GSM Note By Zemaryali

1. Section 0
Review of GSM Principles

2. GSM Architecture Overview
Air Interface Abis Interface A Interface
(Um)
OMC
MS
VLR
BSS
HLR
MS TRX
BTS
MSC AuC
BSC
MS
EIR NSS
PSTN

3. GSM Mobile Terminal (MT)
Reference Points
R S Um A
Interface Interface
Base Station GSM Core
TA
Subsystem Network
SIM ME
TE MS
Mobile Terminal (MT)
TE - Terminal Equipment
TA - Terminal Adaptor
MS - Mobile Station
ME - Mobile Equipment
SIM - Subscriber Identity Module

4. The Mobile Station (MS)
• The mobile station consists of:
• mobile equipment (ME)
• subscriber identity module (SIM)
• The SIM stores permanent and temporary data about
the mobile, the subscriber and the network, including:
• The International Mobile Subscribers Identity (IMSI)
• MS ISDN number of subscriber
• Authentication key (Ki) and algorithms for authentication check
• The mobile equipment has a unique International Mobile
Equipment Identity (IMEI), which is used by the EIR

5. The Base Station Sub-System (BSS)
• The BSS comprises:
• Base Station Controller (BSC)
• One or more Base Transceiver Stations (BTSs) BSS
• The purpose of the BTS is to:
• provide radio access to the mobile stations
• manage the radio access aspects of the system
• BTS contains: BTS
• Radio Transmitter/Receiver (TRX)
• Signal processing and control equipment
• Antennas and feeder cables
• The BSC: BSC
• allocates a channel for the duration of a call BTS
• maintains the call:
– monitors quality
– controls the power transmitted by the BTS or MS BTS
– generates a handover to another cell when required
• Siting of the BTS is crucial to the provision of BTS
acceptable radio coverage

6. BSS Network Topologies
• Chain: cheap, easy to implement
• One link failure isolates several BTSs BSC
• Ring: Redundancy gives some protection if a
link fails
• More difficult to roll-out and extend
• ring must be closed
BSC
• Star: most popular configuration for first GSM
systems
• Expensive as each BTS has its own link
• One link failure always results in loss of BTS
BSC

7. Network Switching System (NSS)
PSTN/ISDN
• Key elements of the NSS: VLR
MSC
GMSC
• Mobile Switching Centre (MSC) with:
• Visitor Location Register (VLR)
• Home Location Register (HLR) with: SS7
Network
• Authentication Centre (AuC)
• Equipment Identity Register (EIR) AuC
• Gateway MSC (GMSC) EIR
HLR
• These elements are interconnected by means of an SS7 network

8. Mobile Switching Centre (MSC)
Functions of the MSC:
• Switching calls, controlling calls and logging calls
• Interface with PSTN, ISDN, PSPDN
• Mobility management over the radio network and other
networks
• Radio Resource management - handovers between
BSCs
• Billing Information VLR
MSC

9. Visitor Location Register (VLR)
• Each MSC has a VLR
• VLR stores data temporarily for mobiles served by the MSC
• Information stored includes:
• IMSI
• MSISDN VLR
• MSRN
• TMSI
MSC
• LAI
• Supplementary service parameters

10. Home Location Register (HLR)
• Stores details of all subscribers in the network , such as:
• Subscription information
• Location information: mobile station roaming number, VLR, MSC
• International Mobile Subscriber Identity (IMSI)
• MS ISDN number
• Tele-service and bearer service subscription information
AuC
• Service restrictions
• Supplementary services
HLR
• Together with the AuC, the HLR checks the validity and service
profile of subscribers

11. HLR Implementation
• One HLR in a network
• May be split regionally
• Stores details of several thousand subscribers
• Stand alone computer - no switching capabilities
• May be located anywhere on the SS7 network
• Combined with AuC
AuC
HLR

12. Gateway Mobile Switching Centre (GMSC)
• A Gateway Mobile Switching Centre (GMSC) is a device which
routes traffic entering a mobile network to the correct destination
• The GMSC accesses the network’s HLR to find the location of the
required mobile subscriber
• A particular MSC can be assigned to act as a GMSC
• The operator may decide to assign more than one GMSC
GMSC

13. Equipment Identity Register (EIR)
• EIR is a database that stores a unique International
Mobile Equipment Identity (IMEI) number for each EIR
item of mobile equipment
• The EIR controls access to the network by returning the status of a
mobile in response to an IMEI query
• Possible status levels are:
• White-listed The terminal is allowed to connect to the network.
• Grey-listed The terminal is under observation by the network
for possible problems.
• Black-listed The terminal has either been reported stolen, or is not a
type approved for a GSM network.
The terminal is not allowed to connect to the network.

14. GSM Network Interfaces
VLR D HLR
MS
Um B C H
MS TRX
AuC
BTS Abis BSC A MSC
BSS F
MS
EIR
NSS

15. P-GSM Spectrum (Primary GSM)
890 915 935 960 MHz
Uplink Downlink
Duplex spacing = 45 MHz
Fu(n)
Range of ARFCN:
1 - 124
1 2 3 4 n
Guard Band
100 kHz wide
Guard Band
100 kHz wide
Channel Numbers (n) (ARFCN)
200 kHz spacing

16. E-GSM Spectrum (Extended GSM)
880 915 925 960 MHz
Uplink Downlink
Duplex spacing = 45 MHz
Range of ARFCN: Fu(n)
1 – 124
975 - 1023 1 2 3 4 n
Guard Band
100 kHz wide
Guard Band
100 kHz wide
Channel Numbers (n) (ARFCN)
200 kHz spacing

17. DCS - 1800 Spectrum
1710 1785 1805 1880 MHz
Uplink Downlink
Duplex spacing = 95 MHz
Fu(n)
Range of ARFCN:
512 - 885
1 2 3 4 n
Guard Band
100 kHz wide
Guard Band
100 kHz wide
Channel Numbers (n) (ARFCN)
200 kHz spacing

18. 1800 MHz Utilization in UK
The present distribution of frequencies among UK operator is:
1710 1721.5 1751.5 1781.5 1785 MHz
Uplink
DECT
Vodafone/
One 2 One Orange
Cellnet
Downlink
1805 1816.5 1846.5
One 2 One 1876.5 1880 MHz
DECT: Digital Enhanced Cordless Telecommunications

19. PCS - 1900 Spectrum
1850 1910 1930 1990 MHz
Uplink Downlink
Duplex spacing = 80 MHz
Fu(n)
Range of ARFCN:
512 - 810
1 2 3 4 n
Guard Band
100 kHz wide
Guard Band
100 kHz wide
Channel Numbers (n) (ARFCN)
200 kHz spacing

20. Multiple Access Techniques
• Purpose: to allow several users to share the resources of the air
interface in one cell
• Methods:
• FDMA - Frequency Division Multiple Access
• TDMA - Time Division Multiple Access
• CDMA - Code Division Multiple Access

21. Frequency Division Multiple Access (FDMA)
• Divide available frequency spectrum
into channels each of the same bandwidth
• Channel separation achieved by filters:
• Good selectivity
Frequency
• Guard bands between channels User 1
• Signalling channel required to allocate a traffic
User 2
channel to a user User 3
• Only one user per frequency channel at any time User 4
User 5
• Used in analog systems, such as AMPS, TACS
Time
• Limitations on:
• frequency re-use
• number of subscribers per area channel bandwidth

22. Time Division Multiple Access (TDMA)
• Access to available spectrum is limited to timeslots
• User is allocated the spectrum for the duration of one timeslot
• Timeslots are repeated in frames
Frequency
Signalling
Signalling
User 6
User 3
User 7
User 1
User 2
User 4
User 5
User 6
User 7
User 1
User 2
User 3
User 4
User 5
Time
Frame Timeslot

23. GSM Channels
GSM defines two fundamental channel types:
• Physical Channels:
• the individual channels carried by a radio frequency carrier
• Each carrier comprises 8 time-separated channels
• Logical Channels:
• time-dependant virtual channels carried on a single physical
channel
• one physical channel may support one or multiple logical channels

24. GSM Physical Channels
• GSM employs both FDMA and TDMA at the Air Interface
• Each BTS may comprise a number of TRXs, with the carrier of each TRX
operating on a different frequency (FDM)
• Each GSM carrier supports 8 time-separated physical channels (TDMA)
• Each physical channel is allocated to a specific timeslot on the carrier
• A group of 8 timeslots on a carrier is known as a TDMA frame
1 frame period
4.615 ms
0 1 2 3 4 5 6 7
timeslot = 0.577 ms

25. GSM Logical Channels
• Two types of logical channel are defined; traffic and control channels
• Each is further sub-divided as shown:
Traffic
Traffic Control
Control
TCH
TCH BCH
BCH CCCH
CCCH DCCH
DCCH
FCCH
FCCH PCH
PCH SDCCH
SDCCH
TCH/F
TCH/F
SCH
SCH RACH
RACH SACCH
SACCH
TCH/H
TCH/H
BCCH
BCCH AGCH
AGCH FACCH
FACCH
CBCH
CBCH

26. Traffic Channels (TCH)
• One physical channel (1 timeslot) can support:
• 1 TCH/F or 2 TCH/H
• TCH/F: 13 kb/s voice or 9.6 kb/s data
• TCH/H: 6.5 kb/s voice or 4.8 kb/s data
Uplink / Downlink Synchronisation
BTS transmits:
The MS transmit burst is delayed by 3 timeslots after the BTS
burst.. This delay allows enables: 0 1 2 3 4 5 6 7
• Use of the same UL and DL timeslot number in TDMA frame
• Avoids simultaneous Tx/Rx requirement MS transmits:
• Allows for timing advance (TA) 5 6 7 0 1 2 3 4
• Allows time to switch between Tx and Rx

27. Broadcast Channels (BCH)
BCH channels are all downlink and are allocated to
timeslot zero. BCH channels include:
• FCCH: Frequency control channel sends the MS a burst of all ‘0’ bits
which acts as a beacon and allows MS to fine tune to the downlink
frequency and time-synchronise.
• SCH: Synchronisation channel enables TDMA-Frame number
synchronisation by sending the absolute value of the frame number
(FN), together with the BTS’s BSIC
• BCCH: Broadcast Control Channel sends network-specific information
such as radio resource management and control messages, Location
Area Code etc.

28. Common Control Channels (CCCH)
CCCH contains all point to multi-point downlink channels (BTS to
several MSs) and the uplink Random Access Channel:
• RACH: Random Access Channel is sent by the MS to request a resources
from the network e.g. an SDCCH channel for call setup.
• AGCH: Access Grant Channel is used to allocate a dedicated channel
(SDCCH) to the mobile.
• PCH: Paging Channel sends paging signal to inform mobile of a call.
• CBCH: Cell Broadcast Channel is an optional GSM Phase II implementations
for SMS broadcast messages, for example road traffic reports or network
engineering messages.

29. Dedicated Control Channels (DCCH)
DCCH comprise the following bi-directional (uplink / downlink)
point to point control channels:
• SDCCH: Standalone Dedicated Channel is used for call set up,
location updating and also SMS
• SACCH: Slow Associated Control Channel is used for link
measurements and signalling during a call
• FACCH: Fast Associated Control Channel is used (when
needed) for signalling during a call, mainly for delivering
handover messages and for acknowledgement when a TCH is
assigned

30. Logical Channels
• Multiframes provide a way of mapping the logical channels on to the
physical channels (timeslots)
• A logical channel is a series of consecutive instances of a particular timeslot
Time TDMA Frame TDMA Frame TDMA Frame
0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7
Logical Channel 1 1 1 1
• A multiframe is a repeating combination of logical channels

31. Traffic Channel Multiframe
• The TCH multiframe consists of 26 timeslots.
• This multiframe maps the following logical channels:
•TCH
•SACCH
• TCH Multiframe structure: •FACCH
T T T T T T T T T T T T S T T T T T T T T T T T T I
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25
T = TCH S = SACCH I = Idle
FACCH is not allocated slots in the multiframe. It steals TCH slots when required.

32. Control Channel Multiframe
• The control channel multiframe is formed of 51 timeslots
• CCH multiframe maps the following logical channels:
Downlink: Uplink:
• FCCH • RACH
• SCH
• BCCH
• CCCH (combination of PCH and AGCH)
Downlink F = FCCH S = SCH I = Idle
F S BCCH CCCH F S CCCH CCCH F S CCCH CCCH F S CCCH CCCH F S CCCH CCCH I
0 1 2-5 6-9 10 11 12-15 16-19 20 21 22-25 26-29 30 31 32-35 36-39 40 41 42-45 46-49 50
RACH
Uplink

33. Multiple Signalling Channel Configurations
• In a non combined multiframe, up to 7 of the 9 blocks may be reserved
for AGCH:
F S BCCH CCCH F S CCCH CCCH F S CCCH CCCH F S CCCH CCCH F S CCCH CCCH I
• In a combined multiframe, up to 2 of the 3 blocks may be reserved for AGCH:
SDCCH SDCCH SDCCH SDCCH SACCH SACCH
F S BCCH CCCH F S CCCH CCCH F S 0 1 F S 2 3 F S 0 1 I
• Additional CCCH capacity can be provided on other timeslots (TS 2,4 or 6) of the
BCCH carrier if required
• The number of AGCH blocks reserved is indicated to the MS in the system
information messages that the MS reads on the BCCH

34. Frame Hierarchy
1 timeslot = 0.577 ms
0 1 2 3 4 5 6 7 1 frame = 8 timeslots = 4.615 ms
Multiframe: = 26 TCH Frames (= 120 ms)
or
51 BCCH Frames (= 235 ms)
Superframe: = 26 BCCH Multiframes (= 6.12s)
or
51 TCH Multiframes (= 6.12s)
= 2048 Superframes
Hyperframe: (= 3 hr 28 min 53.76 s)

35. TRAU Configurations
Um Abis A
BTS Site BSC Site MSC Site
CCU
TRAU A
CCU
16kbps 64kbps 64kbps
BTS Site BSC Site MSC Site
CCU
TRAU B
CCU
16kbps 16kbps 64kbps
BTS Site BSC Site MSC Site
CCU
TRAU C
CCU
16kbps 16kbps 64kbps
CCU Channel Coding Unit MSC Node BSC Node

36. Air Interface Layer Functions
Speech and Data Speech and Data
Layer 3
Signalling CC: Call Control Signalling
MM: Mobility Management
CC MM RR RR: Radio Resources CC MM RR
Layer 2
Build frames
Reconstruct frames
Request
Send acknowledgement
acknowledgement
Layer 1
Channel coding Error correction
Error protection De - interleaving
Interleaving Equalization
RF modulation RF demodulation
Radio waves

37. GSM Voice & Channel Coding Sequence
Speech Coding
8000 Hz
sampling
13-bit
resolution
Quantization
8000x13bits
= 104 kbps 22.8 kbps
2080-bit (20ms) 456-bit blocks
blocks
(note 1)
RPE-LTP Channel GMSK
Speech Coder Coding Interleaving Modulation
Channel Coding 156.25-bit bursts
260-bit blocks
13 kbps Radio Burst
Encryption Multiplexing
note 1: 160 samples of 13 bits per 20ms
Radio Interface

38. Speech Coding
• GSM transmits using digital modulation - speech must be converted to
binary digits
• Coder and decoder must work to the same standard
• Simplest coding scheme is Pulse Code Modulation (PCM)
• Sampling every 125 µs
• Requires data rate of 64 kbps
• This is too high for the bandwidth available on the radio channels
1.2
1
PCM
0.8
0.6
0.4
0.2
0
-0.2
-0.4
-0.6
-0.8
-1
Sample analog signal at 8 kHZ Digital pulse train at 64 kbps

39. Advanced Speech Coding
• We cannot send the 64 kbps required by PCM
• We need alternative speech encoding
techniques
• Estimates are that speech only contains 50 bits
per second of information
• Compare time to speak a word or sentence with
time to transmit corresponding text
• Attempts to encode speech more efficiently:
• speech consists of periodic waveforms -
so just send the frequency and amplitude
“yahoo”
• model the vocal tract - phonemes, voiced
and unvoiced speech
• Vocoder - synthetic speech quality

40. GSM Voice Coding Sequence
Speech Coding
8000 Hz
sampling
13-bit
resolution
Quantization
8000x13bits
= 104 kbps 22.8 kbps
2080-bit (20ms) 456-bit blocks
blocks Radio Interface
(note 1)
RPE-LTP Channel GMSK
Speech Coder Coding Interleaving Modulation
156.25-bit bursts
260-bit blocks
13 kbps Radio Burst
Encryption Multiplexing
Channel Coding
note 1: 160 samples of 13 bits per 20ms

41. Speech Digitisation
8192 (213) quantisation levels
8000 samples per second
8000 samples per second x 13 bits per sample = 104kbps per second
Divided into 20mS blocks = 2080 bits per block

42. GSM Channel Coding
Speech Coding
8000 Hz
sampling
13-bit
resolution
Quantization
8000x13bits
= 104 kbps 22.8 kbps
2080-bit (20ms) 456-bit blocks
blocks Radio Interface
(note 1)
RPE-LTP Channel GMSK
Speech Coder Coding Interleaving Modulation
156.25-bit bursts
260-bit blocks
13 kbps Radio Burst
Encryption Multiplexing
note 1: 160 samples of 13 bits per 20ms

43. GSM (TCH/F) Channel Coding
260 bits
50 Class 1a 78 Class 2 bits
132 Class 1b bits
bits (side information)
Inc 3 4
189 bit block coding 53 bits parity 132 bits tail
bits bits
un
co
de
d
½-rate
x2 convolution encoder
78 non-encoded
378 convolution encoded bits + bits
456 bits

44. Block Interleaving
Speech Coding
8000 Hz
sampling
13-bit
resolution
Quantization
8000x13bits
= 104 kbps 22.8 kbps
2080-bit (20ms) 456-bit blocks
blocks Radio Interface
(note 1)
RPE-LTP Channel GMSK
Speech Coder Coding Interleaving Modulation
156.25-bit bursts
260-bit blocks
13 kbps Radio Burst
Encryption Multiplexing
note 1: 160 samples of 13 bits per 20ms

45. Interleaving - Effects of ‘Burst’ Noise
• Non – Interleaved Channels:
1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8
Noise burst
1 Channel 1
1 Channel 2
1 Channel 3
• Interleaved Channels:
1 1 1 2 2 2 3 3 3 4 4 4 5 5 5 6 6 6 7 7 7 8 8 8
Noise burst

46. Interleaving
Channel Coder Channel Coder
456 bits 456 bits
1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 (8 x 57 bit blocks)
1 11 2 22 3 33 4 44 5 55 6 66 7 77 8 8

47. GSM Burst Multiplexing
Speech Coding
8000 Hz
sampling
13-bit
resolution
Quantization
8000x13bits
= 104 kbps 22.8 kbps
2080-bit (20ms) 456-bit blocks
blocks Radio Interface
(note 1)
RPE-LTP Channel GMSK
Speech Coder Coding Interleaving Modulation
156.25-bit bursts
260-bit blocks
13 kbps Radio Burst
Encryption Multiplexing
Channel Coding
note 1: 160 samples of 13 bits per 20ms

48. Radio Burst Multiplexing
456 bits 456 bits
1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 (8 x 57 bit blocks)
1 11 2 22 3 33 4 44 5 55 6 66 7 77 8 8
26 training
3 57 data bits 1 bits 1 57 data bits 3 8.25
1 burst = 156.25 bit periods (0.577mS)

49. Types of Data Burst
• The 156.25 bit periods of a timeslot can hold different types of data burst:
Stealing flag bits
Normal Burst 26 Training
(Traffic and most control channels) 3 57 Data Bits 1 Bits 1 57 Data Bits 3 8.25
Frequency Correction Burst (FCCH)
3 142 fixed bits 3 8.25
Data and tail bits are all 0
Synchronisation Burst (SCH) 39 Data 64 Training Bits 39 Data
3 Sync Sequence 3 8.25
Data to synchronise MS with BTS Bits Bits
Dummy Burst 26 Training
Transmitted on BCCH carrier when there are no other 3 Bits 3 8.25
bursts - allows power level measurements
Access Burst (RACH) 41 Training
8 36 Data Bits 3 68.25
Long guard period to avoid collisions Bits
Tail bits Guard period

50. GSM Modulation
Speech Coding
8000 Hz
sampling
13-bit
resolution
Quantization
8000x13bits
= 104 kbps 22.8 kbps
2080-bit (20ms) 456-bit blocks
blocks Radio Interface
(note 1)
RPE-LTP Channel GMSK
Speech Coder Coding Interleaving Modulation
156.25-bit bursts
260-bit blocks
13 kbps Radio Burst
Encryption Multiplexing
Channel Coding
note 1: 160 samples of 13 bits per 20ms

51. GSM Voice/Channel Coding Summary
Speech 20ms Block 20ms Block 20ms Block (2080 bits per block)
Speech Coder Speech Coder RPE-LTP encoding
13kbps 260 bits 260 bits
Channel Coder Channel Coder Block and convolution encoding
22.8kbps 456 bits 456 bits
1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 8 x 57-bit blocks
Interleaving
1 11 2 22 3 33 4 44 5 55 6 66 7 77 8 8
26
3 57 data bits 1 training
bits
1 57 data bits 3 8.25 1 burst = 156.25 bit periods (0.577mS)

52. Mobile-Initiated RR Connection Setup
Mobile BSS
Channel Request RACH
Channel Request RACH
Channel Request RACH
AGCH Immediate Assignment

53. Network-Initiated RR Connection Setup
Mobile BSS
PCH Paging Request
Channel Request RACH
AGCH Immediate Assignment

54. RR Connection Release
• Initiated by network only
• Reasons could include:
• End of a call
• Too many errors
• Removal of channel in favour of higher priority call
• MS waits for a short random period and returns to idle state
Mobile BSS
SDCCH Channel Release
Short random delay
Return to idle state

55. Handover Types
There are four different types of handover in the GSM
system, which involve transferring a call between:
• Channels (time slots) in the same cell BSC
Internal
• Cells within the same BSS (same BSC)
BSC
• Cells in different BSSs (different BSCs) but under the
control of the same MSC VLR
External
• Cells under the control of different MSCs MSC
BSC
GSM handovers are ‘hard’ – i.e. mobile only communicates VLR
with one cell at a time MSC

56. Handover Causes
• Handover can be initiated by either MS or MSC
• Handover decision is based on the following parameters (in
priority order):
• Received signal quality
• Received signal strength
• Distance of MS from BTS
• Drops below power budget margin
• Each parameter has a operator-defined threshold and
handover decisions can be based on one or a combination of
the parameters

57. Handover Command Message
Structure of the message sent to MS by original BSS:
MS BSS
Message Type
Cell Description Handover Command
Handover Reference
Power Command
Includes Frequency Hopping
Channel Description information if required
Frequency List Non - Frequency Hopping
or
Mobile Allocation Frequency Hopping

58. Handover Margin
Handover to BTS 1 Handover to BTS 2
Mobile remains with
BTS 1 BTS 1 or BTS 2 BTS 2
Nominal cell boundary
Hysteresis due to handover margin

59. Example of Handover Signalling
Signalling for a basic Inter-BSC handover involving only one MSC (Intra -
MSC):
MS BSS 1 BSS 2 MSC
Measurement report
Measurement report
Handover Required
Measurement report
Handover Request
Measurement report
Acknowledgement
Handover Command
Handover Command
Handover Access
Handover Detection
Physical Information
Handover Complete
Handover Complete
Clear Command
Measurement report
Clear Complete
Measurement report

60. Network Areas
• Cell: radio coverage area of one base station (BTS)
• GSM assigns a cell global identity number to each cell
• Location Area: Group of cells served by one or more BSCs.
• When there is an incoming call, the mobile is paged throughout
its location area. A unique Location Area Identity (LAI) is
assigned to each LA.
• MSC Service Area: part of network covered by one MSC.
• All mobiles in this area will be registered in the VLR associated
with the MSC.
• PLMN Service Area: public land mobile network area - the area
served by one network operator

61. MS Mobility States
A Mobile Station (MS) can be in one of three mobility states:
• MS turned off
• MS turned on in idle mode
• MS turned on in dedicated mode

62. MS Network Connection Sequence
Scan RF Select highest Scan for FCCH
Power on
channels carrier level frequency correction burst
NO
Select next highest FCCH
carrier level detected?
NO
YES
SCH Scan for SCH
detected? synchronisation burst
YES
‘camp-on’ to BCCH Monitor PCH and
and start decoding adjacent carriers

63. IMSI Attach
• Mobile camps on to best serving BTS
• Mobile sends IMSI to MSC
• MSC/VLR is updated in HLR BSC
• Subscriber data including current location area
is added to local VLR
• MSC and HLR carry out authentication check - VLR
challenge and response using Ki
MSC
• Optionally EIR checks for status of mobile
(white/grey/black)
AuC
EIR
HLR

64. IMSI Detach
• Explicit:
• Mobile informs MSC it is switching off BSC
• HLR stores last location area for mobile
• VLR records that mobile is no longer available on network
• Mobile powers down VLR
• Implicit
MSC
• VLR forces IMSI Detach due to no response
AuC
HLR

65. Location Update Options
• Send location update on every cell change
• No paging requirement
• Excessive signalling traffic load
• Page every cell in network
• No location update reuqirement
• Excessive signalling traffic load
• Subdivide network into paging areas
• Requires paging procedure with reduced traffic load
• Required location updating with reduced traffic load

66. Location Updates
BSC
• Location Area Change
BSC
• Periodic Location Update
• IMSI Attach VLR
MSC
• Cell change during call
BSC
• TMSI update on LA change Au
C
HLR
VLR
MSC

67. TMSI Re-allocation
• Used to protect a subscriber’s IMSI
• TMSI only unique within a Location Area (LA)
• Outside an LA, TMSI must be combined with LAI to remain unique
• TMSI re-allocated on LA change (minimum) or as a result of an
exceptional condition.
• Normally takes place in encrypted mode
• Normally tales place in conjunction with another procedure e.g. Location
update, call setup etc

68. Mobile Originated Call
• When the mobile requests access to the network to
make a call:
• BSS determines the nature of the call - e.g. regular voice call,
emergency call, supplementary service
• Allocates radio resources to the mobile for the call
?
• NSS determines the destination of the call:
•Mobile to mobile on same PLMN
•Mobile to mobile on another PLMN
•Mobile to fixed network (PSTN, ISDN)
• MSC / GMSC routes the call appropriately
and handles signalling

69. Mobile-Originated Call Setup
Mobile BSS
Channel Request RACH
Channel Request RACH
Radio Resource
Connection
Channel Request RACH
AGCH Immediate Assignment
LAPDm Connection Setup
SDCCH Unnumbered Acknowledgement
Service Request SDCCH

70. Mobile-Terminated (Network-Originated) Call
VLR 3 HLR
BSS
4
8 7 6
4 2
11 10
8 8
9 BSS 9 1 PSTN
MSC GMSC
5
12 12
8
BSS

71. Network-Initiated Call Setup
Mobile BSS
PCH Paging Request
Channel Request RACH
Radio Resource
Connection
AGCH Immediate Assignment
LAPDm Connection Setup
Paging Response SDCCH
SDCCH Unnumbered Acknowledgement

72. General Authentication Procedure
AuC
MS BSS MSC HLR
Access Request
MS HLR/AuC [IMSI]
Ki RAND RAND Ki Send Authentication info
[IMSI]
A3 A3
Send Authentication info Ack
SRES2 SRES1
[IMSI, Triplet (RAND SRES1 Kc)]
Authentication & ciphering Request
SRES1 SRES1/RAND [RAND]
SRES2
= Authentication & ciphering Response
[SRES2]
MSC

73. User Data Encryption
• Benefits of user data encryption include:
• Provides confidentiality for user data across air interface
• Selection from seven encryption algorithms
• Capability is mandatory for MS and network
• Implementation is optional
• Does not provide for end-to-end encryption

74. General GSM Encryption Procedure
MS BTS MSC AuC
Ki RAND Ki
A8 A8
Kc
Kc
Data Kc Data
A5 A5
Encrypted Data

75. 2.5 Generation GSM
• Evolution of GSM towards 3G systems
• Main requirement is for increased data
rates
3rd Generation
• Mobile access to: n
atio 384 kb/s
• Internet er UMTS 2 Mb/s
G en
• E-mail .5 38.8 kb/s ECSD
2
• Corporate networks
69.2 kb/s
EDGE EGPRS
14.4 HSCSD
kb/s
GPRS 21.4 kb/s
9.6 CSD
kb/s
SMS
Circuit Switched
2nd Generation
Packet Switched

76. HSCSD
• Increases bit rate for GSM by a mainly
software upgrade
• Uses multiple GSM channel coding
schemes to give 4.8 kb/s, 9.6 kb/s or 14.4
kb/s per timeslot
Maximum data rate quoted as
115 kb/s = 14.4 x 8
• Multiple timeslots for a connection
e.g. using two timeslots gives data rates
up to 28.8 kb/s
• Timeslots may be symmetrical or
asymmetrical, e.g. two downlink, one
uplink, giving 28.8 kb/s downloads but 14.4
kb/s uploads.

77. HSCSD Mobile Equipment
• HSCSD handsets are typically limited to 4
timeslots, allowing:
• 2 up / 2 down (28.8 kb/s in both directions)
• 3 down and 1 up (43.2 kb/s down 14.4 kb/s up)
• This limitation arises because the handset
operates in half duplex and needs time to change
between transmit and receive modes
• Nokia cardphone (PCMCIA card for laptops) uses
HSCSD (Orange network)
- quotes data downloads at 28.8 kb/s

78. GPRS
• General Packet Radio Service
• Packet switching: Data
packet
• Data divided into packets
• Packets travel through network
individually
• Connection only exists while packet
is transferred from one node to next
• When packet has passed a node,
the network resources become
available for another packet
• User sees an ‘always on’ virtual
connection through the network

79. PCU Circuit/Packet Data Separation
Visited Gateway PSTN
MSC/VLR MSC
Circuit Switched
A
BTS BSC PCU HLR
Gb
Packet Switched
Serving Gateway
GSN GSN PDN

80. GPRS Air Interface
• New ‘Packet’ logical channels defined - PBCCH, PDTCH etc.
• New multiframe structure based on ‘radio blocks’ of 4 timeslots
• Allows up to 8 mobiles to share a timeslot
• For high data rates, several physical channels may be allocated to one
user
• 4 levels of channel coding schemes (CS-1 to CS-4):
• Decreasing level of error checking
• Greater data throughput rates
• Scheme selected according to CS-4
interference level (C/I)
Data throughput
CS-3
CS-2
CS-1
C/I

81. Using Spare GSM Capacity
• GPRS can use traffic capacity on
the GSM network away from the Maximum Capacity
Available
busy hour for non time critical
Timeslot Usage
Available
for GPRS
data transfers for GPRS
• Even during the busy hour, there Circuit Switched Demand
is spare capacity that GPRS can
make use of:
Time (hours)
• Voice calls start and finish at 0 24
random times, leaving short
periods when channels are
unused Ti
m
es
• Packets of data can be sent when
Timeslots
lot
these channels become available s
- dynamic allocation
Time
Time

82. Charging for GPRS Services
• GPRS allows the user to be ‘always connected’
- charging by time is not appropriate
• Some possible methods of charging are:
• By volume of data transferred Internet
• Flat rate for Internet access
• By Quality of Service
• For content - operator may provide own £
pages (value added services)
• Quality of Service parameters:
£
• Service Precedence (priority)
£
• Reliability £
• Delay £
• Throughput

83. EDGE
(0,1,0)
(0,1,1) (1,1,0)
• Enhanced Data rates for GSM Evolution
• Use 8 Phase-Shift Keying (8PSK) modulation (0,0,1) (1,1,1)
- 3 bits per symbol
• Improved link control allows the system to adapt
to variable channel quality - leads to slightly (0,0,0) (1,0,1)
reduced coverage area (1,0,0)
• Applied to GSM, EDGE allows a maximum data rate of 48 kb/s per
timeslot, giving the quoted figure of 384 kb/s per carrier (8 timeslots)
• EDGE can be applied to HSCSD (ECSD) and GPRS (EGPRS)
• EDGE will be expensive for operators to implement:
• Each base station will require a new EDGE transceiver
• Abis interface between BTS and BSC must be upgraded