Principles of Digital Mobile Communication

Systems
-
The GSM System

2001 edition
by Petri Jarske

Contents:

Principles of Cellular Mobile Communications Systems 2

The mobile radio environment 8
The GSM System 20
Basic Architecture 20
Architecture Evolution 24
Transmission inside GSM 31
The Radio Interface 38
Principles of Signalling 61
Radio Resource Management 70
Mobility & Security Management 82
Communication Management 89
Network Management 93
Evolution of the GSM System 101
CDMA Systems Intro 107
Principles of Cellular Communications Systems

A typical mobile communication environment can be

described with the following assumptions:

• The communication network operators and service providers

want to provide mobile communications services to a large
number of customers.

• The customers are distributed over a (possibly) large

geographical area.

• The customers want to be able to access the services while

moving around in the service area (the degree of mobility
may vary, depending on the system, from 0 to 250 km/h).

• The operators can use certain limited band of radio

frequencies for the wireless part of the communication.

Now, the problem in the exponentially growing markets of

mobile communications is:

• How can the capacity of the communications system be

increased (and increased, and increased, and · · · ) ?

In this context

capacity = number of customers receiving services with

satisfactory quality of service

2
Straightforward solution:
• The same frequencies used over the whole geographical
area.
• For increasing capacity, use more efficient source coding
and modulation (compression, efficient modulation, TDMA,
CDMA, etc.)
• No need to worry about the location of the customer.

Cellular solution:
• Divide the geographical area into small subareas (cells), and
assign each cell enough frequency resource to serve the
customers in this area (see figure below, real cells are not
that regular in shape and size).
• The same frequency resource may be used in many cells
provided that they are separated by enough distance.
Capacity can be increased simply by making the cells
smaller and smaller...

Are there other advantages, in addition to the higher capacity?

The cellular solution also introduces new problems. What
could these be? Think before turning the page.

3
Other advantages:

• Well, at least lower transmitter powers −> less interference

to other users of the same system, less interference to other
systems, also longer battery life
• Flexible coverage: small cells for densely populated areas,
large cells for rural areas.

Problems to be considered:
• In order to provide service anytime, the network has to know
the location of each customer to some accuracy (location
management) at least when a call is coming to the mobile
unit.
• To provide continuous service even when the customer is
moving, handover procedures are needed. That is, the
service connection is passed to a new base station every
time the quality of the existing connection gets too low.

There are two extreme alternatives to handle the previous

problems. (1) The location of the customer is not known prior
to the call but a paging message is sent to the whole network
when a call arrives, or (2) the location of the customer is kept
in a central database with the precision of one cell. Many of
the existing solutions, such as GSM, are something between
these extremes because the signalling load can be minimized
that way.

• Also, the network becomes more complicated and expensive

when smaller cells are introduced. The cost issues are not
much emphasised in this text but they are very important for
the operator, and also to the customer.

4
Some further “tricks” to improve system efficiency in general
(not only capacity):

• transmitter power control: When the transmitted power

level of each transmitter is kept to the minimum required for
satisfactory quality, the interference caused to other cells
sharing the same resource is also minimized. This way, the
cells sharing the same radio resource can be built closer to
each other, and capacity increases (compared to the non-
controlled case).
• frequency hopping: The interference degrading the
transmission quality is not equally distributed to all radio
channels. By changing the channel frequency periodically
for each user, the quality can be made approximately equal
for everybody. This way many users can be served with
satisfactory quality, rather than serving a few customers
with good quality, and leaving some without service.
• discontinuous transmission: In speech communication, the
active speech covers only about 25· · · 40% of time.
During the silent periods, it is sufficient to transmit only
very little information, for example, one or two frames per
second. This again reduces the average transmitted power,
and reduces the interference caused to other users. The cost,
however, is increased complexity because voice activity
detection (VAD) has to be implemented.
• mobile assisted handover: This reduces the network
complexity by giving the responsibility of monitoring the
signals from neighboring cells to the mobile terminal. These
measurements are needed for the handover decision, and
would, otherwise, require constant message exchange
between neighboring cells.

5
Overview of mobile services

Service provision of a particular user depends on:

• contents of the subscription held by the user

• capabilities of the serving network
• capabilities of the user equipment

Examples

Services in GSM:

• Speech − probably the most important also in the future

• Circuit switched data − currently up to 38,4 kbits/s
commercially available, more soon
• Packet data – available
• Short messages − point-to-point & broadcast
• Supplementary services − call forwarding, barring, etc.

Services in IEEE802.11 wireless LANs:

• Packet data, up to 11 Mbits/s in 2.4GHz ISM frequencies,

22Mbits/s under development
• Packet data, up to 54 Mbits/s in 5-6 GHz frequencies
coming 2001
• IP based core network, operator not necessary
• No special speech channel, voice over IP (VoIP)

6
Evolution of Wireless Cellular Communication:

ETSI: GSM evolution to

WCDMA (UMTS)

ANSI: US-CDMA evolution to cdma2000 3GPP 3G

ARIB: selection of 3G technology for

Japan etc.

ITU-T: IMT-2000

3GPP: 3rd Generation Partnership Project is a co-operation

project between the standardisation bodies mentioned above.

7
The mobile radio environment

General description

Radio propagation mechanisms are strongly affected by the

wavelengths used, and the environment (natural or human-made).
Buildings are wave scatterers. The sizes of buildings are typically
many wavelengths of the used frequency, creating reflected waves at
that frequency. Typically, the antenna height of a mobile unit is much
lower than the average height of houses.

Given the conditions above, and the propagation frequency clearly

above 30 MHz, the environment forms a multipath propagation
medium. The base-to-mobile link is usually less than 25 km, so the
radio horizon need not be considered. Actually, earth's curvature
reduces interference from distant sources.

For large cell designs (radius 6.5 · · · 13 km) the height of the base
station antenna is usually 30 · · · 90 m. The height of a mobile unit
antenna is about 2 · · · 3 m.

The base station antenna is usually clear of its surroundings, whereas

the mobile-unit antenna is embedded in them.

Base station
antenna

8
From this description of the environment, we might imagine that the
mobile site will receive many reflected waves and (possibly) one
direct wave. We can assume that the reflected waves received at the
mobile site come from different angles equally distributed throughout
360°.

If the direct signal is strong compared to reflected signals, the

received signal level can be described with Rician statistical model. If
the direct signal is weak (or non-existent), the received signal level
can be described with Rayleigh statistical model.

Path loss and fading

In free space, signal attenuates 6 dB / octave (of distance). That is, if

the distance from the transmitter is doubled, the free space path loss
will be 6 dB more.

The signal strength r(x) or r(t) can be, for modelling purposes,
separated into two parts called long-term fading m(t) or m(x), and
short-term fading r0(t) or r0(x) as

r(t) = m(t)· r0(t)

or

r(x) = m(x)· r0(x)

The long term fading is the envelope of the fading signal, or local
mean.
x+L x+ L
1 1
2 L x∫− L 2 L x∫− L
mˆ ( x) = r (ξ ) d ξ = m(ξ ) r0 (ξ )dξ

9
When the length L is properly chosen, this becomes
x+ L
1
2 L x∫− L
mˆ ( x) = m( x) r0 (ξ )dξ

The long-term signal fading m(x) is mainly caused by terrain

configuration and the built environment between the base station and
the mobile unit.

Terrain configurations can be classified, for example, as

• Open area
• Flat terrain
• Hilly terrain
• Mountain area

and the human made environment as

• Rural area
• Suburban area
• Urban area

Short-term fading is mainly caused by multipath reflections of a

transmitted wave by local scatterers such as buildings or natural
obstacles.

10
Classification of channels

In a dispersive medium, there are two kinds of spread: Doppler

spread F and multipath spread δ. Doppler spread F is spreading in
frequency, and multipath spread δ is spreading in time. In a strict
sense, all media are dispersive. We can classify a medium's
characteristics based on the signal duration T and the signal
bandwidth W.

Nondispersive channels

A nondispersive but fading channel is created if

1 1
F << and δ <<
T W

In many practical systems, the values of T and W can be chosen so

that the channel can be considered nondispersive.

Time-dispersive channels
1 1
δ >> T and δ >> but F <<
W T

11
12
Frequency-dispersive channels

1
F >> W and F >>
T
but
1
δ <<
W

Guess what is doubly-dispersive channel.

13
Delay spread

The mean delay time Td of a channel can be calculated as

∞
Td = ∫ t ⋅ e(t ) dt
0

and the delay spread ∆ as

∞
∆ = ∫ t 2 ⋅ e(t )dt − Td2
2

where e(t) is the impulse response of the channel.

Typical values for the delay spread are:

Type of environment Delay spread ∆

In-building < 0.1 µs
Open area < 0.2 µs
Suburban area 0.5 µs
Urban area 3 µs

14
Prediction of propagation loss

As we saw earlier, the local mean (long-term fading) of the received

signal level can be obtained by averaging a suitable spatial length
over a piece of raw data.

The choice of suitable L is essential for obtaining a good estimate of

the local mean. In practice, L in the range 20λ· · · 40λ is acceptable.
36· · · 50 samples in an interval of 40 wavelengths is adequate for
obtaining the local means.

The measurements are usually recorded while the mobile units are
travelling along a road (street). The recorded signals from the mobile
paths have to be converted to radio path.

15
Models for path loss

Note: path loss model is only for path loss prediction and not for
multipath fading.

Assume that the characteristics of a rough earth surface are random in

nature and that the radius of curvature of the surface irregularities is
large compared to the wavelength of the incident wave. Then the
received signal can be represented by a scattered field Es which can
be approximated by combining the direct wave and the reflected
wave.

Es = (1 + avej∆ψ)E

The reflection coefficient is av and ∆ψ is the phase difference

between the direct and reflected wave. The phase difference can be
expressed as
2π
∆ψ = β ⋅ ∆d = ⋅ ∆d
λ

where β is the wave number and ∆d is the difference between the two
radio path lengths. E is the direct wave received at the mobile
antenna.

16
According to the free-space propagation path loss, the received power
from a direct wave is

2
 λ 
P0 r = Pt  
 4π d 

In the mobile radio environment, the incident angle is usually small,

and therefore, the reflection coefficient is approximately av= −1 and
∆ψ<<1. The received power of the scattered field becomes
2 2
 λ   λ 
Pr = Pt   1 − cos ∆ψ − j sin ∆ψ ≈ Pt   (∆ψ )2
2

 4π d   4π d 

For d >> h1+h2 we can approximate

4π h1h2
∆ψ ≈
λd
This gives
2
hh 
Pr ≈ Pt  1 22 
 d 

This is an imperfect formula since it does not involve wavelength. It

indicates two correct facts
• the equation shows a path loss of 40 dB/dec which has been
verified from the experimental data to be roughly true
• the equation shows a 6 dB/oct rule for an antenna height gain at
the base station, i.e. doubling the antenna height at the base gains
6 dB which also seems to be roughly true within certain limits
but there are two weak points, too
• the wavelength term is missing but the measured data show that
the path loss is a function of frequency
• the equation shows a 6 dB/oct rule also for an antenna height gain
at the mobile unit which is not true in practise

17
An area-to-area path loss prediction model

An area-to-area prediction is sometimes used to predict path loss over

a general flat terrain without knowing the particular terrain
configuration.

The area-to-area path loss prediction requires two parameters: (1) the
power at the reference (1-mile) point of interception Pr0 and (2) a
path loss slope γ. The field strength of the received signal Pr can be
expressed as
−γ −n
r  f 
Pr = Pr 0     α 0
 r0   f0 
or in dB
r  f 
Pr = Pr 0 − γ log   − n log   + α 0
 r0   f0 

where r is in miles or kilometers and r0 equals 1 mile or 1.6 km. γ is

expressed as γth power in the linear formula, and γ dB/dec in the dB
formula. α0 is an adjustment factor.

This is a general formula that can be used for different frequency

ranges above 30 MHz.

The assumed default conditions are:

frequency f0 = 900 MHz

base station antenna heigth = 30.48 m (100 ft)
base station power at the antenna = 10 watts
base station antenna gain = 6 dB above dipole gain
mobile unit antenna height = 3 m (10 ft)
mobile unit antenna gain = 0 dB above dipole gain

18
The adjustment factor is used for different conditions as follows:

α0 = α1α2α3α4α5 (or α0 = α1+α2+α3+α4+α5 in dB)

where
2
 new base station antenna height (m) 
α1 =  
 30.48m 
ν
 new mobile station antenna height (m) 
α2 =  
 3m 
new transmitt er power
α3 =
10W
new base station antenna gain with respect to λ/2 dipole
α4 =
4
α5 = antenna gain correction factor at the mobile unit

The parameters γ and Pr0 are found from empirical data:

Terrain Pr0 (mW) Pr0 (dBm) γ γ (dB/dec)
free space 10−4.5 −45 2 20
open area 10−4.9 −49 4.35 43.5
suburban 10−6.17 −61.7 3.84 38.4
Philadelphia 10 −7 −70 3.68 36.8
Newark 10−6.4 −64 4.31 43.1
Tokyo 10−8.4 −84 3.05 30.5

The values of n and v is also found from empirical data. In suburban

or open area with frequencies < 450 MHz n=20 dB/dec. In urban
areas with >450 MHz frequencies n=30 dB/dec is recommended.

2 for new mobile unit antenna height > 3m

ν =
1 for new mobile unit antenna height < 3m

19
The model of Okumura et al.
(From M. Hata, "Empirical Formula for Propagation Loss in Land Mobile Radio Services", IEEE Trans.
Vehicular Tech., VT-29, No. 3, August 1980.)

The standard formula for propagation loss is

Lp (dB) = 69.55 + 26.16 log fc − 13.82 log hb − a(hm)

+ (44.9 − 6.55 log hb) log R

where fc is the used frequency 150· · · 1500 MHz, hb is the base

station antenna height 30· · · 200 m, R is distance 1· · · 20 km, hm
is the mobile antenna height, and a(hm) is a correction factor for hm
given by

(1.1log f c − 0.7)hm − (1.56 log f c − 0.8) for medium - small city


a (hm ) =  8.29(log1.54hm ) 2 − 1.10 for large city, f c ≤ 400MHz
 3.2(log11.75hm ) 2 − 4.97 for large city, f c ≥ 400MHz


In suburban areas the loss is

Lps = Lp{urban area} − 2 (log (fc/28))2 − 5.4

and in open areas

Lpo = Lp{urban area} − 4.78 (log fc)2 + 18.33 log fc − 40.94

Street orientation channel effect

The signal strength received from a street in line with the base station
is about 10 dB higher than the signal from a street perpendicular to
the base. This phenomenon diminishes at about 8 km distance.

20
Note, that the previous description gave only examples of how radio
path loss is modelled in mobile communication systems. It is not a
complete list, and the exact numbers are not relevant for this course.

21
The GSM System

In the following text, we will concentrate mainly on the GSM

system.

Basic Architecture

The GSM system, as originally specified in 1991, has a

hierarcical architecture, typical for 2nd generation cellular
systems:

BTS

BSC TRAU
HLR
AC
EIR
BTS

MSC PSTN
OSS VLR ISDN

BTS SMSC
BSC TRAU VMS

BTS

BTS = base transceiver station

BSC = base station controller
TRAU = transcoder & rate adapter unit
MSC = mobile (services) switching centre
VLR = visitor location register
AC = authentication centre
HLR = home location register
OSS = operation sub-system including network management (NMS)
SMSC = short message service center
VMS = voice message system
EIR = equipment identity register

22
GSM Network Elements:

The Mobile Station (MS)

MS = ME + SIM

Mobile Equipment (ME): generic radio and processing

functions to access the network, human interface and/or
interface to other terminal equipment.

Subscriber Identity Module (SIM): a smart card containing all

the subscriber related information, confidentiality related
information.

Something to think about: What advantages follow from

making the ME and SIM separate entities?

The Base Station Subsystem (BSS)

BSS = BSC + BTS + TRAU

Base Station Controller (BSC) is in charge of the radio

interface management, allocation and release of radio
channels, handover management (up to some tens of BTS’s).

Base Transceiver Station (BTS): radio transmission and

reception from antennas to the radio interface specific signal
processing, handling 1 · · · 10 radio carriers at a time.

Transcoder & Rate Adapter Unit (TRAU): GSM-specific

speech encoding and decoding, bit rate adaptation.

23
The Network & Switching Subsystem (NSS)

NSS = MSC + VLR + HLR + AC + EIR

Mobile services Switching Center (MSC): performs the basic

switching function, coordinates the set-up of calls to and from
GSM users, manages communications between GSM and
other telecommunications networks.

Visitor Location Registers (VLR): database storing

temporarily subscription data for those subscribers currently
located in the service area of the corresponding MSC, holds
data of their current location area.

Home Location Register (HLR): database holding subscriber

information relevant to the provision of telecommunications
services, some information related to the current location of
the subscriber (mainly under which MSC/VLR the user can be
found).

Authentication Centre (AC): database maintaining security

related information of the subscriptions.

Equipment Identity Register (EIR): database maintaining

security related information of the mobile equipment (separate
from subscriptions).

24
The Operation Sub-System (OSS)

Operation Sub-System (OSS): (1) network operation enabling

the operator to observe system load, blocking rates,
handovers, etc. and providing means to modify network
configuration, (2) equipment maintenance aiming at detecting,
locating and correcting faults, (3) subscription management
for registering new subscriptions, modifying and removing
subscriptions, as well as billing information. Tasks (1) & (2)
are major part of the Network Management System (NMS).
Task (3) is more service management, not directly related to
network status.

Value Add Services

The services offered in the basic GSM network are similar to

those available in a sophisticated PSTN network. Mobility is
the main feature differentiating the basic GSM system from
fixed telephony systems. On top of this, the first services
adding value to the GSM network, have been Short Message
Services (SMS) and Voice Messaging System (VMS).
Especially, the success of SMS has been surprisingly good.

More value add services have been, and will be built as the
capabilities of the GSM network improve over time.
Intelligent Network (IN) features are added to the GSM
networks, in order to enable tailored services to different
customer groups, or individual subscribers.

25
Architecture Evolution

The GSM specification is evolving constantly. Some major

development lines are reviewed here, from architecture point
of view. The functionality of these new features will be
discussed more, later on.

Step 1: Higher data rates

The basic GSM offers circuit switched data transfer services

with rates up to 9.6 kbits/s which is not sufficient for many
services. Higher data rates are possible by changing channel
coding, and using several physical channels (time slots) for a
high rate connection. High Speed Circuit Switched Data
(HSCSD) is an implementation of this concept in GSM.
HSCSD will be discussed in more detail later.

For the GSM architecture, as presented on page 20, HSCSD

does not introduce any visible changes in the block diagram
(so let's not redraw it here). It does, however, require HW and
SW changes in most of the network elements shown in the
architecture block diagram.

BTS BSC/TRAU MSC

I
W PSTN
... ... F ISDN
PDN
HSCSD principle

26
Step 2: Packet data

Wired data networks have typically used packet data transfer.

In order to connect smoothly to these networks, and to use the
radio resource more efficiently, General Packet Radio Service
(GPRS) has been specified to GSM.

From architecture point of view, in addition to HW & SW

changes in the existing network elements, GPRS also
introduces new network elements called Serving GPRS
Support Node (SGSN) and Gateway GPRS Support Node
(GGSN).

BTS

BSC TRAU
HLR
AC
EIR
BTS

MSC PSTN
OSS VLR ISDN

BTS SMSC
BSC TRAU VMS

BTS IP
SGSN IP GGSN IP
networks

27
Step 3: Higher data rates (again)

When we want to go beyond HSCSD in data rates with

minimal changes in the frame structure and protocols, it is
necessary to change the modulation used in the physical layer
to represent the transmitted bit stream. In the GSM case, this
is done by packing 3 bits per symbol on the physical layer,
instead of 1 bit per symbol of basic GSM. This is called
Enhanced Data rates in GSM Environment (EDGE).

For the architecture presented on previous page, EDGE does

not introduce any visible changes in the block diagram (so
let's not redraw it here). It does, however, require HW and SW
changes in most of the basic network elements shown in the
architecture block diagram.

Step 4: Completely new radio interface

For the 3rd generation (3G) cellular networks, the core of the
network, at least in Europe and Japan, will be based on GSM.
The air interface, however, will be based on CDMA
technology which is completely different from basic and
enhanced GSM.

For controlling the CDMA radio network, similar network

elements are needed, as in GSM but different terminology is
used in order to draw distinction between 2G and 3G systems.
Instead of BTS, we have Base Station (BS), and instead of
BSC, we have Radio Network Controller (RNC), in the 3G
network. Of course, the detailed functionality of these
elements is also different from GSM.

28
 BTS

BSC TRAU
HLR
AC
EIR
BTS

MSC PSTN
VLR ISDN

BTS SMSC
BSC TRAU VMS
OSS

BTS IP
SGSN IP GGSN IP
networks

BS

RNC IWU

BS

The 2G and 3G radio interfaces will co-exist for a long period

of time. Also other radio interfaces, such as DECT or wireless
LANs, may utilise the same core network.

29
Step 5: All-IP

BTS

BSC TRAU
HLR
AC
EIR
BTS

MSC PSTN
VLR ISDN
IP NETWORK
BS
SMSC
RNC IWU
VMS

BS
IP
SGSN GGSN
networks

It is expected that eventually GSM, and 3G networks will

evolve into all-IP architecture. Majority of the traffic will use
packet transfer. IP will support mobility management, and
quality of service (QoS) features.

30
In the following, we will concentrate on the basic GSM
functionality, and will revisit HSCSD, GPRS, and EDGE later
on.

Architecture & GSM Functional Planes

Functionally, the GSM system can be divided into five planes:

Transmission: provides the means to carry user information

(speech or data) on all segments along the communication
path, and to carry signalling messages between entities.

Radio Resource Management (RR): establishes and releases

stable connections between mobile stations and an MSC, and
maintain them despite user movements. The RR functions are
mainly performed by the MS and the BSC.

31
Mobility Management (MM): functions are handled by the MS
(or SIM actually), the HLR/AuC, and the MSC/VLR. These
include also management of security functions.

Communication Management (CM): is setting up calls

between users, maintaining and releasing them. In addition to
call control, it includes supplementary services management,
and short message management.

Operation, Administration & Maintenance (OAM): enables

the operator to monitor and control the system.

The following figure tries to illustrate the relationship between

the network elements and functional domains:

GMSC = Gateway MSC, a switching centre which is able to find the

corresponding HLR based on the called number. GMSC and MSC/HLR may be
physically one unit.

32
Transmission inside GSM

On the network side, the GSM system is designed to be

compatible with ISDN where the transmission rates are
multiples of 64 kbit/s. On the air interface, however, the net
bit rate per channel is less than 16 kbit/s. For adapting the
different rates, the Transcoder / Rate Adaptor Unit (TRAU)
has been introduced. For speech, TRAU includes the speech
codecs.

TRAU belongs functionally to the BTS but its actual location

is not strictly specified.

Transmission of speech and data is next briefly described in

the
• radio interface
• BTS - TRAU interface
• interface between TRAU and point of interconnect with
other networks (IWF)

33
Speech on the radio interface

Speech processing for transmission over the air interface

includes the following functions:
• Speech coding
• Error protection (codec specific)
• Error detection (CRC)
• Bad Frame Handling (substitution)
• Voice Activity Detection / Discontinuous Transmission
(VAD/DTX)
• Manufacturer specific audio features
- noise cancelling
- spectrum equalization
- echo cancellation

For spectrum efficiency, as low bit rate as possible on the

radio path (but with acceptable quality, of course), is required.
Speech coding takes care of this.

In the first phase of GSM spec, a “full rate” speech channel

was defined, with provision of “half rate” in the second phase.
Why?

Today, the GSM standard includes the following codecs:

• Full rate (FR), 13 kbit/s RPE-LTP
• Half rate (HR), 5.65 kbit/s VSELP
• Enhanced full rate (EFR), 12.2 kbit/s ACELP
• Adaptive Multi Rate (AMR), ACELP
12.2, 10.2, 7.95, 7.4, 6.7, 5.9, 5.15, 4.75 kbit/s
• AMR wideband codec (under standardization)

34
As an example, we can take a brief look at the original full
rate codec. The full rate speech encoder, compressing 64
kbit/s −> 13 kbit/s, is a so called RPE-LTP (regular pulse
excitation - long term prediction) encoder.

Speech is encoded in blocks of 20 ms, that is 160 samples

having 8 bits each (in A-law representation) are encoded into
260 bits as illustrated in the figure below. Since this is not a
speech processing course, we will not go into details of the
speech codec.

Decoder basically the previous stuff in reverse order:

Up-sampling − LTP filter − LPC filter − de-emphasis filter

35
The transmitted parameters, after speech encoding, are NOT
equal in importance. Therefore, they are divided into 3 classes
of importance, each protected against transmission errors in a
different manner. This will be described later.

Discontinuous transmission

When the user is speaking, speech is encoded at the normal

rate 13 kbit/s (260 bits / 20 ms).

Otherwise a bit rate around 500 bit/s (260 bits / 480 ms) is
used which is sufficient to encode the background noise.

The background noise is regenerated to the listener. Why?

Discontinuous transmission (DTX) requires voice activity

detection (VAD).

What are the advantages of discontinuous transmission?

36
Speech on the BTS-TRAU interface

If TRAU is physically distant from BTS, the 13 kbit/s stream

is carried to the TRAU over standard digital links making use
of 16 kbit/s circuits.

The 20 ms frame synchronization cannot be derived from the

13 kbit/s flow. Therefore, some auxiliary information is
added. This also includes information for speech/data,
full/half rate and bad frame indication. Total 316 bits / 20 ms.

Speech on the TRAU-IWF interface

On a 64 kbit/s link, the standard G.711 speech transmission is

used with A-law coding.

37
Data in the basic GSM system

Several connection types are provided. Why?

Basic division is into “T” and “NT” modes.

In “T” (or transparent) mode, the error correction is entirely

done by a forward error correction (FEC) mechanism.
In “NT” (or non-transparent) mode, an additional scheme is
used where information is repeated when it has not been
correctly received by the other end.
The “T” mode connection types of the basic GSM are
summarized in the following table:

User rate Intermediate Channel type Residual

rate error rate
9600 bit/s 12 kbit/s full rate 0.3 %
4800 bit/s 6 kbit/s full rate 0.01 %
half rate 0.3 %
2400 bit/s 3.6 kbit/s full rate 0.001 %
or less half rate 0.01 %

(residual error rates for typical urban conditions with frequency hopping)

For “NT” mode, the Radio Link Protocol (RLP) is added

which is basically a link protocol of repetition-when-needed
type.

38
The following table summarises all basic GSM data
connection types:

Type QoS two-way delay

TCH/F9.6 T low 330 ms
TCH/F9.6 NT high > 330 ms
TCH/F4.8 T medium 330 ms
TCH/F2.4 T medium 200 ms
TCH/H4.8 T low 600 ms
TCH/H4.8 NT high > 600 ms
TCH/H2.4 T medium 600 ms

(don’t take the quality estimation too literally)

The “T” mode of transmission is derived from the ISDN

specifications (but we will not discuss these much in this
course).

In the “NT” approach, the transmission is considered as a

packet data flow (although the offered service, end-to-end, is a
circuit service).

39
The Radio Interface

The radio interface, in addition to the fact that the users move,
is the source of many difficult problems that need to be solved
in the GSM system (just as in any mobile communication
system).

The radio interface needs to be specified in very detail, in

order to achieve full compatibility mobile stations and
networks of different manufacturers.

Spectral efficiency of a cellular system is one of the key

economic factors.

The multiple access scheme used in GSM is a combination of

TDMA and FDMA. FDMA is mainly used to share spectrum
between neigboring cells. The basic time division is into 8
time slots but the actual time division scheme is more
complicated, as we will soon see.

Logical channels

The basic division between logical channels is:

Traffic channels / Control channels.

40
The main task of the communication system is to transport
user information. For the speech and different types of data
communications, the radio interface accommodates bi-
directional connections.

For these purposes, Traffic CHannels (TCH) are assigned to

the user. Full rate traffic channels may be denoted by TCH/F,
and half rate channels by TCH/H.

All the other logical channel types can be regarded as control

or signalling channels.

One exception to the previous statements is the transfer of

point-to-point short messages, which is implemented in a
similar way as signalling.

When a mobile station is connected to the network (whether or

not there is a user communication in progress), signalling
messages are exchanged between the mobile station and other
network elements.

For signalling in connection with a call, two possibilities are

offered:

Each assigned traffic channel comes with an associated low

rate signalling channel called Slow Associated Control
CHannel (SACCH). This bi-directional channel is capable of
carrying about 2 messages / second, with a transmission delay
of about 0,5 second.

41
The other alternative is (surprise!) Fast Associated Control
CHannel (FACCH) which is actually not a separate logical
channel but uses the traffic channel (TCH) by replacing a user
data frame with a signalling frame when necessary. A
signalling frame is marked with one bit called stealing flag.

Signalling connection is often necessary also when there is no

call in progress (supplementary services management, short
messages, location updating, etc.) For this purpose, a Stand-
alone Dedicated Control CHannel (SDCCH) is set up.

Sometimes, this is also referred to as TCH/8 since its

characteristics are very close to the traffic channel but it uses
only 1/8 of the capacity of a full rate traffic channel. TCH/8
also has an SACCH associated with it.

For spectrum efficiency, traffic channels are allocated to users

only when needed (in PSTN you always have the connection
to the network). Therefore, we can distinguish between
dedicated mode and idle mode of the mobile system.

A mobile station is in dedicated mode when it has a TCH

assigned to it.

In idle mode (but power on), the mobile station is far from
idle. It must continuously listen to one base station, and also
monitor up to 6 other base stations.

42
Before a mobile station can communicate with a base station,
it must become and stay synchronised with it. For this
purpose, two logical channels are broadcast from each base
station: the Frequency Correction CHannel (FCCH), and
the Synchronisation CHannel (SCH).

General information concerning each cell (identity, which

network it belongs to, which frequencies are used, etc.) is
broadcast regularly on the Broadcast Control CHannel
(BCCH).

After the mobile station has synchronised itself with the base,
it can access the network through the Random Access
CHannel (RACH).

Paging messages are sent on the Paging CHannel (PCH) and

messages indicating the allocated channel on Access Grant
CHannel (AGCH). Because these are similar and never used
simultaneously, they can be treated together as PAGCH.

Cell broadcast short messages are broadcast on the Cell

Broadcast CHannel (CBCH). This requires about 80 bytes
every 2 seconds.

The common channels FCCH, SCH, BCCH, PAGCH as well

as the CBCH are downlink (from base to mobile) only. The
RACH is uplink (from mobile to base) only. The other
channels, called dedicated channels (TCHs ans SACCHs),
are bi-directional.

43
The multiple access scheme

The radio interface of GSM uses a combination of Frequency

Division Multiple Access (FDMA) and Time Division
Multiple Access (TDMA) with slow frequency hopping.

The basic unit of transmission on the radio path is a sequence

of about 156 modulated bits called burst. They are sent in
time and frequency windows called slots.

The center frequencies of the slots are placed 200 kHz apart
within the frequency band reserved for GSM, and the duration
of one slot is 15/26 ms ≈ 0.577 ms. All slots in a cell are
aligned in time.

This is illustrated in the following figure.

44
The time axis is divided into 8 distinct slots, numbered
0· · · 7. The information of certain logical channels is
mapped to certain time slot number. For example, if the
shadowed burst in the previous figure belongs to certain
logical channel, the next time we can find information
belonging to the same logical channel is at least 8∗15/26 ms
later.

The frame structure is as follows:

• 8 consecutive time slots form a TDMA Frame.
• 26 or 51 TDMA Frames form a Multiframe.
• 51 or 26 Multiframes form a Superframe.
• 2048 Superframes form a Hyperframe.

The length of a hyperframe is 3 hours 28 minutes 53,76 sec.

At the base station, the transmitted and received bursts are

synchronized such that the received burst arrives 3∗15/26 ms
after the burst with the same time slot number is transmitted.

Transmission 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2
Reception 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7

So, this is the base station viewpoint. The figure looks similar
for a mobile station very close to the base station. The purpose
of this arrangement is to avoid simultaneous transmission and
reception in the mobile station.

For a mobile station several kilometers away from the base

station, the propagation delays have to be considered (30 km
distance => 200 µs round trip delay). This is compensated in

45
the mobile station by transmitting the bursts earlier. The
timing is adjusted with the timing advance parameter.
This timing arrangement also has an impact on the future
development of the GSM system. Think about, for example,
increasing the user data rates without changing the air
interface totally.

In the following description, each rectangle denotes one slot

with certain time slot number. The slots with other time slot
numbers are not shown. So, adjacent slots in the figures are
separated by 8∗15/26 ms. The following figures try to show
how different logical channels are grouped on respective time
sequences:

TCH/F + SACCH

T T T T T T T T T T T T S T T T T T T T T T T T T - ...
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 0

TCH/H + SACCH

T T T T T T T T T T T T S T T T T T T T T T T T T S ...
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 0

Here the slots denoted with bold and italic characters belong
to two different logical channels.

46
TCH/8 + SACCH (8 channels grouped)

T1 T1 T1 T1 T2 T2 T2 T2 T3 T3 T3 T3 T4 T4 T4 T4 T5 T5 T5 T5 T6 T6 T6 T6 T7 T7
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

T7 T7 T8 T8 T8 T8 S1 S1 S1 S1 S2 S2 S2 S2 S3 S3 S3 S3 S4 S4 S4 S4 - - -
26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50

T1 T1 T1 T1 T2 T2 T2 T2 T3 T3 T3 T3 T4 T4 T4 T4 T5 T5 T5 T5 T6 T6 T6 T6 T7
51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75

T7 T7 T7 T8 T8 T8 T8 S5 S5 S5 S5 S6 S6 S6 S6 S7 S7 S7 S7 S8 S8 S8 S8 T - - ...
76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 0

TCH/8 + SACCH (4 channels grouped, with common ch.)

T1 T1 T1 T1
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

T2 T2 T2 T2 T3 T3 T3 T3 T4 T4 T4 T4 S1 S1 S1 S1 S2 S2 S2 S2
26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50

T1 T1 T1
51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75

T1 T2 T2 T2 T2 T3 T3 T3 T3 T4 T4 T4 T4 S3 S3 S3 S3 S4 S4 S4 S4 ...
76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 0

47
The empty slots in the previous figure are used for common
channels.

FCCH + SCH

F S F S F S
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

F S F S
26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50

BCCH + PAGCH/3

B B B B P P P P P P P P P P P P
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50

OK, maybe it is not necessary to show all possible channel

combinations.

48
Some examples of possible cell configurations follow (here
TN = timeslot number).

A small capacity cell with a single transmitter/receiver:

TN0: FCCH, SCH, BCCH, PAGCH/3, RACH/H;
4x(TCH/8+SACCH)

TN1· · · 7: one TCH/F+SACCH each.

A medium capacity cell with 4 transmitters/receivers:

one TN0: FCCH, SCH, BCCH, PAGCH/F, RACH/F;

2x8x(TCH/8+SACCH)

29x(TCH/F+SACCH)

A large capacity cell with 12 transmitters/receivers:

one TN0: FCCH, SCH, BCCH, PAGCH/F, RACH/F

one TN2, TN4, and TN6: BCCH, PAGCH/F, RACH/F

5x8x(TCH/8+SACCH)

87x(TCH/F+SACCH)

49
The frequency band

The so called primary band of GSM includes two 25 Mhz

subbands.

Other bands:

Extension to 33 MHz with 882−890 MHz and 927−935 MHz

GSM1800 bands 1710−1785 MHz and 1805−1880 MHz

In the US GSM1900

The carriers spacing is 200 kHz

The border frequencies are usually not used, which limits the
number of frequencies to 122 in the 25 Mhz band. There may
be additional national limitations.

50
Frequency hopping

The radio interface of GSM uses slow frequency hopping.

Each burst is transmitted with one frequency, in GSM.

This provides at least two advantages:

Frequency diversity: Mobile radio transmission is subject to

severe multipath fading, but different frequencies fade
independently. For example, when a mobile is standing still or
moving very slowly, the signal may fade for several burst
periods, and the connection may be lost. If different frequency
is used for each burst, consecutive frames are probably not
lost, and the connection quality may be acceptable.

Interferer diversity: Cells using same frequencies interfere

each other less if their hopping sequences are independent.
Less interference means better re-use of the radio resource
(cells sharing the same resource may be closer to each other),
and thus, better spectrum efficiency.

51
Frequency hopping is not used on common channels (FCCH,
SCH, BCCH, PAGCH, RACH and CBCH). The downlink
common channels all use the same frequency. Also, signal on
the frequency of the common channels is transmitted
continuously, even if no information is to be transmitted,
because mobile stations in neighboring cells continuously
measure the signal level from the base stations. When there is
not information to be transmitted, dummy frames are used.

Hopping Sequences

With or without frequency hopping, always the uplink

frequency = downlink frequency + 45 MHz.

For a set of n frequencies 64 x n different hopping sequences

can be built, in GSM. They are described by two parameters,
the Mobile Allocation Index Offset (MAIO, n different
values), and Hopping Sequence Number (HSN, 64 different
values).

Two channels having the same HSN but different MAIO never
use the same frequency at the same time. On the other hand,
two channels having the same MAIO but different HSN
interfere with the probability 1/n.

The sequences are pseudo-random, except for the one with

HSN = 0 which uses the frequencies in increasing order.

Channels in one cell usually have the same HSN but different
MAIO. Adjacent cells use different set of frequencies. Distant
cells using the same frequency sets should use different HSN
to minimise interference.

52
From source data to radio waves

As an example, let us look at speech.

Speech Speech
ò ñ
Digitizing and Source decoding
source coding
ò ñ
Channel coding Channel decoding

ò ñ
Interleaving De-interleaving

ò ñ
Ciphering Deciphering

ò ñ
Burst formatting Burst decoding

ò ñ
Modulation
F Demodulation

Note that in the source (speech) codec, encoding is more

complicated than decoding. On the other hand, in the channel
codec, decoding is much more complicated than encoding.

Also, demodulation (including equalisation, synchronisation,

etc.) is computationally intensive.

53
The following blocks are common to all transmission modes.

• channel coding introduces redundancy into the data flow by

adding information calculated from the actual data, in order
to allow correction, or at least, detection of transmission
errors.
• interleaving mixes the bits of several code words such that
consecutive bits are spread over several bursts. This is done
because transmission errors often occur in bursts such that
many consecutive bits (sometimes hundreds) are lost, and on
the other hand, channel codecs perform better on
uncorrelated errors.
• ciphering modifies the contents of the burst by performing
an x-or -operation between a pseudo-random bit sequence
and 114 bits of a normal burst. De-ciphering is done exactly
the same way. The pseudo-random sequence is derived from
the burst number, and a session key with a simple but
confidential algorithm.
• burst formatting adds some tail bits at the ends, and a
training sequence in the middle of the burst, in order to help
synchronisation and equalisation of the received signal.
• modulation transforms the binary signal into an analog
waveform which is mixed into the selected frequency and
the selected timeslot.

The receiver end is more or less logically the reverse

operations in reverse order.

54
Channel coding provides protection against bit errors in the
transmission channel. Error correction is mainly done with the
convolutional codes, and block (parity) codes are for detecting
remaining errors. In common channels, a so called Fire code
is used which is capable of correcting errors occurring in
groups.

The following figure (next page) summarises basic GSM

channel coding schemes.

Some explanation to the figure:

In each box, the last line indicates the chapter of GSM spec. 05.03
defining the function. In the case of RACH, P0 = 8 and P1 = 18; in
the case of SCH, CSCH, CTSBCH-SB and CTSARCH, P0 = 25 and
P1 = 39. In the case of data TCHs, N0, N1 and n depend on the type
of data TCH.
Interfaces:
1) information bits (d);
2) information + parity + tail bits (u);
3) coded bits (c);
4) interleaved bits (e).

55
 TCH/EFS
(Enhanced full
rate speech TCH)
speech frame
244 bits
3.1

cyclic code
+ repetition
in: 244 bits
out: 260 bits
3.1.1 PRACH
interface PTCCH/U
0 SACCH, FACCH, RACH, PDTCH(1-4),
TCH/HS TCH/FS BCCH, CBCH, PCH SCH PBCCH, PAGCH,
(half rate (full rate AGCH, SDCCH CTSBCH-SB, PPCH, PNCH,
speech TCH) speech TCH) CTSAGCH, CTSPCH data TCHs CTSARCH PTCCH/D
speech frame speech frame message data frame message RLC block
112 bits 260 bits 184 bits N0 bits P0 bits Q0 bits
3.2 3.1 3.n.1 4.6, 4.7, 5.3.2 5.1.n.1
4.1.1
interface CS-1 others
1
cyclic code cyclic code Fire code +tail cyclic code cyclic code
+ tail + tail +tail in: N0 bits + tail + tail
in: 112 bits in: 260 bits in: 184 bits out: N1 bits in: P0 bits in: Q0 bits
out: 121 bits out: 267 bits out: 228 bits 3.n.2 out: P1 bits out: Q1 bits
3.2.1 3.1.1 4.1.2 4.6, 4.7, 5.3.2 5.1.n.2
interface others CS-4
2
convolutional convolutional convolutional convolutional convolutional convolutional
code code code code code code
k=7, 2 classes k=5, 2 classes k=5, rate 1/2 k=5, rate r k=5, rate r k=5, rate r
in: 121 bits in: 267 bits in: 228 bits in: N1 bits in: P1 in: Q1 bits
out: 228 bits out: 456 bits out: 456 bits out: 456 bits out: P2 bits out: 456 bits
3.2.2 3.1.2 4.1.3 3.n.3 4.6, 4.7, 5.3.2 5.1.n.3
interface
3
TCH/F2.4 others
reordering and partitioning reordering and partitioning reordering and partitioning
+stealing flag +stealing flag +code identifier
in: 228 bits in: 456 bits in: 456 bits
out: 4 blocks out: 8 blocks out: 8 blocks
3.2.3 3.1.3, 4.1.4, 4.3.4 4.1.4
others
TCH/FS, TCH/EFS
TCH/F2.4, FACCH diagonal interleaving
+ stealing flags
block diagonal block diagonal block rectangular in: 456 bits
interleaving interleaving interleaving out: 4 blocks
in: 4 blocks in: 8 blocks in: 8 blocks diagonally interleaved
out: pairs of out: pairs of out: pairs of to depth 19, starting
blocks blocks blocks on consecutive bursts
3.2.3 3.1.3, 4.3.4 4.1.4 3.n.4
interface
4
encryption unit

56
Bad frame substitution

In speech channels, an important matter affecting speech

quality is the bad frame substitution. After error correction,
even in good conditions, several % of the speech frames may
still be errorneous. In the method originally proposed in the
GSM specification, a lost frame is substituted by the previous
frame. If several speech frames are lost, they are substituted
by attenuated versions of the previous good frame. Each good
frame is reproduced with full amplitude regardless of the
condition of neighboring frames.

This kind of approach causes strange sound effects in poor

channel conditions. One can imagine a situation where the
system manages to get a correct speech frame through only
occasionally. The correct frame is reproduced with full
amplitude, and the missing frames after it are replaced by
attenuated versions of the previous correct frame. This can be
heard as some kind of ringing.

Later, this strategy has been improved, and audio signal

processing is developed to improve the sound quality in poor
channel conditions.

57
Bursts

Normal burst
Tail Information Training Information Tail
sequence
3 58 26 58 3

Access burst
Tail Training Information Tail
sequence
3 26 36 3

Synchronisation burst
Tail Information Training sequence Information Tail

3 39 64 39 3

Frequency correction burst

All zeros

148

Some notes:
• When modulated, the frequency correction burst produces
almost pure sine wave signal.
• Training sequences are pseudo-random sequences with
narrow autocorrelation function.
• Adjacent base stations use different training sequences.
• The mobile station has to switch off its transmitter between
bursts. Is this a problem?

58
Modulation

The modulation chosen in GSM is Gaussian Minimum Shift

Keying. This is a quadrature phase modulation scheme where
the phase φ (t ) of the signal E (t ) = cos(ω 0 t + φ (t )) is changed
according to the input data. One can think that the function
describing the phase change is a ramp filtered by a low-pass
filter whose impulse response is a gaussian pulse. The
filtering spreads the phase change over 3 bit periods. Later
when higher data rates (up to almost 400 kbits/s) are
introduced to GSM, 8-PSK modulation is adopted. This will
be described later.

In GMSK of GSM, the modulating symbol rate is 1/T =

1 625/6 ksymb/s (i.e. approximately 270.833 ksymb/s), which
corresponds to 1 625/6 kbit/s (i.e. 270.833 kbit/s).

Before the first bit of the bursts enters the modulator, the
modulator has an internal state as if a modulating bit stream
consisting of consecutive ones (di = 1) had entered the
differential encoder. Also after the last bit of the time slot, the
modulator has an internal state as if a modulating bit stream
consisting of consecutive ones (di = 1) had continued to enter
the differential encoder.

Each data value di is differentially encoded. The output of the

differential encoder is:
dˆ i = d i ⊕ d i −1 ( d i ∈ {0,1})

where ⊕ denotes modulo 2 addition.

59
The modulating data value αi input to the modulator is:

αi = 1 − 2d$i (αi ∈ {−1, + 1})

The modulating data values αi excite a linear filter with

impulse response defined by:

t
g (t ) = h(t ) * rect  
T

where the function rect(x) is defined by:

t 1 T
rect   = for t <
T T 2

t
rect   = 0 otherwise
T

and * means convolution. h(t) is defined by:

 − t2 
exp 2 2 
h(t ) =  2δ T 
(2π ) ⋅δT

ln(2)
where δ= and BT = 0.3
2πBT
where B is the 3 dB bandwidth of the filter with impulse
response h(t), and T is the duration of one input data bit.

60
The phase of the modulated signal is:
t '−iT
ϕ( t ') = ∑αiπh ∫ g(u)du
i −∞

where the modulating index h is 1/2 (maximum phase change

in radians is π/2 per data interval).

The time reference t' = 0 is the start of the active part of the
burst. This is also the start of the bit period of bit number 0
(the first tail bit).

The modulated RF carrier, except for start and stop of the

TDMA burst may therefore be expressed as:

2 Ec
x(t ' ) = ⋅ cos(2π f 0 t '+ϕ (t ' ) + ϕ 0 )
T
where Ec is the energy per modulating bit, f0 is the centre
frequency and ϕ0 is a random phase and is constant during one
burst.

61
The average spectrum of the GMSK modulated signal is
relatively narrow band but 100 kHz away from the center
frequency the spectrum has dropped only about 10 dB.

Is this a problem?

62
Principles of Signalling

Many functions performed by such a complex network as

GSM are distributed over several distant machines, and
information exchange (signalling) is needed to coordinate
these functions.

Signalling is required between:

• MS and BTS
• BTS and BSC
• BSC and MSC
• MSC and point of entry to external network
• NSS entities (MSC/VLR, GMSC, HLR/AuC, EIR)
• OSS and NSS entities + BSC

Signalling information is organised into messages.

Linking

The link protocols in GSM have very similar functionality but

they are not the same for all interfaces. The main protocols are
summarised in the following table:

Interface Link protocol Comment

MS - BTS LAPDm GSM specific
BTS - BSC LAPD from ISDN
BSC - MSC MTP, level 2 ITU-T SS7
MSC/VLR/HLR protocol

63
Signalling messages are sent over 64 kbit/s circuits, except for
the radio interface.

On the radio interface, SACCH and FACCH are used, as

described earlier.

The signalling message information on the link layer is

structured into frames.

LAPD and MTP-2 have the frame structure of HDLC which is

briefly described here.

HDLC frames start and end with an 8-bit flag pattern

0 1 1 1 1 1 1 0 · · · fram 0 1 1 1 1 1 1 0
e· · ·

In the actual data, after each sequence of 5 consecutive “1”s,

an extra “0” has to be inserted (irrespective of what is the
following bit) in order to avoid flag patterns inside the data.
At the receiving end, the extra zeros have to be removed.
There are, for example, commercial chips to do this
automatically.

One flag can be used to indicate both the end of one frame and
the start of the next one. With the flag mechanism, the frame
contents may be of variable length, without frame length
indication. There is, however, a maximum length (272 octets)
defined in the SS/ protocols which is sufficient to cover most
signalling needs.

64
In LAPDm (radio interface), the use of flags is not necessary.
Why?

A LAPDm frame has a maximum length of 21 (SACCH) or

23 (TCH) octets. The missing two octets on SACCH are used
for timing advance and power control information. Upper
layer messages have to be segmented to these fixed lengths.

A “more” bit enables the receiver to reconstruct the original

message. A length indication is included in every frame, and
unused frames are filled with special fill bytes.

65
For error detection, both LAPD and MTP-2 use the HDLC
scheme of adding 16 redundancy bits to each frame. The
generator polynomial, in this case (using the same notation as
earlier), is

g(D) = D16+D12+D5+1

LAPDm uses the error correction and detection mentioned in

the radio interface chapter.

Error detection serves two purposes. If errors are detected,

repetition of the frame can be asked for.

The second purpose is to monitor the link quality. The link is

declared out of order when the error rate exceeds some given
treshold (e.g. frame error rate > 4∗10−3). Filling frames are
transmitted if nothing else needs to be transmitted, in order to
make error counting reliable.

Concerning error correction, there are two modes in all three

protocols:
• non-acknowledged mode, in which frames are transmitted
only once regardless of the error detection status.
• acknowledged mode, in which errorneous frames are
repeated.

Why, or in what kind of situation, would one want to use non-

acknowledged mode if acknowledged mode is available?
Think about it before turning page.

66
An example of messages where non-acknowledged mode is
more appropriate than acknowledged, are the measurement
messages sent by the mobile station. It is better for the base
station to get a new up-to-date report rather than a repeated
old report, in case a report is lost.

Acknowledgement and repetition is based on cyclic frame

numbering.

In LAPD and LAPDm, acknowledgement os done by the

receiver transmitting the number of the next expected frame to
the sender.

In MTP-2, correctly received frames are acknowledged by

sending back the number of the latest correctly received
frame.

In LAPD, a window mechanism is used where the window

size defines how many frames can be sent but not yet
acknowledged.

There is a maximum for the number of repetitions.

The acknowledged mode transmission must be set up with a

simple handshaking procedure.

The link layer offers the possibility of multiplexing

independent flows on the same channel. For example, on the
radio interface, signalling and short messages are transmitted
on the same channel. The two flows are distinguished with a
link identifier (SAPI).

67
However, short messages are not transmitted on the FACCH
which makes the short message transmission rather slow,
roughly 80 bytes or 600 bits per second. Upper layers reduce
this rate further.

RLP is another HDLC-like protocol which concerns the

transfer of user data (not signalling info).

Networking

The link protocols enable the exchange of frames between two

entities directly interconnected through some physical
medium. There are, however, functions which involve entities
not directly interconnected, such as MS <−> MSC.

Routing is an essential function of networking. This can be

done with either datagrams or virtual circuits. Both are used in
GSM. Another issue in networking is the possibility to have
several independent connections in parallel between entities.

From the mobile station point of view, both of the previous

issues are handled by the Protocol Discriminator (PD). It
gives the functional partition of the messages, but because of
the GSM architecture, this partition also corresponds to an
entity on the network side (see table on next page).

68
 PD function origin/destination
CC call control management MS <−> MSC
SS suppl. services management (and HLR)
MM location management MS <−> MSC/VLR
security management
RR radio resource management MS <−> BSC

On the interfaces between BSC & MSC, and between MSC’s,

the protocols above the link layer are MTP-3, SCCP, TCAP,
and MAP. We will not go into the details of these here. The
following figure tries to give an overall view.

M B B M M
S T S S S
S C C C
| | | | MAP/E |
| | | distribution | TCAP |
| | | SCCP | SCCP |
| | | MTP-3 | MTP-3 |
| | LAPD | MTP-2 | MTP-2 |
| LAPDm | 64 kbit/s | MTP-1 | MTP-1 |
radio Abis A E interface
interface interface interface

Examples of signalling procedures follow.

69
Initial assignment:

Mobile originating call establishment:

70
Networking in the NSS

In all cases in the NSS, the SS7 signalling network standards

(ITU-T) are used.
Two levels of networking:
• National networking is based on MTP3 (message transfer part, level
3 ).
• Interconnection of national networks is based on SCCP
(signalling connection control part).

Also, two levels of addressing:

• MTP address, Signalling Point Code (SPC)
• Global title on top of SPC

The global title may be a PSTN number, data number, or

GSM IMSI. The MTP address in the national network is
derived from this. The following figure tries to illustrate this.

In the previous figure, A derives the SPC for GA from the

global title, GA derives the SPC for GB, and GB derives the
SPC for B.

71
Radio Resource Management
In contrast to fixed telecommunication network, in mobile
communication network the access resources are allocated to
the user only on demand and for the duration of the call.
Another cellular system specific feature is the fact that the
connection is maintained despite the movements of the user.
These are the main functions of radio resource management.
Most of the functions in the RR plane relate to the
management of transmission between MS and anchor MSC.
(Anchor MSC is the single MSC that takes care of the
management functions during the whole call. If the MS moves
to another MSC area during the call, some of the duties are
shared between this relay MSC and the anchor MSC.)

72
Access

The MS accesses the network by sending a message on the

random access channel (RACH).

The network answers by sending and initial assignment

message on the paging and access grant channel (PAGCH).
This contains the description of the allocated channel.

Access on the RACH is not regulated. Two MS’s may send

access requests simultaneously. Most of the complexity of the
access procedure comes from fixing this problem.

Paging and discontinuous reception

When an incoming call (from the MS point of view) arrives,

the MSC/VLR requests the BSS to perform paging in some of
the cells of the BSS. The BSC is in charge of managing the
PAGCH.

For the sake of power consumption, the downlink common

control channel can be divided into several paging sub-
channels. The MS listens only to one sub-channel, and sleeps
otherwise. The subscribers are assigned to paging sub-
channels based on the last digits of their international mobile
subscriber identity (IMSI).

73
Transmission mode management

Transmission modes

TCH/8 TCH/F TCH/H

signalling only signalling only signalling only
speech speech
data 3.6 kbit/s data 3.6 kbit/s
data 6 kbit/s data 6 kbit/s T
data 12 kbit/s T data 6 kbit/s NT
data 12 kbit/s NT

The transmission mode is chosen by the MSC, depending on

the end-to-end service. The BSC is in charge of choosing the
channel, and coordinating the different machines, including
the MS.

The connection is always started as “signalling only”.

74
Cipher mode management

The connection is always started in non-ciphered mode

because ciphering requires a user specific key and the network
has to know the identity of the subscriber before it can be
used.

As in transmission mode management, the MSC makes the

decision (upon request from the subscriber) about the
transition to ciphered mode. The MSC has to provide the
ciphering parameters to all network elements concerned.

Discontinuous transmission

During speech connection, the user data does not always

contain meaningful information (speech silences).
Discontinuous transmission may be used to minimise
transmission on the radio path, in this case.

Discontinuous transmission may be applied independently to

each direction. Again, the decision comes from the MSC.

75
Handover preparation

Handover may be necessary (or of benefit) for at least three

reasons:
• when the MS leaves the radio coverage area of the cell in
charge (“rescue handover”),
• the overall interference level would be lower if the MS
would be in contact to another cell (“confinement
handover”), or
• the cell in charge becomes congested but some of the nearby
cells are not (“traffic handover”).

Depending on the purpose of the handover, the criteria for

making the decision about handover may differ.

The main criterion for rescue handover is the quality of

transmission in the current connection. This is indicated by
error rate, received signal level, and propagation delay.

For confinement handover, the uplink and downlink

transmission quality should be known for neighboring cells in
case the MS would be in connection with that cell. In practise,
only downlink signal levels are measured.

The decision process for traffic handover requires information

on the load of each BTS, known by the MSC’s and BSC’s.

The algorithms for the handover decision are not defined in

the GSM specifications.

76
Measurements

In order to make efficient handovers, measurements should be

done as often as possible. The minimum rate of reporting, in
GSM, is once per second.

The mobile station must report measurements for the serving

cell, and up to 6 neighbour cells.
The reports are carried on the SACCH which is capable of
carrying about 260 bit/s, which is enough for reporting twice
per second when the SACCH is not used for other purposes in
parallel.

Because of the TDMA scheme, the MS has a chance to

measure the neighbour cells during the interval between
uplink transmission and downlink reception.

Each BTS has to transmit continuously, in every burst period,

on one frequency, at constant power level.

A list of frequencies to be measured is sent to the mobile

stations.

Each base station has a “color code” included in its

transmission. This is included in the measurement report in
order to specify which cell was actually measured (the MS
may be able to hear several cells using the same beacon
frequency.

In GSM, the mobile station acquires synchronisation with all

cells on which it reports measurements. That is, in addition to
FCCH, also SCH is decoded.

77
Power control

The advantages of power control are (at least) reduced power

consumption in the terminal equipment which leads to longer
battery life, and reduced interference to other users of the
network.

In GSM, both uplink and downlink power control may be

applied independently.

The range for uplink power control depends on the MS power

class, but anyway, it is between 20 and 30 dB, with steps of 2
dB. For example, for a class 2 GSM mobile station, the
possible transmitter power levels are 13, 15, 17, · · · , 39
dBm (20 mW · · · 8W).

The mobile station power classes are summarised here.

Class GSM900 DCS1800
1 20W 1W
2 8W 0.25W
3 5W -
4 2W -
5 0.8W -

The transmission power is adjusted in steps of 2 dB (not

more), and not more often than 60 ms. So, if an MS is
commanded to change it power level 10 dB, it will be adjusted
in 5 steps.

The initial power level used in access, is fixed for each cell.
This level is broadcast on the BCCH.

78
Timing advance

The transmission and reception of bursts at the base station

must be synchronized, as described earlier. Therefore, the MS
must compensate for the propagation delays by advancing its
transmission 0 · · · 233 µs which is enough to handle cells
of radius up to 35 km.

The access burst is short because the timing advance is not

known before access.

79
Radio channel management

The channel configuration of a cell is the list of channels

defined to be used in the cell. The channel configuration may
change in time.

Access Channels

The capacity requirement for access channels (RACH,

PAGCH) varies depending on traffic load. There are five
possible access channel capacities:
CCCH number of RACH PAGCH
capacity MS groups burst rate message rate
(TACH equiv.) (bursts / sec.) (messages / sec.)
½ 1 114.7 12.7
1 1 216.7 38.2
2 2 433.4 76.5
3 3 650.0 114.7
4 4 866.7 152.9

The access channel configuration is broadcast in the BCCH

messages. The MS transmits access rerquests and listens to
PAGCH corresponding to its own group only.

Traffic Channels

TACH/F can be exchanged to 8 TACH/8’s (and vice versa).

80
Dedicated channel allocation

Dedicated channels, as seen from the network side, are either

allocated to a mobile station, or in a pool of idle channels. The
choice of the allocated channel is the responsibility of the
BSC.

Channels need to be allocated at:

• initial channel assignment (e.g. call setup or location
update)
• subsequent assignment (e.g. change from TCH/8 to TCH/F)
• handover

The aim of channel management is to maximise the total

traffic which can be served with the given resources. For
example, for setting up a call, a TCH/F will be required
(eventually) but a TCH/8 would be sufficient until the actual
conversation begins. Different strategies can be used here
ranging from allocation of TCH/F at initial assignment to
allocation of TCH/F only after the called party has answered.

81
The radio resource management procedures are described here
briefly:

Access and Initial Assignment

MS F channel request F BTS

(on RACH)

MS E immediate assignment E BTS

(on PAGCH)

MS F “initial message” F BTS

E (on TACH) E

Reasons:
• location updating
• answer to paging
• user’s request (e.g. outgoing call)

MS will repeat unanswered request after a random interval.

This is controlled by two broadcast parameters: average time
between repetitions, and maximum number of
retransmissions. In severe overload situations, user’s may be
randomly blocked.

Only after the initial message, the network knows the identity
of the MS. The MS classmark is sent here including MS
revision level, RF power capability, encryption algorithm,
frequency capability, short message capability.

82
Paging

The paging procedure is very straightforward. The MSC sends

a paging message to the BSC’s of the location area, the BSC’s
send a paging command to the BTS’s concerned, and BTS
sends paging messages on PAGCH.

For simplicity, the rest of the RR management procedures are

only listed here:

Transmission mode (change) management

Cipher mode management
Discontinuous transmission mode management
Handover execution
Call re-establishment
RR-session release
Load management
SACCH procedures
-radio transmission control
(power&timing, downlink)
(measurements, uplink)
-general information
Frequency redefinition
General information broadcasting (BCCH)
-cell selection information
-information for idle mode functions
-information needed for access
-cell identity

83
Mobility & Security Management

Mobility allowed for the subscribers and its automatic

management is a fundamental service in a cellular network. It
is also the source of many problems to be solved.

Location management

GSM has been designed to enable international coverage. The

services the user can access when she moves are determined
by her subscription, and coverage limitations.

The international GSM network is divided into PLMN’s

(Public Land Mobile Network) each limited in coverage
within the borders of one country. Countries may have more
than one PLMN’s whose coverage areas overlap −>
competition.

In order to allow roaming (moving from one PLMN area to

another), the PLMN’s must communicate with each other.

A GSM user has a subscription relationship with a single

PLMN which we can call the home PLMN.

GSM phase 1 specifications treat all PLMN’s other than the

home PLMN on the same basis for selection. Access to them
may be allowed or not depending on other conditions (such as
agreements between operators).

Access to PLMN’s of other countries is possible if the

subscription allows it. The GSM specification also allows
national roaming but this is not commonly implemented.

84
Mainly for paging purposes, the PLMN area is divided into
location areas. Each location area is managed by one
MSC/VLR.

In order to obtain normal service, the subscriber must be

registered in the location area of the cell. The registration state
is changed in a location update procedure which is initiated by
the MS. The identity of the last location area is stored on the
SIM (even if the MS is switched off).

PLMN selection

If the serving PLMN can no longer provide normal service,

the MS will search for the whole spectrum to find which
PLMN’s cover the location.

The selection of PLMN may be manual or automatic. At

switch-on, the home PLMN is searched first. In manual mode,
a list of found PLMN’s is displayed, and the user chooses one
from the list. In automatic mode, the MS will make the

85
selection automatically based on a list of preferred PLMN’s
stored on the SIM.

Cell selection

The selection of the serving cell is mainly based on

transmission quality which is measured as the signal level
received by the MS. The criterion that is (or may be) used in
cell selection can be described as follows.

C1 = A − max(B,0) (all values in dB)

where
A = (average received level) − p1
and
B = p2 - (MS maximum RF power)

The parameter p1 is the minimum of the received level with

which the cell can be accessed. This may be in the range −110
· · · −48 dBm. The parameter p2 is the maximum tx power
allowed for an MS in the cell. These parameters are broadcast
by the cell.

In cell selection, only cells with positive C1 are considered.

The candidate cells are ordered according to C1.

86
The criterion C1 determines two things:
• the coverage limit of each individual cell (note: this may be
different for different MS’s)
• the boundary between two adjacent cells (see figure)

These borders are not fixed but change over time depending
on weather, traffic conditions etc. Near the border between
cells, the MS might have to change back and forth between the
two cells if the decision is strictly based on which one has
better C1. This is prevented with another broadcast parameter
called cell reselect hysteresis. In the new candidate cell, C1
must be c.r.h. higher than the C1 of the serving cell before
changing to the new cell. In this case, the borderline where
handover occurs depends on the direction of movement
(figure).

87
So, when the level received from another cell becomes
considerably higher than the level of the serving cell, the MS
will start listening to the new cell. If the new cell is in another
location area, the MS initiates a location update procedure. If
there is a call in progress, handover is executed.

Location management architecture

The HLR is basically an intelligent database used to store

some location information, and subscription related
information.

The VLR is a database where subscriber information is

temporarily stored for those subscribers currently registered in
the MSC area.

Location update procedures

Location update is done, naturally, when the MS moves from

one location area to another, but also periodically. The period
may vary from 6 minutes to 24 hours. The MS initiates the
location update procedure (see figure).

88
If HLR needs to be contacted, the new MSC needs to know
the identity of the subscriber in order to know which HLR to
contact. Subscribers are identified by IMSI (International
Mobile Subscriber Identity) which is as follows

Mobile Mobile Mobile Subscriber Identification Number

Country Code Network
(3 digits) Code (2) (max. 10 digits)

On the air interface, an alias called TMSI (Temporary Mobile

Subscriber Identity) is used whenever possible.

IMSI attach and detach procedures

In order to avoid unsuccesful trials to route calls to an MS

which is swithed off, IMSI attach and IMSI detach
mechanism has been introduced. These are very similar
procedures to location update but usually HLR is not
concerned.

When the MS is switched off, IMSI detach procedure will

inform the corresponding MSC/VLR that it is no use trying to
route calls to this user now.

If the power is switched on while the MS is in the same

location area, an IMSI attach procedure is executed.
Otherwise, location update will be done.

89
Security management

In wireless communication, generally, the security issues are

especially important. Radio transmissions are easy to listen,
and unregistered use of the network may cause severe
economical losses.

The security functions of GSM serve two goals:

• protect the network against unauthorised access
• protect the privacy of the user

The first goal is achieved by authentication. The second goal

is achieved by ciphering the user traffic and signalling, as well
as using a temporary identity on the air interface.

Authentication is started by sending a random number to the

MS. The MS (or actually the SIM) calculates a response using
the random number and a secret key stored on the SIM using a
confidential algorithm. If the response matches the value
calculated on the network side, the authentication is OK. The
algorithm may be operator dependent.

Ciphering is done by generating a ciphering sequence based

on the current frame number and another secret key. The
transmitted data is then x-or’ed with the ciphering sequence.
At the receiving end, the same operation is repeated which
deciphers the data.

The encryption keys are also generated locally in a similar

way as the authentication response is calculated.

90
Communication Management

GSM is basically an access network for general

telecommunication systems, such as PSTN or ISDN.

The communication management procedures of GSM are

simplified and somewhat adapted copies of those specified for
ISDN.

Management functions

• Attributes of communication: directory number of the called

party, forwarding conditions, etc.

• Setting up the transmission path: MSC analyses the called

number and requested service in order to choose the external
network where the call will be routed.

• Routing of mobile terminated calls: some explanation

follows shortly.

• Management of alternate services: alternate speech and data,

multiple calls, etc.

• Transmission of DTMF tones

• Release of the call

• Supplementary services: call forwarding, barring, etc.

• Short message communication

91
Routing of a mobile terminating call is started by first asking
the necessary information from the HLR of the called party.
The HLR, where the query should be addressed, can be
determined from the first digits of the called number.

country national
code destination subscriber number
code

e.g.

+44 385 (UK Vodafone GSM number)

+358 50 (Radiolinja GSM number)

The first digits of the subscriber number identify the HLR of

the user. Note that the subscriber number, and IMSI are two
different numbers.

The HLR record contains sufficient information for finding

the MSC where the user is currently visiting.

Who pays what in mobile terminating calls?

The total cost of a call depends (obviously) on the location of

the GSM subscriber (long distance / local). Also, probably the
calling party would like to know in advance how much he will
be charged. Furhermore, it is assumed that GSM subscribers
do not want their location to be known.

92
Therefore, the charge to the calling party is independent of the
actual location of the called party. The called party will pay
for the rest of the expenses. Examples follow:

situation charging
call within one country the calling party pays for
from PSTN to home PLMN the call to PSTN operator,
PSTN operator may
compensate to PLMN
operator (if agreed)
call to a GSM phone whose the calling party pays the
home PLMN is in the same same as above, the called
country but the user is party will pay for the
roaming in another PLMN international part to the
home PLMN operator
call to a GSM phone whose the calling party pays for
home PLMN is in another an international mobile call
country, and the GSM user to the home PLMN
is roaming in a third country, the called party
country pays the same way as
above

Note that the GSM user gets her bills only from her home
PLMN operator. The different operators involved will deal
with the compensations between themselves.

Communication management procedures are (in normal

conditions) rather straightforward message exchanges. An
example of a mobile originated call establishment was
presented earlier (page 67).

93
Short messages

For a short message communication, a virtual circuit is not

established but the messages are delivered similarly to
signalling messages.

A short message communication is limited to one message

(but of course, applications using short messages may
combine several messages).

The transmission of a message is relayed by a Short Message

Service Centre (SM-SC).

94
Network Management

Because of the complexity of modern telecommunication

networks, and because of the need for cost-effectiveness, it is
impossible to maintain and run the network without an
independent computer network dedicated for this purpose.

The general tasks of network management are:

• service & subscriber management

• mobile station management

• maintenance

• system engineering and operation.

These will be briefly described here.

95
Service & subscriber management

This task involves the subscription administration, as well as

billing and accounting.

Access to the GSM services is possible only for subscribers

known by the network. From the network point of view, the
subscription is materialized in the SIM, and the corresponding
entries in HLR and the authentication centre (AuC).

Naturally, means are needed to create, upgrade, and delete

subscription data.

A commercial structure which is becoming more and more

common is the concept of service providers.

Network operator

HLR info é
ê charge info

Service provider subscription é

ê billing
subscription é
ê billing

J J
96
As mentioned earlier, the subscriber receives a single bill
from the operator or service provider with which the customer
hold her subscription. The services used in other networks are
paid by the operator of the home PLMN of the user, and
naturally, the home PLMN operator will charge the user.

Home ç charge info Visited

PLMN +invoice PLMN
HLR info é
ê charge info é

Service provider
(if any) ê
subscription é access to service
ê billing

J
Maintenance

Maintenance includes the techniques aiming at minimising the

loss of service quality when a failure occurs, as well as
measures to minimise failure occurrences.

There are, naturally, numerous sources of failure. Even though

electronic components are very reliable, there are tens of

97
thousands of them in a network, and some more or less serious
failures will probably occur daily.

In principle, all network elements and events should be

monitored for possible failures. Regular and automatic testing
should also be performed. The users are a valuable source of
information, as well.

To minimise the loss of service quality, it is useful to be able

to do some “first aid” repair automatically, or at least
remotely. For example, a faulty base station can be barred,
and the neighboring base stations reconfigured for the actual
repair to take place.

Mobile station management

All mobile stations must be type approved. When type

approved, the mobile station receives a Type Approval Code
(TAC) which is part of the International Mobile Equipment
Identity (IMEI) number.

TAC FAC serial number reserved

FAC = final assembly code to identify the final assembly

plant. Serial numbers are allocated to the manufacturers.
Operators are notified of the valid IMEIs they can expect on
their network.

The network may ask for the IMEI of a mobile station, for
example, if it detects a problem which may be caused by the
mobile station.

98
Lists of IMEIs are stored in the Equipment Identity Register
(EIR). The information stored in the EIR can be operator
dependent. However, for example, the control of stolen mobile
stations is effective only when operators have common IMEI
checking policy.

The GSM operators use three levels (or lists) for the status of
IMEI’s:

• The white list includes the ranges of IMEI’s allocated to

type approved mobile equipment.

• The black list includes mobile equipment that need to be

barred because they are stolen, or because of severe
malfunctions.

• The grey list includes the IMEI’s of suspicious cases.

System engineering

A network in operation is composed of actual machines. The

operator must choose how many of each machine to order,
with which capacity, where to install them, etc.

Also, the traffic does not remain constant. Installing from the
start a large enough capacity for long term traffic is not cost
effective. Therefore, the system engineering needs to be
refined while in operation.

The goal of cellular planning is to choose the cell sites and

cell parameters (frequency allocation, capacity, power, etc.) in

99
order to provide economically continuous coverage, and
support the required traffic density.

Cellular planning is a cost optimisation problem with some

constraints, such as:

• range: The transmitted power is limited to 20W in vehicle-

mounted, and 2W in handheld GSM phones. The
propagation loss of the signal is a complicated process but
usually the received average signal level is modelled to be
proportional to d−α where d is the distance and α is a
constant in the range 3 < α < 4 depending on the
environment. Because of multipath propagation, the actual
signal level varies a lot around this average.

• interference: In cellular systems, the main sources of

interference to a particular user are the other users of the
same system. In addition to range, interference is another
factor affecting the cell size, especially in dense traffic
areas.

In addition to these factors, cost efficiency is affected by:

• handover criteria
• power control
• discontinuous transmission
• frequency hopping

In addition to cellular planning, the designer has to deside the

cell capacity in terms of number of traffic, control and access
channels.

100
The following table summarises the parameters which system
engineering must manage to optimise the network
configuration for a given quality of service to an expected
number of users.

Area Parameters
frequencies
Cell planning beacon frequencies
hopping sequences
power control parameters
handover parameters
cell selection parameters
BSIC
# of common channels
Dimensioning # of traffic channels
location areas
periodic location updating
Load control overload control
parameters

101
Network operation

This is the major task of network management. CCITT (or

ITU-T) has developed a Telecommunication Management
Network (TMN) concept which aims at providing basis for
integrated management networks.

TMN distinquishes three main categories of functions:

• The operation system functions, which are the management

applications running on the operating staffs’ workstations.
• The mediation functions are introduced for concentration
purposes, and for adaptation of the generic operation system
functions to specific machines.
• The data communication functions, which are the
transmission means used to link the operation system
functions, the mediation functions, the traffic handling
equipment, and the workstations. These can be point-to-
point lines, or X.25 or SS7 network.

The GSM specifications include a basis for so called Q3

protocol, which is a protocol for network management
between operation system functions and mediation functions.
Most of the other protocols are left for the operators (or
manufacturers) to specify.

102
Evolution of the GSM System

After the introduction of basic GSM specification and service,

numerous new features and capabilities have been specified.
The GSM system specification has been developed in phases,
and the work is still going on. In the following, we will study
the main new features specified since the basic GSM
introduction.

High Speed Circuit Switched Data

A straightforward way, in principle, to increase the data rate

in GSM data transmission is to use several time slots out of
each TDMA frame for one data connection. However, from
terminal design (and cost) point of view, the matter is not so
straightforward. A major part of the cost and manufacturing
problems comes from the RF and IF parts of the terminal.
With the existing specification (one slot per connection), the
MS does not have to transmit and receive at the same time
which simplifies the design.

MS RX 0 1 2 3 4 5 6 7 0 1

MS TX 5 6 7 0 1 2 3 4 5 6

Monitor

Now, if in the previous figure, there is enough time between

the TX/RX activities (shaded areas), the terminal can be
implemented using one frequency synthesizer (it takes some
time for the synthesizer to change from one frequency to
another).

103
If two time slots per TDMA frame is used for one connection,
which doubles the data rate, the timing is as follows.

MS RX 0 1 2 3 4 5 6 7 0 1

MS TX 5 6 7 0 1 2 3 4 5 6

Monitor

In this case, the TX/RX activity periods are not overlapping

but more efficient technology is needed to implement this with
a single synthesizer. This makes the terminal more
complicated and expensive. Also, power consumption is
higher.

If more time slots are used in order to obtain higher data rate,
the TX/RX activity periods necessarily overlap, and more
frequency synthesizers (2 or 3) are needed for the
implementation.

MS RX 0 1 2 3 4 5 6 7 0 1

MS TX 5 6 7 0 1 2 3 4 5 6

Monitor

3 slots: 4th slot: 5th slot:

The previous figure shows 3, 4, and 5 slots/frame

configuration. Eight time slots would mean continuous
transmission as a full duplex FDMA system. Monitoring
neighboring base stations would require an independent
receiver, and the terminal would be much more expensive than
one slot terminals. Also, power consumption would be much
higher.

104
For some applications, the uplink/downlink division is useful
to be asymmetric. Usually, the downlink is required to have
more data rate. The asymmetric cases illustrated below (2+1
& 3+1 slots) can be implemented without need to transmit and
receive at the same time in the terminal device.

MS RX 0 1 2 3 4 5 6 7 0 1

MS TX 5 6 7 0 2 3 4 5 6

Monitor

MS RX 0 1 2 3 4 5 6 7 0 1

MS TX 5 6 7 1 2 3 4 5 6

Monitor

The examples above were based on the assumption that one

user gets several consecutive time slots. From the operator
point of view, it would be more efficient to be able to allocate
time slots more freely. For example, one user might get time
slots 1, 3, and 6 in case of 3-time-slot operation.

Without any assumptions about the allocated time slots, the

mobile terminal should be capable of full-duplex operation
with independent monitoring of neighboring base stations. In
this case the terminal equipment would be almost as expensive
as an 8-slot terminal.

The multi-slot systems have required changes in several

aspects of the specifications such as ciphering, frequency
hopping, and generally radio resource management functions.

105
General Packet Radio Service (GPRS)

The GSM system was not originally designed for packet data
transfer but many data applications are bursty and it is more
efficient if the radio resource is reserved only when something
needs to be sent.

GPRS features include:

• True packet radio system - sharing the network and air
interface resources
• Volume based charging
• TCP/IP (Internet & Intranet) interworking, and SMS over
GPRS, (and X.25 interworking)
• Peak data rate from 9.05 kbps to 171.2 kbps
• Protocols designed for evolution of radio
§ EDGE - new GSM modulation
§ Migration into 3rd Generation

The following figure shows (once more) the GPRS reference

model.

MSC PSTN

BTS BSC
GPRS Core

GPRS
SGSN Backbone GGSN Internet
IP Network

106
The new elements introduced in GPRS are the serving GPRS
support node (SGSN) and the gateway GPRS support node
(GGSN).

SGSN's tasks include: authentication & authorization, GTP

tunneling to GGSN, ciphering & compression, mobility
management, session management, interaction with HLR,
MSC/VLR, charging & statistics, as well as NMS interfaces.

GGSN's tasks include: interfacing to external data networks

(resembles a data network router), encapsulating data packets
in GTP and forwarding them to right SGSN, routing mobile
originated packets to right destination, filtering end user
traffic, as well as collecting charging and statistical
information of data network usage.

After logging to GPRS network, the radio resource is not

dedicated to a particular user, but users can request channel
capacity with a simple and fast procedure.

New modulation, Higher data rate - EDGE

In the GMSK modulation of basic GSM, the modulating

symbol rate is about 271 ksymbols/s, and 1 bit/symbol is
transmitted. With 8-PSK modulation and keeping the symbol
rate, we can transmit 3 bits/symbol, and increase the data rate
correspondingly.

107
The 3 bits are mapped to a 8-PSK constellation using Gray-
code as shown in the following figure.

(d3i, d3i+1, d3i+2)= (0,1,0)

(0,0,0)
(0,1,1)
(0,0,1) (1,1,1)
I

(1,0,1) (1,1,0)
(1,0,0)
3π
The 8-PSK symbols are continuously rotated by 8 radians
per symbol before pulse shaping.

108
CDMA Systems Intro

In digital systems, there are three basic multiple access

schemes: frequency division multiple access (FDMA), time
division multiple access (TDMA), and code division multiple
access (CDMA). Quite many systems are combinations of
FDMA/TDMA (such as GSM or US TDMA), or
FDMA/CDMA (such as US CDMA).

In theory, it does not matter whether the spectrum is divided

into frequencies, time slots, or codes. However, in practical
systems, especially, mobile cellular communication, we find
that some schemes are better suited in certain communication
media than others.

CDMA systems are commonly based on spread spectrum

technologies which have originally been developed for
military communication purposes. In military applications, the
advantages are the facts that spread spectrum signals are
difficult (for those who do not know the codes) to

• detect
• receive and decode
• jam

109
In mobile cellular communications, additional advantages of
spread spectrum technology are:

• s.s. signal is less sensitive to frequency selective multipath

fading because of the large bandwidth which gives natural
frequency diversity

• careful frequency planning of cells is not required because

all cells may use the same frequency band

• handovers can be made more reliably when the frequency

does not change, only code is changed (soft handover)

• network capacity (number of users) does not have any strict

upper limit, additional users are seen as increased
interference level

• utilisation of voice activity cycles increases capacity directly

• instead of an equalizer, a correlator can be used in the

receiver

• no guard times or guard bands needed in CDMA

On the other hand, in order to get maximum capacity, the

transmitter powers should be accurately controlled, especially
in the uplink (MS to BS) direction. Otherwise, an MS near the
BS may block another MS which is far away from the BS.

110
Spectrum spreading can be accomplished by direct
sequencing or frequency hopping.

Direct sequence method: Each information bit is symbolized

by a large number of coded bits called chips. For example, if
an information bit rate R = 10 kbits/s is used and it needs a
information bandwidth B = 10 kHz, and if each bit is coded by
100 chips then the chip rate is 1 Mchips/s which needs a DS
bandwidth Bss= 1 MHz. The spectrum spreading is measured
by the processing gain (PG, in dB)

B 
PG = 10 log SS 
 B 

The PG of our example is 20 dB.

Frequency hopping method: A frequency hopping receiver

would equip N frequency channels for an active call in order
to hop over those N frequencies in some determined hopping
pattern. If the information channel width is 10 kHz and there
are N=100 channels to hop, the FH bandwidth Bss=1 MHz.
The processing gain is again 20 dB.

The hopping can be either fast, which makes two or more

hops for each symbol, or slow, which puts two or more
symbols for each hop. The transmission data rate is the
symbol rate. GSM, for example, uses slow frequency hopping.

111
The basic DS technique is illustrated in the following figure.

Let x(t) be a BPSK data stream (a sequence of +1's and −1's).

Then

S(t) = x(t) cos(2πf0t)

The spreading sequence G(t) also is BPSK (G(t) = ±1). Then

St(t) = x(t) G(t) cos(2πf0t)

112
At the receiving end, St(t − T) is received after T seconds of
propagation delay. An estimate of the delay Tˆ is obtained
with a correlator. Then

S(t − T) = x(t − T) G(t − T) G(t − Tˆ ) cos[2πf0(t − T)]

If the delay T is estimated correctly, and since G(t) = ±1

G(t − T) G(t − Tˆ ) = 1
Then
S(t − T) = x(t − T) cos[2πf0(t − T)]

and the data is recovered by modulating with the carrier.

The spreading sequences G(t) are usually pseudonoise (PN)

sequences, which can be generated, for example, with simple
sequence generators.

Different sequence generators (even with same number of

shift registers) produce different length sequences. The
maximum length of a sequence from a generator with N
registers is
L = 2N − 1.

113
The spreading sequences should have a few special properties

• correlation between two different spreading codes F and G

φ FG (m) = ∑ F (n) ⋅ G (n + m)
n
should be small for all values of m.

• autocorrelation of a spreading code G

φGG (m) = ∑ G( n) ⋅ G (n + m)
n

should be small for all values of m except m = 0.

The design of a large number of such codes is a challence.

Reduction of interference by a DS signal

Example: narrow-band interference

114
An example of cellular CDMA systems is IS-95 (or US-
CDMA) specified by the Telecommunications Industry
Association (TIA).

In the U.S. the operators have a choice of implementing the

US-TDMA (IS-54), US-CDMA (IS-95), or any other system
within their frequency allocation. IS-54 and IS-95 have been
defined such that they can coexist with the analog AMPS
system, and dual-mode terminals are used until the digital
services become more common.

The following figure shows the IS-95 network reference

model.

Immediately, one can see that this is very much like GSM, at
this level. Naturally, there are differences if we go to details.
One major difference is the air interface which is, of course,
based on CDMA technology instead of TDMA.

115
The frequency spectrum for cellular systems in the U.S. is
allocated (in an auction) to network operators in slices of 1.25
Mhz. An operator might get, for example, a set of ten 1.25
Mhz channels in each direction.

A channel in the IS-95 system occupies (almost) the whole

1.25 Mhz band. Reverse (MS to BS) and forward (BS to MS)
channels have different configuration.

A reverse CDMA channel is composed of access channels and

traffic channels. All traffic and access channels share the
same spectrum using direct sequence CDMA.

The spectrum spreading is done in several phases. First, a 64-

ary Walsh modulator is used, that is, each 6 bits in the
sequence selects a row in a 64x64 Walsh matrix to be
transmitted further.

Each traffic channel is identified by a distinct user long code

sequence. Signals from different MSs are distinguished by
length 242 − 1 PN sequence with user address dependent time
offset.

Following the long PN code, the signals are further spread in

quadrature by two short (215 − 1) PN codes.

116
The following figure illustrates the reverse traffic channel
operations from data to continuous waves.

The forward channel (BS to MS) is different in

characteristics, and also the transmission method of IS-95
forward channel is different from reverse channel.

In this case, the short PN codes (I and Q) are used for

separating transmissions from different BSs. Length 64 Walsh
functions are used for separating signals within a cell.

The following figure illustrates the forward channel

117
The forward channel contains traffic channels,
synchronisation channel, paging channel, and a pilot signal.
--------
Introduction to 3rd generation systems utilising CDMA will be
given in a separate presentation.

118