GSM Slides Chapter 1

Introduction

1.2
Via a radio connection, the mobile subscriber MS can access the mobile radio network. This access type
is commonly known as radio interface.
On the stationary network side, the radio interface is served by a Base Station = BS
On the mobile network side, the subscriber uses Mobile Equipment = ME
A fully digital interface, as employed in the GSM/DCS, is the basis of a digital mobile radio network

1.2.1
The smallest service areas in a mobile radio network are called radio cells. The totality of these cells
forms a so-called Cellular Mobile Radio Network.
The base stations are connected to mobile services switching center = MSC (star-shaped configuration)
The MSC in turn, are linked to each other and also function as Gateway to the fixed networks (e.g. PSTN)

Public Land Mobile Network PLMN

GSM 900
Global system for mobile communications
GSM 900-PLMN are designed for extensive radio coverage even in rural areas and have a maximum cell
radius of 35 Km

DCS 1800
Digital Cellular System
In DCS 1800, the cells have a radius of up to 8 Km. Due to this comparatively small transmit capacity it is
possible to use very small 'Mobile Equipment'.

1.2.3
Main Differences between GSM/DCS-PLMN and PSTN

PSTN
The terminal equipment is connected via a fixed
line to the exchange (EXCH)
The Subscriber can be reached via this line only
From a network operator’s point of view, a
subscriber is synonymous with his/her subscriber
line.
GSM/DCS-PLMN
The mobile subscriber accesses the network via a
digital radio interface and is served by different
Base Stations depending on his current location
It must be ensured that the mobile subscriber can
be reached in the mobile radio network
irrespective of its geographical location
A mobile subscriber identifies itself by means of a
personal chip card. In order to make a call, the
subscriber only needs to insert this card in any
GSM mobile equipment.

Ummer Ishtiaq BTE-FA06-120 Page 1

1.3 Service Concept in the GSM/DCS

In the GSM/DCS-PLMN, mobile subscribers are offered three service categories:

-Supplementary Services
-Teleservices
-Bearer Services

Bearer Services:
Bearer services are pure transport services. With bearer services, the network functions required for a
specific type of message transmission are clearly defined. These network functions involve, for example,
the support of various data transmission rates and modes.
The handling of a bearer service presupposes that the network functions mentioned above are provided
up to the network access point in all of the networks participating in the connection setup.
Bearer services comprise, for example, the various data communication services ( circuit or packet
switched, synchronous or asynchronous ) with various transmission rates (in GSM/DCS they range
between 300 bit/s and 9.6 Kbit/s).

Teleservices:
With Teleservices, not only the transport functions required for a connection setup, but also the
features and characteristics of the terminal equipment are clearly defined, e.g. a specific signal protocol
between terminals.
Teleservices are therefore provided up to the user access point at the terminal equipment.
Examples- the common telephony service, fax services, short message service etc.

Bearer and Teleservices are also called Basic Services.

Supplementary Services:
Supplementary Services cannot be assigned to a user without a basic service.
Supplementary services modify or enhance a basic service and offer the subscriber additional control
functions for this basic service.
The following supplementary services can be used in association with the basic service ”Telephony”
-call forwarding
-call charge display
-call hold
Supplementary services can partly be activated and deactivated respectively by means of subscriber
controlled inputs (SCI).

1.4
The chip card is the so-called Subscriber Identity Module (SIM) and is used by the subscriber to identity
itself in the GSM/DCS network.
The SIM can store permanent and temporary data required for call handling.

Temporary data:
-temporary subscriber identity
-current location
-ciphering data

Ummer Ishtiaq BTE-FA06-120 Page 2

Permanent data:
-permanent subscriber identity
-key/algorithm for authentication and ciphering

By inserting the SIM card and switching on the ME, the MS initiates a number of signaling activities in
the mobile network. This process is called Location Registering / Location Update.
When these signaling activities are completed
-the mobile network knows the subscriber’s current location
-the subscriber’s current location is stored on the SIM card

Only after a location update

-can the MS be reached
-can the MS use his telecommunication services (Only exception: emergency calls can be made without
location update).
Mobile Equipment Me with inserter SIM card is called Mobile Station MS
ME + SIM = MS

1.5
The following features are typical of GSM 900 and DCS 1800
-the radio interface is digital
-the mobile subscriber can move freely on a national card and international basis
-the mobile telecommunication services can only be used together with a SIM
-the GSM/DCS MS can personalize every GSM/DCS ME by means of their SIM

GSM Slides Chapter 2

Architecture of GSM/DCS-PLMN

2.2 Functional Network Architecture

The GSM/DCS system consists of 3 subsystems:

-SSS ( Switching Subsystem )

-RSS ( Radio subsystem )
-OMS ( Operation & Maintenance Subsystem )

2.3 Network Components of the radio subsystem

Radio subsystem:
RSS consists of
-Mobile equipment ME
-Base station BS
-Radio Interface UM

Ummer Ishtiaq BTE-FA06-120 Page 3

The BS terminates the radio interface UM on the stationary network side. The BS has a modular design.
It include the:
-Base transceiver Station = BTS
-Base station controller = BSC
-Transcoding and rate adaption unit = TRAU

A BSC can control several BTS. The interface between BSC and BTS is call Abis interface.
The BSC, the TRAU and BTS form a unit which is called Base Station System BSS in the GSM terminology.
Every BSC contained in the network controls one Base station system BSS.

2.3.1

The BTS provides the cells with the radio interface Um which means that it supplies the radio channels
and sends cell-descriptive parameters such as transmit capacity, name of the cell etc.
The base station controller BSC is responsible for the intelligent functions in the BSS.
It controls several BTS.
It distributes traffic channel connections from the SSS to the cells BTS and switches the connection
through transparently.
A BSC always control one BSS

2.3.2 The Network component TRAU

The TRAU adapts the 64kbit/s (speech,data) from the MSC to the comparatively low transmission rate of
the radio interface (22.8 kbs)
The TRAU consists of two functional units:
-the Transcoder TC for speech compression
-the rate adaptor RA for data rate adaption
The TRAU interfaces are called
-A interface (to the SSS (MSC))
-Asub interface (to the BSC)

The TC transforms the incoming speech information, which is embedded in 64 kbps channels, into
transcoded speech information, which Is embedded in 16 kbps channels.
The transcoded speech is a digital way of speech representation which requires less transport capacity
than the standard 64kbit PSM speech representation.
The Rate adaptor RA filters the data out of the 64 kbps signal coming from the MSC and generates a 16
kbps signal.
Within the TRAU, the submultiplexer combines four 16 kbps signals to form one 64 kbps signal.
The Asub interface can carry 4 times the number of traffic channels carried by the A interface.
If the TRAU is installed at the MSC site, the network operator can save line costs.

Ummer Ishtiaq BTE-FA06-120 Page 4

2.4. Network components of the switching subsystem

The switching subsystem comprises the following network components:

MSC- Mobile services switching center
HLR- Home location register
VLR- Visitor Location register
AC- Authentication center
EIR- Equipment identification register

2.4.1. The network Component MSC

In the GSM/DCS network, speech and data channels are switched through by exchanges as in the
common telephone network. However, GSM/DCS has exclusively digital exchanges called Mobile
Services Switching Center MSC.
The MSC are responsible for establishing traffic channel connections:
-to the BSS
-to the other MSC
-and to other network (e.g. to eh PSTN)
The database of an MSC contains information for the routing of traffic channel connections and handles
the basic and supplementary services. In addition the MSC performs the administration of cells and
location areas.

2.4.2. The network components HLR and VLR

With GSM/DCS – unlike in the PSTN – the subscriber administration is not performed by the exchange
because the mobile subscriber is not permanently connected to an MSN. Instead, the mobile
subscriber’s current location determines the MSC responsible for it at that particular moment.
Therefore, the GSM/DCS contains a central network component, the so-called Home Location Register
HLR, which administers the subscriber data of an area covering either a whole PLMN or only parts of it.
The HLR is a database where the mobile subscribers are created, released, barred or deleted by the
operator. The HLR contains all permanent subscriber identities, as well as the services (and
corresponding restrictions) a mobile subscriber is authorized to use.

A great part of the HLR subscriber data is required for connection setup and clear down. To ensure that
this data is immediately available for a call, the information is temporarily stored in a further database,
which is closest to the mobile subscriber’s location. This type of database is called Visitor Location
Register VLR and is associated with the MSC.
During the location update, the subscriber data is passed from the HLR to the current VLR. The data is
stored for as long as the mobile subscriber moves around in the area associated with this VLR.
The VLR provides the subscriber data whenever it is needed for handling a call.
If a subscriber moves to another VLR service area, a location update takes place again: the new VLR
requests subscriber data from the HLR responsible for the mobile subscriber.

Ummer Ishtiaq BTE-FA06-120 Page 5

2.4.3. The network components AC and EIR

If a mobile subscriber wants to access the network, the VLR verifies whether its SIM card is approved .i.e
performs an authentication.
For this, the VLR uses authentication parameters, called triples, which are generated continuously and
subscriber-individually by the Authentication Center AC. On request, the AC provides the VLR with these
triples.
The network component AC is associated with the HLR.

The authentication is, however, not the only check performed during call setup. The <SC also verifies
whether the used ME is approved or whether, if a fault is suspected, its radio characteristics must be
observed.
Therefore, the MSC first requests the International Mobile Equipment Identity IMEI from the MS and
then sends it to the Equipment Identification Register EIR.

In the EIR, the IMEI of the whole ME used are categorized into three ‘lists’:
-the ‘white list’ which contains the ME approved without restrictions
-the ‘gray list’ contains the equipment to be observed
-the ‘black list’ contains the unapproved equipment

The EIR checks whether the IMEI fits into one of these lists and passes the result to the MSC.
If for example, the ME fits into the black list, it cannot participate in the call setup.

2.5 The network components of the operation and maintenance system

For all network elements of the SSS and BSS, the operation, monitoring and maintenance can be
performed centrally by the OMS Operation & Maintenance Subsystem.
An OMS consists of one or more OMC Operation & Maintenance Center.
The OMC is linked to the SSS and BSC network elements via an X.25 packet data network.
In the OMC, the Operation & Maintenance Terminals OMT for the entry of operation and maintenance
commands are interconnected via a Local Area Network LAN.
The interface to the X.25 Packet Switched Public Data Network (PSPDN) is the Operation &
Maintenance Processor OMP.

2.6 Physical Connections in the GSM/DCS-PLMN

All physical connections in the SSS, RSS and to the PSTN are PCM30 systems.

2.6.2. Signaling Connections

In the case of signaling, the physical carriers are also PCM30 channels. The signaling process employs the
Common Channel Signaling System No.7
-between the SSS network elements
-between the MSC and BSC
-between the MSC and the Gateway exchange in the PSTN

Ummer Ishtiaq BTE-FA06-120 Page 6

In addition to the CCS7 signaling connections, there are also signaling connections between BSC and BTS
and between MSC and the mobile station. These channels are switched through transparently in the BSC
and BTS.

Triple:
A triple is a set of three parameters which are generated subscriber-individually.
RAND (Random Number):
Random number used for the generation of this triple.
KC ( Cipher Key ):
Cipher key used for radio channel ciphering
SRES ( Signal response ):
Reference value which the mobile subscriber must also calculate itself during the authentication.

IMEI:
The IMEI represents an internationally uniquely defined code, which is assigned to every mobile
equipment by the manufacturer. The IMEI consists of 15 digits:
-the Type Approval Code TAC, which is made up of 6 digits and assigns the equipment to a certain
category according to GSM applications.
-the Final Assembly Code FAC, which characterizes the assembly location with 2 digits.
-the Serial Number SNR, which is made up of 6 digits and is assigned by the manufacturer, and
-one Spare Bit SP.

X.25:
X.25 is a standard for packet-switched data transmission which was specified by the CCITT.

PCM30:
A PCM30 system is a digital transmission system providing 32 usable channels with a transmission rate
of 64kbps in each case. The channels are represented by time slots. 32 time slots are combined to form
a PCM 30 transmission frame. The time slot 0 contains bit patterns for frame alignment and
synchronization. The other time slots contain either pulse-code modulated useful information or signal
information in the form of 8 bit words. The total bit rate of PCM30 is 1024 kbps.

Ummer Ishtiaq BTE-FA06-120 Page 7

 GSM Slides Chapter 3
Radio Interface

3.2 The GSM/DCS Frequency Bands

With the GSM-PLMN and DCS-PMN, a specific frequency range is available for radio transmission in each
case. This frequency range is divided into two sub-bands:
-Uplink UL for radio transmission between MS and BTS
-Downlink DL for radio transmission between BTS and MS

GSM 900:
With the extended GSM 900, the ranges are:
UPLINK 880 MHz to 915 MHz and Downlink from 925 MHz to 960 MHz

DCS 1800:
UPLINK 1710 MHz to 1785 MHz, DOWNLINK 1805 MHz to 1880 MHz

3.3 RFS in GSM and DCS

Both sub-bands, the uplink and downlink are divided into Carriers=C or Radio frequency Channels RFC
with a bandwidth of 200 KHz
The carrier access procedure in the frequency range is called Frequency Division Multiple Access FDMA
The difference between the GSM and DCS radio channels relate to:
-the operating frequency
-the bandwidth of the sub-bands
-the duplex spacing(i.e. the spacing between associated channels in UPLINK and DOWNLINK
respectively)
-the number of carriers provided

Depending on the traffic volume, every radio cell uses one or more RFC
As the network capacity is limited, the RFC have to be used several times
To avoid co-channel interferences, however it must be observed during network planning that adjacent
cells use different RFC
Therefore, a safe distance is required between the BTS using the same RFC. This safe distance is called
REUSE DISTANCE

3.4 Physical Channels

Similar to the PCM30 system ( 1 link with 32 channels ). 1 RFC consists of 8 channels. Several mobile
subscribers can therefore access one RFC at the same time. This access procedure is called Time division
multiple access TDMA
A physical channel is defined by a specific carrier pair and by the time slot number in the TDMA frame

Ummer Ishtiaq BTE-FA06-120 Page 8

Per radio transmission direction (UPLINK/DOWNLINK). 174 RFC with 8 channels each are available =
1392 physical channels (GMS) in total

3.5 Logical Channels

A physical channel can function as traffic channel ( for the transmission of speech and data information )
and as control channel respectively ( for the transmission of signaling and control information )
The generic term for traffic and control channel respectively is “logical channel”

3.5.1 Traffic Channels

The traffic channels=TCH differ with regard to

-the type of information they transfer
-the channel rate(i.e. available transmission rate)
-the data rate for data transmission(i.e. actual transmission data)

Speech Data
full rate speech half rate speech full rate data half rate data
22.8 kbps 11.4 kbps 22.8 kbps 11.4 kbps
data rate data rate
9.6 kbps 4.8 kbps
4.8 kbps <= 2.4 kbps
<= 2.4 kbps

full rate half rate

Speech 13 kbps 6.5 kbps
speech + correction bits 22.8 kbps 11.4 kbps

with half rate transmission of speech and data, the number of traffic channels available is doubled
because one physical time slot serves twp connection at the same time. This is due to an alternate use if
the time slot: first it is used for one connection, and in the next TDMA frame for the other connection

3.5.2. Control Channels

The following types of control channels are defined:

Broadcast Channels Dedicated control Associated control Common control

channels channels Channels
BCH DCCH ACCH CCCH
BCH and DOWNLINK DCCH are assigned to ACCH are always associated CCCH are control
control channels an MS for a specific with an existing traffic channels used by all MS
channel and are intended for
intended to carry cell- transaction as long as exchanging signaling and BS, for example to
specific information for no traffic channels is information to control the request and provide
synchronization, error provided physical link during a dedicated control
correction etc. connection channels (DCCH)

Ummer Ishtiaq BTE-FA06-120 Page 9

3.6. Bursts

The bit structure of a channel depends on whether it is used as traffic or as control channel

TDMA – frame
7 0 1 2 3 4 5 6 7 0

TB Coded bits training sequence coded bits TB GP

3 58 26 58 3 8.25

Such a uniquely defined bit sequence is called burst

TB= Tail bits
This burst section consists of 3 bits and is intended for delimitation of the time slot flag
Coded Bits
These burst section contain the coded traffic information(speech or data) in 2 x (57+1) bits
Training Sequence
This burst section contains a 28 bit long bit sample, used for synchronization
GP= Guard Period
These 8.25 bits serve to guard phase deviations(which are due to the “movement” of the MS)

A further time slot used as control channel can contain, for example, either a synchronization burst for
the synchronization channel, or a frequency correction burst for the frequency correction channel

TDMA – frame
7 0 1 2 3 4 5 6 7 0

TB Fixed bits TB GP
3 142 3 8.25

Ummer Ishtiaq BTE-FA06-120 Page 10

 GSM Slides Chapter 4
Architecture of the BSS and SSS Network Components

4.2 Architecture of the Base Transceiver Station

Basically, a BTS comprises:

-a control unit
-an interface unit
-one or more TDMA systems
-and one antenna combiner

Every TDMA system is responsible for transmitting the 8 physical channels in the TDMA frame of an RFC.
This means that the number of TDMA systems is equal to the number of RFC used by the BTS. Via
internal connections, the network and control information is transmitted from the TDMA systems to the
antenna combiner and vice versa.
The BTS control unit controls and monitors the other functional units of the BTS via internal signaling
lines. In addition, it controls the optional feature frequency hopping. Frequency hopping refers to the
dynamic switching of different RFC to different carrier frequencies, except for those RFC on which the
BCH is transmitted.

The interface circuit is the termination equipment for the 2 Mbps link to the BSC. It handles all physical
interface functions e.g. synchronization, signal level adaption and channel distribution to the TDMA
systems.

4.3 Architecture of Transcoding and Rate Adaption Unit

The conversion of the 64kbps speech bit rate into a 13 or 6.5 kbps full or half bit rate respectively called
transcoding and is handled by the TRAU. The TRAU supplements the 13 and 6.5 kbps signals with a
header to obtain 16 kbps, which are then forwarded to a submultiplexer. At the output of this
multiplexer, a new 64 kbps signal (with 4 transcoded speech connections) is available for transmission
via a PCM 30 system.
The data transmitted from the MSC to the base station is always digital and is embedded in a 64 kbps
channel. The TRAU filters the data out of the 64 kbps signal and adds a header. In this way, a 16 kbos
signal is obtained.

4.4 Architecture of the Base Station Controller

The base station controller BSC is responsible for the BTS control and the administration of radio
resources and frequencies. The BSC has suitable interface circuits for the 2 Mbps inks to the TRAU and
to the various BTS. The traffic and control channels from and to the BTS respectively are switched
through by means of a switching device.

Ummer Ishtiaq BTE-FA06-120 Page 11

4.5 Architecture of the SSS network components

The SSS network components MSC, VLR, HLR, AC, and EIR are mainly implementer as software functions
and are based on the same HW architecture.

The hardware architecture of an SSS network component always comprises

-a switching network for switching the traffic and control channels
-interface circuits for the PCM 30 systems to other network components
-a central control processor and
-a control unit for the CCS7 signaling channels

If a network component functions as MSC, a special unit is required in addition to this basic
configuration, a unit which provides interworking functions, if necessary for all bearer and teleservices.

------------------------------------------------------------------------------------------------------------------------------------------

Frequency Hopping:
Frequency hopping means that each logical radio channel (except for BCCH) changes its frequency from
one TDMA frame to the next according to a fixed algorithm. The time slot, however, remains the same.
The purpose of this procedure is to distribute interferences, which occur on only one RFC, to all existing
channels, in order to ensure that they have the same grade of transmission quality.

Interworking Functions:
The PSTN transmits data in the form of acoustic signals in the normal speech band. For this, a MODEM is
used, which transforms the originally digital data signal coming from the terminal equipment into an
acoustic signal.

Ummer Ishtiaq BTE-FA06-120 Page 12

 GSM Slides Chapter 5
Geographical Network Organization of the GSM/DCS

5.2 The GSM/DCS Subareas

A national GSM/DCS-PLMN is first subdivided into MSC service areas.

Mobile subscribers, who have carried out a location update/location registration in one of these MSC
service areas, are registered in the VLR associated with the affected MSC.
The MSC are connected to the BS in their areas. The BS are responsible for the cells which are the
smallest service area in a PLMN.
The BTS is responsible for the radio supply of a cell. This size of the cell varies, depending on the
topography and the traffic intensity. Thus, the cell size in always smaller in densely populated areas than
in rural areas.

5.3 Subarea Identities

From an administrative point of view, several cells are combined to form a so-called Location Area (LA).
Every LA has an own identity, which uniquely identifies it on an international basis.
The appropriate term is Location Area Identity LAI. It contains:
-The mobile country code MCC identifies the country using a combination of 3 digits.
-The mobile network code MNC serves to differentiate the various PLMN within a country by means of
3 digits.
-The Location are code LAC characterize the location area within the PLMN by using 2 bytes.

If an MS initiates a location update in a location area, the LAC is stored in the VLR and the LAI on the SIM
card. The LAI is the most exact information about a mobile subscriber’s current location in the VLR,
which means that the cell is not known in the VLR.

Every cell has its own identity which is distributed by the BTS in a broadcast channel.
The Cell Global Identity CGI consists of:
-the LAI and
-the Cell identity CI
Like the LAC, the CI is made up of a bit sequence with a length of 2 bytes.

Ummer Ishtiaq BTE-FA06-120 Page 13

 GSM Slides Chapter 6
Mobile Subscriber Identities in GSM/DCS

6.2 MSISDN

The digit combination is called Mobile Station International ISDN Number MSISDN.
The MSISDN is made up of:
-Country Code CC
-National Destination Code NDC
-Subscriber Number SN

The length of CC, NDC, SN (MSISDN) is limited to 12 digits.

The first two digits of the SN identify the HLR where the mobile subscriber is administrated. A maximum
of 5 other digits stand for the individual subscriber number.

6.3 The IMSI

The GSM/DCS-specific identities for a country and PLMN are included in still another digit combination,
which is used in the case of system-internal signaling transactions in order to indentify a subscriber. The
digit combination is the International Mobile Subscriber Identity IMSI and has the following structure:

----------------- IMSI ------------------

MCC MNC MSIN

MCC:
The mobile country code identifies the country using 3 digits.
MNC:
The mobile network code identifies the PLMN using 2 digits.
MSIN:
The mobile subscriber identification number MSIN has a fixed length of 10 digits. Similar to the SN in the
MSISDN, the first two digits of the MSIN also identify the HLR where the mobile subscriber is
administrated. The remaining 8 digits represent an individual subscriber identification. The IMSI is
permanently stored on the SIM card. In the HLR, the IMSI is used as storage address for the subscriber
data.

6.4 The TMSI

With signaling transactions on the radio interface, it must be possible to address and identify a
subscriber. As the transactions are partly unciphered, the IMSI is not suited for reasons of
confidentiality. In other words, the privacy of the subscriber is not guaranteed under certain
circumstances.

Ummer Ishtiaq BTE-FA06-120 Page 14

That is why on the radio interface the IMSI is replaced by another identity, which is temporarily
allocated and stored in the VLR and stored on the SIM card. This second identity is called Temporary
Mobile Subscriber Identity TMSI and the variable structure. It identifies a subscriber only in the current
VLR.

Ummer Ishtiaq BTE-FA06-120 Page 15