CHAPTER 7:

PERSONAL COMMUNICATION SYSTEMS: SECOND

GENERATION
GSM, IS-54, IS-95

I. F. Akyildiz

Broadband & Wireless Networking Laboratory

School of Electrical and Computer Engineering
Georgia Institute of Technology
Tel: 404-894-5141; Fax: 404-894-7883
Email: ian@ece.gatech.edu
Web: http://www.ece.gatech.edu/research/labs/bwn
 Introduction to GSM:
Development of Mobile Telecommunication
FDMA
Systems

CT0/1
AMPS
NMT CT2
IMT-FT
IS-136 DECT
TDMA

TDMA EDGE IMT-SC

D-AMPS
GSM GPRS IS-136HS
PDC UWC-136
IMT-DS
UTRA FDD / W-CDMA
IMT-TC
CDMA

UTRA TDD / TD-CDMA

IMT-TC
TD-SCDMA
IS-95 cdma2000 1X IMT-MC
cdmaOne cdma2000 1X EV-DO
1X EV-DV
1G 2G 2.5G 3G (3X)

IFA’2006 ECE4833 2
 2G Reference Model

HLR

PSTN
MSC
VLR

BSC

BTS

IFA’2006 ECE4833 3
 2G FACTS

 Today many providers all over the world use GSM

(more than 184 countries in Asia, Africa, Europe,
Australia,America)

 More than 1.2 Billion subscribers

 More than 70% of all digital mobile phones use

GSM

IFA’2006 ECE4833
 GSM Overview

 Several first generation analog cellular systems in Europe but

incompatible - limited roaming

 1987-1989 ETSI standards for pan-European Global System for

Mobile Communications (GSM, originally Group Spe’ciale Mobile
1982) at 900 MHz
– 1992 GSM is launched
– 1990-1993 Standards for Digital Cellular System at 1800 MHz
(DCS 1800, recently renamed GSM 1800; US version is PCS
1900)

IFA’2006 ECE4833 5
 GSM Overview

 Objectives:
– Broad offering of speech and data services
– Compatible with wireline networks
– Automatic roaming and handoff
– Highly efficient use of frequency spectrum
– Support for different types of mobile terminal equipment (e.g.,
cars, portable handsets)
– Digital signaling and transmission
– Low cost infrastructure and terminal equipment

IFA’2006 ECE4833 6
 GSM: Mobile Services
 GSM offers
– Several types of connections
Voice connections, data connections, short message
service
– Multi-service options (combination of basic services)
 Three service domains
– Bearer Services
– Telematic Services
– Supplementary Services

IFA’2006 ECE4833 7
 Bearer Services
 Telecommunication services to transfer data between access points
 Different data rates for voice and data (original standard)
– Data Service (Circuit Switched)
synchronous: 2.4, 4.8 or 9.6 kbps
asynchronous: 300 - 1200 bps
– Data Service (Packet Switched)
synchronous: 2.4, 4.8 or 9.6 kbps
asynchronous: 300 - 9600 bps
 Today: data rates of approx. 50 kbps possible

IFA’2006 ECE4833 8
 Tele Services I
 Offered Services
– Mobile Telephony
primary goal of GSM was to enable mobile telephony offering the
traditional bandwidth of 3.1 kHz

– Emergency Number
common number throughout Europe (112); mandatory for all service
providers; free of charge; connection with the highest priority
(preemption of other connections possible)

IFA’2006 ECE4833 9
 Tele Services II
 Additional Services
– Non-Voice-Teleservices
Fax
Voice mailbox (implemented in the fixed network supporting the
mobile terminals)
Electronic mail (MHS, Message Handling System, implemented in
the fixed network)
Short Message Service (SMS)
alphanumeric data transmission to/from the mobile terminal using
the signaling channel, thus allowing simultaneous use of basic
services and SMS

IFA’2006 ECE4833 10
 Supplementary Services

 May differ between different service providers,

countries and protocol versions
 Important services
– Identification: forwarding of caller number
– Suppression of number forwarding
– Automatic call-back
– Conferencing with up to 7 participants
– Locking of the mobile terminal (incoming or outgoing calls

IFA’2006 ECE4833 11
 GSM Reference Architecture

PSTN
Network &
Switching VLR OMC
Subsystem
MSC HLR AUC
(NSS)
A NMC
EIR
BSS BSS
BSC
RADIO
Abis ADC
SUB- BTS BTS
SYSTEM Um OSS
MS MS Operation Subsystem
MT
TE

IFA’2006 ECE4833 12
 BSS: BASE STATION SUBSYSTEM

* BTS (Base Transceiver Station): Sender and receiver

* BSC (Base Station Controller):
Controlling several transceivers

■ INTERFACES:

■Um : Radio interface

■Abis : Standardized, open interface with 16 kbps user channels
■ A: Standardized, open interface with 64 kbps user channels

IFA’2006 ECE4833
 BSS: BASE STATION SUBSYSTEM

 BTS handles channel allocation, signaling, frequency hopping, handover

initiation, etc.

 BSC manages radio channels, paging, handoff for several BTSs

 MSC is the gateway to PSTN and Packet Data Networks

 MSC performs switching, paging functions, MS location updating,

handoff control, etc.

IFA’2006 ECE4833 14
 Base Station Subsystem
Functions BTS BSC
Management of radio channels X
Frequency hopping (FH) X X
Management of terrestrial channels X
Mapping of terrestrial onto radio channels X
Channel coding and decoding X
Rate adaptation X
Encryption and decryption X X
Paging X X
Uplink signal measurements X
Traffic measurement X
Authentication X
Location registry, location update X
Handover management X

IFA’2006 ECE4833 15
 Mobile Station

 Mobile Termination (MT) supports physical channel between MS and base station
(radio transmission, channel coding, speech coding)

 Terminal equipment (TE), e.g., telephone set, speaker, microphone, keypad, and radio
modem
. Contains terminal/user-specific data in form of smart card (Subscriber Identify
Module or SIM card), plugs into any GSM terminal like credit card and identifies user
to network for personal mobility (in addition to terminal mobility) and security

– SIM (Subscriber Identity Module):

Smart card issued at subscription time
Personalization of the mobile terminal, stores user parameters such as address and
type of service
Calls are directed to the SIM rather than the terminal
Stores short messages
Carries a PIN number that needs to be verified to make the
information on the card available to the user.

IFA’2006 ECE4833 16
 Network and Switching Subsystem

 NSS is the main component of the GSM

– Switching, mobility management, interconnection to other
networks, system control

 Components
– Mobile Services Switching Center (MSC)
Controls all connections via a separated network to/from a
mobile terminal within the domain of the MSC - several BSC
can belong to a MSC

IFA’2006 ECE4833 17
 Network and Switching Subsystem

 The MSC (Mobile Switching Center) plays a central

role in GSM
– switching functions
– additional functions for mobility support
– management of network resources
– interworking functions via Gateway MSC (GMSC)
– integration of several databases

IFA’2006 ECE4833 18
 Network and Switching Subsystem

Detailed Functions of a MSC

– specific functions for paging and call forwarding
– termination of SS7 (signaling system no. 7)
– mobility specific signaling
– location registration and forwarding of location
information
– provision of new services (fax, data calls)
– support of short message service (SMS)
– generation and forwarding of accounting and billing
information

IFA’2006 ECE4833 19
 Network and Switching Subsystem

– Databases (important: scalability, high capacity, low delay)

Home Location Register (HLR): central master database containing user
data, permanent and semi-permanent data of all subscribers assigned to
the HLR (one provider can have several HLRs)

Visitor Location Register (VLR): local database for a subset of user

data, including data about all user currently in the domain of the VLR

Equipment Identity Register (EIR): registers GSM mobile stations and

user rights. Stolen or malfunctioning mobile stations can be locked and
sometimes even localized. It allows stolen or fraudulent mobile stations to be
identified

IFA’2006 ECE4833 20
 Network and Switching Subsystem

– Authentication Center (AUC)

Authentication Center (AUC) is accessed by HLR to authenticate a user for

service.

It contains authentication and encryption keys for subscribers

Generates user specific authentication parameters on request of a VLR

Authentication parameters used for authentication of mobile terminals and

encryption of user data on the air interface within the GSM system

IFA’2006 ECE4833 21
 Handoff (Handover in Europe)

 Two types
– Internal: between BTSs that belong to the same BSSs
– External: between two different BSSs controlled by the same
MSC
 Sometimes there are handoffs between BSSs that are controlled by
two different MSCs (the old MSC continues to handle call
management)

 Reasons to handoff:
– Signal strength deterioration at the edge of a cell
– Traffic balancing (to easy traffic congestion)

IFA’2006 ECE4833 22
 4 Types of Handover
1
2 3 4
MS MS MS MS

BTS BTS BTS BTS

BSC BSC BSC

MSC MSC
 Intra-cell: due to narrowband interference need to switch to another frequency
 Inter-cell, intra-BSC: MS moves from one cell to another, but stays within the control of the
same BSC
 Inter-BSC, intra-MSC: between cells controlled by different BSCs (handover controlled by the
MSC)
 Inter MSC: between cells belonging to different MSCs

IFA’2006 ECE4833 23
 GSM – TDMA/FDMA
(124 Frequencies; in each Freq there are 8 channels (time slots))

935-960 MHz
cy 124 channels (200 kHz)
Downlink
en
qu
fre

890-915 MHz
124 channels (200 kHz) Uplink
Each channel is separated time
in time via a frame
GSM TDMA Frame
1 2 3 4 5 6 7 8
4.615 ms
Each frame is subdivided
into 8 GSM time-slots Each slot represents a
GSM Time-Slot (normal burst) physical TDM channel
guard guard and lasts for 577 µs
tail user data S Training S user data S tail space
space
3 bits 57 bits 1 26 bits 1 57 bits 3
8.25 8.25 S: Stealing bit
577 µs
Each TDM channel occupies the 200 kHz carrier for 577 µs every 4.615 ms
IFA’2006 ECE4833
 GSM-Time Slot (Burst Period)
1 time slot  156.25 bit durations = 0.577 µ s
Bit rate  270.833 kbps

Tail (Trail Bits): Allow synchr. of transmissions from MSs

located at different distances from the BS.
Consist of 0s.
User Bits: User data encrypted in blocks by conventional
encryption of 114 plaintext bits into 114
ciphertext bits; the encrypted bits are then placed
in two 57 bit fields in the time slot.

IFA’2006 ECE4833 25
 GSM-Time Slot (Burst Period)

Stealing Bit:
Used to indicate whether this block contains data or is “stolen” for
urgent control signalling.

Training Bits:
Allow the receiver to synchronize itself; enables MSs and BSs to
determine that the received signal is from the correct transmitter and
not a strong interfering transmitter.
They are also used for multipath equalization, extracts the desired signal
from unwanted reflections.

IFA’2006 ECE4833 26
 GSM Physical Channels
TDMA frame = 4.615 ms

Timeslot 1 2 3 4 5 6 7 8
Frequency 1 Ch 1 Ch 2 Ch 3 Ch 4 Ch 5 Ch 6 Ch 7 Ch 8

Frequency 2 Ch 1 Ch 2 Ch 3 Ch 4 Ch 5 Ch 6 Ch 7 Ch 8

: :
: :

Frequency 124 Ch 1 Ch 2 Ch 3 Ch 4 Ch 5 Ch 6 Ch 7 Ch 8

IFA’2006 ECE4833 27
 GSM-Channels
 The total RF Spectrum (~50 MHz) is located in 890-915 MHz
(upstream) and 935 – 960MHz (downstream)

 This spectrum is divided into 124 RF carriers of 200KHz.

 The offset of the upstream/downstream pairing is fixed 45 MHz.

 Each RF carrier is further divided into 8 time slots (TDMA)-physical

channels

 There is no pre-assignment of any channels to a specific and

exclusive use.

IFA’2006 ECE4833 28
 GSM Hierarchy of Frame Structure

Hyperframe (=2048 superframes=2,715,648 frames=21,725,184slots)

0 1 2 ... 2045 2046 2047 3 h 28 min 53.76 s

perframe (=51 multiframes))

0 1 2 ... 48 49 50 6.12 s

Multiframe (traffic multiframes)=51 FRAMES

0 1 2 ... 48 49 50 235.4 ms

Frame: 8 burst of time slots

0 1 ... 6 7 4.615 ms
slot
burst 577 µs

IFA’2006 ECE4833 29
 GSM Hierarchy of Frame Structure

Hyperframe (=2048 superframes=2,715,648 frames=21,725,184slots)

0 1 2 ... 2045 2046 2047 3 h 28 min 53.76 s

Superframe (=26 multiframes))

6.12 s
0 1 ... 24 25
Multiframe ( control multiframes)
0 1 ... 24 25 120 ms

Frame: 8 burst of time slots

0 1 ... 6 7 4.615 ms
slot
burst 577 µs

IFA’2006 ECE4833 30
 REASON FOR FRAME HIERARCHY

* Needed to identify the location of certain bursts

among the large stream of bursts that are directed
toward different MSs.
* Each MS needs a a number of counters to track
the related packets at different levels of the
hierarchy.
* GSM radio interface has several traffic and control
channels defined in a hierarchy built upon the basic
8-slot TDMA transmission format.
IFA’2006 ECE4833 31
 GSM Logical Channel Structure

TCH CCH CBCH

TCH/F TCH/H

BCH CCCH DCCH

FCCH SCH BCCH PCH AGCH RACH ACCH SDCCH

SACCH FACCH

IFA’2006 ECE4833 32
 GSM Channel Types
 3 groups of logical (i.e., Virtual Circuits) channels, TCH, CCH
and CBCH, which are realized on top of physical channels.
 TCH (Traffic Channel) (BS <-> MS)
To carry voice or data traffic of the users
 CCH (Control Channel)
For control and signaling functions
 CBCH (Cell Broadcast Channel)
For broadcast functions from a service center to a
MS in a cell
area.
IFA’2006 ECE4833 33
 GSM Logical Channels

 Traffic (TCH) Channels:

Two-way, carrying voice and data

– Full-rate traffic channels (TCH/F)

– Half-rate traffic channels (TCH/H)

– Full rate channel may carry 13 kbps speech or data at

12, 6, or 3.6 kbps
– Half rate channel may carry 6.5 kbps speech or data at
6 or 3.6 kbps

IFA’2006 ECE4833 34
 GSM Logical Channels, cont..

 CCH consists of 3 groups of logical control channels, BCH, CCCH and

DCCH
 BCH (Broadcast Channel):
Point-to-multipoint downlink only.
Contains three sub-channels, BCCH, FCCH and SCH
– BCCH (Broadcast Control Channel):
Used by the BTS to broadcast synchronization parameters,
available services, and cell ID.
I.o.w. sending cell identities, organization info about common
control channels, cell service available, etc.

IFA’2006 ECE4833 35
 GSM Logical Channels
– FCCH (Frequency Correction Channel):
An MS uses it to synchronize its carrier frequency and
bit timing.

– SCH (Synchronization Channel):

Used by the BTS to broadcast frame synchronization
signals to all MSs;
I.o,w., send TDMA frame number and base station
identity code to synchronize MSs.

IFA’2006 ECE4833 36
 GSM Logical Channels, cont…

 CCCH (Common Control Channel) One way:

Consists of three sub-channels, PCH, AGCH and RACH.
These channels are used for paging and access

- PCH (Paging Channel): Used by BTS to page the MS

– AGCH (Access Grant Channel):
to assign MSs to stand-alone dedicated control channels for initial
assignment; Used by the MS to access the BTS for call establishment
– RACH (Random Access Channel): for MS to send requests for
dedicated connections; for the acknowledgement from the BTS to the MS
after a successful attempt by MS using RCH.

IFA’2006 ECE4833 37
 GSM Logical Channels, cont…

 DCCH (Dedicated Control Channel): bi-directional

point-to-point -- main signaling channels. Consist of
two sub-channels, SDCCH and ACCH
– SDCCH (Stand-alone Dedicated Control Channel):
for service request, subscriber authentication,
equipment validation, assignment to a traffic
channel; Call establishment and mobility management

IFA’2006 ECE4833 38
 GSM Logical Channels, cont…

– ACCH consists of two sub-channels, SACCH and FACCH

SACCH (Slow Associated Control Channel): for out-of-band
signaling associated with a traffic channel, e.g., signal
strength measurements; Assigned to each TCH and SDCCH. Used to
exchange parameters between the BTS and the MS to maintain the link.

FACCH (Fast Associated Control Channel): for preemptive

signaling on a traffic channel, e.g., for handoff messages;
Used to support fast transitions in the channel when SACCH is not adequate.

IFA’2006 ECE4833 39