SMART Communications, Inc.

SYSTRA

Introduction to GSM

 Problem: Beginning of 1980s European countries were using many

and different incompatible mobile
phone systems. Increased needs for
telecommunication services
Action by CEPT:
CEPT founded a group to
specify a common mobile system for
WESTERN EUROPE
Name of the Group and System:
GSM
Groupe Speciale Mobile
Global System for Mobile Communications

 GSM Requirements and Specifications Set:

Several operators in each country
Open system
No major changes on the existing PSTN

Pan European
Good speech quality
Efficient use of Radio frequencies
High/Adequate capacity
Compatible with ISDN and w/ other data
communication specifications
Good security for both subscriber and
transmitted information.

 Evolution of GSM

(Short History)

1982 - CEPT initiated a new cellular system.

Reserve
frequencies in 900 MHz band
for GSM
1985
- CEPT time schedule and action plan

1986 - CEPT tested 8 experimental systems in

Paris
1987 - Allocation of frequencies for uplink and
downlink
1988
- ETSI created. Members fr. admin, industry & user
grps - Final recommendations for GSM Phase I
1989
1990 - Validation sys. Implemented. 1st GSM
World
congress in Rome with 650
participants
1991 - First official call in the world with GSM on
July
1 - Worlds first GSM network in Finland. By
1992
December 13 networks in 7 areas.
Australian
operators first non-European
signatories of GSM
MoU. New
frequency allocation for uplink and
downlink for GSM 1800

 Evolution of GSM

(Contd..)

1993 - GSM demonstrated in Africa.

Roaming agreement between several
operators
GSM networks operating in 18 areas by
1994 - 32
First GSM network in South Africa
December
GSM phase 2 data/fax bearer services
69 GSM networks in operation by December
GSM MoU with 156 members from 86 areas
GSM World Congress in Madrid with 1400
participants.
1995 - 117 GSM Networks in operation around the
world
Fax, data and SMS roaming were implemented.
GSM phase 2 standardization completed
including
adaptation
for GSM 1900.
1st GSM 1900
1996 - 120 Networks
in operation.
8K SIM
network
US
launchedinand
Pre-Paid GSM SIM Cards
1998 - Over 2 million GSM 1900 users in US and a total
of
120 million GSM 900/1800/1900 users worldwide.

Advantage of GSM:
Digital Radio Path = system tolerates more
inter-cell interference, thus efficient use of RF
Better Quality of speech
Data transmission is supported
New services offered due to ISDN
compatibility
International Roaming possible
Large market = increased competition and
lower investment for operators and rates for
users.

Three Subsystems in GSM Network

Network Switching Subsystem (NSS)
Base Station Subsystem (BSS)
Network Management System

Traffic Management

Basic Service of Telephone

Networks
Connect two people
(set-up and maintain the call)
Involved Tasks:
Identify the called person
Determine his location
Route the call to him
Sustain the connection until conversation is
over.
Subscriber must be LOCATED and IDENTIFIED
Charge
the caller
to
be able to provide him with requested
SERVICES

 How does the network keep track

of the subscribers?
Through LOCATION UPDATE
Through the help of various
DATABASES

The First Database

The Subscriber Identity Module (SIM)
a small memory device mounted on a
card that contains user specific
identification
the SIM + mobile equipment = mobile
station (MS), a device able to access
services in a GSM network via the Air
interface.

Mobile
Equipment

Subscriber
Identity
Module

Air
Interface

Mobile
Station

GSM
Network

The Second
Database
The Visitor Location Register (VLR)
database which temporarily keeps
record of subscribers currently located
in the service area of the MSC

Visitor
Locatio
n
Registe
r

Mobile Switching Center

The Third Database

The Home Location Register (HLR)
database which permanently keeps
record of basic identification data of the
subscribers including their current
location (variable) equivalent to a VLR
address.

Home Location
Register

Location Update Procedures:

MS

BSS

MSC

VLR

HLR

LOCATION UPDATE REQUEST

REQUEST SUBS ID
SEND SUBS ID
REQUEST SUBS INFO
SEND SUBS INFO
AUTHENTICATION
AUTHENTICATION RESPONSE
HLR UPDATE

Call Set-Up in a GSM Network:

MSISDN = CC +NDC +SN
CC = Country Code
NDC = National Destination Code
SN = Subscriber #
IMSI = MCC + MNC + MSIN ( fixed 15 digits )
MCC = Mobile Country Code
MNC = Mobile Network Code
MSIN = Mobile Subscriber Identification #
LAI = MCC + MNC + LAC
MCC = Mobile Country Code (of visiting country)
MNC = Mobile Network Code(of serving PLMN)
LAC = Location Area Code

Location Update
Location Registration (power
on) IMSI Attach.
Generic - every time MS detects a
change in Location
Area
Periodic - location updates at
regular intervals set by the
operator. (default 7 hours)

First time Location Update (1)

HLR DB

MSISDN
IMSI
VLR Address
63+918+9499247 310+02+1234567890
vlr2

Sub. Data
services

HLR
Loc Up

IMSI Request
MSC
VLR2
VLR1 Authen

MSC

BSC
1

IMSI

BTS
1

Loc Up + TMSI
LAI 1

MS

Generic Location Update

HLR

Subscriber Info
TMSI + LAI

Del old
data

Update
TMSI

BTS
MSC
BSC
1
Authentication
VLR1
VLR2
1
IMSI
Loc Up + new TMSI
Security Info

MSC

MS

LAI 1

Call Establishment (PSTNO-MT)

HLR DB

MSISDN
IMSI
VLR Address
63+918+9499247 310+02+1234567890
vlr2

HLR
Enquiry

HLR

MSISDN

PSTN
MSISDN
A
MSISDN (B)
CC+ NDC + SN
63 918
9499247

Sub. Data
services

IMSI = MCC+MNC+MSIN

MSC 1

IMSI
MSC 2

VLR1

VLR DB

VLR2

BSC1

IMSI
MSRN
LAI
DATA
310+02+1234567890
1
MSRN
services
POOL MSRN = CC+NDC+SN

BTS
1

LAI 1

B B

MS

Paging
What the network does to locate the
called subscriber.
Service Area of VLR is divided into
smaller areas called Location Areas (LA)
LAI - Location Are Identity
LAI = MCC + MNC +LAC

VLR knows the LA of the subscriber

All the BTSs within that LA is paged for
the subscriber.

Call Establishment (MO-PSTNT)

MSISDN (A)
CC+ NDC + SN
63 2
5113580

HLR

MSISDN

PSTN

MSC
VLR1

MSC
VLR2

BSC
1

BTS
1

LAI 1
A

MS

Call Establishment (MO-MT)

HLR DB

MSISDN
IMSI
VLR Address
63+918+9499247 310+02+1234567890
vlr1

Sub. Data
services

HLR
IMSI = MCC+MNC+MSIN

IMSI

MSC
VLR1
VLR DB
IMSI

MSRN

HLR Enquiry
MSISDN

MSC
VLR2

MSISDN
BTS
1

BSC
1

LAI 1

LAI Services
2
Speech

MSRN
MSRN = CC+NDC+SN

B B

MS

BSC
2

BTS
2

MS

LAI2

MSISDN (C)
CC+ NDC + SN
63 918 9499247

Handover
The process by which an ongoing call
handled by one cell is transferred to
another cell.
Two reasons for Handover:
Handover due to Measurements
Handover due to Traffic Reasons

Four Types of Handover:

Intra
Inter
Inter
Inter

cell - Intra BSC Handover

cell - Intra BSC Handover
cell - Inter BSC Handover
MSC Handover

Handover (1)
HLR

PSTN

MSC/VLR 1

MSC/VLR 2

BSC2

BSC1

BSC3

A
BTS1
Measurement Report

BTS2

BTS3

BTS4

Handover (2)
HLR

PSTN

MSC/VLR 1

MSC/VLR 2

BSC2

BSC1

BSC3

A
BTS1

BTS2

BI am OK

BTS3

BTS4

Handover (3)
HLR

PSTN

MSC/VLR 1

MSC/VLR 2

BSC2

BSC1

BSC3

A
BTS1

BTS2

Measurement Report

BTS3

BTS4

Handover (4)
HLR

PSTN

MSC/VLR 1

MSC/VLR 2

BSC3

BSC2

BSC1

A
BTS1

BTS2

BTS3

BI am OK

BTS4

Handover (5)
HLR

PSTN

MSC/VLR 1

MSC/VLR 2

BSC3

BSC2

BSC1

A
BTS1

BTS2

BTS3

Measurement Report

BTS4

Handover (6)
HLR

PSTN

MSC/VLR 1

MSC/VLR 2

BSC2

BSC1

BSC3

A
BTS1

BTS2

BTS3

BTS4

I am OK

Handover (7)
HLR

PSTN

MSC/VLR 1

MSC/VLR 2

BSC2

BSC1

BSC3

A
BTS1

BTS2

BTS3

BTS4

GSM Security Management

AC

VLR

BTS

Air Interface

ME

SIM

RAND
Ki

A3

Authentication

SRESCOMPARING

SRES

A3

Request of IMEI

IMEI Checking

EIR

Traffic
A8

Kc

ME
Provide IMEI

Ciphering
A5

EncryptedData
Data
Encrypted

Traffic
A5

Kc

A8

Ki

Transmission

AIR INTERFACE
Frequency Allocation
Radio Channel
DOWNLINK
935 - 960 MHz
1805-1880 MHz

UPLINK
890-915 MHz
1710-1785 MHz
Mobile

Cell Site
Air Interface

COMPARISON
TACS
GSM 900
DCS 1800
Uplink
890 - 905 MHz
890 - 915 MHz
1710 - 1785 MHz
Downlink
935 - 950 MHz
935 - 960 MHz
1805 - 1880 MHz
Duplex Distance
45 MHz
45 MHz
95 MHz
Carrier Separation
25 kHz
200 kHz
200 kHz
Number of Channels
15 Mhz / 25 kHz = 600 25 MHz / 200 kHz = 124 75 MHz / 200 kHz = 374
Channels defined in Switch 1, 2, .599, 600
1, 2, .123, 124
512 , 513 .884, 885
Access Method
FDMA
TDMA
TDMA

Terminologies
Uplink - signal flow from MS to BTS
Downlink - signal flow from BTS to MS
Transceivers (TRX) - devices in the BTS
that transmit and receive radio signals in
each of the GSM channels.
Implementation of Digital Radio
Transmission in GSM:
FDMA (Frequency Division Multiple Access)
TDMA (Time Division Multiple Access)

Modulation
Gaussian Minimum Shift Keying

LOGICAL CHANNELS
Common Channels - used for
broadcasting different info to MS and
setting up of signaling channels
between MSC/VLR and the MS
Dedicated Channels - used to
facilitate the discussions between
the MS and the BTS, BSC and
MSC/VLR.

LOGICAL CHANNELS
On every physical channel, a number of
logical channels are mapped. Each logical
channel is used for a specific purpose.

11 Logical Channels in the GSM system:

2 are used for Traffic
9 are used for Control Signaling

LOGICAL CHANNELS
TRAFFIC CHANNELS (TCH)
Full Rate Channel
Half Rate Channel

CONTROL CHANNELS (with horrible abbreviations!)

Broadcast Channels (BCH)
Frequency Correction Channel (FCCH)
Synchronization Channel (SCH)
Broadcast Control Channel (BCCH)

Common Control Channels (CCCH)

Paging Channel (PCH)
Random Access Channel (RACH)
Access Grant Channel (AGCH)

Dedicated Control Channels (DCCH)

Stand alone Dedicated Control Channel (SDCCH)
Slow Associated Control Channel (SACCH)
Fast Associated Control Channel (FACCH)

BROADCAST CHANNELS
FCCH = FREQUENCY CORRECTION CHANNEL
=> To tell the Mobile that this is the BCCH carrier
=> To able the Mobile to synchronize to the frequency
(Downlink only)
SCH = SYNCHRONISATION CHANNEL
=> Used for sending BSIC (Base station Identity Code)
=> Give TDMA frame number to the Mobile.
(Downlink only)
BCCH = BROADCAST CONTROL CHANNEL
=> Used for sending information to the mobile like
CGI (Cell Global identity), LAI (Location Area Identity),
BCCH carriers of the neighboring cells,
maximum output power allowed in the cell and other
broadcast messages like barred cell. (Downlink only)

COMMON CONTROL CHANNELS

PCH = PAGING CHANNEL
=> Used for paging the Mobile. (Downlink only)
Reason could be an incoming call or an incoming Short Message.
RACH = RANDOM ACCESS CHANNEL
=> Used for responding to the paging (terminating), Location updating
or to make call access (originating) by asking for a signaling channel.
(Uplink only)
AGCH = ACCESS GRANT CHANNEL
=> Used to allocate SDCCH to the mobile.
(Downlink only)

DEDICATED CONTROL CHANNELS

SDCCH = STAND ALONE DEDICATED CONTROL CHANNEL
=> Used for allocating voice channel (TCH) to the mobile (call setup) and
Location updating.
=> Send Short Text message to Idle Mobile
(Uplink & Downlink)
SACCH = SLOW ASSOCIATED CONTROL CHANNEL
=> Used for sending information to the mobile like
CGI (Cell Global identity), LAI (Location Area Identity),
BCCH of all the neighbors and TA (Timing Advance)
=> Send Short Text message to Busy Mobile
(Downlink
=> Used for sending signal strength & bit error rate measurement of the
serving cell and signal strength of the BCCHs of the neighboring cells.
(Uplink)
FACCH = FAST ASSOCIATED CONTROL CHANNEL
=> Used for handover. (Uplink & Downlink)

CBCH = CELL BROADCAST CHANNEL

=> Used for sending short messages to all the mobiles within a geographic area.
Typical example is Traffic congestion in a major road or a major accident
in an area. Up to 93 characters can be sent.
=> If the mobile is in the Idle mode then the short message will be send through
the CBCH. If the mobile is Busy, it will not be sent.

NOT TO BE CONFUSED WITH SMS !!!!!!!!

(SHORT MESSAGE SERVICE)
=> SMS messages are short TEXT messages up to 160 characters in length that you
can send or receive. The messages are not sent straight to the other mobile but is
sent to message centre operated by the Network provider.
=> If the mobile was switched off or is at outside of the coverage area,
the message is stored in the Message Service Center. The message
will be offered to the subscriber when the mobile is switched on again
or has reentered the coverage area again.
=> If the mobile is in the Idle mode the short message will be send through
the SDCCH. If the mobile is Busy the short message will send through
the SACCH.

BROADCAST CHANNELS
all downlink!
Hey. Im a
GSM xmitter!

GSM?

FCCH
GSM!!!
SCH TDMA#BSIC...

BCCH
LAneigborscell infomax power...
Hey! Dont shout
at me, lower your
power...

Okok

COMMON CONTROL CHANNELS

Hello! You have a call.

PCH downlink only

RACH uplink only

AGCH downlink only

Ok. Use SDCCH.

Hello! I have to set

up a call.
I need SDCCH.

DEDICATED CONTROL CHANNELS

uplink and downlink
On SDCCH:

SDCCH

SACCH
timing advance
MS power

-call set up signaling

-location updating
-periodic registration
-IMSI attach/detach
-SMS
-facsimile
etc..
On SACCH
-mobile transmits signal
strength on ncell quality

FACCH
handover

Dont shout
at me.
I cant hear
you little
butt.

1 TDMA FRAME
200 kHz
4.615 ms
0.577 ms
TS 0

TS 1

TS 2

TS 3

TS 4

TS 5

TS 6

TS 7

FCCH,
SCH,
BCCH
PCH,
RACH,
AGCH

SDCCH,
SACCH
CBCH

TCH,
SACCH
FACCH

TCH,
SACCH
FACCH

TCH,
SACCH
FACCH

TCH,
SACCH
FACCH

TCH,
SACCH
FACCH

TCH,
SACCH
FACCH

F = FCCH
S = SCH
B = BCCH
C = PCH or
AGCH
D = SDCCH
A = SACCH
T = TCH

4.615 ms

4.615 ms

TS0 TS1 TS2 TS3 TS4 TS5 TS6 TS7

TS0 TS1 TS2 TS3 TS4 TS5 TS6 TS7

F
S
B
B
B
B
C
C
C
C
F
S
C
C
C
C
.
.
.

D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
.
.
.

T
T
T
T
T
T
T
T
T
T
T
T
A
T
T
T
.
.
.

T
T
T
T
T
T
T
T
T
T
T
T
T
T
T
T
.
.
.

T
T
T
T
T
T
T
T
T
T
T
T
A
T
T
T
.
.
.

T
T
T
T
T
T
T
T
T
T
T
T
T
T
T
T
.
.
.

T
T
T
T
T
T
T
T
T
T
T
T
A
T
T
T
.
.
.

T
T
T
T
T
T
T
T
T
T
T
T
T
T
T
T

1 Frame
(Downlink - BTS transmit)
1 carrier = 200 kHz

.
.
.

R = RACH
A = SACCH
T = TCH

R
R
R
R
R
R
R
R
R
R
R
R
R
R
R
R
.
.
.

D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
D
.
.
.

T
T
T
T
T
T
T
T
T
T
T
T
A
T
T
T
.
.
.

T
T
T
T
T
T
T
T
T
T
T
T
I
T
T
T
.
.
.

T
T
T
T
T
T
T
T
T
T
T
T
A
T
T
T
.
.
.

T
T
T
T
T
T
T
T
T
T
T
T
I
T
T
T
.
.
.

T
T
T
T
T
T
T
T
T
T
T
T
A
T
T
T
.
.
.

T
T
T
T
T
T
T
T
T
T
T
T
I
T
T
T

1 Frame
(Uplink - Mobile transmit)
1 carrier = 200 kHz

.
.
.

Thank you very much . . .

from Smart Communications

Downlink
Uplink

..

0 1 2 3 4 5 6 7

5 6 7 0 1

0 1

2 3 4 5 6

3 TIMESLOT
3 * 0.577ms = 1.73ms

2 3 4 5

6 7 0 1 2 3 4 5 6 7

...

0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7

3 TIMESLOT
3 * 0.577ms = 1.73ms

..

3 TIMESLOT
3 * 0.577ms = 1.73ms

TCH UP-DOWNLINK OFFSET

This means that the mobile does not transmit and receive at the same time.