BASIC

GSM
PRINCIPLES
 COMPARISON
TACS GSM 900 DCS 1800
Uplink 890 - 905 MHz 890 - 915 MHz 1710 - 1785 MHz
Downlink 935 - 950 MHz 935 - 960 MHz 1805 - 1880 MHz
Duplex Distance 45 MHz 45 MHz 95 MHz
Carrier Separation 25 kHz 200 kHz 200 kHz
Number of Channels 15 Mhz / 25 kHz = 600 25 MHz / 200 kHz = 124 75 MHz / 200 kHz = 374
Channels defined in Switch 1, 2, .599, 600 1, 2, .123, 124 512 , 513 .884, 885
Access Method FDMA TDMA TDMA
 GSM 900
TACS DCS 1800

1 Voice Channel 1 Voice Channel

1 Control 10 Control
Channel
Channels
Logical Channels:

1 VOICE CHANNEL

10 CONTROL CHANNELS
 TCH = Traffic Channel

Full rate - Used for speech at 13 kbits/s or

sending data at 9.6 kbits/s

Half rate - Used for speech at 6.5 kbits/s or

sending data at 4.8 kbits/s

Enhanced Full rate - Used for speech at 13

kbits/s or sending data at 9.6 kbits/s but with
almost Land line quality
BACK
 DCCH

CCCH CBCH

NEXT BCH
BCH = Broadcast Channels

FCCH = FREQUENCY CORRECTION CHANNEL

- To tell the Mobile that this is the BCCH carrier
- To able the Mobile to synchronize to the frequency
(Downlink only)

SCH = SYNCHRONISATION CHANNEL

- Used for sending BSIC (Base station Identity Code)
- Give TDMA frame number to the Mobile.
(Downlink only)
BCH = Broadcast Channels

BCCH = BROADCAST CONTROL

CHANNEL
- Used for sending information to the mobile like
CGI (Cell Global identity), LAI (Location Area
Identity), BCCH carriers of the neighboring cells,
maximum output power allowed in the cell and
other broadcast messages like barred cell.
(Downlink only)
BACK
CCCH = Common Control Channels

PCH = PAGING CHANNEL

- Used for paging the mobile; Reason could be an incoming call
or an incoming short message
(Downlink only)
RACH = RANDOM ACCESS CHANNEL
- Used for responding to the paging (terminating), location
updating or to make call access (originating) by asking for a
signaling channel.
(Uplink only)
AGCH = ACCESS GRANT CHANNEL
- Used to allocate SDCCH to the mobile.
(Downlink only)
BACK
DCCH = Dedicated Control Channels

SDCCH = STAND ALONE DEDICATED CONTROL

CHANNEL
- Used for allocating voice channel (TCH) to the mobile
(call setup) and Location updating.
- Send Short Text message to Idle Mobile
(Uplink & Downlink)

FACCH = FAST ASSOCIATED CONTROL CHANNEL

- Used for handover
(Uplink & Downlink)
DCCH = Dedicated Control Channels

SACCH = SLOW ASSOCIATED CONTROL CHANNEL

- Used for sending information to the mobile like CGI (Cell
Global Identity), LAI (Location Area Identity), BCCH of all the
neighbors and TA (Timing Advance)
- Send Short Text message to Busy Mobile
(Downlink)
- Used for sending signal strength & bit error rate
measurement of the serving cell and signal strength of the
BCCHs of the neighboring cells.
(Uplink)
BACK
CBCH = Cell Broadcast Channel

Used for sending short messages to all the

mobiles within a geographic area.
Typical example: traffic congestion in a major road or
a major accident in an area. Up to 93 characters can
be sent.
If the mobile is in the Idle mode then the short
message will be send through the CBCH. If the
mobile is Busy, it will not be sent.
NOT TO BE CONFUSED WITH SMS
What is an SMS?

Short Message Service

SMS messages are short TEXT messages up to 160
characters in length that you can send or receive. The
messages are not sent straight to the other mobile but
is sent to message center operated by the Network
Provider
What is an SMS?

If the mobile was switched off or is at outside of the

coverage area, the message is stored in the Message
Service Center. The message will be offered to the
subscriber when the mobile is switched on again or
has reentered the coverage area again.
If the mobile is in the idle mode the short message
will be send through the SDCCH. If the mobile is busy
the short message will be sent through the SACCH.

BACK
 1 TDMA FRAME
200 kHz
4.615 ms

0.577 ms

TS 0 TS 1 TS 2 TS 3 TS 4 TS 5 TS 6 TS 7

FCCH, SDCCH, TCH, TCH, TCH, TCH, TCH, TCH,

SCH, SACCH, SACCH, SACCH, SACCH, SACCH, SACCH, SACCH,
BCCH CBCH FACCH FACCH FACCH FACCH FACCH FACCH
PCH,
RACH,
AGCH
F D T T T T T T R D T T T T T T
S D T T T T T T R D T T T T T T
B D T T T T T T R D T T T T T T
B D T T T T T T R D T T T T T T
B D T T T T T T R D T T T T T T
B D T T T T T T R D T T T T T T
C D T T T T T T R D T T T T T T
C D T T T T T T R D T T T T T T
C D T T T T T T R D T T T T T T
C D T T T T T T R D T T T T T T
F D T T T T T T R D T T T T T T
S D T T T T T T R D T T T T T T
C D A T A T A T R D A I A I A I
C D T T T T T T R D T T T T T T
C D T T T T T T R D T T T T T T
C D T T T T T T R D T T T T T T
 4.615 ms 4.615 ms
TS0 TS1 TS2 TS3 TS4 TS5 TS6 TS7 TS0 TS1 TS2 TS3 TS4 TS5 TS6 TS7

F D T T T T T T R D T T T T T T
S D T T T T T T R D T T T T T T
F = FCCH B D T T T T T T R = RACH R D T T T T T T
S = SCH A = SACCH
B = BCCH B D T T T T T T T = TCH R D T T T T T T
C = PCH or B D T T T T T T R D T T T T T T
AGCH
D = SDCCH
B D T T T T T T R D T T T T T T
A = SACCH C D T T T T T T R D T T T T T T
T = TCH
C D T T T T T T R D T T T T T T
C D T T T T T T R D T T T T T T
C D T T T T T T R D T T T T T T
F D T T T T T T R D T T T T T T
S D T T T T T T R D T T T T T T
C D A T A T A T R D A I A I A I
C D T T T T T T R D T T T T T T
C D T T T T T T R D T T T T T T
C D T T T T T T R D T T T T T T
1 Frame 1 Frame
(Downlink - BTS transmit) (Uplink - Mobile transmit)
1 carrier = 200 kHz 1 carrier = 200 kHz
Downlink . 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 .

5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7
Uplink .
3 TIMESLOTS 3 TIMESLOTS 3 TIMESLOTS
3 * 0.577ms = 1.73ms 3 * 0.577ms = 1.73ms 3 * 0.577ms = 1.73ms

TCH UP-DOWNLINK OFFSET

This means that the mobile does not transmit and receive at the same
time.
Also note that :
in TS 0 : All the Logical Channels will repeat itself after 51 frames
in TS 1 : All the Logical Channels will repeat itself after 102 frames
in TS 2 to 7 : All the Logical Channels will repeat itself after 26 frames
 MSISDN

MOBILE STATIONS ISDN NUMBER

Is the mobile number used in a GSM PLMN
(Public Land Mobile Network)
MSISDN = Country Code + National Destination
Code + Subscriber number
Maximum length is 15 digits
e.g.: 63 + 0918 + 8889999
 IMSI
INTERNATIONAL MOBILE SUBSCRIBER IDENTITY
Is the subscriber number used over radio path for all signaling in the
GSM PLMN.
This number is stored in SIM (Subscriber Identity Module), HLR (Home
Location Register, and VLR (Visitor Location Register)
IMSI = MCC + MNC + MSIN
= Mobile Country Code + Mobile Network Code + Mobile
Identification Number
[ 3 digits ] [ 2 digits ] [ 11 digits ]
e.g.: 502 + 19 + 2345451
 TMSI
TEMPORARY MOBILE SUBSCRIBER IDENTITY
Is used for the subscriber's confidentiality. Since the TMSI has
only local significance (within MSC/VLR), the structure of the
TMSI can be chosen by the Vendor. But the size must be 1/2 of
the size of IMSI. Each time a mobile request for location
updating or call setup, MSC/VLR allocates to the IMSI a new
TMSI, so the TMSI is used on the signaling path, protecting the
IMSI identity. Plus since the TMSI is half the size of IMSI, we
can page twice the amount compared to IMSI.
 LAI
LOCATION AREA IDENTITY
Is used to uniquely identify each location area in the GSM PLMN.
When the system receives an incoming call it knows in which
location area it should page the mobile and does not page the
entire network.
LAI = MCC + MNC + LAC
= Mobile Country Code + Mobile Network Code + Location
Area Code
[ 3 digits ] [ 2 digits ] [ 1 to 65536 ]
e.x. = 502 + 20 + 60001
 CGI
CELL GLOBAL IDENTITY
Is used for cell identification within the GSM network
CGI = MCC + MNC + LAC + CI
= Mobile + Mobile + Location + Cell
Country Code Network Code Area Code Identity
[ 3 digits ] [ 2 digits ] [ 1 to 65536 ] [ 1 to 65536 ]

e.x. = 502 + 20 + 60001 + 50001

 BSIC

BASE STATION IDENTITY CODE

Is used to distinguish co channel frequency
used in the neighboring cell
BSIC = NCC + BCC
= Network Color Code + Base Station
Color
Code
[ 0 to 7 ] [ 0 to 7 ]
 SIM
SUBSCRIBER IDENTITY MODULE
Used to provide storage on subscriber related information as following :
- IMSI (International Mobile Subscriber Identity)
- Temporary network data like TMSI, LAI, Location update status
- Subscriber Authentication Key (Ki) and Ciphering Key (Kc) which are
used for security purposes
- BCCH information : List of carrier frequencies to be used for cell
selection
- Forbidden PLMN
- Language preference
- PIN number (Personal Identification Number) and PIN error counter
- PUK number (Personal Unlock Key) and PUK error counter
Pin Management

The PIN number consist of 4 to 8 digits and it is loaded by the service

activator an subscription time. Afterwards the PIN number can be
changed as many times an user wishes including the length of the PIN
number. The user can disable the PIN function but again can be
inhibited at subscription time by a authorized person. If an incorrect PIN
is entered, an indication is given to the user. After 3 consecutive
incorrect entries, the SIM is blocked, even if if the SIM is removed or the
mobile is switch off and on. If the SIM card is blocked the user cannot
access the network. The unblocking of the SIM card can only be done
by keying in the PUK (Personal Unlock Key). PUK is 8 digit and is given
to the user at subscription time. If an incorrect PUK is entered more than
10 times then the PUK will not work anymore and the SIM card will
continue to be blocked until taken to the mobile vendor service center.
Two Physical Types of SIM:

ID-1 SIM - looks like a Plug in SIM - looks like

credit card a small chip is installed
semi permanently in
the mobile equipment
When the mobile is in idle mode it must always
be camped to a BCCH carrier!

WHY?!

THERE ARE THREE REASONS:

For the PLMN to know in which location area the mobile is so that it
can page the mobile when an incoming call or short text message is
received.
The mobile can initiate a call by accessing the network on Random
Access Channel (RACH) of the cell which it camped on.
To receive system information from the PLMN like traffic congestion
and major accidents.
An Idle Mobile Does Four Tasks:

PLMN SELECTION

CELL SELECTION

CELL RESELECTION

LOCATION UPDATING
PLMN SELECTION

When the mobile is switched on it will select

the registered PLMN in the mobile if there
exists one.
If there is no registered PLMN or the
registered PLMN is not available (no
coverage) then the mobile will try to select
another PLMN either automatically or
manually depending on its mode.

BACK
Automatic Mode

The automatic mode uses a list of PLMNS in an order

of priority. The priority will be :
The last network on which you were registered
Home PLMN
Each PLMN stored in the SIM card in priority order
Other PLMN with signal level above -85 dBm in
random order
All other PLMN in decreasing signal strength
BACK
Manual Mode

In the manual mode the mobile will try to connect to

the Home PLMN first. If it is unsuccessful then it will
provide a list of available PLMN and ask the user to
choose one. If the second chosen PLMN is not
successful then the mobile will make an indication to
the user to select another PLMN. Until the users
selects another network a message No Access will
be displayed. If there is no GSM or DCS coverage at
all then a message No Network will be displayed.

BACK
CELL SELECTION

Once the mobile is switched on and the registered

home PLMN was selected (e.x. SMART), it will next
search for a BCCH frequency list, stored in its memory
or in its SIM card. The list can have up to 32 BCCH
frequencies for the mobile to scan. This reduces the time
of cell selection, compared to scanning the whole
frequency band. If this feature is turned off at the switch
then the mobile has to scan the entire frequency band
for the strongest BCCH carrier.
CELL SELECTION

The BCCH frequency list is called BA (BCCH Allocation) list

and there are 2 types, ACTIVE AND IDLE. Idle is a list of BCCH
used for scanning when the mobile is in an idle mode and Active is
a list of BCCH used during mobile busy mode. Why 2 List ???
When the mobile is in idle mode it may want to scan a longer list of
BCCH and tune to the strongest whereas when in Active mode the
list of BCCH should be shorter (correspond to defined neighbors) so
that the mobile will scan the short list and get a more accurate
signal strength measurements to achieve better handover
performance. It is also to reduce the time spend by the mobile to
decode the BSIC.

Recommendation: ACTIVE MODE LIST SHOULD NOT BE

MORE THAN 15 BCC FREQUENCIES.
CELL SELECTION

If there is no BA list stored in the Mobile or SIM card then the

mobile will scan all the 124 GSM channels and 374 DCS channel
and arrange the frequencies in a DESCENDING order of signal
strength. It will take the mobile 3 to 5 seconds to scan the whole
band. After which it will tune to the strongest frequency. The mobile
will check if this is a BCCH carrier by looking out for the frequency
correction burst send by the FCCH (Frequency Correction
Channel). If it is the BCCH carrier than mobile tunes to this carrier
to read the SCH (Synchronization Channel) for the BSIC parameter.
Next it will read the BCCH for system information like CGI (Cell
Global identity), LAI (Location Area Identity), BCCH carriers of the
neighboring cells (BA List), maximum output power allowed in the
cell and other broadcast messages like barred cell.
CELL SELECTION

Next the mobile will compare if the selected cell belongs

to a forbidden PLMN stored in its SIM card. It will look at the
2 digit Network Mobile Code transmitted by the BCCH on the
LAI (Location Area Identity). If those 2 digits ware registered
as forbidden in the SIM card then the mobile will not select
this cell. The mobile then will tune to the second strongest
BCCH carrier and subsequently does the same process over
and over again until it finds the right cell. Once it finds the
right cell it will start using the BA (BCCH allocation) list
transmitted by the BCCH carrier for cell reselection, will be
discussed later.
CELL SELECTION

Lets say the chosen PLMN is correct, able to read the FCH, SCH
and BCCH and the chosen Cell is accessible (no cell barring),
DOES THIS MEAN THAT THE MOBILE NOW CAN CAMP ON
THIS SITE?

NO!!
THERE IS ONE LAST CRITERIA CALLED C1 CELL SELECTION
CRITERION WHICH MUST BE CALCULATED BY THE MOBILE AND IF
THE C1 VALUE IS GREATER THAN 0 THEN THE MOBILE CAN CAMP
ON THIS CELL OR ELSE THE NEXT CELL WITH C1 > 0 WILL BE
SELECTED.
 C1-CELL SELECTION CRITERION
C1 = A - Max (B,0)
and C1 > 0 for the mobile to camp on this BTS
where:
A = RxLev - RxLevAccMin
B = MsTxPwrMaxCCH - P

RxLev = Signal strength received by the mobile

RxLevAccMin = Minimum Signal level to be received by the mobile from BTS (BCCH)
before it could access the BTS
MsTxPwrMaxCCH = Maximum Transmit Power allowed to access the BTS (using
RACH)
P = Mobile Class power
C1 = (RxLev - RxLevAccMin) - Max(MsTxPwrMaxCCH - P,0)
Ex : C1 = ( -80 - (-100) ) - Max (33 - 33, 0)
= -80 + 100 - Max (0, 0)
= 20
C1 > 0 so mobile will camp on this site
Shortcut: If RxLevel > RxLevAccMin then Mobile can camp on this site
ACCMIN (Ericsson) RxLevAccessMin (Nokia) SSACC (TACS) (Uplink)

Minimum Signal level that must be received by the mobile

from BTS (BCCH) before it could access the BTS

= -102 (GSM900) = -100 (DCS1800)

WHY?!

General rule: The signal received by the mobile

should be 2dB higher than the mobile sensitivity
What is the accurate way of setting the
RxLevAccessMin parameter ?

RxLevAccessMin = Mobile Sensitivity + Body loss + Multipath loss +

Interference Margin
Mobile Sensitivity = -104 for GSM900 and -102 for DCS1800
Body loss = 3 dB recommended by ETSI and 5 dB recommended by Ericsson for
GSM 900
= 3 dB recommended by ETSI and 3 dB recommended by
Ericsson for DCS 1800
Multipath loss = Signal loss from base station due to reflection by buildings, etc
before reaching mobile. Normally the Multipath loss is around 3 dB but can be
overcome by Antenna Diversity which has gain around 3 dB too. (Space diversity = 3
dB, 90 degrees polarized diversity = 3 dB, 45 degrees slant polarized diversity = 4.5
dB)
Interference Margin = Margin allocated to overcome C/I and C/N, the
recommended value is 2 dB
What is the accurate way of setting the
RxLevAccessMin parameter ?

RxLevAccessMin = Mobile Sensitivity + Body loss +

Multipath loss + Interference Margin
RxLevAccessMin = -104 + 3 + 0 + 2 (for GSM 900 with
ETSI standard)
= - 99 dBm
RxLevAccessMin = -104 + 5 + 0 + 2 (for GSM 900 with
Ericsson standard)
= - 97 dBm
RxLevAccessMin = -104 + 3 + 0 + 2 (for DCS 1800)
= - 99 dBm
 TACS GSM 900 DCS 1800
Class 1 10 Watt (40dBm) 20 Watt (43dBm) 1 Watt (30dBm)
Class 2 4 Watt (36dBm) 8 Watt (39dBm) 0.25 Watt (24dBm)
Class 3 1 Watt (30dBm) 5 Watt (37dBm) 4 Watt (36dBm)
Class 4 0.6 Watt (28dBm) 2 Watt (33dBm) *
Class 5 * 0.8 Watt (29dBm) *

TACS GSM 900 DCS 1800

Mobile Sensitivity -113 dBm -104 dBm -102 dBm
BTS Sensitivity -116 dBm -107 dBm -106 dBm
CCHPWR (Ericsson) MsTxPwrMaxCCH (Nokia) PLC (TACS)

Maximum Transmit Power allowed to access the

BTS (using RACH) - mobile is idle

= 33dBm = 30dBm = 0 (28dBm)

(GSM900) (DCS1800) (DCS1800)
MsTxPwr (Ericsson) MsTxPwr (Nokia) PLVM (TACS)

Maximum Transmit Power allowed to use in a BTS

during busy status (using TCH) - mobile is busy

= 33dBm = 30dBm = 0 (28dBm)

(GSM900) (DCS1800) (DCS1800)
 MsTxPwrMin (Nokia)

Minimum Transmit Power allowed to use in a BTS

during busy status (using TCH) mobile is busy

= 13dBm (GSM900) = 13dBm (DCS1800)

 Switch on the Mobile

For 2 to 3 seconds the mobile will scan all the 124

channels in GSM900 and 374 channels in DCS1800

Mobile will compare the signal strength

of the 124 channels and tune to the strongest

Tune to the second No

Mobile will check if it is a BCCH carrier ?
strongest channel
Yes
The mobile will synchronize to this carrier
and read the BCCH info like LAI, CGI

No Does the BCCH belong to the wanted PLMN,

E.x: Smart, Globe, Islacom ?

Yes
Yes
Is the cell barred from accessing ?

No
No
Is C1 >0 ?

Yes
Camp on this site !!!
An Idle Mobile Does Four Tasks:

PLMN SELECTION

CELL SELECTION

CELL RESELECTION

LOCATION UPDATING
CELL RESELECTION

1) Perform Cell Reselection Measurement First

After the cell has been successfully selected, the mobile now
will start reselection tasks. It will continuously make measurements
on its neighboring cells (as indicated by the BA list) to initiate cell
reselection if necessary. At least 5 measurement samples per
neighboring cell are needed. A running average of the received
signal level will be maintained for each carrier in the BA list.
CELL RESELECTION

All system information messages sent on the current BCCH on the

serving cell must be read by the mobile every 30 seconds to monitor
changes in cell parameters (ex: MsTxPwrMax). The mobile also has to read
the 6 strongest BCCH every 5 minutes to receive its cell parameters (ex:
MsTxPwrMax). The 6 strongest can be seen from the BA list which has the
updated measurement of the 32 BCCH carrier. The neighboring list for the
best 6 neighbors is updated every 60 seconds, which means the mobile has
to measure each neighbor by 10 seconds. The mobile also has to read the
BSIC of the 6 strongest BCCH every 30 seconds to confirm that it is still
monitoring the same cells. If a new BSIC is detected, then the BCCH of this
BSIC will be read to receive the cell parameters.
CELL RESELECTION

1) Cell Reselection Criteria

The mobile will reselect and camp on another cell if any of the following criteria is satisfied:
The serving cell is barred.
C1 value in the current cell is below 0 for 5 seconds which indicates that the path loss is
high and the mobile needs to change cell.
The Mobile has unsuccessfully tried to access the network as defined by the MAXRET
(Ericsson) parameter or MaxNumberRetransmissions (Nokia).
MAXRET is the maximum number of retransmission a mobile can do when it is accessing
the system. It is defined per cell.

Assuming that one of the criteria above was satisfied then the mobile will select a cell with
a better C1.
However if the cell belongs to a different location area then the C1 for that cell has to
exceed a reselection hysterisis parameter called CRH (Ericsson) or CellReselectHyseteris
(Nokia) for the reselection to happen!!
CELL RESELECTION
If the mobile is moving in a border area between location areas, it might repeatedly change
between location areas. Each change requires location updating and cause heavy signaling load and
risk paging message being lost. To prevent this, a cell reselect hysteresis parameter CRH is used.
The cell in a different location area will only be selected if the C1 of that cell is higher than the C1 of
the current serving cell by the value of the Reselect Hysteresis.
Since the Value of CRH maybe different for each cell, the CRH used for comparison will be the
one broadcast by the serving cell. If the value is set very low then the mobile will Ping-Pong between
location areas which will increase signaling load. If the value is set very high the mobile may camp in
the wrong cell too long.
Recommendations: Set the value to 6

LA 1 C1 = 1 LA 2
Serving cell CRH = 4 Target cell

C1 = 6
 BASIC
COMPARISON
MOBILE IDLE
When the mobile is idle, it listens to the best cell to camp. Mobile decides to choose the cell by
itself without the help of BSC. This is done by comparing signal strength of each BCCH
frequency and if found the strongest then it will camp once the C1 > 0 (Cell Selection
Criterion). If after camping to this cell, it finds that a neighboring cell is much better then it will
change to that neighboring cell. If the new cell is in same location area the mobile does not
have to inform the BSC about its new cell but if the new cell is from a different different location
area then the mobile will perform a location updating to inform the BSC.

MOBILE BUSY
A mobile is considered busy when there is a call going on (speech, data or fax) or it is in the
middle of a call setup. At this stage the mobile cannot decide by itself whether it is necessary
for the mobile to handover to a better cell. Only BSC can determine if a mobile has to change
to another cell other than the serving cell. BSC makes the decision based on measurement
reports sent by both Mobile and BTS. This decision making is called locating. In a busy state,
mobiles can receive Short Text Message (SMS) but cannot receive Cell Broadcast Messages.