Global System For Mobiles: Ver1.1 WIPRO Global R&D 1

GSM
Global System for Mobiles
ver1.1 WIPRO Global R&D 1

Contents
• Introduction
• GSM Concepts
• GSM System Specifications
• GSM Network
• GSM Entities and Signaling Architecture
• Functional plane - Radio Resource management
• GSM Identifiers
• Functional plane - Mobility Management
• Functional Plane - Connection Management
• References
Evolution of Cellular
communication standards
• Analog standards
– Advanced Mobile Phone Service (AMPS)
• US, 800 MHz band
– Total Access Communication System (TACS)
• UK, based on AMPS in 900 MHz band
– Nordic Mobile Telephone System(NMT)
• Scandinavian, Both in 450 MHz and 900 MHz band

Evolution of Cellular
communication standards ...
• Digital Standards
– Dual mode AMPS (D-AMPS)
• US, Analog signaling and Digital voice coding
– IS-95
• US, CDMA based
– Global Systems for mobile communications
(GSM)
• European standard, 890 MHz - 960 MHz band

Why GSM?
• There were so many systems available need to
consolidate ,Limitations of Analogue
system,Incompatibility between systems.Moving
towards PCN(Personal Communications Network)
• Mobility was the keyword in developing a new

system to reach people on move between countries
yet stay connected.

What are the types in
GSM Network?
• GSM-900 (Channels 125 operating band

900Mhz carrier spacing 200khz spacing
45Mhz)
• GSM -1800 (Channels 374 spacing 95Mhz)

GSM in comparison with other
Standards?
• GSM gives mobility without any loss in Audio quality
• Encryption techniques used gives high security in the air Interface
and also use of SIM.
• Bit Interleaving for high efficiency in Transmission.
• Variable Power (Power budgeting- extend battery life)
• Minimum Interference.(Eq DTX )
• Features-CCS7 Signaling
– SMS (Short Message Services)
– Emergency Calls
– CELL Broadcast

GSM Concepts - Cellular
Structure
• Cellular
2 – Networking
2 7 technology that breaks
7 3 1 geographic area into
1 6 cells shaped like honey
4 comb
6 5
5 • Cell
– Area of coverage
provided by one or
more Radio terminals
Cell Planning
• Traffic and Coverage Analysis
•Collection of data
•Traffic calculation
•Nominal Cell Plan
•Coverage and Interference Prediction
•Site Survey and Signal strength Measurement
•Evaluation, final Cell Plan
•Installation
•Optimization

Transmission Direction
• Uplink Transmission
– Transmission from Mobile to Radio Terminal
• Down Link Transmission

– Transmission from Radio Terminal to Mobile
– Uplink and Downlink channels separated by 45
MHz

TDM
Power
8 8
0 0
f1 f2 FDM
Access Techniques
• Uplink 890 MHz to 915 MHz

• Down Link 935 MHz to 960 MHz
• 25 MHz divided into 125 channels of 200
KHz bandwidth
UP 890.0 890.2 890.4 914.8 915.0
DOWN 935.0 935.2 935.4 959.8 960.0

Access Techniques
• Time Division Multiple Access
– Each carrier frequency subdivided in time
domain into 8 time slots
– Each mobile transmits data in a frequency, in
its particular time slot - Burst period = 0.577
milli secs.
– 8 time slots called a TDMA frame. Period is .
577 * 8 = 4.616 milli secs
0.577 ms
0 1 2 3 4 5 6 7
4.616 ms
GSM System specifications
Frequency band
Uplink 890 MHz-915 MHz
Downlink 935 MHz-960MHz
Duplex distance 45MHz
Carrier separation 200KHz
Modulation GMSK
Air transmission rate 270Kbps
Access method FDMA/TDMA
Speech Coder RPE-LTP-LPC
(Regular pulse excitation
-Long Term predictive
ver1.1
-linear predictive Coder)
WIPRO Global R&D 14
MS
GSM - Network Structure
Um
BTS VLR HLR
BSC
Abis MSC
A
MS AuC
BTS GMSC
Abis
EIR
A
MSC
BSC PSTN
Um
BTS
VLR
OMC Server

GSM Network
SS
Switching
AUC System
External
PSTN & VLR HLR EIR
PDN N/W OMC
MS Mobile Station MSC
BTS Base transceiver System
BSC Base Station Controller
MSC Mobile Switching Center
HLR Home Location Register BSS BSC Base Station
VLR Visitor Location Register
BTS
System
EIR Equipment Identity Register
AUC Authentication Center
OMC Operation And Maintenance Center MS
Mobile Station (MS)
•Hand portable unit

•Frequency and Time Synchronization
•Voice encoding and transmission
•Voice encryption/decryption functions
•Power measurements of adjacent cells
•Display of short messages
•International Mobile Equipment Identifier (IMEI)
Subscriber Identity Module (SIM)
•Portable Smart Card with memory (ROM-6KB to 16KB-A3/A8
algorithm, RAM- 128KB TO 256KB, EEPROM- 3KB to 8KB )
•Static Information
–International Mobile Subscriber Identity(IMSI) (MCC + MNC+MSIN
–Personal Identification Number (PIN)
–Authentication Key (Ki)
•Dynamic Information
–Temporary Mobile Subscriber Identity(TMSI)
–Location Area Identity (LAI)
–Phone memories, billing information
–Ability
ver1.1
to store Short Messages received
WIPRO Global R&D 18
Base Transceiver Station
(BTS)
•Consists of one or more radio terminals for

transmission and reception
•Each Radio terminal represents an RF Channel
•TRX and MS communicates over Um interface
•Received data transcoding
•Voice encryption/decryption
•Signal processing functions of the radio interface
•Uplink Radio channel power measurements
Base Station Controller (BSC)
•External Interfaces
–‘Abis’ interface towards the BTS
–‘A’ interface towards the MSC
•Monitors and controls several BTSs
•Management of channels on the radio interface
•Alarm Handling from the external interfaces
•Performs inter-cell Handover
•Switching from ‘Abis’ link to the ‘A’ link
•Interface to OMC for BSS Management
Gateway Mobile Services
Switching Center (GMSC)
•Interface of the cellular network to PSTN

•Routes calls between PLMN and PSTN
•Queries HLR when calls come from PSTN to
mobile user
•Inter-BSC Handover
•Performs call switching
•Paging
•Billing
Home Location Register
(HLR)
•Stores user data of all Subscribers related to the GMSC

–International Mobile Subscriber Identity(IMSI)
–Users telephone number (MS ISDN)
–Subscription information and services
–VLR address
–Reference to Authentication center for key (Ki)
•Referred when call comes from public land network
Visitor Location Register
(VLR)
•Identity of Mobile Subscriber

•Copy of subscriber data from HLR
•Generates and allocates a Temporary Mobile
Subscriber Identity(TMSI)
•Location Area Code
•Provides necessary data when mobile originates
call

Authentication Center (AuC)
•Stores Subscriber authentication data called Ki, a

copy of which is also stored in in the SIM card
•Generates security related parameters to authorize a
subscriber (SRES-Signed RESponse)
•Generates unique data pattern called Cipher key (Kc)
for user data encryption
•Provides triplets - RAND, SRES & Kc, to the HLR
on request.
EIR (Equipment Identity
Register)
EIR is a database that contains a list of all valid
mobile station equipment within the network,
where each mobile station is identified by its
International Mobile Equipment Identity(IMEI).
EIR has three databases.,
White list - For all known,good IMEI’s
Black list - For all bad or stolen handsets
Grey list - For handsets/IMEI’s that are
uncertain
GSM Entities and Signaling
Architecture

Interfaces and Protocols
Digital
Networks
ISUP
Abis A E
LAPD BSSAP TUP
MAP
Um LAPDm F MAP B POTS

MAP
C
D G

Functional Plane of GSM …RR
Radio Resource Management (RR)

• Establish and Release stable connections between
MS and MSC
• Manage Limited Radio and Terrestrial resources
• Handover process is the sole responsibility of the
RR Layer
• Functions of RR layer are performed by MS and
BSC and partly by MSC
Channel concept
Physical channel:
One timeslot of a TDMA-frame on one carrier
is referred to as a physical channel.
There are 8 physical channels per carrier in
GSM,channel 0-7(timeslot 0-7)
Logical channel:
A great variety of information must be
transmitted between BTS and the MS,for e.g.
user data and control signaling.Depending
on the kind of information transmitted we
refer to different logical channels.These logical
channels
ver1.1
are mapped on physical channel.
WIPRO Global R&D 29
Logical channels
Logical channels
Control channels Traffic channels
Half Full
CCCH DCCH
BCH rate rate
FCCH SCH BCCH PCH AGCH RACH SDCCH SACCH FACCH

Control channels Broadcast
channels BCH
Frequency correction channel-FCCH
This serves two purposes
To make sure this is the BCCH carrier.
To allow the MS to synchronize to the frequency.
Synchronization Channel-SCH
This is used by the MS to synchronize to the
TDMA frame structure within the particular cell.
Listening to the SCH the MS receives the TDMA
frame number and also the BSIC.
Control channels Broadcast
channels BCH
Broadcast Control Channel-BCCH

The last information the MS must receive in
order to receive calls or make calls is some
information concerning the cell. This is BCCH.
This include the information of Max power
allowed in the cell,BCCH carriers for the
neighboring cells,Location Area Identity etc.
This is transmitted Downlink point to multipoint.

Control channels Common
Control Channels,CCCH
Paging Channel-PCH
The information on this channel is a paging message including
the MS’s identity(IMSI).This is transmitted on Downlink.
Random access channel-RACH:

When the mobile realizes it is paged it answers by requesting a
signaling channel on RACH. RACH is also used by the MS if
it wants to originate a call.It is transmitted in Uplink point
to point.
Control channels Common
Control Channels,CCCH
Access Grant Channel-AGCH

On request for a signaling channel by MS the network
assigns a signaling channel(SDCCH) on AGCH. AGCH is
transmitted on the downlink point to point.

Control channels Dedicated
Control Channels-DCCH
Stand alone dedicated control channel(SDCCH)
AGCH assigns SDCCH as signaling channel on request by

MS.The MS is informed about which frequency & timeslot to
use for traffic.
This is transmitted both sides up and Downlink

point-point.

Control channels Dedicated
Control Channels-DCCH
Slow associated control channel-SACCH
Average signal strengths and quality of service of the serving
base station and of the neighboring cells is sent on
SACCH.Mobile receives information like what TX power
it has to transmit and the timing advance.
Fast associated control channel-FACCH

This channel is used for handover. Whenever a call is to be
transferred from one cell to another cell this channel is used.
Traffic Channels-TCH
Full rate traffic channel occupies one physical

channel(one TS on a carrier)
Two half rate TCHs can share one physical

channel.

Logical to Physical Channel
Mapping
TDMA Frames
0 1 2 3 4 5 6 7 0 1 2 3 ……..
TS 0 - FCCH + BCCH + CCCH

TS 1 - SDCCH + SACCH
TS 2-7 - TCH

Burst
The information format transmitted during

one timeslot in the TDMA frame is called
a burst.
Different Types of Bursts
 Normal Burst
 Random Access Burst
 Frequency Correction Burst
 Synchronization Burst
Normal Burst
T Coded Data S T. Seq. S Coded Data T GP

3 57 1 26 1 57 3 8.25
Tail Bit(T) :Used as Guard Time

Coded Data :It is the Data part associated with the burst
Stealing Flag :This indicates whether the burst is
carrying
Signaling data.
Training Seq. :This is a fixed bit sequence known both to
the BTS & the MS.This takes care of the
ver1.1
signal deterioration.
WIPRO Global R&D 40
T Training Sequence Coded Data T GP
8 41 36 3 68.25
Random Access Burst
T Fixed Bit Sequence T GP

3 142 3 8.25
Freq. Correc. Burst
T Coded Data Training Sequence Coded T GP

3 39 64 Data 39 3 8.25
Synchronization Burst

Handover
• Means to continue a call even a mobile crosses the
border of one cell to another
• Procedure which made the mobile station really roam
• Handover causes
– RxLev (Signal strength , uplink or downlink)
– RxQual (BER on data)
– O & M intervention
– Timing Advance
– Traffic or Load balancing

Handover Types
– Internal Handover (Intra-BSS)

Within same base station - intra cell
Between different base stations - inter cell
– External Handover (Inter-BSS)

Within same MSC -intra MSC
Between different MSCs - inter-MSC

Handover process
CELL 1
BSC
Handover Complete
LUP Reply
Req
LUP
Meas
MeasAcc
LUP Rep
Req
Rep+ Cell
Handover
Cell 1
2
1
2 to CELL 1
CELL 2

GSM Identifiers-Subscriber
Identities -MSISDN
The MSISDN is a GSM directory number which
uniquely identifies a mobile subscription in the
Public Switched Telephone Network (PSTN).
Calls will be routed from the PSTN and other
networks based on the Mobile Subscribers’
MSISDN number.
MSISDN= CC + NDC + SN
CC= Country Code (91)
NDC= National Destination Code(98370)
SN= Subscriber Number (12345)
International Mobile Subscriber
Identity [IMSI]
A subscriber is always identified within the GSM
network by the IMSI This is used for all signaling in the
PLMN. It is stored in the Subscriber Identity Module(SIM), in the
HLR and in the VLR. The IMSI consists of three different parts.
IMSI= MCC + MNC + MSIN
(Maximum of 15 digits)=(3 digits)+(1-2 digits)+(maximum 11
digits)
MCC = Mobile Country Code
MNC = Mobile Network Code
MSIN = Mobile Station Identification Number

Temporary Mobile Subscriber
Identity [TMSI]
The TMSI is used for the subscriber’s confidentiality.
It should be combined with the LAI to uniquely identify a
MS.
Since the TMSI has only local significance (that is, within the
MSC/VLR area), the structure may be chosen by each
administration.
The TMSI should not consist of more than four
octets.

Mobile Station Roaming
Number[MSRN]
HLR knows in what Service area the subscriber
is located. In order to provide a temporary number
to be used for routing, the HLR requests the current
MSC/VLR to allocate a Mobile Station Roaming
Number(MSRN) to the called subscriber and to
return it. At reception of the MSRN, HLR sends it
to the MSC, which now can route the call to the
VLR where the called subscriber is currently
registered.
International Mobile Equmt.
Identity [IMEI]
The IMEI is used for equipment identification. An IMEI
uniquely identifies a mobile station as a piece or assembly of
equipment.
IMEI = TAC + FAC + SNR + sp
TAC= Type Approval Code (6 digits),determined by GSM body
FAC= Final Assembly Code (2 digits), identifies the
manufacturer
SNR= Serial Number (6 digits), uniquely identifying all
equipment within each TAC and FAC
sp = Spare for future use (1 digit)

Location Area Identity
LAI identifies a location area which is a group of cells..
It is transmitted in the BCCH.
When the MS moves into another LA (detected by monitoring
LAI transmitted on the BCCH) it must perform a LU.
LAI = MCC + MNC + LAC

MCC= Mobile Country Code(3 digits), identifies the country
MNC= Mobile Network Code(1-2 digits), identifies the GSM-
PLMN
LAC= Location Area Code, identifies a location area within a GSM
PLMN network. The maximum length of LAC is 16 bits,
enabling 65536 different location areas to be defined in
ver1.1 one GSM PLMN. WIPRO Global R&D 50
Functional Plane - Mobility
Management
Mobility Management (MM)
• Location updating
• Paging
• Security Management
– Preventing unauthorized users
– Maintaining Privacy of users
• Providing roaming facility
• MM functionality mainly handled by MS, HLR,
MSC/VLR.

Location Update
(1)Location
IMSI MGT (2) update request
IMSI
MSC/VLR
BSC BTS
(ID=2)
(6)Location
(3)Subscriber Update
Information (4)Subscriber acknowledge
Request Information
LAI=2
IMSI MSC/VLR
HLR (ID=1) LAI=1
(ID=2)
(5)Location
Cancellation
MSC/VLR VLR
BSC BTS
(ID=1)
Security - Authentication
MS
Ki RAND
– Authentication center provides
RAND to Mobile
A3 – AuC generates SRES using Ki
SRES of subscriber and RAND
– Mobile generates SRES using
MS BTS AuC Ki and RAND
– Mobile transmits SRES to BTS
RAND
– BTS compares received SRES
with one generated by AuC
SRES
SRES
Auth Result

Security - Ciphering
MS
Ki RAND
A8
– Data sent on air
interface ciphered for
security
Kc
Um interface – A5 and A8 algorithms
MS Network
Kc
used to cipher data
Kc
– Ciphering Key is
Data
A5
Ciphered
A5
Data
never transmitted on
Data
air

Functional Plane
Communication Management
(CM)
• Setup of calls between users on request

• Routing function i.e. Choice of transmission
segments linking users
• Point to Point Short message services

MS registration in network
• MS scans complete GSM frequency band for

highest power
• Tunes to highest powered frequency and looks for
FCCH. Synchronizes in frequency domain
• Get training sequence from SCH which follows
FCCH. Synchronizes in time domain.
• Accesses BCCH for network id, location area and
frequencies of the neighboring cells
MS registration in network
MS BTS BSC (G)MSC VLR HLR Action
Channel Request (RACH)

Channel Assignment (AGCH)
Location Update Request (SDCCH)

Authentication Request (SDCCH)
Authentication Response (SDCCH)
Comparison of Authentication params
Accept LUP and allocTMSI (SDCCH)
Ack of LUP and TMSI (SDCCH)
Entry of new area and identity into

VLR and HLR
Channel Release (SDCCH)

MS
Mobile Originated Call
BTS HLR
BSC VLR
MS AuC
BTS GMSC
Authentication response
(SDCCH) Call release
Call Setup
Connected
Exchange of
Communication EIR
Assignment
Alerting
Connected
of TCH
(AGCH) (TCH) Call
Alerting
Connected
release
Setup
MSC Exchange of
Call
Assignment
Alerting
Connected
release
Alloc
Call ofofdedicated
TCH
Authentication
Req establishment
Ciphering
for dedicated
response
command
response
request
channel
channel
request BSC Communication
Exchange
(TCH)
(AGCH)
(AGCH)of
(SDCCH) communication
for communication (RACH) PSTN
(TCH)
BTS

MS
Mobile Terminated Call
Paging HLR
BTS
Paging BSC VLR
Query for
VLR info
MS AuC
BTS Query VLR GMSC Reply
for LAC and
Paging TMSI
the area
EIR
Route
to MSC
MSC
BSC
PSTN
BTS
Land to
Mobile call

References
• Wireless and Personal Communication Systems.
Vijay.K.Garg and Wilkes.
• Overview of the GSM System and Protocol Architecture,
IEEE Comm. magazine Moe
Rahnema.
• The GSM System for Mobile Communications

– Michel Mouly & Marie-Bernadette Pautet
Overview of the GSM Comm.
– John Scourias.

Global System For Mobiles: Ver1.1 WIPRO Global R&D 1

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Global System For Mobiles: Ver1.1 WIPRO Global R&D 1

Uploaded by

Copyright:

Available Formats

GSM

Global System for Mobiles

ver1.1 WIPRO Global R&D 1

ver1.1 WIPRO Global R&D 3

ver1.1 WIPRO Global R&D 4

• Mobility was the keyword in developing a new

ver1.1 WIPRO Global R&D 5

• GSM-900 (Channels 125 operating band

• GSM -1800 (Channels 374 spacing 95Mhz)

ver1.1 WIPRO Global R&D 6

ver1.1 WIPRO Global R&D 7

ver1.1 WIPRO Global R&D 9

• Down Link Transmission

ver1.1 WIPRO Global R&D 10

• Uplink 890 MHz to 915 MHz

UP 890.0 890.2 890.4 914.8 915.0

DOWN 935.0 935.2 935.4 959.8 960.0

ver1.1 WIPRO Global R&D 12

BTS VLR HLR

ver1.1 WIPRO Global R&D 15

•Hand portable unit

•Consists of one or more radio terminals for

•Interface of the cellular network to PSTN

•Stores user data of all Subscribers related to the GMSC

•Identity of Mobile Subscriber

ver1.1 WIPRO Global R&D 23

•Stores Subscriber authentication data called Ki, a

ver1.1 WIPRO Global R&D 26

Um LAPDm F MAP B POTS

ver1.1 WIPRO Global R&D 27

Radio Resource Management (RR)

Control channels Traffic channels

FCCH SCH BCCH PCH AGCH RACH SDCCH SACCH FACCH

Broadcast Control Channel-BCCH

ver1.1 WIPRO Global R&D 32

Random access channel-RACH:

Access Grant Channel-AGCH

ver1.1 WIPRO Global R&D 34

AGCH assigns SDCCH as signaling channel on request by

This is transmitted both sides up and Downlink

ver1.1 WIPRO Global R&D 35

Fast associated control channel-FACCH

Full rate traffic channel occupies one physical

Two half rate TCHs can share one physical

ver1.1 WIPRO Global R&D 37

TS 0 - FCCH + BCCH + CCCH

ver1.1 WIPRO Global R&D 38

The information format transmitted during

T Coded Data S T. Seq. S Coded Data T GP

Tail Bit(T) :Used as Guard Time

Random Access Burst

T Fixed Bit Sequence T GP

Freq. Correc. Burst

T Coded Data Training Sequence Coded T GP

ver1.1 WIPRO Global R&D 41

ver1.1 WIPRO Global R&D 42

– Internal Handover (Intra-BSS)

– External Handover (Inter-BSS)

ver1.1 WIPRO Global R&D 43

ver1.1 WIPRO Global R&D 44

ver1.1 WIPRO Global R&D 46

ver1.1 WIPRO Global R&D 47