMPONENTS................................................................................................................................9
1.3 TERRESTRIAL INTERFACE.......................................................................................................................................30
1.4 SERVICE AREA AND NUMBER PLANNING..................................................................................................................40
1.5 CHANNELS ON THE AIR INTERFACE.........................................................................................................................54
1.6 RADIO TECHNOLOGIES..........................................................................................................................................71
1.7 THE FUTURE DEVELOPMENT..................................................................................................................................81
1 GSM Fundamentals

1.1 Basic Concepts of Cellular Mobile System

4
Each cell in the Cellular Network requires a RF carrier. A RF carrier is a pair of
radio frequencies. One is used in each direction (including transmitting and
receiving) so that information may be passed in both directions simultaneously.

The frequency spectrum allocated for cellular system is only a narrow bandwidth.
The bandwidth for the GSM system is 25MHz. The transmitting and receiving
frequencies in GSM are separated by 45MHz to avoid interference. The frequency
bandwidth used for the downlink (from base station to MS) is 935-960MHz. The
frequency bandwidth for the uplink (from MS to base station) is 890-915MHz. The
channel bandwidth is 200 KHz.

Considering the interference to other systems, the very first carrier is not used.
Thus, there are only 124 RF carriers in the GSM frequency band.

5
 The Frequency Spectrum
DCS 1800

Base Station Receive Base Station Transmit

1710 1785 1805 1880MHz

Separation: 95MHz
Channel Bandwidth: 200KHz

The bandwidth for the DCS1800 system is 75MHz. The transmitting and receiving
frequencies in DCS1800 are separated by 95MHz to avoid interference.

The frequency bandwidth used for the downlink (from base station to MS) is 1805-
1880MHz. The frequency bandwidth for the uplink (from MS to base station) is
1710-1785MHz.

The channel bandwidth is 200 KHz just the same as GSM. Due to interference to
other systems, the very first carrier is still not used. Thus, there are 374 RF
carriers in the DCS1800 frequency band.

Thus, DCS 1800 has three times the frequency allocation of GSM 900. So you will
understand that DCS1800 can meet the requirements of high traffic in the large
densely populated area, while GSM 900 can meet the requirements of large
coverage.

6
The hexagonal regions in this diagram are known as cells and represent the
geographic area covered by one RF carrier. Sure it is really like the shape of bee’s
cell. Now you will understand that why it is called as cellular system.

Cellular system involves dividing a large service area into regions called "cells".
Each cell has the equipment to switch, transmit and receive calls from any
subscriber located within its' radio coverage area.

Cells are conventionally regarded as being hexagonal, but in reality they are
irregularly shaped. The cell shape is determined by the nature of the surrounding
area such as hills, tall buildings etc.

In Omni -Directional Cells, all the cells have their own Cell Site this is known as an
Omni cell. When traffic density is very high, cells can be reduced into many smaller
size called as “sectoring ".

In 120 Degree Sectors, the original cell is divided into three smaller cells. These
cells share the same cell site but each has its own allocation of radio carriers.

7
Because the frequency spectrum allocated for cellular system is only a narrow
bandwidth, it is very clear that there are not enough frequencies available for every
cell to have a different RF carrier. Therefore the frequencies must be reused. It
means that the same RF carrier can be used in other several different cells at the
same time. By reusing frequencies, many more phone calls may be made.

The radio frequencies available are allocated according to a regular pattern. In this
way, each carrier used repeatedly throughout the coverage area according to a
frequency re-use pattern.

This diagram illustrates 4*3 Re- Use Pattern. It means that 4 sites share the same
group frequencies and each site has 3 cells. These group frequencies can be
reused in another 4 sites.

Care must be taken to make the cells which are using the same frequencies far
enough apart from one another to prevent interference.

8
1.2 GSM Network Components

9
This diagram shows a simplified GSM network. The main components of a GSM
System are: BSS, NSS and OMC

The Mobile Station (MS) is the only direct part of the network that the subscriber
can see.

BSS means Base Station Subsystem. BSS is responsible for the system functions
related to radio and transmission of the GSM system. BSS includes BSC and BTS.
BSC means base station controller. BTS means base transceiver station.

NSS means Network Subsystem. NSS is composed of MSC/VLR, HLR/AuC/EIR.

NSS is the control and switching part of the whole GSM system.

MSC means Mobile Switching Center. HLR means home location register. AuC
means authentication center. EIR means equipment identification register. MSC
provides the interface between GSM network and the Public Switched Telephone
Network (PSTN).

OMC means operation and maintenance center. It is used to configure and

maintain the network from a central location. OMC is connected to BSS and NSS
through LAN or WAN.

10
The Mobile Station consists of two parts, the Mobile Equipment (ME) and an
electronic “smart card” called a Subscriber identity module (SIM card).

The Mobile Equipment is the hardware used by the subscriber to access the
network. This may be a telephone, fax machine etc. The hardware has an identity
number which is unique for that particular device and permanently stored in it. This
enables stolen mobile equipment to be detected by GSM system. This identity
number is called an International Mobile Equipment Identity (IMEI).

The SIM is a card which plug into the Mobile Equipment. This card identifies the
mobile subscriber and also provides other information regarding the service. The
subscriber is identified by an identity number called the International Mobile
Subscriber Identity (IMSI).

Mobile Equipment may be purchased from any store but the SIM card must be
obtained from the GSM network operator. When SIM card is not inserted into the
mobile equipment, only the emergency calls can be made.

11
The SIM card as mentioned previously is a "smart card" which plugs into the
mobile equipment and contains information about the mobile subscriber. The SIM
card contains the following information:

International Mobile Subscriber Identity (IMSI) - This number identifies the mobile
subscriber. It is only transmitted over the air interface during initialization.

Temporary Mobile Subscriber Identity (TMSI) - This number identifies the

subscriber, it is periodically changed by the system in order to protect the
subscriber from being identified by someone monitoring the radio interface.

Location Area Identity (LAI) identifies the current location of the subscriber.

Subscriber Authentication Key (Ki) - This is used to authenticate the SIM card.

Mobile Station International ISDN Number (MSISDN) - This is the telephone

number of the mobile. It is comprised of a country code, a national code and a
subscriber number.

Most of the data contained within the SIM is permanent (such as Ki and IMSI).
Some of the parameters (such as LAI) will be continuously updated to reflect the
current location of the subscriber.

The SIM card has high security and provides protection for the subscriber's
information to be difficult to duplicate. The SIM can be also protected by use of
Personal Identity Number (PIN) password. PIN is similar to credit card password

12
and it is used to prevent unauthorized use of the card. The SIM card also executes
the Authentication Algorithm in which Ki is used.

13
The BSS provides the connection between the mobile equipment and the Mobile
Switching Center. The BSS consists of two major hardware components:

The BSC provides the control for the BSS and communicates directly with the
MSC. The BSC may control one or more BTS.

The BTS comprises of a combination of RF equipment that provides the air

interface for a particular cell. This is the part of the GSM network that
communicates with the mobile station. The antenna is included as part of the BTS.

The Transcoder is used to compress the signals so that they can be more
efficiently sent over the terrestrial interfaces. In fact it will convert data between
64kbps and 16kbps.

Sub-Multiplexer is used to combine the data in order to save the transmission cost
between MSC and BTS. Although the Transcoder is considered to be part of the
BSS, but it is very often located closer to the MSC in order to optimize the
transmission between MSC and BTS.

Maybe you are wondering how TC and SM can save the transmission line. Ok, the
detailed reason will be described in the next slide.

14
It is known that the 64Kbps Pulse Code Modulation (PCM) circuits are adopted in
PSTN. So if 64kbps from the MSC transmitted on the air interface without
modification, it would occupy an excessive amount of radio bandwidth. This would
use the available radio spectrum inefficiently.

Then the Transcoder is required to convert the speech or data output from the
MSC into the data rate specified by GSM standard. For example, 64kbps/PCM is
converted to 13kbps speech or 3.6/6/12kbps data over the interface between BSS
and MS. The required bandwidth is therefore reduced.

Transcoder may be located with the MSC or BSC. If it is located at the MSC, the
13kbps channels are transmitted to the BSS by inserting additional synchronization
data to 16kbps and then combining four of them into each 64kbps terrestrial circuit.
Thus each 30 channel 2Mbps PCM link can carry 120 GSM- specified voice
channels. It obviously costs savings for the system operator.

Therefore, Transcoder is commonly arranged to be located with the MSC side and
it will reduce the number of 2 Mbps link required.

15
The Network Switching System includes the main switching functions of the GSM
Network. It also contains the databases required for subscriber data and mobility
Management. Its main function is to manage communications between the GSM
Network and other networks.

The components of the Network Switching System are listed below:

1. Mobile Switching Center - MSC

2. Home Location Register - HLR

3. Visitor Location Register - VLR

4. Equipment Identity Register - EIR

5. Authentication Center - AUC

6. Inter-Working Function -IWF

7. Echo Canceller -EC

In addition to mobile switching center, NSS has Location Register network entities.
These entities are the Home Location Register (HLR), Visitor Location Register
(VLR), Equipment Identity Register (EIR). Normally, HLR, AuC and EIR are located
in the same physical entity, and MSC/VLR can also be co-located in one physical
entity. All the database registers are used to manage subscriber data and keep
track of a mobile subscriber’s location as it roams around the network.

16
Functionally, the Inter working Function and the Echo Canceller may be
considered as parts of the MSC since their activities are linked with the switch.
Echo Canceller is used between PSTN and MSC. Inter working Function is used
between MSC and other network.

17
The main function of MSC is for call- switching in GSM system. Its overall purpose
is the same as that of any telephone exchanger.

The MSC will carry out several different functions depending upon its position in
the network. When the MSC provides the interface to PSTN, it will be known as a
Gateway MSC (GMSC). In this position it will provide the switching required for all
mobile originated or terminated traffic.

The GSM network typically contains more than one MSC, each MSC provides
service to mobiles located within a defined geographic coverage area. The
functions carried out by the MSC are listed below:

1. Call Processing function - Includes of data/ voice call setup, inter - BSS and
Inter - MSC Handover and control of mobility management.

2. Operation and Maintenance Supporting function - Includes database

management, traffic measurement and a man machine interface.

3. Inter-network & Inter-working function - Manages the interface between the

GSM network and the PSTN

4. Billing function- Collects call billing data and transit the bills to the centralized
billing center.

18
The HLR is the database for subscriber parameters. Various identification numbers
and addresses are stored as well as authentication parameters. This information is
entered into the database by the network operator when a new subscriber is added
to the system.

The parameters stored in the HLR are listed below:

1. Subscriber ID (IMSI and MSISDN)

2. Current subscriber VLR (Current location)

3. Supplementary service information (e.g. Current forwarding number )

4. Subscriber status (registered / de-registered )

5. Authentication key and AUC functionality

6. Temporary Mobile Subscriber Identity (TMSI)

7. Mobile Subscriber Roaming Number (MSRN)

The HLR database contains the master database of all the subscribers in GSM
system. It’s data can be remotely accessed by all the MSCs and VLRs in the
network.

19
Although the network may contain more than one HLR, there is only one database
record per subscriber - each HLR is therefore handling a portion of the total
subscriber database.

The subscriber data may be accessed by either the IMSI or the MSISDN number.
The data can also be accessed by an MSC or a VLR in a different network and
allow inter-network calling and inter-country roaming.

20
The VLR contains a copy of most of the data stored at the HLR. However, It is a
temporary data that exists for only as long as the subscriber is "active" within the
VLR coverage.

So, the VLR provides a temporary local database for the subscriber. This function
reduces the need for excessive and time-consuming references to the "home" HLR
database.

The additional data stored in the VLR is listed below:

1. Mobile status (busy /free/no answer etc.)

2. Location Area Identity (LAI)

3. Temporary Mobile Subscriber Identity (TMSI)

4. Mobile Station Roaming Number(MSRN)

21
The EIR contains a centralized database for validating the International Mobile
Equipment Identity (IMEI).

This database is concerned solely with MS equipment and not with the subscriber.

The EIR database consists of lists of IMEIs organized as follows:

1. WHITE LIST contains those IMEIs that have been assigned to valid mobile
Equipment.

2. BLACK LIST Contains IMEIs of mobiles which have been reported stolen or
which are have forbidden service for some other reason.

3. GREY LIST Contains IMEIs of mobiles that have problems (e.g. faulty software).
These are not sufficiently significant to enter into a "black list".

22
The AUC is a processor system. It performs the "authentication " function. It will
normally be co -located with the HLR. The authentication process will usually take
place each time the subscriber "initializes "on the system.

In the authentication process, secure data stored on the SIM card is calculated and
compared with the data held in the HLR database. The Authentication Process is
as follows:

A random number is sent to the Mobile from the AUC.

This number is calculated together with Authentication Key (Ki) stored in the SIM
card by authentication algorithms, which is held in the SIM card.

The calculation of the random number and Ki will get two results. One is a
response called as SRES, which are returned to the AUC. Another is an Encryption
Key called as Kc which is stored in the SIM card. The Encryption key is used to
encrypt data that is sent over the air interface in order to make the interface more
secure.

1. While the mobile is carrying out these calculations, the AUC carries out exactly
the same calculations using the random number and ki stored in the HLR. Then
AUC also gets a response.

23
2. The AUC compares it with the response from the subscriber. If the responses
produced by the AUC and the subscriber are the same, the subscriber is permitted
to access the network.

3. The Encryption Key produced by the AUC is stored and sent to the BTS to
enable ciphering to take place.

The first time a subscriber attempts to make a call, the full authentication process
takes place. However, for subsequent calls, authentication may not be necessary.

24
The IWF provides the function to enable the GSM system to connect with the
various forms of data networks.

The basic features of the IWF are listed below:

1. Rate Conversion function

2. Protocol Adaptation function

GSM system may require IWF capability or not. This depends upon the network to
which it is being connected.

25
An Echo Canceller is used between PSTN and MSC for all voice circuits. Echo
control is required at the MSC because the GSM system delay can cause an
unacceptable echo condition even on a short distance with PSTN.

The GSM system delay may be caused by call processing, speech encoding and
decoding etc. The total round trip delay is approximately 180ms.

This would not be apparent to the call between MS. But this case will be very
different for the call between MS and land subscriber.

It is well known that, in the PSTN a 2- wire to 4- wire hybrid transformer is required
in the circuit because the standard telephone connection is 2- wire. This
transformer causes the echo, which does not affect the land subscriber. During a
normal PSTN land to land call, no echo is apparent because the delay is too short
and the user is unable to distinguish.

However, with the GSM round trip delay added and without the EC, the effect
would be very irritating to the MS subscriber and disrupting speech. Thus, Echo
controller is required between PSTN and MSC.

26
The operation and maintenance sub- system provides a capability to manage the
GSM network remotely.

Operation and Maintenance Center is a centralized facility that supports daily

management for the whole GSM system including MSC, HLR, BSC and BTS.

The OMC provides a central point from which to control and monitor the whole
network entities as well as monitor the quality of service provided by the network.

Because GSM does not specified the OMC specification and it is left to the
network operator to decide what capabilities they wish it to have. Thus, at present,
GSM manufacturers have their own OMCs, which are not compatible with those of
other manufacturers.

Generally, an OMC only manages a certain area of GSM network. Another

equipment Network Management Center-NMC should be mentioned here. NMC
has a view of the entire PLMN and is responsible for the management of the
network as a whole. The NMC locates at the top of the hierarchy and provides
global network management.

27
There are two types of OMC as below:

1. OMC (R) - It is assigned specifically to the Base Station System.

2. OMC (S) – It is assigned specifically to the Network Switching System.

These two parts can be located together or work independently according to the
practical requirements.

28
The OMC Functional Architecture is illustrated in this diagram:

The OMC should support the following functions as recommendations:

1. Event/Alarm Management

2. Fault Management

3. Performance Management

4. Configuration Management

5. Security Management

29
1.3 Terrestrial Interface

30
Each GSM component is designed to communicate over an interface specified by
the GSM standards. This provides flexibility and enables a system operator to
adopt system components from different manufacturers. For example Motorola
BSS equipment may be coupled with a Huawei NSS.

Each interface within the GSM system has a specified name associated with it.
This table illustrates the names of all the interfaces specified by GSM.

Name Interface
Um MS ⇔ BTS
Abis BTS ⇔ BSC
A BSC ⇔MSC
B
MSC⇔VLR
C
MSC⇔HLR
D
VLR ⇔HLR
E
MSC⇔MSC
F
MSC⇔EIR
G
H VLR ⇔VLR
HLR ⇔AUC
This section will introduce the terrestrial interfaces. It comprise all the connections
between the GSM system entities, while the Um, or air – interface is not included
since it belongs to radio interface and will be introduce in the next section.
31
The GSM interfaces conform to ITU specifications, which widely used throughout
the world.

This diagram shows the GSM system with the 2Mbps interfaces, which are
highlighted. These interfaces carry traffic from the PSTN to the MSC, between
MSCs, from an MSC to a BSC and from a BSC to remotely sited BTSs. These
links are also used between the MSC and IWF.

32
This diagram illustrates the structure of 2Mbps.

Each is a 2.048 Mbps link provides 30*64Kbps channels available to carry speech,
or data and two channels for control information.

The speech or data channels may contain CCS7 LAPD or X.25 formatted
information.

Therefore, these 2Mbps links commonly act as the physical bearer for all the
interfaces used between the GSM system entities.

33
This diagram shows the interface in GSM system with the X.25 packet data
connections or TCP/IP with highlight.

The X.25 or TCP/IP provide the OMC with communications to all the entities, such
as between OMC and MSC, between OMC and BSC, etc.

34
This diagram illustrates the use of CCS7 in the GSM system, carrying signaling
and control information between most major entities and to and from the PSTN.

The following message protocols, which are part of CCS7, are used to
communicate between the different GSM network entities.

The structure of CCS7 conforms to OSI structure. The left side is OSI 7 layer. The
right side is the CCS7 used in GSM system.

The first level is physical layer with 2Mbps trunk, also called as MTP level 1.

The second level is link layer with MTP level 2

The third level is network layer with MTP level 3 and SCCP.

The layers from layer 4 to layer 6 are not used in GSM CCS7 structure.

The seventh level is application layer, such as TUP, ISUP, MAP, TCAP and BSSAP.

35
This slide lists the abbreviation of CCS7.

MTP Message Transfer Part

TCAP Transaction Capabilities Application Part

SCCP Signaling Connection Control Part

TUP Telephone User Part

ISUP ISDN User Part

MAP Mobile Application Part

BSSAPBase Station System Application Part

BSSMAP BSS Management Application Part

DTAP Direct Transfer Application Part

As for the detailed description, please refers to the course of CCS7

36
This slide introduces the CCS7 protocols used on the GSM interfaces.

Inter - facing the PSTN, the MSC performs call signaling functions using the
Telephone User Part (TUP) while inter - facing the ISDN, the ISDN User Part
(ISUP) will be used.

Between the MSC and the BSC, the Base Station System Management
Application Part (BSSMAP) is used. The Direct Transfer Application Part (DTAP) is
used to send messages between the MSC and the mobile station (MS). MAP is
used between the MSC and the VLR, EIR, and HLR.

37
Abis is the interface between BSC and BTS. Because the GSM specifications for
this interface are not very specific, therefore Abis interface is not an open and
standard interface. Thus, the Abis interface of different manufacturers is varied.
This means that one manufacturer's BTS will not work with another manufacturer's
BSC. That is to say, BSC and BTS must come from the same manufacture.

Through Abis interface, a different type of protocol is required. GSM has specified
the use of LAPD protocol in Abis interface.

38
The LAPD protocol uses the standard frame structure shown in this slide.

The first and last bit are flag bits. Between them, there are frame check sequence,
information, control and address.

39
1.4 Service Area and Number Planning

40
MS service area is subdivided into following six levels: System area, PLMN service
area, MSC service area, Location area, Base station area, and radio cell

1. The System area comprises one or more international PLMN service area. In
this area, the other users from PLMN、PSTN and ISDN can connect with the
MS without knowing where it is.

2. PLMN service area is served by one operator. The PLMN service area is
served by one or more HLR. There are the same numbering plan and the
routing plan in PLMN service area. PLMN service area comprises one or more
MSC service area.

3. MSC service area is served by one MSC. It may be a part of a city or an entire
country area. MSC service area comprises one or more Location area.

4. Location area is determined by the operator to fulfill the requirements imposed

by traffic and flow, population density and subscriber mobility. Location area
comprises one or more Base station area.

5. Base station area is served by one or more BTS. It consists of one cell if the
antenna is omni-directional, or more than one cell if the antenna is directional.
Base station area comprises one or more radio cell.

41
6. Radio cell is served by a directional or omni-directional antenna. It is the
smallest service area in GSM system. In radio cell, specific radio channel
devices are used for each radio connection.

42
In the GSM system, For identification purpose, We defined the number for GSM
system equipment, mobile subscriber, mobile equipment and cell.

MSC/VLR number is used to identify MSC/VLR. The format is CC+NDC+LSP

CC means Country Code. For example: The CC of China is "86".

NDC means National Destination Code. For example: The NDC of China Mobile is
139、138、137、136、135.

LSP means Locally Significant Part. It is defined by Telecom operator.

For example, a MSC/VLR number is 86-139-00311

Since the MSC and the VLR are usually co-located together, so the MSC-Number
and the VLR-Number are the same in most case.

43
HLR number is used to identify HLR.

The format is：CC+NDC+H0 H1 H2 H3 0000.

CC： Country Code. For example: The CC of China is "86".

NDC ： National Destination Code. For example: The NDC of China Mobile is
139、138、137、136、135.

H0H1H2H3 is defined by Telecom operator.

For example: 86-139-0666-0000

44
The IMSI is the unique international code for the mobile subscriber within the GSM
system area. But it is not known to the mobile subscriber. IMSI is stored in SIM
card and is assigned to the MSISDN in the HLR. It is also stored in HLR and VLR.

The structure of IMSI is shown in this diagram

MCC ： Mobile Country Code ， it consists of 3 digits. For example: The MCC of
China is "460".

MNC ： Mobile Network Code ， it consists of 2 digits. For example: The MNC of
China Mobile is "00".

MSIN：Mobile Subscriber Identification Number. Its format is H1H2H3 S ABCDEF.

The first 3 digits H1H2H3 of the MSIN identify the HLR Identification.

NMSI ： National Mobile Subscriber Identification ， MNC and MSIN form NMSI
together.

For example of IMSI: 460-00 –666-9777001

Note that IMSI should be not more than 15 digits.

45
MSISDN is used in the following cases:

1. By the caller to set up a connection to this mobile subscriber

2. By the MSC/Gateway MSC to address the HLR when inquiring the visitor
location of the mobile subscriber.

MSISDN is stored as semi-permanent data in the database of HLR and VLR. It is

transferred on MAP interface.

The structure of MSISDN is shown in this diagram.

CC： Country Code. For example: The CC of China is "86".

NDC ： National Destination Code. For example: The NDC of China Telecom is
139, 138, 137, 136, 135.

SN： Subscriber Number. It’s format: H0 H1 H2 H3 ABCD

For an Example of MSISDN: 86-139-0666-1234

46
IMEI means International Mobile Station Equipment Identification. It is the unique
number for mobile equipment. Please note the difference between IMSI and IMEI.
IMSI is the identification for mobile subscriber, IMEI is the identification for mobile
equipment.

The structure of IMEI is shown as follows.

TAC---Type approval code. It is administered by the type approval center.

FAC----Final assembly code. It is administered by the manufacturer.

SNR----Serial number. It is issued by the manufacturer of the MS.

SP-------Not used.

47
TMSI means Temporary Mobile Subscriber Identification.

1. The TMSI is assigned only after successful subscriber authentication.

2. The VLR controls the allocation of new TMSI numbers and notifies them to the
HLR.

3. TMSI is used to ensure that the identity of the mobile subscriber on the air
interface is kept secret. The TMSI will be updated frequently; this makes it
very difficult for the call to be traced and therefore provides a high degree of
security for the subscriber.

4. The TMSI consists of 4 bytes (8 HEX numbers) and determined by the

telecom operator.

48
MSRN means Mobile Subscriber Roaming Number

HON means Hand-over Number

The MSRN is not a direct subscriber number. At the request of HLR the VLR
allocates a MSRN. Then the MSRN is transferred to the HLR. The HLR passes the
MSRN on to the original MSC from which a call is then set up.. The MSRN is then
used to route the call to the MSC which MS is currently located. At the end of call
setup this MSRN is released again for further call setup processes. So, MSRN is a
temporary number.

During handover process, For example, when the MS is moving from MSC-A to
MSC-B, the MSC-B will request a HON from it's VLR and transfers it to the MSC-A.

The HON is used by the MSC-A to set up a connection to the MSC-B.

Usually, MSRN and HON share the same numbering plan.

The format of MSRN/HON is CC+NDC+individual number. CC and NDC is the

same as that of MSISDN. The individual number is taken from a pool of numbers
specially reserved for MSRN/HON. In fact, the format of MSRN/HON is based on
MSC number and another several digits are added

49
LAI means location area identification. The LAI is the international code for a
location area.

Each VLR controls several LALs and as a subscriber moves from one LAI to
another, the LAI is updated in the VLR. As the subscriber moves from one VLR to
another, the VLR address is updated at the HLR.

The format of LAI is shown in this slide.

MCC：Mobile Country Code，it consists of 3 digits.

For example: The MCC of China is "460"

MNC：Mobile Network Code，It consists of 2 digits.

For example: The MNC of China Mobile is "00"

LAC： Location Area Code，It is a two bytes BCD code (hex).

The value 0000 and FFFF is invalid.

For example of LAI: 460-00-0011

50
CGI means cell global identification. The CGI is a unique international identification
for a cell.

The format is LAI+CI

LAI：Location Area Identification

CI ： Cell Identity. This code uses two bytes BCD code (hex) to identify the radio
cells within a LAI.

For example of CGI: 460-00-0011-0001

51
RSZI means Regional Subscription Zone Identity. It is used by the operators to
determine MS roaming permission or restriction.

This diagram shows the structure of RSZI

CC、NDC: Same as that of MSISDN

ZC (Zone Code): is designed by telecom operator and stored in the VLR.

52
BSIC means Base Station Identification Color Code

The structure of BSIC shows in this diagram.

NCC----PLMN network color code. It comprises 3 bits. It allows various

neighboring PLMNs to be distinguished.

BCC----BTS color code. It comprises 3 bits. It allows distinction

Between different radio frequency channels using the same frequency in

neighboring cells.

53
1.5 Channels on The Air Interface

54
The channels used in the air interface are divided into two types: physical channel
and logical channel.

The physical channel is the medium over which the information is carried, in the
case of a terrestrial interface this would be a cable. The logical channels consist of
the information carried over the physical channel.

First physical channels will be introduced.

A single GSM RF carrier can support up to eight mobile subscribers

simultaneously. This diagram shows how this is accomplished. Each channel
occupies the carrier for one eighth of the time. This is a technique called Time
Division Multiple Access (TDMA).

Time is divided into discrete periods called "time slot". The time slots are arranged
in sequence and are conventionally numbered 0 to 7. Each repetition of this
sequence is called a "TDMA frame".

Each mobile telephone call occupies one time slot (0-7) within the frame until the
call is terminated, or a handover occurs. The TDMA frames are then built into
further frame structures according to the type of channel. We later shall introduce
how the information builds into frames and multi – frames.

The information carried in one time slot is called a "burst". Each data burst
occupies its allocated time slot and provides a single GSM physical channel.

55
There are two main groups of logical channels, traffic channels and control
channels.

The traffic channel carries speech or data information.

A full rate TCH/F carries information at a gross rate of 22.8kbps. The raw data rate
for each TCH is 13kbps and 9.6kbps, 4.8kbps and 2.4kbps for data

A half rate TCH/H carries information at half of the full rate channel or at the gross
rate of 11.4kbps. The data rate associated with the half rate TCH are 4.8kbps and
2.4kbps.

The different types of traffic channel are listed below:

TCH/FS Full rate speech channel

TCH/HS Half rate speech channel

TCH/F9.6 9.6Kbps full rate data channel

TCH/F4.8 4.8Kbps full rate data channel

TCH/F2.4 2.4Kbps full rate data channel

TCH/H4.8 4.8Kbps half rate data channel

TCH/H2.4 2.4Kbps half rate data channel

56
There are four main groups of control channel that are listed below:

1. Broadcast Control Channel - BCCH

2. Transmitted at all times convey information about cell timing and

configuration.

3. Common Control Channel - CCCH

4. Used by BSS and MS when trying to initiate a connection over the air.

5. Dedicated Control Channel DCCH

6. This dedicated channel is used to convey signaling information during call set
- up.

7. Associated Control Channel - ACCH

The associated channels are used to transmit signaling information when a call is
in progress.

57
The Broadcast Control Channel is transmitted by the BTS at all times. The RF
carrier used to transmit the BCCH is called as the BCCH carrier. The information
carried on the BCCH is monitored by the mobile periodically (at least every 30s)
when it is switched on and not in a call.

Broadcast Control Channel (BCCH) - Carries the following information (this is only
a partial list):

1. Location Area identity (LAI)

2. List of neighboring cells that should be monitored by the mobile

3. List of frequencies used in the cell

4. Cell identity

5. Power Control indicator

6. DTX permitted

7. Access Control (e.g. Emergency calls, call barring)

8. CBCH description

The BCCH is transmitted at constant power at all times and its signal strength is
measured by all mobiles which may seek to use it.

58
Frequency Correction Channel (FCCH) is transmitted frequently and is more easily
detected by the mobile than SCH. When the FCCH is detected, the mobile corrects
the frequency. It is then able to detect the SCH which contains the precise
synchronization information.

Synchronization Channel (SCH) carries the information to enable the mobile to

synchronize to the TDMA frame structure. The following parameters as also
carried.

1. Frame Number

2. Base Site Identity Code (BSIC)

The mobile will monitor BCCH information from surrounding cells and store the
information from the best six cells. The SCH information on these cells is also
stored so that the mobile may quickly re-synchronize when it enters a new cell.

59
The common control channel (CCCH) is responsible for transferring control
information between all mobiles and the BTS. This is necessary for the
implementation of "call origination" and "call paging" functions.

It consists of the following types:

Random Access Control Channel (RACH) - Transmitted by the mobile when it

wishes to access to the system. This occurs when the mobile initiates a call or
responds to a page.

Paging Channel (PCH) - Transmitted by the BTS when it wishes to contact a

mobile.

Access Grant Control Channel (AGCH) - Transmitted by the BTS. The AGCH is
used to assign dedicated resources to an MS such as a Standalone Dedicated
Control Channel (SDCCH).

Cell Broadcast Channel (CBCH) - This channel is used to transmit messages to be

broadcast to all mobiles within a cell e.g. traffic info. The CBCH will steal time from
an SDCCH.

Active mobiles must frequently monitor both BCCH and CCCH. The CCCH will be
transmitted on the RF carrier with the BCCH.

60
Dedicated control channels (DCCH) are assigned to a single mobile connection for
call setup or for measurement and hand over purposes:

Standalone Dedicated Control Channel (SDCCH) - This supports the transfer of

data to and from the mobile during call setup. It also carries information for call
forwarding and transmission of short messages.

Associated Control Channels – ACCH

These channels can be associated with either an SDCCH or a TCH. They are used
for carrying information associated with the process being carried out on either the
SDCCH or the TCH.

Slow Associated Control Channel (SACCH) - Conveys power control and timing
information in the downlink direction (towards the MS) and Receive Signal
Strength Indicator (RSSI) and link quality reports in the uplink direction.

Fast Associated Control Channel (FACCH) - the FACCH is transmitted instead of a

TCH. The FACCH "steals" the TCH burst and inserts its own information. The
FACCH is used to carry out user authentication and handover.

61
The different logical channel types mentioned previously are grouped into what are
called channel combinations. The four most common channel combinations are
listed below:

1. Full Rate Traffic Channel Combination - TCH8/FACCH + SACCH

2. Broadcast Channel Combination - BCCH + CCCH

3. Dedicated Channel Combination - SDCCH8 + SACCH8

4. Combined Channel Combination - BCCH + CCCH + SDCCH4 + SACCH4

As for the half rate channel combination will not introduce here because it will be
provided in the future.

62
 Now the relation between Channel Combinations and Time slots will be introduced.

The channel combinations are sent over the air interface in a selected time slot.

Some channel combinations may be sent on any time slot but others must be sent
specific time slots. Below is a table mapping the channels combination to their
respective time slots.

Channel Combination Time slots

Traffic Any time slot
Broadcast 0,2,4,6(0 must be used first)
Dedicated Any time slot
Combined 0 only
This diagram gives an example.

In the low capacity cell, ts0 is used as combined channel, while other time slots
used for traffic channels.

In the higher capacity cell, ts0 is used as broadcast channel, ts1 is used as
dedicated channel, while other time slots used for traffic channels.

63
This diagram illustrates how these different channel combinations may be mapped
onto the TDMA structure.

Several logical channels share one time slot. The individual channels are
sequenced so that each receives the amount of time it requires. This sequencing is
carried out by the use of multi-frames, each channel combination has a different
multi-frame configuration.

This diagram shows the time relationship between time slot, TDMA frame, and
multi-frame for traffic channels. Traffic channels occupy a 26 - frame multi-frame
structure.

64
This multi-frame structure for control channels is different from traffic channel.

The diagram shows the time relationship between time slot, TDMA frame, and
multi-frame for control channels. Control channels occupy a 51 - frame multi-frame
structure.

65
This diagram illustrates a 26 frame multi-frame structure, this is used to transmit a
Traffic Channel Combination (TCH / SACCH / FACCH). Note the FACCH is not
shown in the diagram as it does not receive its own time allocation. The FACCH
steals a time period from the TCH when it is required.

The 13th frame is used by the SACCH (Slow Associated Control Channel) which
carries link control information to and from the mobile and BTS. Also note that the
26th frame is idle which will be used when half rate speech channel is a reality.

66
The 51 - frame structure used for control channels is considerably more complex
than the 26 frame structure used for the traffic channels.

The 51 – frame multi-frame structure occurs in several forms, depending on the

type of control channel and the system operator's requirements.

This diagram gives an example.

In the downlink direction (from BSS to MS), the time slot is shared by several
logical channel types. Some of the channels are repeated frequently e.g. SCH and
FCCH while others less frequently e.g. BCCH.

In the uplink direction (from MS to BSS), all time slots are allocated to RACH. This
is because RACH is the only control channel in the BCCH/CCCH group, which
operates in the uplink direction.

67
This diagram shows the 51 - frame structure used to accommodate 8 SDCCHs
although, as it takes two repetitions of the multi-frame to complete the entire
sequence, it may be more logical to think of it as a 102 - frame structure! This
structure may be transmitted on any time slot.

Note that the 8 SACCHs (shaded) are associated with the 8 SDCCHs. It is
important to remember that each SDCCH has an SACCH just like a traffic channel.

68
This diagram illustrates the 51 - frame Control Channel combined Multi-frame.

In this configuration the BCCH and SDCCH share a common time slot, this means
that each logical channel has less time than it would if one of the other
configurations were used. Because each channel has less time, fewer subscribers
can be supported. Therefore the combined channel combination is used in areas
where traffic density is low.

Like the SDCCH multi-frame, it takes two repetitions of the 51 - frame multi-frame
to complete the sequence, this is really a 102 - frame structure.

69
By the end of this section, Super frames and hyper frames will be introduced.

From the previous slide, we have known that the control channel multi-frame is
not a direct multiple of the traffic channel multi-frame. This case is not by accident.
From the diagram, it can be seen that any given frame number will only occur
simultaneously in both multi-frames every 1326 TDMA frames (26×51). This
number of TDMA frames is called a "super frame" and it takes 6.12s to transmit.
This arrangement means that the timing of the traffic channel multi-frame is always
moving in relation to that of the control channel multi-frame. This enables a mobile
to receive and decode BCCH information from surrounding cells.

If the two multi-frames were exact multiples of each other, then control channel
time slots would be permanently 'masked' by traffic channel time slot activity. This
changing relationship between the two multi-frames is particularly important.

The "hyper frame" consists of 2048 super frames, this is used in connection with
ciphering and frequency hopping, the hyper frame lasts for over three hours, after
this time the ciphering and frequency hopping algorithms are restarted.

70
1.6 Radio Technologies

71
It is well known that there are three methods of modulating a signal so that it may
be transmitted over the air:

1、Amplitude Modulation (AM)

2、Frequency Modulation (FM)

3、Phase Modulation (PM)

The modulator causes the frequency, amplitude or phase of an RF carrier to be

varied in proportion to the signal it is going to carry.

GSM uses a digital air interface. It means that digital signals are transmitted on the
radio channel.

Digital signals can use any of the modulation methods but phase modulation
provides the best noise tolerance. Since phase modulation can be implemented
easily for digital signals, this is the method, which is used for the GSM air interface.
Phase Modulation is known as Phase Shift Keying when applied to digital signals.

72
Phase Modulation provides a high degree of noise tolerance, however there is a
problem with this modulation. When the signal changes phase abruptly, high
frequency components are produced, thus, a wide bandwidth would be required for
transmission.

We have mentioned previously that GSM has a narrow bandwidth and to be as

efficient as possible with the available bandwidth. Therefore, a more efficient
development of phase modulation called as Gaussian Shift Keying(GMSK) is
actually used by the GSM air interface.

With GMSK the phase change does not occur instantaneously. Instead it occurs
over a period of time and therefore the addition of high frequency components to
the spectrum is reduced.

With GMSK, first the digital signal is filtered through a Gaussian filter. This filter
causes distortion to the signal, the corners are rounded off. This distorted signal is
then used to phase shift the carrier signal. The phase change therefore is no
longer instantaneous but spread out.

73
In GSM system, one of the main factors which restrict reducing the size of a mobile
station is the battery.

A battery must be large enough to maintain a telephone call for an acceptable

amount of time without needing to be recharged. Since there is demand for
mobiles to become smaller and lighter the battery must also become smaller and
lighter.

Four features which enable the life of a GSM mobile battery to be extended.

1. Power Control

2. Voice Activity Detection - VAD

3. Discontinuous Transmission - DTX

4. Discontinuous Reception - DRX

74
POWER CONTROL is a feature of the GSM air interface which allows the operator
to not only compensate for the distance from mobile to BTS as regards timing, but
can also cause the BTS and mobile to adjust their power output. This feature
saves radio battery power at the mobile, and helps to reduce co -channel and
adjacent channel interference.

Both Uplink and Downlink power settings can be controlled independently and
individually.

Initial power setting for the MS is set by the information provided on Broadcast
Control Channel (BCCH) for a particular cell.

The BSS controls the transmit power of both the mobile and the BTS .The received
mobile power is monitored by the BSS and the receive BTS power is monitored by
the mobile and then reported to the BSS. Using these measurements the power of
both mobile and BTS can be adjusted accordingly

75
VOICE ACTIVITY DETECTION - VAD is a mechanism whereby the source
transmitter equipment identifies the presence or absence of speech.

VAD implementation is effected in speech mode by encoding the speech pattern

silences at a rate of 500 bit/s rather than the full 13 Kbit/s. This results in a data
transmission rate for background noise, which is regenerated in the receiver,
known as "comfort" noise.

Comfort noise is necessary. Because without "comfort" noise the total silence
between the speech would be considered to be disturbing by the listener.

DISCONTINUOUS TRANSMISSION - DTX increases the efficiency of the system

through a decrease in the possible radio transmission interference level. It does
this by ensuring that the Mobile Station does not transmit unnecessary message
data. DTX can be implemented, as necessary on a call, its' effects will be most
noticeable in communications between two Mobile Stations.

When implemented at the mobile station DTX also result in considerable power
saving. If the mobile does not transmit during 'silences' there is a reduction in the
overall power output requirement.

The function of DTX may be selected by the system operator and there are
different specifications applied for different types of channels.

76
DISCONTINUOUS RECEPTION – DRX allows the mobile station to effectively
"switch -off" during times when reception is deemed unnecessary.

After initially locking on to a BCCH, MS will monitor BCCH, FCCH and SCH. The
Mobile is aware of the Frame Number and repetition format for frame
synchronization. Therefore, it can determine when next relevant information is to
be transmitted. This allows the mobile to 'go to sleep and listen -in only ‘. This is
called DRX. It also effectively saves in power usage.

VAD, DTX and DRX result in battery use time being considerably extended and
can reduce the effective battery size needed.

77
Multi path Fading results from a signal traveling from a transmitter to a receiver by
a variety of routes. This is caused by the signal being reflected from objects, or
being influenced by atmospheric effects as it passes, for example, through layers
of air of varying temperatures and humidity.

The received signals will therefore arrive at different times and not be in phase with
each other, they will have experienced time dispersion. When the receive antenna
is moving, the exact phase of each path changes and consequently the combined
signal-strength is also continually changing.

GSM offers many techniques, which combat multi-path fading effects. In the
following, Diversity and Frequency Hopping will be introduced.

78
Signals arrive at the receive antenna from multiple paths. The signals are therefore
received by the antenna at different phases, some at a peak and some at trough.
This means that some signals will add together to form a strong signal while others
will subtract causing a weak signal

When diversity is implemented, two antennas are situated at the receiver. These
antennas are placed several wavelengths apart to ensure minimum correlation
between the two receive paths .The two signals are then combined, this ensures
that a low signal strength is less likely to occur.

79
 .

Frequency hopping means each time the BTS or mobile transmits a burst on a
different RF carrier frequency. In one way, Frequency hopping brings the security
benefit to GSM system. The other main reason is to reduce multi path fading
effects

The hopping must use a predetermined sequence so that both transmitter and
receiver must hop in synchronization. This sequence is stored in a 'frequency
hopping table'.

Care should be taken to that BCCH is not frequency hopped and it is always
transmitted at the same frequency. This is because the BCCH in any cell must be
transmitted on a dedicated RF carrier ,otherwise mobiles would be unable to find
and decode it.

There are two methods of frequency hopping, Synthesizer Hopping and Baseband
Hopping. Both are slow frequency hopping techniques. This means that the
frequency of the transmission only changes once every time a burst is transmitted.

In Synthesizer Hopping, each time slot on a given transceiver can transmit at a

different frequency. The transceiver retunes between time slots. This is an efficient
method for small sites with few transceivers.

In Baseband Hopping, each transceiver stays at the same frequency and data is
switched to the appropriate .The numbers of hopping frequencies is limited to the
number of transceivers.

80
1.7 The Future Development

81
Nowadays, The mobile communication market has experienced rapid growth.
GSM system wins widely market applications. However, it represents a large and
continuously increasing percentage of all new mobile subscribers in the world.

All professional Market Forecasts say GSM will stay in the Lead in the recent
several years.

From this diagram, you can know about the average growth of GSM mobile
subscribes in the world. Last year, the number of mobile subscribers reaches more
than 200millions. In 2001, it will reach about 300 millions.

82
It is obvious that the development of technologies is driven by market forces. In old
days, voice service represents the traditional service and can meet demands of
most customers. Nowadays, the customers have diversity demands for services.
For example, the demand for data communication is growing fast. Surfing on the
Internet is not a new thing, it has becoming the people’s daily necessary and
change the people’s life style. From this diagram, you can know about the
development trends of service required by the customers.

83
The growing demands for data communication not only occurs in the fixed
telephone subscriber. It also occurs in the mobile subscriber. The demands of
surfing on the Internet through MS also are required by more and more customers.
Although it’s growth is slower than the telephone subscriber. But it will represent
the future development of mobile communication. How to meet these requirements
is a severe challenge for both the mobile manufactures and the telecommunication
operators.

84
Driven by the market force, cellular system experienced three generations. GSM
and DCS 1800 belong to Second Generation cellular technologies

In recent years second generation technologies have been developed to GPRS

called 2.5G to support high-speed data packet services. Its maximum rate can
reach 115kbps.

A third generation system is being developed. It aims at integrating and merging a

range of communication services and providing high-speed and wide-band
services.

GSM will become the basis for the Third Generation (3G) system will evolve
from GSM. The maximum rate of Mobile multimedia services can reach 2Mbps.

85
Summary:

The contents of this course are mainly divided into seven sections:

Section 1 deal with principles of the Cellular Telecommunication, where we discuss

the concepts of cell and frequency spectrum used in cellular system.

Section 2 provides a detailed discussion of GSM Network Components and their

functions.

Section 3 describes service Area and Number Planning

Section 4 is devoted to Terrestrial Interface in GSM system.

Section 5 provides a detailed discussion of Channels on the Air Interface

Section 6 deals with radio interfaces, where we discuss the basic concepts of radio
technologies.

Section 7 briefly introduces the Future Development of mobile communication

So much for the courses for GSM fundamentals. Thank you.

86