GSM & GPRS Primer

By Erick OConnor
February 2005

Topics
Background

General Packet Radio System (GPRS)

The history of cellular communications

Key statistics

Protocol layers
Key information

Worldwide subscribers
Top 20 global mobile operators

Dimensioning a Network
Mobility Management

Global System for Mobile (GSM)

Third-Generation Systems (UMTS)

The Radio environment

Basestation & Network subsystems

Evolution paths
Core components

Subscriber data & addressing

Circuit-switched network architecture
Overview of PDH transmission
Common Channel Signalling & GSM MAP

2001 - 2005 Erick OConnor

The following symbol indicates that the

slide contains animations. Press the
A
space bar to advance the animation

History of Cellular Communications

1960s to the Present Day

the early years

1960 1970s
Idea of a cell-based mobile radio system developed by AT&Ts Bell Labs in late 1960s
First commercial analogue mobile cellular systems deployed 1978

1980s (1st Generation Analogue Systems)

Usage in N.America grows rapidly
Advanced Mobile Phone System (AMPS) becoming the de facto standard

Europe, run by the PTTs, characterised by multiple incompatible analogue standards

Nordic Mobile Telecommunications (NMT-450)

Total Access Communications (TAC) United Kingdom
C-Netz West Germany
Radiocom 2000 France
RTM / RTMS Italy etc. etc.

Capacity limitations already becoming apparent by end of decade.

2001 - 2005 Erick OConnor

 going digital
Late 1980s to early 1990s (2nd Generation Digital Systems)
N.America relies on de facto let the best technology win standardisation
By contrast Europe decides to rely on standardisation & co-operation
Huge pent-up demand for mobility can not be met by upgrading existing purely analogue systems.
Parallel advances in digital techniques and Very Large Scale Integration (VLSI) chipset
manufacture suggest a new way forward
However European domestic markets individually too small to achieve the economies of scale
necessary for vendors to take the risk of developing such a risky new solution
Enter the European Commission with a political agenda demonstrate Europes technology
leadership and ensure European manufacturers can compete globally

New spectrum auctions in USA in early 1990 (PCS 1900) lead to plethora of standards
D-AMPS IS-54 Motorola sponsored, TDMA IS-136, CDMA IS-95 Qualcomm sponsored
Plus, limited GSM

Meanwhile in Europe
2001 - 2005 Erick OConnor

GSM is born
Late 1980s to early 1990s (2nd Generation Digital Systems)
Guided by European Commission & European Telecommunications Standard Institute
26 European telecommunication administrations establish the Groupe Spciale Mobile
(GSM) in 1982 with aim to develop a new specification for a fully digital pan-European
mobile communications network
The Group notes that the new industrys economic future will rely on unprecedented levels
of pan-European co-operation
Political decision to force member countries to:
allocate frequencies at 900 MHz in every EC country (later 1800 MHz)
specify the exact technology to be used and;
deploy systems by 1991

First commercial GSM networks deployed in 1992

Denmark / Finland / France / Germany / Italy / Portugal / Sweden / United Kingdom

2001 - 2005 Erick OConnor

beginning of the GSM success story

By End of 1993
One million subscribers using GSM
GSM Association has 70 members, 48 countries
First non-European operator, Telstra of Australia
Western Europe - 32%
Central & Eastern
Europe - 3%
Caribbean, Central &
Latin America - 8%

Central Asia - 11%

North America - 20%

Middle East &

Africa - 4%

Asia-Pacific - 22%

And, by technology.

Western Europe - 29%

2000 (470 million)

Central & Eastern

Europe - 3%

Caribbean, Central &

Latin America - 13%

Central Asia - 13%

www.gsmworld.com

Asia-Pacific - 19%
North America - 17%

Middle East &

Africa - 6%

.Subscribers
2004 (1,192 million)

2001 - 2005 Erick OConnor

the turn of the century & 3rd generation services

Multiple operators per country & worldwide (800+)
intense price based competition
Huge growth in subscribers thanks to pre-paid but falling ARPU & high churn (c.25%)
Market close to saturation slowing subscriber penetration growth rates (c.85%)

The challenge what to do in future?

Europe keen to replicate commercial success of GSM but, Americans & Japanese had
different views and needs
Japan had run out of spectrum for voice
Americans unhappy at being dictated to by a European standard
European vision of always on data & rich value added content services

America & Japan jointly force Europe to open up standardisation process so as not to once
again lock-out other trading blocs vendors
Creation of 3rd Gen Partnership Programme (3GPP) body
Heated standardisation on Wideband CDMA (Qualcomm vs Ericsson)
Final agreement on Universal Mobile Telecommunications Standard (UMTS) in 1998.

2001 - 2005 Erick OConnor

The market today key statistics

2001 - 2005 Erick OConnor

GSM design
Radio & Network subsystems, Signalling & Transmission

Basic GSM network elements

A
PSTN

Network Subsystem

ISDN
PDN
ISC

BTS
BSC

GMSC SIWF

XCDR

User Data &

Authentication

MSC

BTS

BSC

BTS
MS + SIM

Radio Subsystem

2001 - 2005 Erick OConnor

EIR

AUC

HLR

VLR
AUC
BSC
BTS
EIR
GMSC
HLR
ISC
ISDN
MSC
PDN
PSTN
SIWF
VLR
XCDR

Authentication Centre
Basestation Controller
Basestation Transceiver
Equipment Identity Register
Gateway Mobile Switching Centre
Home Location Register
International Switching Centre
Integrated Services Digital Network
Mobile Switching Centre
Packet Data Network (X25)
Public Switched Telephony Network
Shared Interworking Function
Visitor Location Register
11
Transcoder (16 / 64kbps coding)

GSM air interface design

Access Techniques

Time Division Multiple Access

Frequency Division Multiple Access

Space Division Multiple Access

Radio characteristics
Gaussian Minimum Shift Keying (GMSK)

Slow Frequency Hopping

8 Timeslots per Carrier

1 Downlink Timeslot reserved for signalling

3 timeslot difference between uplink & downlink

+400 kHz

GMSK Spectrum

8 timeslots
f3
f2

Logical structure

f0

-400 kHz

Frequency

Multiple cells

f1
f0

FDMA & TDMA

Time

Frame structure used for synchronisation

51-frame Multiframe (235.4 ms)

51 or 26 Multiframe Superframe (6.12 sec)

2048 Superframe Hyperframe (3 hr 28 mins)

2001 - 2005 Erick OConnor

Downlink

Uplink

Delay

12

Radio subsystem (i)

Basestation Transceiver (BTS) provides radio
channels for signalling & user data

BTS
BSC

A BTS has 1 to 6 RF carriers per sector and

1(omni) to 6 sectors

e.g. 3/3/3 = 3 sector with 3 carriers per sector

3 x 7 Timeslots x 3 = 63 Timeslots total

c.52 Erlangs @ 2% Grade of Service

c.2,000 users per BTS @ 25 mErl / User (90 seconds)

Frequency reuse depends on terrain,

frequencies available etc.

BTS

XCDR

BSC

BTS
MS + SIM

Frequency reuse &

cluster formation

3
1

3
1
f2

f3
f1
K=3

Paired spectrum shared by Operators

900 / 1800 MHz in Europe / Asia (25 & 75 MHz)

1900 MHz in N.America

200 kHz channel separation

125 Channels @ 900 MHz
2001 - 2005 Erick OConnor

7
1
4
f6
f5

2
3
f7
f1
f4

6
5
f2
f3

7
1
4

2
3

K=7

13

Radio subsystem (ii)

BTS
BSC

Basestation Controller (BSC) controls a number of BTS

XCDR

Acts as a small switch

Assists in handover between cells and between BTS

BTS

Manages the Radio Resource, allocating channels on the air interface

BSC

BTS
MS + SIM

Transcoding (XCDR) function is logically associated with BTS

But, typically located at BSC to save on transmission costs
XCDR provides 13 kbps Coding / Decoding between GSM Codec & standard 64 kbps A-law
encoded voice

Interfaces
Abis BTS to BSC interface (never fully standardised so vendor-specific variants exist)
A BSC to MSC interface carrying voice, BSC signalling and Radio
Traffic Channels are mapped one-to-one between BTS and Transcoder
BTS can be connected in Star or Daisy-chain arrangement to BSC (max. 15)

2001 - 2005 Erick OConnor

14

Network subsystem (i)

PSTN
ISDN
PDN
ISC

Core component is Mobile Switching Centre (MSC)

GMSC SIWF

Performs all switching functions of a fixed-network switch

MSC

Allocates and administers radio resources & controls mobility of users

Multiple BSC hosted by one MSC

Gateway MSC (GMSC) provide interworking with other fixed & mobile networks
Crucial role in delivering in-coming call to mobile user in association with Home Location
Register (HLR) interrogation

Shared Interworking Function (SIWF)

Bearer Services are defined in GSM including 3.1 kHz Voice, ISDN, 9.6 kbps Data & 14.4 kbps
IWF provides modem capabilities to convert between digital bearer & PSTN, ISDN & PDN

International Switching Centre (ISC)

Provides switching of calls internationally. Switch may be provided by another carrier
2001 - 2005 Erick OConnor

15

Network subsystem (ii)

Home Location Register (HLR) holds
master database of all subscribers
Stores all permanent subscriber data &
relevant temporary data including:

MS-ISDN (Mobile Subscribers telephone no.)

MSRN (Mobile Station Roaming no.)

Current Mobile Location Area

Actively involved in incoming call set-up &

supplementary services

Visitor Location Register (VLR)

associated with individual MSCs
VLR stores temporary subscriber information
obtained from HLR of mobiles currently
registered in serving area of MSC

EIR

AUC

HLR

VLR

Authentication Centre (AUC) &

Equipment Identity Register (EIR)
GSM is inherently secure using
encryption over the air-interface and for
authentication / registration
AUC holds each subscribers secret key
(Ki) & calculates triplet for challenge /
respond authentication with mobile
SIM is sent data and must calculate
appropriate response
EIR is used to store mobile terminals
serial numbers

Involved in registration of mobiles

Assists in delivery of supplementary service
features such as Call Waiting / Call Hold

2001 - 2005 Erick OConnor

16

GSM call setup & Signalling

Signalling Air interface

Air Interface Signalling
Downlink signalling (to Mobile Station)
Relies on Bearer Control Channel
(BCCH) set at fixed frequency per cell

Mobile Stations use this to lock-on to

network
Mobile Stations periodically scan
environment and report back other
BCCH power levels to BSC to assist
in handover

Access Grant Channel (AGCH) used

to assign a Control or Traffic Channel to
the mobile
Paging Channel (PCH) paging to find
specific mobiles

2001 - 2005 Erick OConnor

Uplink signalling (from MS) more

complicated
Random Access Channel (RACH)
competitive multi-access mode using
slotted ALOHA to request dedicated
signalling channel (SDCCH)

Bidirectional channels include

Traffic Channels (TCH) Carrying full rate
voice @ 13 kbps / half-rate voice
Standalone Dedicated Control Channel
(SDCCH) used for updating location
information or parts of connection set-up
Slow Associated Control Channel
(SACCH) used to report radio conditions
& measurement reports
Fast Associated Control Channel
(FACCH) uses stolen traffic channel
capacity to add extra signalling capacity

18

Signalling Mobile Application Part interfaces

Network Signalling
Um

Air interface signalling

Abis

Radio management

BSS management, connection

control & mobility management

Subscriber data, location

information, supplementary
service settings

Routing information requests

Exchange of location-dependent
subscriber data & subscriber
management

GSM Specific Signalling Interfaces

(Mobile Application Part)
MSC

EIR

MSC
F
BSC

Subscriber & equipment identity

check

Inter-MSC handover, transfer of

subscriber data

2001 - 2005 Erick OConnor

C
A

BTS

B
Abis

HLR

VLR

Inter-MSC handover signalling

BTS

G
VLR

Um
MS + SIM

19

ITU-T Common Channel Signalling System Number 7

Application Parts

GSM interfaces B, C, D, E & G

carried as Mobile Application Part

Most basic CSS7 signalling

MAP

Transaction Control
Application Part
component responsible for
carrying higher level
Application Parts to their
correct destinations

INAP

TCAP

OMAP

ISUP

TUP

SCCP

Signalling Connection
Control Part
Functionally equivalent to TCP
layer, carries Connectionless
messages between Network
elements

Standard Telephone
User Part (TUP)

ISDN User Part

MTP Layers 1/2/3

Add functionality to
permit ISDN signalling
(i.e. fully digital)
between networks

ISO Layers 1 thro 7

Actually carry the specific

messages for Mobile (MAP),
Intelligent Network (INAP) or
Operations & Maintenance
(OMAP)

Signalling 101
Line signalling tell the other end you want to make call
Register signalling tell the other end the destination of the call
2001 - 2005 Erick OConnor

Message Transfer Part

Lowest level, permits
interconnection with
underlying physical
transmission medium

20

PDH transmission composition of 32 channel E1 bearer

TS 0 Synchronisation
Header

TS16 Signalling

ITU-T G.703 E1 link 2048 kbps

32 x 64 kbps Timeslots

0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31

140 Mbps

Plesiochronous Digital Hierarchy (PDH)

34 Mbps
Voice / Data Timeslot

2 Mbps
Abis - Voice GSM Codec
4 x 13 kbps Timeslots

STM-16
STM-4

Synchronous Digital Hierarchy (SDH)

(SONET - USA)

STM-1

2001 - 2005 Erick OConnor

21

Circuit-switched network architecture

(Transmission & Signalling planes)

BSS
CCS7
CO
HLR
MSC
SDH
SSP
STP

Basestation Subsystem
Common Channel Signalling #7
Central Office
Home Location Register
Mobile Switching Centre
Synchronous Digital Hierarchy
Service Switching Point
Signalling Transfer Point

CSS7 Signalling Plane

SSP
HLR
CCS7 Links

CO Switch
STP

MSC

SDH Fibre
Optic Network
Synchronisation
Other Networks

Drop & Insert

Multiplexers
BSS

2001 - 2005 Erick OConnor

Transmission Plane

22

Call setup
Data held in HLR:
Subscriber & Subscription Data

International Mobile Subscriber

Identity (IMSI)

Mobile Station ISDN (MS-ISDN)

Bearer & teleservice subscriptions

Service restrictions

Parameters for additional services

Information on subscriber equipment

Authentication data

18765432

Using
When
The
HLR
MSC
handset
the
returns
directs
is
MS-ISDN
MSRN
MSC
assigned
acknowledges
receives
the
the
the
BSC
MSRN
at
MSC
registration
the
toroutes
interrogates
the
page
incoming
a subscriber
virtual
incoming
theand
subscriber
call
call
number
the
iscall
to
it
another
queries
HLR
the
and
and
telling
serving
tothe
virtual
find
its
inform
call
VLR
the
MSC.
status
isto
the
CallTMSI
isthe
placed
to
aGMSC
mobile
by
dialling
the
and
GMSC
obtain
number
handset
established
location
how
the
used
of to
TMSI
an
between
of
for
route
incoming
mobile
for
security
the
the
subscriber.
call
subscriber.
call.
two
purposes.
toparties.
the serving
Together
The handset
MSC.
with cell
mayIDalso
mobile
number
(MS-ISDN).
location
signal
theinformation
BSC / MSC stored
during in
thethe
call
VLR
to the
set up
MSCsupplementary
now has
sufficientsuch
services
information
as Call Hold,
to be3-way
able to
calling
routeetc.
the call.
MS-ISDN
MSRN

BSC

BTS

Temporary Mobile Subscriber

Identity (TMSI)
Current VLR address

Current MSC address

Local Mobile Subscriber Identity

2001 - 2005 Erick OConnor

XCDR

GMSC

3 MSRN

5 MSRN

BSC

HLR

7 TMSI
BTS
MS + SIM

2 MS-ISDN

MSC

Mobile Station Roaming Number

(MSRN)

PSTN

BTS

Tracking & Routing Information

TMSI

VLR

TMSI

Principle of routing call to mobile subscribers

23

GPRS Design

GPRS network elements

Other GPRS
PLMN

SM-SC
BTS
BSC

GGSN

PCU

BG
SGSN
PDN

GGSN
BTS

BSC
VLR
BTS

GPRS MS + SIM

2001 - 2005 Erick OConnor

HLR

BG
BSC
BTS
GGSN
HLR
PCU
PDN
PLMN
SM-SC
SGSN
VLR

Border Gateway
Basestation Controller
Basestation Transceiver
Gateway GPRS Support Node
Home Location Register
Packet Control Unit
Packet Data Network (X25)
Public Land Mobile Network
Short Message Service Centre
Serving GPRS Support Node
Visitor Location Register
25

How GSM & GPRS co-exist

X.25 / IP / PDN

PSTN

Internet

De facto interfaces
G.703 E1 64kbps

DHCP

Radius

Firewall

DNS

Gi (IP)

SMSC

OSS

GMSC

IWF

MAP C

MAP E
VLR

GSM

LIAN

Gn (IP)

HLR
MAP D

SMSC

CG

GGSN

MAP Gr

SGSN

DNS
MAP Ga

GPRS

XCDR
A (G.703 E1 16kbps)

BSC
BTS
Cells

PCU

Gb (Frame Relay)

Abis (G.703 E1)

Voice or Data link

Signalling & Name of Interface
2001 - 2005 Erick OConnor

BSC
BTS
CCS7
CG
DHCP
DNS
GSN
HLR
IWF
LIAN
MAP
MSC
OSS
PCU
PSTN
VLR
XCDR

Basestation Controller
Basestation Transceiver
Common Channel Signalling #7
Charging Gateway
Dynamic Host Configuration Protocol
Domain Name Server
GPRS Serving Node (Serving / Gateway)
Home Location Register
Interworking Function (Circuit / Packet)
Legal Intercept Attendance Node
Mobile Application Part (CCS7)
Mobile Switching Centre (Serving / Gateway)
Operational Support System
Packet Control Unit
Public Switched Telephony Network
Visitor Location Register
26
Transcoder (16 / 64kbps coding)

GPRS key information

Four Coding Schemes defined
CS1 9.05 kbit / second per timeslot
CS2 13.40
CS3 15.60
CS4 21.40
Higher speed = Trade off of Forward Error
Correction & hence quality

Three Handset Types defined

Class A simultaneous voice & data
Class B voice or data only at one time
Class C data only

GSM offsets uplink timeslots (Ts) from

downlink by 3 to save on radio transmit /
receive hardware
Therefore todays handsets are typically:
1 Ts downlink

2 to 3 Ts uplink

Class B

CS1 & CS2 capable

Equals 3 x 13.40 = 40.20 kbit/s maximum

Handsets can exceed this limit

But cost more

Use more power etc,

GPRS

0 1 2 3 4 5 6 7 8

Downlink

Signalling
Uplink
GPRS

2001 - 2005 Erick OConnor

27

Protocol layers in GPRS

Application Protocol (http / ftp)
Transmission Control Protocol (TCP)

TCP
TCP
IP
IP

IP
IP

TCP
TCP

TCP
TCP

IP
IP

IP
IP

SNDCP
SNDCP

SNDCP
SNDCP

GTP
GTP

GTP
GTP

LLC
LLC

LLC
LLC

UDP /
TCP
TCP

UDP
UDP //
TCP
TCP

IP
IP

IP
IP

RLC
RLC

RLC
RLC

BSSGP
BSSGP

BSSGP
BSSGP

MAC
MAC

MAC
MAC

Network
Network
Service

Network
Network
Service
Service

L2
L2

L2
L2

GSM
GSM RF
RF

GSM
GSM
RF
RF

L1
L1 bis
bis

L1
L1 Bis
Bis

L1
L1

L1
L1

Laptop GPRS MS
/ PDA

2001 - 2005 Erick OConnor

BSS

SGSN

BSSGP
GSM RF
GTP
LLC
MAC
RLC
SNDCP

GGSN

Basestation System GPRS Protocol

Radio Frequency
Gateway Tunnelling Protocol
Logical Link Control
Medium Access Control
Radio Link Control
Subnetwork Dependent Convergence Protocol
28

Mobility management
Mobility management

Attach
Know who is the MS

Know what the user is allowed to do

Detach
Leave the system

Location updates
Know location of MS

Addresses are statically or dynamically

assigned

Context information includes:

PDP Type

PDP address (optional)

Quality of Service (5 classes Service

Precedence / Reliability / Delay /
Throughput Maximum & Mean)

SGSN has main control of QoS

Connection-less (IPv4 / IPv6)

Point-to-Multipoint (Release 2)
Multicast

Every mobile must have an address for each

PDP Context in use

Point-to-Point
Connection-orientated (X25)

Route mobile terminated (MT) packets to MS

GPRS Service Descriptions

Packet Data Protocol (PDP) Contexts

Groupcast

Short Message Service (SMS)

2001 - 2005 Erick OConnor

29

GPRS dimensioning
900MHz UK Network

Dimensioning

7 Timeslots per Carrier

1 to 6 RF carriers / cell

8 million subscribers
10% GPRS handset penetration

1 to 3 cells / BTS
5,000 BTS

800,000 users
10:1 Activity factor

250 BSC
50 MSC

10:1 x 800,000 = 80,000 simultaneous users

8 SGSN / 2 GGSN

10 GMSC

Exact dimensioning depends on:

GPRS
SGSN c.10,000 simultaneous users
GGSN c.45,000 simultaneous users
10 to 1 contention ratio

Number of users
Geography
Population density
Data profile & activity
GPRS growth

2001 - 2005 Erick OConnor

30

Evolution towards UMTS All IP core

Internet

GSM & GPRS

PSTN

Packet Data

Packet
Gateway

Circuit
Gateway

All IP Packet
Network

HLR

CAMEL

Call Control
Server
BTS
RNC Server
BTS

BSC

UMTS
Node B

BTS

3rd Generation UMTS

2001 - 2005 Erick OConnor

31

Further Reading
GSM Switching, Services and Protocols Jrg Eberspcher & Hans-Jrg
Vgel, John Wiley & Sons, 2000
GPRS General Packet Radio Service Regis J. Bud Bates, McGraw-Hill
Telecom Professional, 2002
GPRS Networks Geoff Sanders, Lionel Thorens, Manfred Reisky, Oliver
Rulik, Stefan Deylitz, John Wiley & Sons, 2003

2001 - 2005 Erick OConnor

32