GSM Concepts

Telcom Global Solutions Inc.
t he par t ner of c hoi c e i n t he w i r el ess w or l d

SM
SM
ONE PANORAMA CENTER,7701 L AS COL I NAS RI DGE, SUI TE 240 I RVI NG, TEXAS 75063 USA
tel: (972) 830-6500 Fax: (972) 830-6503 Web: www.telcomglobalsolutions.com
Global System for Mobile Communications
TECH0002A Introduction to GSM Concepts
SM
SM
SM
SM
Contents
Introduction
Transition from Analog to Digital System
GSM Subscriber Services
Network Architecture
Network Areas
The Network Switching Subsystem (NSS) or (SSS)
The Radio Subsystem (RSS), or Base Station Subsystem (BSS)
The Operation Support Subsystem (OSS)
Frequency Of Operation
GSM-900 Channel Structure
Burst Structure
Physical Channels and Logical Channels
Inter -BTS Synchronization
SM
SM
Contents
Handover
Synchronized handover
Pseudo-Synchronized handover
Pre-Synchronized handover
Physical Layer Specifications
GSM Channel Generation
GSM Speech Coding
GSM Channel Coding
GSM Interleaving
GSM Ciphering
GSM Authentication
Gaussian Minimum Shift Keying (GMSK) Modulation
Slow Frequency Hopping
Discontinuous transmission and Reception
SM
SM
Contents
GSM Network Protocols
Air Interface Um
LAPDm
Radio Resources Management
Mobility Management
Connection Management
Abis Interface
LAPD (Link Access Protocol D)
Radio Signaling Link
Operation and Maintenance Link
Difference between LAPD and LAPDm
A-Interface
BSSAP (DTAP, BSSMAP)
SM
SM
Contents
Network Signaling Types
SS7 Signaling Protocols
Mobile Application Part
IS-41 and GSM
GSM-Future Trends
SM
SM
Introduction
The Global System for Mobile communications is a second generation TDMA based
digital cellular communications system. It was developed in order to create a common
European mobile telephone standard but it has been rapidly accepted worldwide.
In the beginnings of cellular systems development, each country developed its own
system, which was an undesirable situation for the following reasons:
The equipment was limited to operate only within the boundaries of each country.
The market for each mobile equipment was limited.
SM
SM
Introduction
In order to overcome these problems, the Conference of European Posts and
Telecommunications (CEPT) formed, in 1982, the Groupe Spcial Mobile (GSM) in
order to develop a pan-European mobile cellular radio system (the GSM acronym
became later the acronym for Global System for Mobile communications).
The standardized system had to meet certain criterias:
Spectrum efficiency
International roaming
Low mobile and base stations costs
Good subjective voice quality
Compatibility with other systems such as ISDN (Integrated Services Digital Network)
Ability to support new services
SM
SM
Introduction
In 1989 the responsibility for the GSM specifications passed from the CEPT to the
European Telecommunications Standards Institute (ETSI).
The aim of the GSM specifications is to describe the functionality and the interface for each
component of the system, and to provide guidance on the design of the system.
These specifications will then standardize the system in order to guarantee the proper inter-
working between the different elements of the GSM system.
In 1990, the phase I of the GSM specifications were published but the commercial use of GSM
did not start until mid-1991.
SM
SM
Event Log
Year Events
1982
CEPT establishes a GSM group in order to develop the standards for a
pan-European cellular mobile system
1985 Adoption of a list of recommendations to be generated by the group
1986
Field tests were performed in order to test the different radio techniques
proposed for the air interface
1987
TDMA is chosen as access method (in fact, it will be used with FDMA)
Initial Memorandum of Understanding (MoU) signed by telecommunication
operators (representing 12 countries)
1988 Validation of the GSM system
1989 The responsability of the GSM specifications is passed to the ETSI
1990 Appearance of the phase 1 of the GSM specifications
1991 Commercial launch of the GSM service
1992
Enlargement of the countries that signed the GSM- MoU> Coverage of
larger cities/airports
1993 Coverage of main roads GSM services start outside Europe
1995 Phase 2 of the GSM specifications Coverage of rural areas
SM
SM
In the 1980s most mobile cellular systems were based on analog systems. The GSM
system can be considered as the first digital cellular system. The different reasons that
explain this transition from analog to digital technology are
The capacity of the system
Cellular systems have experienced a very significant growth in 80s.
Analog systems were not able to cope with this increasing demand.
In order to overcome this problem, new frequency bands and new technologies were proposed.
But the possibility of using new frequency bands was rejected by a big number of countries
because of the restricted spectrum (even if later on, other frequency bands have been allocated
for the development of mobile cellular radio). The new analog technologies proposed were able
to overcome the problem to a certain degree but the costs were too important.
The digital radio was, therefore, the best option to handle the capacity needs in a cost-efficiency
way.
SM
SM
Aspects of quality
The quality of the service can be considerably improved using a digital technology rather than
an analog one.
In fact, analog systems pass the physical disturbances in radio transmission (such as fades,
multipath reception, spurious signals or interferences) to the receiver. These disturbances
decrease the quality of the communication because they produce effects such as fadeouts,
crosstalks, hisses, etc.
On the other hand, digital systems avoid these effects transforming the signal into bits. This
transformation combined with other techniques, such as digital coding, improve the quality of
the transmission.
The improvement of digital systems comparing to analog systems is more noticeable under
difficult reception conditions than under good reception conditions.
SM
SM
Compatibility with other systems such as ISDN
The decision of adopting a digital technology for GSM was made in the course of developing
the standard.
During the development of GSM, the telecommunications industry converted to digital
methods. The ISDN network is an example of this evolution.
In order to make GSM compatible with the services offered by ISDN, it was decide that the
digital technology was the best option.
Additionally, a digital system allows, easily than an analog one, the implementation of future
improvements and the change of its own characteristics.
SM
SM
GSM Services
Categories of Service
Tele-Services
Bearer services
Supplementary services
CATEGORY SERVICE
Telephony
Emergency Calls
Short Message Service(SMS)
Telefax
Asynchronous Data
Synchronous Data
Asynchronous PAD*
Alternate Speech and Data
Telefax
Call Forwarding
Call Barring
GSM Phase-I Servi ces
*packet-switched, packet assembler, disassembler access
Teleservices
Bearer Services
Supplementary
Services
CATEGORY SERVICE
Telephony(Half rate)
Improvements in SMS
Calling /connected line identity
presentation and restriction
Call waiting
Call hold
Multi-party Communication(Conference)
Closed user group
On-line charge information
Unstructured supplementary services
data
Operator determined barring
Supplementary
Services
GSM Phase-II Servi ces
Teleservices
Bearer Services
Synchronous dedicated packed data
access
GSM Network Provides
Superior speech quality
Low terminal operational and service costs
High level of security
International roaming, Support of low power hand
portable terminals
SM
SM
Subscriber Services
There are two basic types of services offered through GSM: telephony (also referred to
as teleservices) and data (also referred to as bearer services).
Telephony services are mainly voice services that provide subscribers with the
complete capability (including necessary terminal equipment) to communicate with
other subscribers.
Data services provide the capacity necessary to transmit appropriate data signals
between two access points creating an interface to the network.
SM
SM
Subscriber Services
In addition to normal telephony and emergency calling, the following subscriber services are
supported by GSM:
dual-tone multi-frequency (DTMF)DTMF is a tone signaling scheme often used for various control purposes via
the telephone network, such as remote control of an answering machine. GSM supports full-originating DTMF.
facsimile group IIIGSM supports CCITT Group 3 facsimile. As standard fax machines are designed to be connected
to a telephone using analog signals, a special fax converter connected to the exchange is used in the GSM system. This
enables a GSMconnected fax to communicate with any analog fax in the network.
short message servicesA convenient facility of the GSM network is the short message service. A message consisting
of a maximum of 160 alphanumeric characters can be sent to or from a mobile station. If the subscriber's mobile unit is
powered off or has left the coverage area, the message is stored and offered back to the subscriber when the mobile is
powered on or has reentered the coverage area of the network. This function ensures that the message will be received.
cell broadcastA variation of the short message service is the cell broadcast facility. A message of a maximum of 93
characters can be broadcast to all mobile subscribers in a certain geographic area. Typical applications include traffic
congestion warnings and reports on accidents.
voice mailThis service is actually an answering machine within the network, which is controlled by the subscriber.
Calls can be forwarded to the subscriber's voice-mail box and the subscriber checks for messages via a personal security
code.
fax mailWith this service, the subscriber can receive fax messages at any fax machine. The messages are stored in a
service center from which they can be retrieved by the subscriber via a personal security code to the desired fax
number.
SM
SM
Subscriber Services
Supplementary Services
GSM supports a comprehensive set of supplementary services that can complement and support
both telephony and data services. Supplementary services are defined by GSM and are
characterized as revenue-generating features. A partial listing of supplementary services follows.
call forwardingThis service gives the subscriber the ability to forward incoming calls to another number if
the called mobile unit is not reachable, if it is busy, if there is no reply, or if call forwarding is allowed
unconditionally.
barring of outgoing callsThis service makes it possible for a mobile subscriber to prevent all outgoing
calls.
barring of incoming callsThis function allows the subscriber to prevent incoming calls. The following two
conditions for incoming call barring exist: baring of all incoming calls and barring of incoming calls when
roaming outside the home PLMN.
advice of charge (AoC)The AoC service provides the mobile subscriber with an estimate of the call
charges. There are two types of AoC information: one that provides the subscriber with an estimate of the bill
and one that can be used for immediate charging purposes. AoC for data calls is provided on the basis of time
measurements.
call holdThis service enables the subscriber to interrupt an ongoing call and then subsequently reestablish
the call. The call hold service is only applicable to normal telephony.
SM
SM
Subscriber Services
Supplementary Services
call waitingThis service enables the mobile subscriber to be notified of an incoming call during a
conversation. The subscriber can answer, reject, or ignore the incoming call. Call waiting is applicable to
all GSM telecommunications services using a circuit-switched connection.
multiparty serviceThe multiparty service enables a mobile subscriber to establish a multiparty
conversationthat is, a simultaneous conversation between three and six subscribers. This service is
only applicable to normal telephony.
calling line identification presentation/restrictionThese services supply the called party with the
integrated services digital network (ISDN) number of the calling party. The restriction service enables
the calling party to restrict the presentation. The restriction overrides the presentation.
closed user groups (CUGs)CUGs are generally comparable to a PBX. They are a group of
subscribers who are capable of only calling themselves and certain numbers.
SM
SM
Abis
u
m
A
ME
SIM
ME
SIM
A A
Abis Abis
u
m
u
m
SM
SM
Network Areas
In the GSM system, the network is divided into the following partitioned areas.
!GSM service area;
!PLMN service area;
!MSC service area;
!Location area (LA);
!Cells
GSM Service Area
SM
SM
Network Areas
GSM service area
The GSM service area is the total area served by the combination of all member-
countries where a mobile can be serviced.
PLMN service area
The next level is the PLMN service area. There can be several within a country, based
on its size.
The links between a GSM/ PLMN network and other PSTN, ISDN, or PLMN
networks will be on the level of international or national transit exchanges.
All incoming calls for a GSM/PLMN network will be routed to a Gateway MSC.
Call connections between PLMNs, or to fixed networks, must be routed through
certain designated MSCs called a gateway MSC
SM
SM
Network Areas
MSC/VLR service areas
! In one PLMN there can be several MSC/VLR service areas.
! MSC/VLR is a sole controller of calls within its jurisdiction.
! The mobile location can be uniquely identified since the MS is registered in a VLR,
which is generally associated with an MSC.
Location area
! There are several LAs within one MSC/VLR combination.
! A LA is a part of the MSC/VLR service area in which a MS may move freely
without updating location information to the MSC/VLR exchange that controls the
LA.
Cells
! Lastly, a LA is divided into many cells.
! A cell is an identity served by one BTS. The MS distinguishes between cells using
the Base Station Identification Code (BSIC) that the cell site broadcasts over the air
SM
SM
Network Areas
Location area (LA)
MSC/VLR service area
PLMN service area
SM
SM
A GSM system is basically designed as a combination of three major subsystems:
! The Network Switching Subsystem (NSS) or (SSS)
! The Radio Subsystem (RSS), or Base Station Subsystem (BSS)
! The Operation Support Subsystem (OSS)
SM
SM
The network subsystem includes the equipment and functions related to end-to-end
calls, management of subscribers, mobility, and interface with the fixed PSTN.
The network and the switching subsystem together include the main switching functions
of GSM as well as the databases needed for subscriber data and mobility management
In particular, the switching subsystem consists of
! Mobile Switch Center (MSC),
! Visitor Location Register (VLR),
! Home Location Register (HLR),
! Authentication Center (AUC), and
! Equipment Identity Register (EIR)
! Interworking Function (IWF)
SM
SM
The switching system (SS) is responsible for performing call processing and subscriber-
related functions. The switching system includes the following functional units.
Home location register (HLR)
The HLR is a database used for storage and management of subscriptions and
memorize administrative information of each subscriber in the GSM network but
also the current position of each MS
Each HLR is identified by the HLR number which is sensed to all the interested
VLRs
The HLR is considered the most important database. The HLR is the reference
database that permanently stores data related to subscribers, including a
subscriber's service profile, location information, and activity status. When an
individual buys a subscription from one of the PCS operators, he or she is
registered in the HLR of that operator.
SM
SM
Various identification numbers and addresses as well as authentication parameters,
services subscribed, and special routing information are stored stored in HLR.
Current subscriber status, including a subscriber's temporary roaming number and
associated VLR if the mobile is roaming, are maintained.
Location registration is performed by HLR
The HLR provides data needed to route calls to all MS-SIMs home based in its
MSC area, even when they are roaming out of area or in other GSM networks.
The HLR provides the current location data needed to support searching for and
paging the MS-SIM for incoming calls, wherever the MS-SIM may be.
The HLR is responsible for storage and provision of SIM authentication and
encryption parameters needed by the MSC where the MS-SIM is operating. It
obtains these parameters from the AUC.
SM
SM
The HLR maintains records of which supplementary services each user has
subscribed to and provides permission control in granting access to these services.
Based on described functions, different types of data are stored in HLR.
Some data are permanent; that is, they are modified only for administrative reasons,
while others are temporary and modified automatically by other network entities
depending on the movements and actions performed by the subscriber.
Some data are mandatory, other data are optional
Both the HLR and the VLR can be implemented in the same equipment in an MSC
(collocated).
A PLMN may contain one or several HLRs
SM
SM
Permanent HLR Data
IMSI It identifies unambiguously the MS in the
whole GSM system
International MS ISDN number: It is the directory
number of the mobile station
MS category specifies whether a MS is a pay
phone or not
Roaming restriction (allowed or not)
Closed user group (CUG) membership data
Supplementary services related parameters:
Forwarded-to number, registration status, no reply
condition timer, call barring password, activation
status, supplementary services check flag
Authentication key, which is used in the security
procedure and especially to authenticate the
declared identity of a MS
Temporary HLR Data
The temporary data consists of the
following.
LMSI (Local MS identity)
RAND/SRES and Kc; data related to
authentication and ciphering
MSRN;
VLR address, which identifies the VLR
currently handling the MS
MSC address, which identifies the MSC
area where the MS is registered
Roaming restriction;
Messages waiting data (used for SMS)
Temporary data changes from call to call. The HLR interacts with MSCs mainly for the procedures of
interrogation for routing calls to a MS and to transfer charging information after call termination
SM
SM
The principally functions of the HLR are:
! Localization of each MS, therefore the HLR communicate with the VLR
! Security, the HLR communicate with the AUC and with the VLR
! Call routing, therefore communication with the GMSC
! Management of the supplementary services
! Management of the phone bills
SM
SM
Mobile services switching center (MSC)
! Because of the GSM represents a independent network, it must dispose of entities
which provide the connection to other users. Therefore the main component of the
switching subsystem is the Mobile Services Switching Center, MSC.
! The main role of the MSC is to manage the communications between the GSM
users and other telecommunications network users. The basic switching function is
performed by the MSC, whose main function is to coordinate setting up calls to and
from GSM users.
! The MSC has interfaces with the BSS on one side (through which MSC VLR is in
contact with GSM users) and the external networks on the other
(ISDN/PSTN/PSPDN)
! An MSC is generally connected to several BSSs, which provide radio coverage to
the MSC area.
! MSC is also connected to other GSM PLMN entities such as other MSCs and HLR
through a fixed network.
SM
SM
Mobile services switching center (MSC)
! The MSC is the telephone switching office for mobile-originated or terminated
traffic.
! The MSC controls the call setup and routing procedures in a manner similar to the
functions of a land network end office.
! The MSC provides call setup, routing, and handover between BSCs in its own area
and to/from other MSC; an interface to the fixed PSTN; and other functions such
as billing
! It also performs such functions as toll ticketing, network interfacing, common
channel signaling, and others.
SM
SM
Paging
Coordination of call set up from all MSs in its
jurisdiction;
Dynamic allocation of resources;
Handover management;
Reallocation of frequencies to BTSs in its area
to meet heavy demands;
Specifically, the call-handling function of
paging is controlled by MSC. MSC
coordinates the set up of calls to and from all
GSM subscribers operating in its area.
Synchronization with BSSs;
The dynamic allocation of access resources
is done in coordination with the BSS. More
specifically, the MSC decides when and
which types of channels should be assigned
to which MS. The channel identity and
related radio parameters are the
responsibility of the BSS
Location registration;
Billing for all subscribers based in its area;
Encryption;
Signaling exchange between different
interfaces;
One MSC may interface several BSSs
Mobile services switching center Functions
SM
SM
Visitor location register (VLR)
! A VLR is linked to one or more MSCs. The function of the VLR is to memorize
temporarily information about the mobiles which are currently located in the
geographical area controlled by the linked MSC
! The VLR is a database that contains temporary information about subscribers that
is needed by the MSC in order to service visiting subscribers.
! The VLR supports a mobile paging and tracking subsystem in the local area where
the mobile is presently roaming
! The VLR is always integrated with the MSC. A VLR may be in charge of one or
several MSC LAs
SM
SM
When a mobile subscriber roams from one LA to another, their current location is
automatically updated in their VLR.
When a mobile station roams into a new MSC area If the old and new LAs are under the
control of two different VLRs, the VLR connected to that MSC will request data about
the mobile station from the HLR the entry on the old VLR is deleted and an entry is
created in the new VLR by copying the basic data from the HLR.
Later, if the mobile station makes a call, the VLR will have the information needed for
call setup without having to interrogate the HLR each time.
The subscriber's current VLR address, stored at the HLR, is also updated. This provides
the information necessary to complete calls to roaming mobiles
SM
SM
The following information are memorized in the VLR data base:
! IMSI (International mobile subscriber identity) - The IMSI is 15 digit
number and is composed of the Mobile country code (MCC), The
Mobile network code (MNC) and the Mobile subscriber identification
number (MSIN). In GSM unlike other standards the MSIN is not used as
the subscribers telephone number. To make subscriber tracking more
difficult the IMSI is used only as identifier when the temporary mobile
subscriber identity (TMSI) is not available for initial system connection
SM
SM
! MSISDN -Mobile subscriber ISDN,The directory number of mobile a
mobile can have several MSISDNs in parallel on one SIM, Different
numbers are used for different services voice, fax etc, Example 49 171
5205787 is the directory number of a subscriber to the D1 network of
Germany. The country code (CC) identifies a country or region (49
Germany 1 for US), the national destination code (NDC) identifies the
PLMN (171 for operator D1) and the subscriber number (SN) is unique
identifier within PLMN.
SM
SM
! MSRN (Mobile station roaming number) - A temporary identifier used
for mobile terminating calls to route a call from the gateway MSC to the
serving MSC/VLR . The serving MSC/VLR is the MSC/VLR in which
area the subscriber currently roams. The VLR assigns the MSRN when a
request for the routing information is received from the HLR. The
MSRN is released after the call has been setup . The MSRN is used
solely to route an incoming call and contains no information to identify
the caller or the called party.
SM
SM
! LMSI (Local Mobile Subscriber Identity) - A 4-byte long parameter
that the VLR assigns to a subscriber on a temporary basis. The intention
is to expedite queries in the VLR. When the LMSI is assigned both sides
don't only use the IMSI but also LMSI. Although there is no use for the
LMSI in the HLR,except for quarries to the VLR, it must be stored in the
HLR. Furthermore, it is required to send the LMSI whenever data
between the two databases are exchanged.
! Security Parameters
! HLR Number to identify the responsible HLR
! MS Status
SM
SM
! Temporary Mobile Subscriber Identity, TMSI the TMSI changes
always when the MS enter in another Location Area (LA). Used to
identify a mobile subscriber like IMSI. Unlike the IMSI, However the 4-
byte long TMSI has only temporary significance. The VLR assigns a
TMSI upon location registration for confidentiality purposes, so it is
required to transfer the IMSI over the air-interface frequently.
Assignment and use of the TMSI is only possible with active
ciphering.The TMSI can take any value, except FF FF FF FF
Hex
. This
value is reserved in case the SIM does not contain a valid IMSI.
! Supplementary Services
SM
SM
Authentication center (AUC)
! A unit called the AUC provides authentication and encryption parameters that
verify the user's identity and ensure the confidentiality of each call.
! The AUC protects network operators from different types of fraud found in today's
cellular world.
! The Authentication Center memorize the secret keys and the authentication
algorithms of each subscriber.
! The same information are also memorized on the subscriber`s SIM Card.
! The AUC does also control if the subscriber is allowed to enter in the network. The
authentication mechanism check the SIM without transmitting the personal
information on the radio channel.
! The authentication take place when the subscriber beg in a call, make a Location
Update or change the status of supplementary services. the AUC is a protected data
base.
SM
SM
Authentication center (AUC)
The AUC memorize the following information:
! IMSI
! Ki the authentication key
! TMSI Temporary Mobile Subscriber Identity
! LAI, Location Area Identity
! RAND Generator
! A3 and A8 algorithms
Equipment identity register (EIR)
The EIR is a database that contains information about the identity of mobile
equipment that prevents calls from stolen, unauthorized, or defective mobile stations.
The EIR is an optional register and therefore it must not be present in all the networks.
The EIR is also one of the registers used only for security, because it contains
information about the mobile equipment in the network.
SM
SM
Equipment identity register (EIR)
Each mobile equipment is identified by the International Mobile Equipment Identity
(IMEI) which is memorized by the manufacturer and cannot be removed. By the
registration mechanism the MS always send the IMEI to the network, so that the EIR can
memorize and assign them to three different lists:
! White List This list contains the IMEI of the phones who allowed to enter in the network
! Black List This list on the contrary contains the IMEI of the phones who are not allowed to enter
in the network, for example because they are stolen. Those phones aren`t able to enter in all the
GSM networks which dispose of a EIR
! Grey List This list contains the IMEI of the phones momentarily not allowed to enter in the
network, for example because the software version is too old or because they are in repair
By the registration mechanism the MSC check if the MS is contained in the Black or Grey
list, if so it is the mobile cannot enter in the network.
One EIR per GSM network is enough. In the future there will be an interconnection
between all the EIRs to avoid that a mobile stolen in one country can be used in a GSM
network from a different country.
The AUC and EIR are implemented as stand-alone nodes or as a combined AUC/EIR node.
SM
SM
IWF-Interworking Function
A subsystem in the PLMN that allows for non-speech communication between the GSM
and the other networks ( PSTN,ISDN,CSPDN,PSPDN) .
The tasks of an IWF are in particularly to adapt transmission parameters and protocol
conversion.
The physical manifestation of an IWF may be through a modem which is activated by the
MSC dependent on the bearer service and the destination network.
SM
SM
The radio subsystem includes the equipment and functions related to the management of
the connections on the radio path, including the
management of handovers. It mainly consists of a BSC, BTS, and the MS.
The GSM system is realized as a network of radio cells.
Each cell has a BTS with several transceivers. A group of BTSs are controlled by one
BSC.
BSC and BTS together are known as a BSS, These communicate across the standardized
Abis interface, allowing (as in the rest of the system) operation between components
made by different suppliers.
SM
SM
The BSS is a set of BS equipment (such as transceivers and controllers) that is in view by the
MSC through a single A interface as being the entity responsible for communicating with
MSs in a certain area.
The function split is basically between a transmission equipment, the BTS, and a managing
equipment at the BSC.
A BTS comprises radio transmission and reception devices, upto and including the antennas,
and also all the signal processing specific to the radio interface.
A BSC is a network component in the PLMN that functions for control of one or more BTS.
It is a functional entity that handles common control functions within a BTS.
The interface between the BSC and a remote BTS is a standard interface termed the A-bis.
SM
SM
BTS
BTS Encodes, encrypts, multiplexes, modulates and feeds the RF signals to the antenna;
Transcoding and rate adaptation (TRAU) ;
Time and frequency synchronization signals transmitted from BTS;
Voice communication through full rate or half rate (future date) speech channel;
Received signal from mobile is decoded, decrypted and equalized before demodulation;
Frequency hopping controlled such that no two MSs in the same BSC area are hopped
together;
Random access detection;
Timing advance;
Uplink radio channel measurements.
SM
SM
Transcoder/Rate Adapter Unit (TRAU)
The Transcoder/Rate Adapter Unit (TRAU) is the equipment in which coding and decoding is
carried out as well as the rate adaptation in case of data.
The transcoder takes 13-Kbps speech or 3.6/6/12-Kbps data and multiplexes four of them to
convert into standard 64-Kbps data.
First, the 13 Kbps or the data at 3.6/6/12 Kbps are brought up to the level of 16 Kbps by inserting
additional synchronizing data to make up the difference between a 13-Kbps speech or lower rate
data, and then four of them are combined in the transcoder to provide 64 Kbps.
Then, up to 30 such 64-Kbps channels are multiplexed onto a 2.048 Mbps if a CEPT1 channel is
provided on the A-bis interface
Depending on the relative costs of a transmission plant for a particular cellular operator, there may
be some benefit, for larger cells and certain network topologies, in having the transcoders either at
the BTS, BSC, or MSC location.
If the transcoder is located at MSC, they are still considered functionally a part of the BSS. This approach
allows for the maximum of flexibility and innovation in optimizing the transmission between MSC and
BTS.
If the transcoder/rate adapter is placed outside the BTS (part of BSC or MSC), the A-bis interface can only
operate on a 16-Kbps channel within the BSS. Four traffic channels can then be multiplexed on one 64-
Kbps circuit. Thus, the TRAU output data rate is 64 Kbps
SM
SM
SM
SM
BSC
The BSC provides all the control functions and physical links between the MSC and
BTS.
It is a high-capacity switch that provides functions such as handover, cell configuration
data, and control of radio frequency (RF) power levels in base transceiver stations.
A number of BSCs are served by an MSC.
BSC Functions
Radio Resource management for BTSs under its control;
Intercell handover; Reallocation of frequencies among BTSs;
Power management of BTSs;Time and frequency synchronization signals to BTSs;
Time delay measurement of the received signals from MSs with respect to BTS clock;
Controls frequency hopping;
Performs traffic concentration to reduce the number of lines from BSC to MSC and BTSs;
Provides interface to the Operations and Management for BSS
SM
SM
BTS-BSC Connection
Serial Connection (Line or Ring Topology)
In serial connection the BTSs are connected in a line or ring topology.
Only one BTS for the line topology or two BTSs for the ring topology are physically
connected to the BSC.
For the network operators the advantage of serial approach over the star approach is that
it saves lines costs.
The serial connection allows for efficient use of resources and this advantage becomes
particularly obvious when colocated or sectored BTSs are used.
The disadvantage of the line connection is that a single link failure causes the loss of
connection to a large number of BTSs. (For serial configuration). For that reason the use
of ring configuration provides some redundancy in which the signal can always go in
one or two directions so that in the event of link failure it is still possible to provide an
alternative connection.
SM
SM
BTS-BSC Connection
Serial Connection
SM
SM
BTS-BSC Connection
Serial Connection
SM
SM
BTS-BSC Connection
Star Connection
Star configuration was the most popular configuration when the first systems were
deployed in 1991-1992.
In star configuration every BTS has its own connection and an A-bis interface to BSC.
Disadvantage are the high costs of the line and a single link failure causes loss of a BTS.
SM
SM
BTS-BSC Connection
Star Connection
SM
SM
The Operation and Support System
The operations and maintenance center (OMC) is connected to all equipment in the
switching system and to the BSC.
The implementation of OMC is called the operation and support system (OSS).
The OSS is the functional entity from which the network operator monitors and controls
the system.
The purpose of OSS is to offer the customer cost-effective support for centralized,
regional, and local operational and maintenance activities that are required for a GSM
network.
An important function of OSS is to provide a network overview and support the
maintenance activities of different operation and maintenance organizations.
SM
SM
Additional Functional Elements
Message Center (MXE)
The MXE is a node that provides integrated voice, fax, and data messaging. Specifically, the MXE
handles short message service, cell broadcast, voice mail, fax mail, e-mail, and notification.
Mobile Service Node (MSN)
The MSN is the node that handles the mobile intelligent network (IN) services.
Gateway Mobile Services Switching Center (GMSC)
A gateway is a node used to interconnect two networks. The gateway is often implemented in an
MSC. The MSC is then referred to as the GMSC.
All the calls from the network to other networks are first routed to a special MSC ,the Gateway
Mobile Services Switching Centre, GMSC.
The GMSC is the interface between the GSM and other networks, for example the fixed networks
but also GSM network from other operators.
If for example a fixed network subscriber call a GSM subscriber the call at first is routed to the
GMSC.
The GMSC then asks the HLR which identify the responsible VLR and also the current position.
When the current position is known the GMSC is able to rout the call to the responsible MSC.
SM
SM
Additional Functional Elements
GSM Interworking Unit (GIWU)
The GIWU consists of both hardware and software that provides an interface to various
networks for data communications. Through the GIWU, users can alternate between speech and
data during the same call. The GIWU hardware equipment is physically located at the
MSC/VLR.
SM
SM
Mobile Terminal
Each terminal is identified by the IMEI (International mobile equipment Identity),
which is memorized in the mobile equipment. The IMEI is memorized by the
manufacturer and cannot be changed. The IMEI consists of:
IMEI = TAC / FAC / SNR / SP
TAC =Type Approval Code, this code identified the terminal
FAC =Final assembly Code, this code identified the manufacturer`s country
SNR =Serial number
SP =reserve
A list of relevant Mobile Terminal functions includes
Voice and data transmission;
Frequency and time synchronization;
Monitoring of power and signal quality of the surrounding cells for optimum handover;
Provision of location updates;
Equalization of multipath distortions;
Display of short messages up to 160 characters long;
Timing advance
SM
SM
Subscriber Identity Module- SIM
A GSM phone cannot be used without SIM Card. The SIM Card, which belongs to the
group of the smart cards, contains information about the user.
The SIM is part of the MS, because of the mobile station in GSM is split in two parts.
In analogue cellular systems this information are stored in a permanent memory of the
terminal, so it is quite difficult to change the number (the only exemption is the German
C-Netz).
The SIM dispose of a memory part and a micro-chip, which must be able to execute the
encryption algorithms. The technical characteristics of a SIM Card depend on the age,
so for example there are phase1,2 SIM Cards and the newest which are able to
memorize up to 16Kb.
SM
SM
The SIM Card contains the following information:
! IMSI, International Mobile Subscriber Identity
! TMSI, Temporary Mobile Subscriber Identity
! Ki, Individual Subscriber Authentication Key (Ki is an individual key that is different for
every SIM card. Its value is a number of upto 16 bytes which is used for authentication. Ki is
only known to the SIM card and AUC/HLR. Since data secuirty and protection from the misuse
essentially depends on this information the value of Ki is the most secret data of GSM world.
That is why Ki is not transmitted on any interface and is used only with in the SIM card and
AUC/HLR)
! A8, Ciphering Key Generation Algorithm
! A3, Authentication Algorithm
SM
SM
The SIM Card contains the following information:
! PIN and PIN2, Personal Identity Number - A four to eight digit number that provides limited
protection against unauthorized use. The PIN can be changed by the user and is stored in the
SIM. PIN is optional and can be disabled.
! PUK and PUK2, PIN Unblocking Key- A 10-digit code stored in the SIM , which in contrast
to PIN can not be altered by the user.
! Memory for phone numbers
! SMS messages
! Favorite Networks
! Memory for several services provided by GSM phase2
SM
SM
By inserting the SIM Card into a terminal, the user must digit a identification number,
the Personal Identification Number, PIN.
If the user digit a wrong PIN for three times, the SIM is not suitable at the moment and
so it is necessary that the user digit another code to restore the functionality of the SIM,
the PIN Unlocking Key, PUK.
If the user digit the PUK wrong too for ten times, the functionality of the SIM Card
cannot be restored and therefore the SIM will be useless.
Because of the introduction of new services by the GSM phase2 it was necessary to
protect a few parts of the cellular phone`s menu. The PIN2 and the PUK2 do this.
With the PIN and the PUK the SIM Card is efficiently protect against unauthorized
access.
SM
SM
MS consists of two main parts, the terminal and the SIM Card. The possibility that the
SIM can be removed and used in other phones is very interesting for the user. If a user
has got two mobile stations, for example one installed fixed on the car and the other one
a handheld terminal, he can use for both the same phone number. The only thing he
must do is to remove the SIM from one terminal and put it in the other.
But the user can also manage two or more numbers (for example from different
networks) with only one terminal by changing the SIM.
Finally the user can also use his own SIM with his friend`s terminals, and the calls are
all put on the same bill.
The possibility to get service from two or more different networks with only one mobile
equipment (terminal) is called MS Roaming. But there does also exist another roaming,
called SIM Roaming. Because of the interface between the SIM and the network is
standardized a SIM from a GSM900 network can might as well be used in a DCS1800
phone, without technical obstacles. This is called SIM Roaming.
SM
SM
The SIM also contains the IMSI, which is very important for the MS identification. The
IMSI consists of the Mobile Country Code (MCC), the Mobile Network Code (MNC) and
the user`s identification number within his network (Mobile Subscriber Identification
number, MSIN). The IMSI 222 01 4728563085 (*) contains the following information:
! The user is from Italy (MCC =222)
! The user is a TIM customer (MNC =01 =TIM)
! In the TIM network the user is identified by the MSIN 4728563085
There are also a few algorithms and authentication keys memorized on the SIM: the
Individual Subscribers Authentication Key, Ki, the A3 (Authentication Algorithms) and
the A8 (Encryption Algorithm). The A3 and the A8 can be grouped in to the A38.
The Phase1 SIM Cards dispose of 3Kb EEPROM memory capacity, the Phase2 on the
contrary of 8Kb. 6Kb are enough to memorize all the Phase2 information, the other
available memory capacity can be used by the user.
1Kb EEPROM for example is able to memorize 6 SMS messages or 40 phone numbers.
As with all Smart Cards also the quality of the SIM Card become worse with the time. Therefore a
SIM Card normally is guaranteed for only one or two years by the network provider.
SM
SM
SIM Locking
The SIM Locking is often used by some network operators to "keep" the customers for
a few years.
Because of the SIM Locking the terminal can be used only with one SIM card, so the
customer cannot use the terminal to access to another network.
Often the network operators sell very cheap phones, but as condition the user must be
their customer for a determinated time.
In this case the operator often use SIM Locking to be certain that the customer respect
this condition.
Often when the years ( in which the user can use only one SIM Card) determinated by
the operator are past the operator give the user a code to restore the correct functionality
of the terminal, so that the user finally can use the terminal with all SIM Cards.
The SIM Locking is forboded in many countries but used in other like UK, Sweden
(Comviq) and Spain (Airtel and Movistar).
SM
SM
Frequency Of Operation
GSM networks presently operate in four different frequency ranges. These are:
GSM400 450.4 457.6 MHz paired with 460.4 467.6 MHz or 478.8 486 MHz paired with
488.8 496 MHz
GSM 900 (also called GSM) - operates in the 900 MHz frequency range and is the most
common in Europe and the world. 880 - 915 MHz paired with 925 - 960 MHz
GSM 1800 (also called PCN (Personal Communication Network), and DCS 1800) - operates in
the 1800 MHz frequency range and is found in a rapidly-increasing number of countries
including France, Germany, Switzerland, the UK, and Russia. 1710 - 1785 MHz paired with
1805 - 1880 MHz
GSM 1900 (also called PCS (Personal Communication Services), PCS 1900, and DCS 1900) -
the only frequency used in the United States and Canada for GSM. 1850 - 1910 MHz paired
with 1930 - 1990 MHz
SM
SM
GSM-900-Spectrum Allocation
The International Telecommunication Union (ITU), which manages the international
allocation of radio spectrum (among many other functions), allocated the bands 890-915
MHz for the uplink (mobile station to base station) and 935-960 MHz for the downlink
(base station to mobile station) for mobile networks in Europe.
Since this range was already being used in the early 1980s by the analog systems of the
day, the CEPT had the foresight to reserve the top 10 MHz of each band for the GSM
network that was still being developed.
SM
SM
BTS-MS Frequency Separation-GSM-900
ARFCN =Absolute Radio Frequency Channel Number
MS Transmit Frequency (MHz) =890.0 +[(ARFCN)x(.2)]
BTS Transmit Frequency (MHz) =935.0 +[(ARFCN)x(.2)]
SM
SM
GSM-900 Multiple Access
Since radio spectrum is a limited resource shared by all users, a method must be devised
to divide up the bandwidth among as many users as possible.
The method chosen by GSM is a combination of Time- and Frequency-Division
Multiple Access (TDMA/FDMA).
The FDMA part involves the division by frequency of the (maximum) 25 MHz bandwidth into
124 carrier frequencies spaced 200 kHz apart.
One or more carrier frequencies are assigned to each base station.
Each of these carrier frequencies is then divided in time, using a TDMA scheme.
SM
SM
The fundamental unit of time in this TDMA scheme is called a burst period and it lasts
15/26 ms (or approx.. 0.577 ms).
Eight burst periods are grouped into a TDMA frame (120/26 ms, or approx. 4.615 ms), which
forms the basic unit for the definition of logical channels.
One physical channel is one burst period per TDMA frame.
Channels are defined by the number and position of their corresponding burst periods.
All these definitions are cyclic, and the entire pattern repeats approximately every 3
hours.
Channels can be divided into dedicated channels, which are allocated to a mobile
station, and common channels, which are used by mobile stations in idle mode.
SM
SM
The combination of a Time Slot
number and an ARFCN
constitutes a physical channel
for both the forward and reverse
link.
Channelization is accomplished
by the notion of logical
Channels.
Each physical channel in a GSM
system can be mapped into
different logical channels at
different times
SM
SM
GSM-900 Multiple Access and Channel Structure
RF Channels
SM
SM
GSM-900 Synchronization between Uplink and Downlink
SM
SM
GSM-900 Synchronization between Uplink and Downlink
At the BTS, TDMA frames on all radio frequency channels, in the downlink as well as on the
uplink, are aligned.
However MS and BTS do not transmit simultaneously
The MS theoretically is transmitting three time slot after the BTS.
The Time between sending and receiving data is used by the MS to perform various measurements
on the signal quality of the receivable neighbor cells
Practically the MS does not send data exactly three timeslots after receiving data from the BTS.
Depending on the distance between the BTS and MS a considerable propagation delay
known as timing advance (TA) have to be considered.
The Propagation Delay requires the MS to transmit its data a little earlier as determined by
the three time slots delay rule.
SM
SM
GSM-900 Frame Hierarchy
In GSM every TDMA frame is assigned a fixed number which repeats itself in a time period of 3
hours,28minutes, 53seconds and 760 ms.
This time frame is refereed to as Hyperframe.
Multiframe and superframe are layers of hierarchy that lies between the basic TDMA frame and
the hyperframe.
Two variant s of multifarmes are provided in GSM
26 multiframe contains 26 TDMA frames with a duration of 120 ms. This multiframe carries only traffic
channels and the associated control channels.
51 multiframe contains 51 TDMA frames with a duration of 235.8 ms and carries signaling exclusively.
Each superframe contains 26- 51- multifarmes or 51-26 multiframes.
The frame hierarchy is used for synchronization between the BTS and the MS , Channel Mapping
and Ciphering.
Every BTS permanently broadcasts the current frame number over the synchronization channel
(SCH) and therefore forms a internal clock of the BTS.
SM
SM
SM
SM
SM
SM
There is no coordination between the BTSs , all have an independent clock except for the
synchronized BTSs (For synchronized Handover).
An MS can communicate with a BTS only after the MS has read the SCH data, which informs the
MS about the frame number which in turn indicates the chronological sequence of various control
channels (Important during initial access to BTS or Handover)
MS sends a channels request to the BTS at a specific moment in time lets say frame number Y. (t =Frame
number X frame).
The channel request is answered with channel assignment after being processed by the BTS and BSC.
The MS finds its own channel assignment among all the other ones because the channel assignment refers
back to frame number Y.
The MS and BTS also need the frame number information for the ciphering process.
The hyperframe with its long duration was only defined to support ciphering, since by means of the
hyperframe, a frame number is repeated only about every three hours.
This makes it more difficult for hackers to intercept a call.
SM
SM
Physical Channels versus Logical Channels
Physical channels are all the available TSs of a BTS, whereas every TS corresponds to a physical
channel.
There are two types of Physical channels
Half Rate Channels
Full Rate Channels
A BTS with 6-carriers has 48 TSs (6x8) physical channels (in full rate configuration)
Logical Channels are laid over the grid of physical channels
According to the functions performed the Logical Channels are laid over the physical channels as
Traffic Channels (TCH)
Control Channels (CCH)
Logical Channel Mapping always applies to the same TS number of consecutive TDMA frames.
SM
SM
GSM-900 Traffic Channel Configuration
A traffic channel (TCH) is used to carry speech and data traffic.
Traffic channels are defined using a 26-frame multiframe, or group of 26 TDMA frames.
The length of a 26-frame multiframe is 120 ms, which is how the length of a burst period is defined (120
ms divided by 26 frames divided by 8 burst periods per frame).
Out of the 26 frames, 24 are used for traffic, 1 is used for the Slow Associated Control Channel (SACCH)
and 1 is currently unused
There are two types of TCHs that are differentiated by their traffic rates and are defined as
follows.
Half Rate
Half-Rate Speech Channel(TCH/HS)
Half-Rate Data Channel
4.8kbps (TCH/H4.8)
2.4kbps (TCH/H2.4)
Full Rate
Full-Rate Speech Channel(TCH/FS)
Full-Rate Data Channel
9.6kbps (TCH/F9.6)
4.8kbps (TCH/F4.8)
2.4kbps (TCH/F2.4)
SM
SM
GSM-900 Control Channel Configuration
Common channels can be accessed both by idle mode and dedicated mode mobiles.
The common channels are used by idle mode mobiles to exchange the signalling information required
to change to dedicated mode.
Mobiles already in dedicated mode monitor the surrounding base stations for handover and other
information.
The common channels are defined within a 51-frame multiframe, so that dedicated mobiles using the
26-frame multiframe TCH structure can still monitor control channels
SM
SM
GSM-900 Control Channel Configuration
Broadcast Channel (BCH)
Broadcast Control Channel (BCCH) (Downlink Channel)
Frequency Correction Channel(FCCH) (Downlink Channel)
Synchronization Channel(SCH) (Downlink Channel)
Common Control Channel (CCCH)
Paging Channel(PCH) (Downlink Channel)
Random Access Channel(RACH) (Uplink Channel)
Access Grant Channel(AGCH) (Downlink Channel)
Dedicated Control Channel (DCCH)
Stand-alone Dedicated Control Channel(SDCCH)
Slow Associated Control Channel(SACCH)
Fast Associated Control Channel(FACCH)
SM
SM
GSM-900 Broadcast Channels (BCH)
Broadcast Control Channel (BCCH )
The BCCH carrier broadcasts continuously for the MS to measure and average the signal
strengths from a site, to identify the BTS with the best serving potential.
At any base station, only one RF channel or carrier transmits the BCCH data: this RF channel
is called the BCH carrier.
The BTS will never reduce the power transmitting the BCH carrier because the MSs need to
measure the signal strengths from this frequency broadcasting at its maximum power or
highest potential.
The BTS must fill every timeslot on the BCCH carrier with a burst and if it has no real data
to send to the MSs, the BTS will send a dummy burst
Frequency Correction Channel(FCCH)
This logical channel is used for initial carrier acquisition or synchronization of the base station
for the mobile unit
Synchronization Channel(SCH)
The Frequency correction channel helps the mobile unit to get an estimate of the carrier
frequency. For further tuning, and proper frame synchronization, the SCH is used
SM
SM
GSM-900 Common Control Channel (CCCH)
Random Access Channel (RACH)
The RACH is a reverse link channel used by MS to acknowledge a page from the PCH, and is
also used by mobiles to originate a call.
Paging Channel (PCH) or the Access Grant Channel (ACGH)Frequency
Correction Channel(FCCH)
CCCHs are the most commonly used control channels and are used to page specific subscribers,
assign signaling channels to specific users, and receive mobile requests for service
SM
SM
GSM-900 Dedicated Control Channel (DCCH)
Stand-alone Dedicated Control Channel(SDCCH)
SDCCH carries signaling data following the connection of the mobile with the base
station,and just before a TCH assignment is issued by the base station.
The SDCCH ensures that the mobile station and the base station remain connected while the
base station and MSC verify the subscriber unit and allocate resources for the mobile.
SDCCHs may be assigned their own physical channel or may occupy TS0 of the BCH if there
is low demand for BCH or CCCH traffic
Slow Associated Control Channel(SACCH)
SACCH is always associated with a traffic channel or a SDCCH and maps onto the same
physical channel.
On the forward link, the SACCH is used to send slow but regularly changing control
information to each mobile on that ARFCN, such as
power control instructions
specific timing advance instructions
The reverse SACCH carries information about the received signal strength and quality of the
TCH, as well as BCH measurement results from neighboring cells
SM
SM
GSM-900 Dedicated Control Channel (DCCH)
Fast Associated Control Channel(FACCH)
FACCH carries urgent messages, and contains essentially the same type of information as the
SDCCH.
A FACCH is assigned whenever a SDCCH has not been dedicated for a particular user and
there is an urgent message (such as a handoff request).
The FACCH gains access to a time slot by stealing frames from the traffic channel to which it
is assigned.
This is done by setting two special bits, called stealing bits, in a TCH forward channel burst. If
the stealing bits are set, the time slot is known to contain FACCH data, not a TCH, for that
frame.
Like traffic channels dedicated control channels are
bi-directional and have the same format and function on both the forward and reverse
links.
may exist in any time slot and on any ARFCN except TS0 of the BCH ARFCN
SM
SM
GSM-900 Additional Channels
TCH/8
In order to increase system efficiency when it comes to signaling transactions, an additional
type of channel has been introduced.
Its rate is very low and only has specified usage for signaling and short message transmission.
This channel is referred as TCH/8. If a TCH/H is considered as half a TCH/F, then this is one-
eighth of a TCH/F.
A TCH/8 message is sent over one time slot for every other 8 frames
Cell Broadcast Short message
Cell Broadcast Short message requires the means to transmit around one 80 octet message every
two seconds from the network toward the mobile stations in idle mode.
This corresponds to half the capacity of a downlink TCH/8. In each cell where this service is
supported a special channel a CBCH (Cell Broadcast Channel ) is used (or broadcasting
messages.
A CBCH is derived from a TCH/8. Some special constraints exist for the design of this channel.
Because of the requirement that it can be listened to in parallel
with the BCCH information and the paging messages
SM
SM
GSM-900 Burst Structure
The nature of the TDMA transmission is that the radio energy is emitted in a pulsed
manner rather than continuously.
Mobile station and the BTS sends bursts periodically.
GSM System -Power over time presentation
SM
SM
The actual data transmission is happening only for the 148bit time period or 542.8
micro-sec.
Because GMSK (Guassian Minimum Shift Keying) GSM Modulation does not contains
am amplitude modulated signal (At least in theory) ,the effective transmission power is
constant over the entire transmission period.
In total a Burst has a window of 577 micro-sec or 156.25 bits before the next time slot
starts.
Physically speaking the power level has to be reduced by 70 dB after 577 micro-sec.
This restrictions applies to uplink and downlink and determines the maximum number of bits
an MS can send or receive at one time.
The net bit rate is 114 bits per burst not 156.25 bits.
This reduced number of bits results from the mapping of a physical burst to a logical burst
The physical burst needs administrative bits that reduces the space available for the signaling
or user data.
SM
SM
Each Burst always begins with the tail bits, which are necessary to synchronize the
recipient. Tail bits are except for the access burst always coded as 000.
The tail bit is followed by 148 data bits which differ in format for various burst types.
Each burst is terminated by another set of tail bits and the so called guard period.This
guard period is required by the sender to physically reduce the transmission power.
Guard period is long for access burst to allow mobile stations that are far from the BTS
propagation delay benefit.
There are five possible burst types specified by GSM standards
Normal Burst
Frequency Correction Burst
Synchronization Burst
Random Access Burst
Dummy Burst
SM
SM
GSM-900 Normal Burst
The normal Burst is used for almost every kind of data transmission on all channel
types.
Only exception is the initial channel request from the mobile station send in the access burst
and transmission of the synchronization data of a BTS by synchronization burst.
All other data transfer on all the traffic channels, dedicated control channels and common
control channels in uplink and downlink direction are done in normal burst.
Every Normal burst contains 114 bits of useful data that are sent in two packets of 57
bits each with TSC (Training sequence) placed between two packets (114 bits are
channel coded and contain overheads)
There is a stealing flag between the training sequence and each data packet which
indicates to the recipient whether a 57 bit packet actually contains user data or FCCH
information.
SM
SM
GSM-900 Synchronization Burst
The synchronization burst is used to transmit synchronization channel information.
The synchronization burst uses a format similar to the normal burst, however for the
synchronization burst each packet contains only a 39-bit payload because the training
sequence is 64 bit long.
The training sequence for the synchronization channel is identical for all the BTSs and
therefore allows a mobile station to easily distinguish an accessible GSM-BTS from
any other radio system that accidentally works at the same frequency.
Training Sequence in Synchronization burst serves two purposes
Transmission error determination for MS
Help MS distinguish GSM sources among other transmission sources at same frequencies.
SM
SM
GSM-900 Access Burst
A mobile station uses the access burst only for the initial access to BTS
Connection setup starting from the idle state (MS sends channel request in this case)
For handover (MS sends handover Access message)
In both the cases MS does not know the current distance to the BTS and hence the
propagation delay for the signal.
As long as propagation delay is not known to MS it assumes it zero.
Therefore it generally is uncertain if the access burst arrives with the receiver window of a
BTS and how long the overlap is.
That is the reason for a lesser length of an access burst and the longer duration of the guard
period
To ensure that an access burst arrives at the BTS during the proper time period the number of
bits for the access burst was set to only 88 bits. The maximum distance between BTS and MS
is with this timing about 35 km.
The normal burst would not fit into the receiver window if the unknown propagation delay is
greater than zero. This is the reason why normal burst is used only after the distance between
the MS and BTS is determined and the MS adjust its transmission accordingly . The
adjustment parameter is called offset time. And is calculated from the access burst.
SM
SM
Access burst begins with 8 tail bits rather than 3 as in the case of other bursts and the
access burst always starts with the bit sequence 00111010.
The tail bits together with the the following 41-bit synchronization sequence which also
always carries the same value allows the BTS to distinguish access burst from the error
signals and the interference signals.
Hence the Access burst serves the same purpose on the uplink as the synchronization
burst does on the downlink.
SM
SM
SM
SM
GSM-900 Frequency Correction Burst
The most simple format of all the bursts is used in the frequency correction burst which
is transmitted only in the frequency correction channel.
All the 148 bits (142 bits+6 tail bits) are coded with 0. A sequence of zeros at the input
of GMSK modulator produces a constant transmitter frequency which is exactly 67.7
kHz above the BCCH median frequency.
Therefore the frequency of the FCCH is always 67.7 kHz above the frequency that is
advertised as the downlink frequency.
This constant transmission frequency allows an MS to fine tune its frequency to BCCH
frequency, to subsequently be able to read the data within the synchronization burst.
SM
SM
GSM-900 Dummy Burst
When the MS powers up, it checks the power level of BCCH frequencies of the BTSs
nearby to determine which BTS to use as a serving cell.
Similarly when the MS is active that is involved in a call the power level of the BCCH
frequencies of the neighboring cells serve as basis for a possible handover decision.
To be useful as a reference the BCCH frequency has to be transmitted with the constant
power level.
Thus all time slots have to be occupied and it is not allowed to apply power control on the
downlink.
For the above purpose dummy bursts are defined
These dummy bursts are inserted into otherwise empty time slots on the BCCH frequency.
To prevent accidental confusion with the frequency correction bursts the dummy burst is
coded with the pseudorandom bit sequence predefined by GSM standards.
SM
SM
GSM-900 Mapping of logical channels onto Physical Channels
In particular the downlink direction of TS-0 of the BCCH-TRX is used by various
channels.
The following channels structure can be found on the TS-0 of a BCCH-TRX depending
on the actual configuration:
FCCH
SCH
BCCH information 1-4
Four SDCCH Subchannels (Optional)
CBCH (Optional)
Above multiple use is possible because the logical channels can time share TS-0 by
using different TDMA frames.
The FCCH and SCH of a BTS is not broadcast permanently but there only from time to time.
Time sharing is not limited to FCCH and SCH but is widely used. Such an approach results in
lower transmission capacity, which is still sufficient to convey all necessary signaling data.
It is possible to combine up to four physical channels in consecutive TDMA frames to a block,
so that it is possible for the same SDCCH to use the same physical channel in four consecutive
TDMA frames.
On the other hand, an SDCCH subchannel has to wait for a complete 51-multiframe before it
can be used again.
SM
SM
GSM-900 Mapping of
logical channels onto
Physical Channels
SM
SM
The freedom to define a channel configuration is restricted bay a number of constraints
When configuring a cell a network operator has to consider the peculiarities of a
service area and the frequency situation to optimize the configuration
Experience with the average and maximum loads that are expected for a BTS and how the load
is shared between the signaling and the payload is an important factor in such consideration.
GSM 05.02 provides the following guidelines which need to be taken into account
when setting up control channels
The FCCH and the SCH are always sent in TS-0 of the BCCH carrier at specific frame
numbers.
The BCCH,RACH,PCH and AGCH also must be assigned only to the BCCH carrier. These
channels however allow for assignment to all even numbered TSs e.g. 0,2,4 and 6 as well as to
various frame numbers.
SM
SM
In practice, two configurations are mainly used which can be combined if necessary.
FCCH+SCH+BCCH+CCCH//SDCCH/8 addresses a channel configuration which no SDCCH
subchannels are available on TS-0. Eight such SDCCH subchannels are defined on TS-1. In
that case TS-1 obviously is not available as traffic channel.
FCCH+SCH+BCCH+CCCH+SDCCH/4 addresses a channel configuration in which all the
control channels are assigned to TS-0 in particular to have TS-1 available to carry payload
traffic. Because TS-0 needs to be used by other control channels too it is possible to establish
only four SDCCH subchannels that is only half the number compared to the preceding
configuration.
A channel configuration is always related to a single TS and not to a complete TRX.
It is not possible to combine traffic channels and SDCCHs, If necessary a TS can be
sacrificed to allow for additional SDCCHs.
SM
SM
FN TS-0 TS-1 FN TS-2 TS-3 to TS-6 TS-7
0 SDCCH-0 0 TCH "----DO----" TCH
1 SDCCH-0 1 TCH "----DO----" TCH
2 BCCH-1 SDCCH-0 2 TCH "----DO----" TCH
6 AGCH/PCH SDCCH-1 6 TCH "----DO----" TCH
10 SDCCH-2 10 TCH "----DO----" TCH
11 SDCCH-2 11 TCH "----DO----" TCH
12 AGCH/PCH SDCCH-3 12 SACH "----DO----" SACH
20 SDCCH-5 20 TCH "----DO----" TCH
21 SDCCH-5 21 TCH "----DO----" TCH
22 SDCCH-0 SDCCH-5 22 TCH "----DO----" TCH
25 SDCCH-0 SDCCH-6 25 "----DO----"
30 SDCCH-7 4 TCH "----DO----" TCH
31 SDCCH-7 5 TCH "----DO----" TCH
32 CBCH SACCH-0 6 TCH "----DO----" TCH
36 SDCCH-3 SACCH-1 10 TCH "----DO----" TCH
38 SDCCH-3 SACCH-1 12 SACH "----DO----" SACH
40 SACCH-2 14 TCH "----DO----" TCH
41 SACCH-2 15 TCH "----DO----" TCH
42 SACCH-0 SACCH-2 16 TCH "----DO----" TCH
48 SACCH-1 22 TCH "----DO----" TCH
49 SACCH-1 23 TCH "----DO----" TCH
50 24 TCH "----DO----" TCH
25 "----DO----"
FCCH
SCH
FCCH
SCH
FCCH
SCH
FCCH
SCH
FCCH
SCH
5
1
M
u
l
t
i
f
r
a
m
e
2
6
M
u
l
t
i
f
r
a
m
e
2
6
M
u
l
t
i
f
r
a
m
e
Example of Downlink part of
a full rate channel
configuration of
FCCH/SCH+CCCH+SDCCH
/4+CBCH on TS-0, SDCCH/8
on TS-1 and TCHs on TS-2-7.
The missing SACCHs of TS-0
and TS-1 can be found in the
next multiframe. There is no
SDCCH/2 on TS-0 because of
CBCH
SM
SM
5
1
M
u
l
t
i
f
r
a
m
e
2
6
M
u
l
t
i
f
r
a
m
e
2
6
M
u
l
t
i
f
r
a
m
e
Example of Uplink part of a
full rate channel
configuration. RACHs can be
found only on TS-0 of the
designated frame numbers.
The missing SACCHs on TS-
0 and TS-1 can be found in
the next multiframe
FN TS-0 TS-1 FN TS-2 TS-3 to TS-6 TS-7
4 RACH SACCH-2 4 TCH "----DO----" TCH
5 RACH SACCH-2 5 TCH "----DO----" TCH
12 SACCH-3 12 SACH "----DO----" SACH
13 SACCH-3 13 TCH "----DO----" TCH
14 RACH 14 TCH "----DO----" TCH
15 RACH SDCCH-0 15 TCH "----DO----" TCH
25 RACH SDCCH-2 25 "----DO----"
38 SDCCH-0 SDCCH-5 12 SACH "----DO----" SACH
47 SACCH-0 21 TCH "----DO----" TCH
48 SACCH-0 22 TCH "----DO----" TCH
49 SACCH-0 23 TCH "----DO----" TCH
50 SACCH-0 24 TCH "----DO----" TCH
25 "----DO----"
SM
SM
GSM-900 Inter -BTS Synchronization
Intercell-Synchronization impacts the quality of service in the area of handover
performances.
This notion of Synchronization includes also the de-synchronization of the cells as full
synchronization can be very detrimental to some aspects of system performance.
Best performance is obtained when time bases in neighbor cells are synchronized so that
burst emissions are synchronous, but de-synchronized so that in particular multiframes are
not synchronous
Synchronization between cells, if limited to bursts can also be useful for pre-
synchronization. It improves the search time for neighbor cells, though not in an obvious
way.
In fact all-clock phasing is the worst possible case for pre-synchronization performance.
The best scheme for pre-synchronization is when cell clocks are organized to minimize
the probability of simultaneity between FCCH SCH or BCCH bursts in two adjacent
cells.. This kind of "offset synchronization is of course more complex to implement than
an all-clock phasing synchronization
SM
SM
GSM-900 Synchronized handover
All BTSs that are finely synchronized can perform a synchronized handover. Fine
synchronization means that the starting time and the ending times of all the time slots are
identical for the synchronized cells.
Consider the following example of three BTSs (BTS-1, BTS-2,BTS-3)
BTS-1 and BTS-3 are finely synchronized and BTS-2 operates independently
Lets assume that a handover is to performed from BTS-1 to BTS-3.
In general the distance from the MS and BTS-1 and BTS-3 will be different, that results in
different propagation delays for the signal from BTS-1 to MS and BTS-3 to MS.
Based on that difference the MS will be able to calculate the timing advance for handover from
BTS-1 to BTS-3
Consequently, it is not necessary for BTS-3 to send PHYS_INFO Messages to the MS.
This possibility does not exist for handover from BTS-1/BTS-3 to non-synchronized BTS-2. Only
a non-synchronized handover is possible in this case and requires the BTS-2 to send
PHYS_INFO messages to MS to adjust timing advance.
SM
SM
GSM-900 Synchronized handover
SM
SM
GSM-900 Pseudo-Synchronized handover
Pseudo-Synchronized Handover requires the MS to predetermine the time offset between
the BTS-1(active cell) and BTS-2 (destination cell) from the neighbor cells measurement.
The MS sends the MEAS_REP message to BTS-1 or more precisely to the BSC. These
data reflects the view of MS only.
Another condition of Pseudo-Synchronized Handover is that BTS-1 needs to know
exactly how much earlier or later the destination cell (BTS-2), relative to BTS-1 actually
transmits.
With the above information and the measurement from the MS it is possible for the BTS-1 to
calculate the distance between the MS and BTS-2 and hence the timing advance that the MS has
to preset when being handed over to the MS.
For the MS Pseudo-Synchronized Handover is an optional feature and its availability is
indicated to the BSC in the MS classmark during call setup.
SM
SM
GSM-900 Pre-Synchronized handover
Pre-Synchronized handover requires the same behavior from the MS as a synchronized
handover.
The BTS does not send a PHYS_INFO message and the MS uses either the value
requested in the HND_CMD message or standard TA(timing advance), with a value 1,
when the HND_CMD message does not contain any value of TA
SM
SM
GSM-900/DCS-1800/PCS-1900 Physical Layer Specifications
The most important difference between the DCS and GSM system is the frequency of
operation and number of voice channels.
DCS is restricted and optimized to two hand portable mobile power classes of the 1 Watt
and .25 Watt peak power where as GSM mobile power is much higher
Attribute GSM-900 DCS-1800 PCS-1900
Operating Frequency
RX-TX (MHz)
Rx: 935-960
Tx: 890-915
Rx: 1805-1880
Tx: 1710-1785
Rx: 1930-1990
Tx: 1850-1910
Total Spectrum
(MHz)
2 x 25 2 x 75 2 x 60
Number of Carriers
124
8 ch./carrier
372
8 ch./carrier
300
8 ch./carrier
Peak Power (mobile) .8-20 W .25-1 W .25-1 W
Mean Power (mobile) .1-2.5 W .03-0.25 W .03-0.25 W
Attribute GSM/DCS
Multiple Access Method TDMA/FDM
Duplex Method FDD
Carrier Spacing 200 khz
Modulation GMSK
Modulation Rate 271 kbps
Speech Codec RPE-LEP
Data Rate(after Channel Coding) 22.8 kbps
Data Rate(after Speech Coding) 13 kps
Total Channel Bit Rate 270.833kbs
SM
SM
GSM-900/DCS-1800/PCS-1900 Power Classes
In GSM,BTSs and the mobile stations are classified and available in different power
classes.
The mobile station indicates its power class during every connection set-up to the
network.
MS (W/dBm) BTS (W/dBm) MS (W/dBm)
BTS
(W/dBm)
MS (W/dBm) BTS (W/dBm)
1 320/55 1/30 20/43 1/30 20/43
2 8/39 160/52 0.25/24 10/40 0.25/24 10/40
3 5/37 80/49 4/36 5/37 2/33 5/37
4 2/33 40/46 2.5/34 2.5/34
5 0.8/29 20/43
6 10/40
7 5/37
8 2.5/34
Mi cro
(M1)
0.25/24 1.6/32 0.5/27
Mi cro
(M2)
0.08/19 0.5/27 0.16/22
Mi cro
(M3)
0.03/14 0.16/22 0.05/17
GSM DCS1800 PCS1900
Cl ass
SM
SM
GSM-900/DCS-1800/PCS-1900 Power Classes
GSM requires that every mobile station is subject to power control. For the BTS power
control is optional.
Depending on the quality of a connection the BSC will request the BTS and the mobile
station to adjust their input power. The purpose of the power control is to minimize
interference with other channels and to increase the working time of the battery.
The BSC informs the BTS via the Abis interface within a BS_POWER_CON message of the
output power to be used.
Only if necessary , the BSC will send an MS_POWER_CON message to the BTS to initiate an
adjustment of the of the input power of mobile station.
This new output power level is forwarded to the mobile station within the layer 1 header of the
next SACCH to be sent. One SACCH is sent to the mobile station every 480-ms always telling
the mobile station of the current output power.
The maxium power is called Pn. Starting from there the output power may be reduced in steps of
2 Db. Power control on the BTS side allows reduction of output power by 30dB in 15 steps while
the output power of the MS is reduced between 20dB or 30dB depending on the standard and the
power class of the MS.
All downlink channels of the BCCH-TRX have to be permanently use the maximum output
power Pn since the BCCH is serving as beacon and refernce for the neighbor cell measurement
of the mobile station.
There is also minimum output power below which a mobile station may not transmit. That value
is 5dBm for GSM and 0dBm for DCS1800/PCS1900.
SM
SM
GSM Channel Generation
SM
SM
GSM Speech Coding
GSM is a digital system, so speech which is inherently analog, has to be digitized.
The method employed by ISDN, and by current telephone systems for multiplexing voice lines over
high speed trunks and optical fiber lines, is Pulse Coded Modulation (PCM).
The output stream from PCM is 64 kbps, too high a rate to be feasible over a radio link. The 64 kbps
signal, although simple to implement, contains much redundancy.
The GSM group studied several speech coding algorithms on the basis of subjective speech
quality and complexity (which is related to cost, processing delay, and power consumption
once implemented) before arriving at the choice of a Regular Pulse Excited -- Linear
Predictive Coder (RPE--LPC) with a Long Term Predictor loop.
Basically, information from previous samples, which does not change very quickly, is used to predict
the current sample.
The coefficients of the linear combination of the previous samples, plus an encoded form of the
residual, the difference between the predicted and actual sample, represent the signal.
Speech is divided into 20 millisecond samples, each of which is encoded as 260 bits, giving a total
bit rate of 13 kbps. This is the so-called Full-Rate speech coding.
Recently, an Enhanced Full-Rate (EFR) speech coding algorithm has been implemented by North
American GSM1900 operators. This is said to provide improved speech quality using the existing 13
kbps bit rate.
SM
SM
GSM Channel Coding
Because of natural and man-made electromagnetic interference, the encoded speech or
data signal transmitted over the radio interface must be protected from errors.
The channel coding is performed using two codes: a block code and a convolutional code.
The block code corresponds to the block code defined in the GSM Recommendations
05.03. The block code receives an input block of 240 bits and adds four zero tail bits at the
end of the input block. The output of the block code is consequently a block of 244 bits.
SM
SM
GSM Channel Coding
A convolutional code adds redundancy bits in order to protect the information.
A convolutional encoder contains memory.
This property differentiates a convolutional code from a block code.
A convolutional code can be defined by three variables : n, k and K.
The value n corresponds to the number of bits at the output of the encoder, k to the number of bits
at the input of the block and K to the memory of the encoder.
The ratio, R, of the code is defined as follows : R =k/n.
Let's consider a convolutional code with the following values: k is equal to 1, n to 2 and K to 5.
This convolutional code uses then a rate of R =1/2 and a delay of K =5, which means that it will
add a redundant bit for each input bit.
The convolutional code uses 5 consecutive bits in order to compute the redundancy bit. As the
convolutional code is a 1/2 rate convolutional code, a block of 488 bits is generated. These 488
bits are punctured in order to produce a block of 456 bits. Thirty two bits, obtained as follows, are
not transmitted :
C (11 +15 j) for j =0, 1, ..., 31
The block of 456 bits produced by the convolutional code is then passed to the interleaver.
SM
SM
GSM Speech Channel Coding
GSM uses convolutional encoding and block interleaving to achieve this protection. The
exact algorithms used differ for speech and for different data rates. The method used for
speech blocks will be described below.
The speech codec produces a 260 bit block for every 20 ms speech sample. From
subjective testing, it was found that some bits of this block were more important for
perceived speech quality than others. The bits are thus divided into three classes:
Class Ia 50 bits - most sensitive to bit errors
Class Ib 132 bits - moderately sensitive to bit errors
Class II 78 bits - least sensitive to bit errors
SM
SM
SM
SM
Class Ia bits have a 3 bit Cyclic Redundancy Code added for error detection. If an error is
detected, the frame is judged too damaged to be comprehensible and it is discarded. It is
replaced by a slightly attenuated version of the previous correctly received frame.
These 53 bits, together with the 132 Class Ib bits and a 4 bit tail sequence (a total of 189
bits), are input into a 1/2 rate convolutional encoder of constraint length 4.
Each input bit is encoded as two output bits, based on a combination of the previous 4 input bits.
The convolutional encoder thus outputs 378 bits, to which are added the 78 remaining
Class II bits, which are unprotected.
Thus every 20 ms speech sample is encoded as 456 bits, giving a bit rate of 22.8 kbps.
SM
SM
SM
SM
GSM Control Channel Coding
In GSM the signaling information is just contained in 184 bits.
Forty parity bits, obtained using a fire code, and four zero bits are added to the 184 bits
before applying the convolutional code (r =1/2 and K =5).
The output of the convolutional code is then a block of 456 bits, which does not need to be
punctured.
SM
SM
GSM Control Channel Coding
SM
SM
GSM Interleaving
Interleaving is the procedure to distribute or interlace the bits of channel coded block onto
several bursts.
Since channel coding is designated to detect and correct errors on only a relative few bits,
it is the goal of interleaving to prevent complete loss of information when the whole burst
is corrupted.
If foe example the complete burst is lost but all other are transmitted without error only one bit of
a larger piece of information is missing and can be restored by viterby decoder.
The likely hood of group error an the radio interface is naturally much higher than errors
on the single bits.The reason is the effect of fading which typically is slower than the 270
kbps transmission rate of the Air interface.
For transmission of data, the bits are distributed even more than the speech.
For data transmission it is even more important not to lose a single bit since it could render a
complete transmission useless.
Speech is not very sensitive to single bit error however is effected by the propagation delay which
do not effect the data transmission.
SM
SM
GSM Interleaving
In full rate speech channel interleaving accounts for a maximum delay of 37.5 ms while
the maximum delay cause by more intense interleave in case of data transmission is 106.8
ms.
Only RACH and SCH are transmitted without interleaving.
The figure shows the interleaving for the full rate speech channel
The 456 channel-coded bits of block n are divided into 8 sub blocks with 57 bits each and are
rearranged.
Subblocks 0 through 3 of block n are then interleaved with Subblocks 4 through 7 of block n-1.
While Subblocks 4 through 7 of block n are then interleaved with Subblocks 0 through 3 of block
n+1.
Initially the subblocks 0 through 3 forms the upper half of the burst while the subblocks 4 through
7 forms the lower half of the burst
During the subsequent formation of the burst the bits of the upper half alternatingly join with the
bits of lower half, stealing flags are inserted in the middle of the burst.
SM
SM
GSM Speech Channel Interleaving
The block of 456 bits, obtained after the channel coding, is then divided in eight blocks of 57 bits .
But these eight blocks of 57 bits are distributed differently.
The first four blocks of 57 bits are placed in the even-numbered bits of four consecutive bursts. The
other four blocks of 57 bits are placed in the odd-numbered bits of the next four bursts.
The interleaving depth of the GSM interleaving for speech channels is then eight. A new data block
also starts every four bursts.
The interleaver for speech channels is called a block diagonal interleaver.
The figure shows the interleaving for the full rate speech channel
The 456 channel-coded bits of block n are divided into 8 sub blocks with 57 bits each and are rearranged.
Subblocks 0 through 3 of block n are then interleaved with Subblocks 4 through 7 of block n-1. While
Subblocks 4 through 7 of block n are then interleaved with Subblocks 0 through 3 of block n+1.
Initially the subblocks 0 through 3 forms the upper half of the burst while the subblocks 4 through 7 forms
the lower half of the burst
During the subsequent formation of the burst the bits of the upper half alternatingly join with the bits of
lower half, stealing flags are inserted in the middle of the burst.
SM
SM
GSM
Interleaving
SM
SM
GSM Control Channel Interleaving
A burst in GSM transmits two blocks of 57 data bits each. Therefore the 456 bits
corresponding to the output of the channel coder fit into four bursts (4*114 =456).
The 456 bits are divided into eight blocks of 57 bits.
The first block of 57 bits contains the bit numbers (0, 8, 16, .....448), the second one the bit
numbers (1, 9, 17, .....449), etc.
The last block of 57 bits will then contain the bit numbers (7, 15, .....455).
The first four blocks of 57 bits are placed in the even-numbered bits of four bursts. The
other four blocks of 57 bits are placed in the odd-numbered bits of the same four bursts.
Therefore the interleaving depth of the GSM interleaving for control channels is four and
a new data block starts every four bursts.
The interleaver for control channels is called a block rectangular interleaver.
SM
SM
GSM Data TCH Channel Interleaving
A particular interleaving scheme, with an interleaving depth equal to 22, is applied to the
block of 456 bits obtained after the channel coding.
The block is divided into 16 blocks of 24 bits each, 2 blocks of 18 bits each, 2 blocks of
12 bits each and 2 blocks of 6 bits each.
It is spread over 22 bursts in the following way :
the first and the twenty-second bursts carry one block of 6 bits each
the second and the twenty-first bursts carry one block of 12 bits each
the third and the twentieth bursts carry one block of 18 bits each
from the fourth to the nineteenth burst, a block of 24 bits is placed in each burst
A burst will then carry information from five or six consecutive data blocks. The data
blocks are said to be interleaved diagonally. A new data block starts every four bursts.
SM
SM
GSM Ciphering
Ciphering modifies the contents of the eight interleaved blocks through the use of
encryption techniques known only to the particular mobile station and base station.
Security is further enhanced by the fact that the encryption algorithm is changed from call
to call.
Two types of ciphering algorithms, called A3 and A5, are used in GSM to prevent
unauthorized network access and privacy for the radio transmission respectively.
Encryption only applies to the air interface. Therefore, tapping of the call is still possible
on the terrestrial part of the connection. Precondition for ciphering is successful
authentication
SM
SM
GSM Authentication and Ciphering Activation steps
Authentication and Ciphering Activation steps
For each mobile station, the VLR stores up to five different authentication triplets. Such a triplet
consists of SRES (Signal Response used to verify the identity of an MS, 4 bytes long is calculated
by the MS by applying K
i
and RAND to algorithm A3) , RAND (Random Number , a number the
AUC picks on a random basis, The RAND range is upto 2
128
-1 and has a length of 16 bytes, the
network sends RAND in an AUTH_REQ message to the MS for authentication and ciphering)
and K
C
(8 byte long cipher key and results from applying the two parameters Ki and RAND to
the algorithm A8 ,both the BTS and the mobile uses K
c
for ciphering )and was originally
calculated and provided by HLR/AUC.
At first the MS is sending a connection request to the network (LOC_UPD_REQ). Among other
this request contains the ciphering key sequence number (CKSN) and the mobile station class
mark which indicates what ciphering algorithm (A5/X) are available on the mobile station.
The NSS (Particularly VLR) examine the CKSN and decides whether authentication is necessary.
Particularly to establish a second connection while another connection already exists( multiparty
call) It is obvious the that authentication is not required a second time during the same network
access. A message is send to MS if authentication is required. This DTAP (Direct transfer
application part SS7 messaging) (AUTH_REQ) contains the RAND received from HLR/AUC.
The SIM uses the RAND and the value K
i
as well as algorithm A3 to calculate SRES.
SM
SM
SM
SM
The MS sends the results of this calculation, the SRES to VLR. The VLR compares the SRES
that the mobile has send with the one that the HLR/AUC has send earlier. The authentication is
successful if both the values are identical.
Immediately after calculating SRES the MS uses RAND and Ki to calculate the ciphering key via
algorithm A8.
To activate ciphering the VLR sends the value Kc that the AUC has calculated and a reference to
the chosen A5/X algorithm via MSC and the BSC to the BTS.
SM
SM
The BTS retrieve the cipher key Kc and the information about the required ciphering algorithm
from the ENCR_CMD message and only forwards the information about A5/X algorithm in the
CIPH_MOD_CMD message to the MS. That message triggers the MS to enable ciphering of all
outgoing data and de-ciphering of all incoming information. Change of ciphering mode is
confirmed by MS by sending CIPH_MOD_CMD message.
The algorithm A5/X uses the current value of the frame number (FN) at the time t
x
together with
the cipher key Kc as the input parameters. The output of this operation are the so called ciphering
sequences each 114 bits long whereby one is needed for ciphering and other for de ciphering.
SM
SM
The first ciphering sequence and the 114 bits of useful data of a burst are XORed to provide the
encrypted 114 bits that are actually sent over the air-interface. Ciphering sequences are altered
with every frame number which in turn changes the encryption with every frame number.
Deciphering takes place exactly in the same way but in opposite direction.
Ciphering key sequence number (CKSN)
Ciphering key sequence number a 3 -bit long value that reference to a ciphering key Kc. That is
when a particular Kc is stored in the MS and the MSC/VLR a CKSN is assigned as well. The
purpose of it is to allow the mobile station and the network a negotiation of the Kc to be used
without compromising security by transmitting the value of Kc over the air.
This applies particularly when the MS tries to establish an additional or subsequent operation
with the network.
In those cases when MS requests a connection it sends its last valid CKSN as a parameter of
LOC_UPD_REQ or CM_SERV_REQ message to VLR.
The VLR then decides based on the CKSN if the ciphering can start immediately or if another
authentication is required.
The VLR may decide to request another authentication even if the CKSN mactes the VLRs entry
SM
SM
SM
SM
SM
SM
The first ciphering sequence and the 114 bits of useful data of a burst are XORed to provide the
encrypted 114 bits that are actually sent over the air-interface. Ciphering sequences are altered
with every frame number which in turn changes the encryption with every frame number.
Deciphering takes place exactly in the same way but in opposite direction.
Ciphering key sequence number (CKSN)
Ciphering key sequence number a 3 -bit long value that reference to a ciphering key Kc. That is
when a particular Kc is stored in the MS and the MSC/VLR a CKSN is assigned as well. The
purpose of it is to allow the mobile station and the network a negotiation of the Kc to be used
without compromising security by transmitting the value of Kc over the air.
This applies particularly when the MS tries to establish an additional or subsequent operation
with the network.
In those cases when MS requests a connection it sends its last valid CKSN as a parameter of
LOC_UPD_REQ or CM_SERV_REQ message to VLR.
The VLR then decides based on the CKSN if the ciphering can start immediately or if another
authentication is required.
The VLR may decide to request another authentication even if the CKSN mactes the VLRs entry
SM
SM
GSM - Gaussian Minimum Shift Keying (GMSK) Modulation
It is a special form of minimum shift keying (MSK) which belongs to the group of frequency
modulation (FM) techniques.
The modulated output signal Fo depends on the input signal E, where Fo is swithched between the two
frequencies (FT +f) and ( FT - f).
This represents the two digital input values E=0 and E=1.
Middle waveform shows the same bit sequence after two consecutive bits have been joined by an
exclusive OR operation.
SM
SM
Truth Table for the the Transmission
A disadvantage of MSK is the resulting , relative wide spectrum of this operation, due to
the hard shift between the two frequency (FT-ft) and (FT+ft). It is , however crucial for
every mobile system to use the scare frequency resources as economically as possible.
The GSM community, for that reason decided not to use MSK, instead it chose GMSK
which better meets the frequency economy constraint.
GMSK also uses the two frequency (FT +ft) and (FT-ft) buts shifts smoothly between the
two.
Bit (N-1) Bit N XOR Frequency
0 0 0 FT +ft
0 1 1 FT - ft
1 0 1 FT - ft
1 1 0 FT +ft
SM
SM
The figure below illustrate the GMSK process
SM
SM
The figure below illustrate the GMSK process
Input signal represents a rectangular shaped voltage. That voltage is then filtered by a low pass
filter which smoothes the edges of the rectangle as shown in the previous figure.
The new signal is used as input to the modulator.
The resulting output frequency and smooth shift between FT+ft and FT-ft are shown in the
figure which translates into smaller frequency spectrum that is less bandwidth
This positive effect results from filtering the input signal with gauss filter with following
parameters
BT =0.3 Where B =-3-dB bandwidth and the T =duration of an input bit
T =577 ms/ 156.25 bits =3.693 ms
SM
SM
From the availble data and the index of modulation h =0.5 the frequency shift ft can be
derived.
The value +- ft indicates the extrema of the frequency that is the maximum and minimum
between the carrier frequency is switched.
Following rule applies
ft = (data rate-h)/2
The data rate is determined by the reciprocal value of the T
(Duration of one bit) 1/T = 270.8 kHz.
ft = (270.8 kHz -0.5)(0.5)
ft = 67.7 kHz
An interesting side effect is that since all the 142 bits of the frequency correction burst are
coded with zero value the transmission frequency of a BTS is not exactly the BCCH
frequency but is shifted by exactly 67.7 kHz upwards.
The advantage of GMSK are
It does not at least in theory contains any AM part
The required bandwidth of the transmission frequency is an acceptable 200 kHz
SM
SM
GSM Slow Frequency Hopping
The propagation conditions and therefore the multipath fading depend on the radio
frequency.
In order to avoid important differences in the quality of the channels, the slow frequency
hopping is introduced.
The slow frequency hopping changes the frequency with every TDMA frame. A fast
frequency hopping changes the frequency many times per frame but it is not used in GSM.
The frequency hopping also reduces the effects of co-channel interference.
There are different types of frequency hopping algorithms. The algorithm selected is sent
through the Broadcast Control Channels.
Even if frequency hopping can be very useful for the system, a base station does not have
to support it necessarily On the other hand, a mobile station has to accept frequency
hopping when a base station decides to use it.
SM
SM
GSM Discontinuous transmission
Minimizing co-channel interference is a goal in any cellular system, since it allows better service
for a given cell size, or the use of smaller cells, thus increasing the overall capacity of the system.
Discontinuous transmission (DTX) is a method that takes advantage of the fact that a person
speaks less that 40 percent of the time in normal conversation by turning the transmitter off during
silence periods.
An added benefit of DTX is that power is conserved at the mobile unit.
The most important component of DTX is Voice Activity Detection. It must distinguish between voice and
noise inputs, a task that is not as trivial as it appears, considering background noise.
If a voice signal is misinterpreted as noise, the transmitter is turned off and a very annoying effect called
clipping is heard at the receiving end.
If, on the other hand, noise is misinterpreted as a voice signal too often, the efficiency of DTX is
dramatically decreased.
Another factor to consider is that when the transmitter is turned off, there is total silence heard at
the receiving end, due to the digital nature of GSM. To assure the receiver that the connection is
not dead, comfort noise is created at the receiving end by trying to match the characteristics of the
transmitting end's background noise.
SM
SM
GSM Discontinuous Reception
Another method used to conserve power at the mobile station is discontinuous reception.
The paging channel, used by the base station to signal an incoming call, is structured into
sub-channels.
Each mobile station needs to listen only to its own sub-channel.
In the time between successive paging sub-channels, the mobile can go into sleep mode,
when almost no power is used.
SM
SM
SM
SM
Ensuring the transmission of voice or data of a given quality over the radio link is only
part of the function of a cellular mobile network.
A GSM mobile can seamlessly roam nationally and internationally, which requires that
registration, authentication, call routing and location updating functions exist and are
standardized in GSM networks.
In addition, the fact that the geographical area covered by the network is divided into cells
necessitates the implementation of a handover mechanism.
These functions are performed by the Network Subsystem, mainly using the Mobile
Application Part (MAP) built on top of the Signaling System No. 7 protocol.
The signaling protocol in GSM is structured into three general layers depending on the
interface. Layer 1 is the physical layer, which uses the channel structures discussed earlier
over the air interface. Layer 2 is the data link layer..
SM
SM
SM
SM
Air Interface Um
SM
SM
LAPDm
The only GSM specific signaling of OSI layer 1 and Layer 2 can be found on the air-
Interface Um Where LAPDm signaling is used. The other interfaces of GSM use already
defined protocols like LAPD and SS7.
The modified version of LAPD is an optimized version for the GSM air-interface and is
particularly tailored to deal with the limited resources and peculiarities of the radio link.
LAPDm frame lacks in particular the TEI, the FCS and flags at both ends as in GSM their
task is performed by other GSM process (For example task of FCS is performed by
channel coding/decoding.
LAPDm defines four frame formats -- namely A, Abis, B, and Bbis .B is normally used to
send addressed, numbered information requiring acknowledgement (ACK), but it can also
carry unnumbered information which does not require acks. The A frame is used as fillers
when there is no information to transfer. It is also used to carry the acknowledgements.
Bbis and Abis formats (information and fillers respectively) are used in broadcast
channels and hence do not have address and control fields. By default SAPI 0 is used for
signalling.
SM
SM
LAPDm
Three different formats of identical length (23 bytes) are defined and the respective use
depends on the type of information to be transferred.
A-Format:
A frame in A -format generally can be sent on any DCCH in both directions, uplink and
downlink.
The A-format is sent as a fill frame when no payload is available on an active connection for
example in the short time period immediately after the traffic channel is connected.
B-Format:
The B-format is used on the air -interface to transport the actual signaling data; hence every
DCCH and every ACCH use this format.
Maximum length of the layer 3 information to be carried is restricted depending on the channel
type (SDCCH, FACCH, SACCH). This value is defined per channel type by the constant N201 .
If the information to be transmitted requires less space this space has to be filled with fill in
octets.
SM
SM
LAPDm
Bbis Format:
For transmission of BCCH,PCH and AGCH.
There is no header in the Bbis format that would allow for addressing or frame identification.
Addressing is not necessary since BCCH, PCH and AGCH are CCCHs in which addressing is not
required.
In contrast to DCCH,the CCCH transports only point to multipoint messages.
Format A and B are used in uplink and downlink directions. The Bbis format is required
only in downlink direction only.
The relationship for signaling information between the maximum frame length of a
LAPDm frame (=23 bytes=184 bits) and number of input bits for channel coding (=184
bits)
SM
SM
SM
SM
SM
SM
LAPDm
Address field:
Address field starts with the bits EA and C/R.
SAPI (Service access point identifier) identifies the point where Layer 2 provides a service to
Layer 3. Possible values of SAPI
C/R (Command/Response) bit indicates if the frame is a command or a response
EA (Address Extension) bit indicates whether this is the final octet of the address or not
Address field contains a 2-bit long link protocol discriminator (LPD) which in GSM is with one
exception always coded with 00
bin
. The exception is the Cell broadcast service (CBS) where LPD
is 01
bin
SAPI (Decimal) Meaning
0 RR, MM, CC
3 SMS, SS
Possible Values of SAPI on the Air Interface
SM
SM
LAPDm
Control Field:
Defines the frame type and contains, in case of I frames, the counters N(R) and N(S), in case of
supervisory frames it contains only N(R).
N(R) and N(S)
The counters for the forward error correction that indicate that the
frame was received N(R) or Send N (S) respectively
Both the counters are used by LAPDm and LAPD protocols to
acknowledge I-Frames (only) on the air interface and Abis interface
SM
SM
LAPDm
Control Field:
Defines the frame type and contains, in case of I frames, the counters N(R) and N(S), in case of
supervisory frames it contains only N(R).
Frame Length Indicator Field consists of three parts
Bit 0
Bit 0, The EL-bit: The EL-bit indicates if current octet is last one of the frame length indicator
field.
GSM does not allow the frame length indicator field to exceed one octet and hence the value of
EL bit is always zero. If the future application require a different length GSM can change this
restriction.
EL bit value Action
EL=0 This is the Last Octet
EL=1
Another Length Indicator
Field Follows
SM
SM
LAPDm
Bit-1
Bit-1 .the M-bit
If the entire messages are longer than the data fields of the LAPDm frames allows, the
information has to be partitioned and transmitted in consecutive frames.
The M-bits is used in such situations to indicate that the message was segmented and the further
frames belonging to the same message have to be expected
The M-bit of the last segment is set to zero.
Bits 2-7
The length indicator. This indicates the actual length of the information field.
The value range is from zero to N201.
SM
SM
LAPDm
Information Field.
For all three frame formats, the information field that carries signaling data consists of N201
octets. Where N201 represents a value that is different for the various channels types.
N200 (GSM 04.06 for LAPDm, Q.921
for LAPD
A counter for the maximum number of
retransmmissions on the Air or Abis
interface.
It defines how often one message can
be retransmitted before the layer 2
connection is torn down.
For the Abis interface this value is 3.
For air -interface N 200 can take
diffent values depending on the
channel types
N201 (GSM 04.06 for LAPDm, Q.921
for LAPD
A counter for the maximum number of
octets in the information field of the
LAPD/LAPDm frames on the Abis or
Air Interface.
The value of N201 on the Abis
interface is 260.
The value on the Air-Interface
depends on the channel type
SM
SM
LAPDm
Channel Type N-200
SACCH 5
SDCCH 23
FACCH (Full-Rate) 34
Facch (Half-Rate) 29
Value of N-200 on the Air Interface
Channel Type N-201
SACCH 18
SDCCH, FACCH 20
BCCH, PCH, AGCH 23
Value of N-201 on the Air Interface
SM
SM
LAPDm
Name
Command
Frame
Answer
Frame
Possible Values of Control
Field (Hex)
I Yes No
(0X),(2X),(4X),(6X),(8X) if even
then I frame
RR Yes Yes (1X)
RNR Yes Yes (5X)
REJ Yes Yes (9X)
DISC Yes No (53) because P-bit is always 1
UI Yes No (03) because P-bit is always 0
DM No Yes (0F), (1F)
SAMBE Yes No (7F) because P-bit is always 1
UA No Yes (73) because P-bit is always 1
I-Frame Group
Supervisory-Frame Group
Unnumbered-Frame Group
Frame Types Of Air Interface
SM
SM
Across the Um interface, the data link layer is a modified version of the LAPD protocol
used in ISDN, called LAPDm. Across the A interface, the Message Transfer Part layer 2
of Signaling System Number 7 is used. Layer 3 of the GSM signaling protocol is itself
divided into 3 sublayers.
Radio Resources Management
Controls the setup, maintenance, and termination of radio and fixed channels,
including handovers.
Mobility Management
Manages the location updating and registration procedures, as well as security and
authentication.
Connection Management
Handles general call control, similar to CCITT Recommendation Q.931, and
manages Supplementary Services and the Short Message Service.
SM
SM
Signaling between the different entities in the fixed part of the network, such as between
the HLR and VLR, is accomplished through the Mobile Application Part (MAP).
MAP is built on top of the Transaction Capabilities Application Part (TCAP, the top layer
of Signaling System Number 7. The specification of the MAP is quite complex, it is one
of the longest documents in the GSM recommendations
SM
SM
Radio resources management
RR (Radio Resource) management procedures include the functions related to the
management of the common transmission resources, e.g., the physical channels and the
data link connections on control channels
The radio resources management (RR) layer oversees the establishment of a link, both
radio and fixed, between the mobile station and the MSC.
The general purpose of Radio Resource procedures is to establish, maintain and release
RR connections that allow a point-to-point dialogue between the network and a Mobile
Station. This includes the cell selection/reselection and the handover procedures.
Moreover, Radio Resource management procedures include the reception of the uni-
directional BCCH and CCCH when no RR connection is established. This permits
automatic cell selection/reselection
The main functional components involved are the mobile station, and the Base Station
Subsystem, as well as the MSC.
SM
SM
The RR layer is concerned with the management of an RR-session which is the time that
a mobile is in dedicated mode, as well as the configuration of radio channels including the
allocation of dedicated channels.
An RR-session is always initiated by a mobile station through the access procedure, either
for an outgoing call, or in response to a paging message.
The details of the access and paging procedures, such as when a dedicated channel is
actually assigned to the mobile, and the paging sub-channel structure, are handled in the
RR layer.
In addition, it handles the management of radio features such as power control,
discontinuous transmission and reception, and timing advance.
SM
SM
SM
SM
.
SM
SM
Handover
In a cellular network, the radio and fixed links required are not permanently allocated for
the duration of a call. Handover, or handoff as it is called in North America, is the
switching of an on-going call to a different channel or cell. The execution and
measurements required for handover form one of basic functions of the RR layer.
There are four different types of handover in the GSM system, which involve transferring
a call between:
Channels (time slots) in the same cell
Cells (Base Transceiver Stations) under the control of the same Base Station Controller
(BSC),
Cells under the control of different BSCs, but belonging to the same Mobile services
Switching Center (MSC), and
Cells under the control of different MSCs.
SM
SM
Handover
The first two types of handover, called internal handovers, involve only one Base Station
Controller (BSC).
To save signaling bandwidth, they are managed by the BSC without involving the Mobile
services Switching Center (MSC), except to notify it at the completion of the handover.
The last two types of handover, called external handovers, are handled by the MSCs
involved.
An important aspect of GSM is that the original MSC, the anchor MSC, remains
responsible for most call-related functions, with the exception of subsequent inter-BSC
handovers under the control of the new MSC, called the relay MSC.
SM
SM
Handover
Handovers can be initiated by either the mobile or the MSC (as a means of traffic load
balancing).
During its idle time slots, the mobile scans the Broadcast Control Channel of up to 16
neighboring cells, and forms a list of the six best candidates for possible handover, based
on the received signal strength. This information is passed to the BSC and MSC, at least
once per second, and is used by the handover algorithm.
The algorithm for when a handover decision should be taken is not specified in the GSM
recommendations.
SM
SM
Handover
There are two basic algorithms used, both closely tied in with power control. This is
because the BSC usually does not know whether the poor signal quality is due to
multipath fading or to the mobile having moved to another cell. This is especially true in
small urban cells.
Minimum Acceptable Performance Handover
Power Budget Handover
SM
SM
Minimum Acceptable Performance Handover
The 'minimum acceptable performance' algorithm gives precedence to power control over
handover, so that when the signal degrades beyond a certain point, the power level of the
mobile is increased. If further power increases do not improve the signal, then a handover
is considered. This is the simpler and more common method, but it creates 'smeared' cell
boundaries when a mobile transmitting at peak power goes some distance beyond its
original cell boundaries into another cell.
Power Budget Handover
The 'power budget' method uses handover to try to maintain or improve a certain level of
signal quality at the same or lower power level. It thus gives precedence to handover over
power control. It avoids the 'smeared' cell boundary problem and reduces co-channel
interference, but it is quite complicated.
SM
SM
Mobility management
The Mobility Management layer (MM) is built on top of the RR layer, and handles the
functions that arise from the mobility of the subscriber, as well as the authentication and
security aspects.
Location management is concerned with the procedures that enable the system to know
the current location of a powered-on mobile station so that incoming call routing can be
completed.
Location updating A powered-on mobile is informed of an incoming call by a paging message
sent over the PAGCH channel of a cell.
One extreme would be to page every cell in the network for each call, which is obviously a waste
of radio bandwidth.
The other extreme would be for the mobile to notify the system, via location updating messages,
of its current location at the individual cell level.
This would require paging messages to be sent to exactly one cell, but would be very wasteful
due to the large number of location updating messages.
A compromise solution used in GSM is to group cells into location areas. Updating messages are
required when moving between location areas, and mobile stations are paged in the cells of their
current location area.
SM
SM
Mobility management
The location updating procedures, and subsequent call routing, use the MSC and two
location registers: the Home Location Register (HLR) and the Visitor Location Register
(VLR).
When a mobile station is switched on in a new location area, or it moves to a new location
area or different operator's PLMN, it must register with the network to indicate its current
location.
In the normal case, a location update message is sent to the new MSC/VLR, which records
the location area information, and then sends the location information to the subscriber's
HLR.
The information sent to the HLR is normally the SS7 address of the new VLR, although it
may be a routing number.
The reason a routing number is not normally assigned, even though it would reduce
signaling, is that there is only a limited number of routing numbers available in the new
MSC/VLR and they are allocated on demand for incoming calls.
SM
SM
Mobility management
SM
SM
Mobility management
SM
SM
Mobility management
If the subscriber is entitled to service, the HLR sends a subset of the subscriber
information, needed for call control, to the new MSC/VLR, and sends a message to the old
MSC/VLR to cancel the old registration.
For reliability reasons, GSM also has a periodic location updating procedure.
If an HLR or MSC/VLR fails, to have each mobile register simultaneously to bring the database
up to date would cause overloading.
Therefore, the database is updated as location updating events occur. The enabling of periodic
updating, and the time period between periodic updates, is controlled by the operator, and is a
trade-off between signaling traffic and speed of recovery.
If a mobile does not register after the updating time period, it is de-registered.
A procedure related to location updating is the IMSI attach and detach. A detach lets the
network know that the mobile station is unreachable, and avoids having to needlessly
allocate channels and send paging messages. An attach is similar to a location update, and
informs the system that the mobile is reachable again. The activation of IMSI
attach/detach is up to the operator on an individual cell basis.
SM
SM
Mobility management
A procedure related to location updating is the IMSI attach and detach.
A detach lets the network know that the mobile station is unreachable, and avoids having
to needlessly allocate channels and send paging messages.
An attach is similar to a location update, and informs the system that the mobile is
reachable again.
The activation of IMSI attach/detach is up to the operator on an individual cell basis.
SM
SM
Mobility management
Authentication and security
Since the radio medium can be accessed by anyone, authentication of users to prove that
they are who they claim to be, is a very important element of a mobile network.
Authentication involves two functional entities, the SIM card in the mobile, and the
Authentication Center (AUC).
Each subscriber is given a secret key, one copy of which is stored in the SIM card and the
other in the AUC.
During authentication, the AUC generates a random number that it sends to the mobile.
Both the mobile and the AUC then use the random number, in conjunction with the
subscriber's secret key and a ciphering algorithm called A3, to generate a signed response
(SRES) that is sent back to the AUC. If the number sent by the mobile is the same as the
one calculated by the AuC, the subscriber is authenticated.
SM
SM
Mobility management
The same initial random number and subscriber key are also used to compute the
ciphering key using an algorithm called A8.
This ciphering key, together with the TDMA frame number, use the A5 algorithm to
create a 114 bit sequence that is XORed with the 114 bits of a burst (the two 57 bit
blocks).
Enciphering is an option for the fairly paranoid, since the signal is already coded,
interleaved, and transmitted in a TDMA manner, thus providing protection from all but
the most persistent and dedicated eavesdroppers.
SM
SM
Mobility management
Another level of security is performed on the mobile equipment itself, as opposed to the
mobile subscriber. As mentioned earlier, each GSM terminal is identified by a unique
International Mobile Equipment Identity (IMEI) number.
A list of IMEIs in the network is stored in the Equipment Identity Register (EIR). The
status returned in response to an IMEI query to the EIR is one of the following:
White-listed
The terminal is allowed to connect to the network.
Grey-listed
The terminal is under observation from the network for possible problems.
Black-listed
The terminal has either been reported stolen, or is not type approved (the correct type
of terminal for a GSM network). The terminal is not allowed to connect to the
network.
SM
SM
Communication management
The Communication Management layer (CM) is responsible for Call Control (CC), supplementary
service management, and short message service management
The call control (CC) protocol is one of the protocols of the Connection Management (CM)
sublayer.
Every mobile station must support the call control protocol. If a mobile station does not support any bearer
capability at all then it must respond to a SETUP message with a RELEASE COMPLETE message.
In the call control protocol, more than one CC entity are defined.
Each CC entity is independent from each other and communicates with the correspondent peer entity using
its own MM connection. Different CC entities use different transaction identifiers.
Certain sequences of actions of the two peer entities compose elementary procedures. These
elementary procedures may be grouped into the following classes:
Call establishment procedures.
Call clearing procedures.
Call information phase procedures.
Miscellaneous procedures.
SM
SM
The terms "mobile originating" or "mobile originated" (MO) are used to describe a call
initiated by the mobile station. The terms "mobile terminating" or "mobile terminated"
(MT) are used to describe a call initiated by the network
Call control attempts to follow the ISDN procedures specified in Q.931, although routing
to a roaming mobile subscriber is obviously unique to GSM.
Other functions of the CC sublayer include call establishment, selection of the type of
service (including alternating between services during a call), and call release.
The HLR must therefore query the subscriber's current VLR, which will temporarily allocate an
MSRN from its pool for the call. This MSRN is returned to the HLR and back to the GMSC,
which can then route the call to the new MSC. At the new MSC, the IMSI corresponding to the
MSRN is looked up, and the mobile is paged in its current location area
SM
SM
SM
SM
SM
SM
Call routing
Unlike routing in the fixed network, where a terminal is semi-permanently wired to a
central office, a GSM user can roam nationally and even internationally.
The directory number dialed to reach a mobile subscriber is called the Mobile Subscriber
ISDN (MSISDN), which is defined by the E.164 numbering plan. This number includes a
country code and a National Destination Code which identifies the subscriber's operator.
The first few digits of the remaining subscriber number may identify the subscriber's HLR
within the home PLMN.
An incoming mobile terminating call is directed to the Gateway MSC (GMSC) function.
The GMSC is basically a switch which is able to interrogate the subscriber's HLR to
obtain routing information, and thus contains a table linking MSISDNs to their
corresponding HLR.
A simplification is to have a GSMC handle one specific PLMN. It should be noted that the
GMSC function is distinct from the MSC function, but is usually implemented in an MSC.
SM
SM
Call routing
Call routing for a mobile terminating call
SM
SM
Call routing
The routing information that is returned to the GMSC is the Mobile Station Roaming
Number (MSRN), which is also defined by the E.164 numbering plan.
MSRNs are related to the geographical numbering plan, and not assigned to subscribers,
nor are they visible to subscribers.
The most general routing procedure begins with the GMSC querying the called
subscriber's HLR for an MSRN.
The HLR typically stores only the SS7 address of the subscriber's current VLR, and does
not have the MSRN (see the location updating section).
The HLR must therefore query the subscriber's current VLR, which will temporarily
allocate an MSRN from its pool for the call.
This MSRN is returned to the HLR and back to the GMSC, which can then route the call
to the new MSC. At the new MSC, the IMSI corresponding to the MSRN is looked up,
and the mobile is paged in its current location area
SM
SM
SS Management
Users in GSM have some control on the way their calls are handled by the network.
This capability is described as supplementary services, each one of them corresponding to
some specific variation of the way the basic service is rendered to the user.
The entities involved in SS management are very few: the mobile station and HLR are the
only entities involved
SM
SM
SMS Management
The last aspect of the CM layer is related to the point-to-point short message services
(SMS-PP).
The purpose of the Short Message Service (SMS)is to provide the means to transfer
messages between a GSM PLMN Mobile Station and a Short Message Entity via a
Service Center, as described in TS GSM 03.40. The terms "MO" - Mobile Originating -
and "MT" - Mobile Terminating - are used to indicate the direction in which the short
message is sent.
SM
SM
SMS Management
SM
SM
SMS Management
SM
SM
SMS Management
SM
SM
Abis Interface
SM
SM
The Abis-Interface ( interface protocol between the BTS and BSC ) utilizes Layer 1
through Layer 3 of OSI protocol stack.
Layer 1 forms the D-Channel.
The LAPD is in layer 2
Layer 3 is divided into TRX management ( The Common Channel Management (CCM), The
Radio Link Management (RLM) and the dedicated Channel Management (DCM) )
SM
SM
The ISDN D-channel protocol, Which GSM largely has adopted provides the basics of
signaling on the Abis -Interface. This link access protocol is referred to as LAPD.
The underlying concept of the LAPD frame is the more general HDLC(High level Data
link Control) format which partitions a message into an address field, a control field, a
checksum and a flag field at both ends of the message.
LAPD massage is divided into three groups
The Information Frame (I-frame)group consists of only the I-Frame
The Supervisory Frame Group consists of receive ready (RR) frame, the receive -not-ready
(RNR) frame and the reject (REJ ) frame.
The Unnumbered Frame Group. This group comprises the set-asynchronous -balance-mode-
extended (SAMBE) frame, the disconnected-mode (DM) frame, UI frame, the disconnect (DISC)
frame, the unnumbered-acknowledgement (UA) frame, the Frame-Reject (FRMR) and the
exchange -identification (XID) frame
SM
SM
Manufacturers have implemented LAPD differently. Some have chosen to implement
LAPD modulo 8 in which the control fields consists of 8 bits, while the others have
chosen to implement LAPD modulo 128 which uses 16 bit control field.
On the practical side , there is only one difference between the LAPD modulo 128 and
LAPD modulo8.
That is the definition of the range of values for the send sequence numbers N(S) and the receive
sequence number N(R).
In an 8-bit-wide control field the range of the N(S) and the N(R) is always between 0 and 7, while
the 16-bit control field allows for values of N(S) and N(R) between 0 and 127.
The consequence is that in LAPD modulo 8 no more than eight messages may be
transmitted without the acknowledgement. The difference is of little importance in GSM,
since the requirement on the unacknowledged frames is restricted by other influences.
The number of unacknowledged frames for SAPI =0 is two and the number of unacknowledged
frames for SAPI =62 and =63 is one.
LAPD modulo 128 is more widely used in GSM.
SM
SM
The structure of a LAP-D frame
16 bits 8 bits 16 bits 16 bits 8 bits 0 to 260 Octets
Layer 3 Data
01111110
01111110
SM
SM
Polling bit P-bit for frame types used
as command
Final Bit F-bit for frame types used as
response
P/F bit for frame types that can be
used as both command and response
SM
SM
Polling bit P-bit for frame types used
as command
Final Bit F-bit for frame types used as
response
P/F bit for frame types that can be
used as both command and response
SM
SM
SM
SM
SAPI (Deci mal ) Pri ori ty Meani ng
0 2
Radio Signaling
Radio (Signaling
Link or RSL)
62 1
O& M Message
(O& M Link)
63 1
Layer 2
Management
Possi bl e Val ues of SAPI on the Abi s Interface
Frame Type Direction C/R
BSC---> BTS 1
BTS---> BSC 0
BSC---> BTS 0
BTS---> BSC 1
C/R -Bit in Command Frames and Response
Frames
Command
Frame
Response
Frame
GSM uses TEI to distinguish
among various TRXs. One TEI is
assigned to Each TRX
SM
SM
Send Sequence Number and the Receive Sequence Number
The N (S) and the N(R) serve the purpose of acknowledging the transfer and the receipt of I frames.
The method of counting can be modulo 8 or modulo 128. In case of modulo 8 three bits are used for
the counter allowing for the values of frame numbers between 0 and 7. 7 bits are used in modulo 128
allowing for values 0 to 127.
On the air interface LAPDm only the modulo 8 is used whereas both varients can be used on the
Abis interface.
SM
SM
The BTS sends an I frame and the Increments its counter N(S). The BSC receives the I-Frame,
increments counter N(R) and sends an RR frame with the new value of N(R) back to the BTS.
The BTS does not need to continue to buffer the I frame after it receives the acknowledgement
from the BSC.
Next the BSC sends an I-frame to the BTS and the increments its counter N(S) to 1.The values of
N(S) and N(R) in the transmitted I frames correspond inversely to the ones stored internally in the
BTS.
The BTS then checks for consistency of the information and increments if every thing is right its
counter N(R) and responds to the BSC with the RR frame with new value of N(R).
The RR frames are need to be exchanged between the BTS and the BSC within certain time
intervals during the so called idle cases when no data being transmitted.
The value of N(S) and N(R) are not changed during that process which is called polling
However they have to correspond inversely to each other. This applies to LAPD modulo 8 and
LAPD modulo 128.
SM
SM
Flag (1 octet) - This is always 7E
16
(0111 1110
2
) .This sequence is used as an indicator of
the beginning and end of a frame.
Control (2 octets) - The frame level control field indicates the frame type (Information,
Supervisory, or Unnumbered) and sequence numbers (N(r) and N(s)) as required.
Information - Layer 3 protocol information and User data
CRC (2 octets) - Cyclic Redundancy Check is a low-level test for bit errors on the user
data. A checksum is calculated using the data between the Start flag and the CRC field,
same procedure is performed at the receiver end and the respective values of CRC are
compared. Receiver will request a retransmission in the event that the calculated CRC
does not match the one received.
Flag (1 octet) - This is always 7E
16
(0111 1110
2
)
Check Sum
SM
SM
RR Frame
An RR frame acknowledges that an I frame has been received. It also is used for the polling
between BTS and BSC.
During Idle phases (No I frame transmission) RR frames are exchanged between the BSC and the
BTS with the periodicity based on the value of T 203 timer (10 second default value)
RNR Frame
RNR frame is used to signal that no more than I frame can be accepted. This situation may arise
when too many unprocessed I -frames are stored in the input buffer so that no space is available
for more I-frames.
The RNR frame requests a halt to the transmission of I frames and requires the transmitter to wait
for an RR frame before the transmission can be resumed.
This frequently results in an overload situation on the sender side because data for transmission
quickly backs up which in turns results in the sender also sending RNR frames.

SM
SM
REJ Frame
In contorts to the RNR frame which is used to signal an overload situation and hence to request
the temporary halt on the transmission, The REJ frame is used to indicate a transmission error
condition that has been detected by CRC analysis.
The REJ frames contains a value for the N(R) which indicates the first I frame that has to be
repeated.
An REJ frame is also used to indicate that I frames with a wrong value for N(S) or N(R) were
received. That requests the retransmission of all the I frames with the value of N(R) and higher.
SAMBE Frame
SAMBE frames are sent when no layer 2 connection has been established.
DM Frame
Transmitting side use the DM frame to indicate that it can no longer maintain the layer 1
connection.
A DM frame indicates that the sender will immediately tear down the layer 2 connection without
waiting for the acknowledgement from the receiver. DM frame is used to take a connection out of
service.
SM
SM
UI Frame
Unlike an I frame a UI frame contains neither a send sequence number nor a receive sequence
number. Another difference is that the conents of UI frame does not require an acknowledgement
P-BIT=0.
DISC Frame
The DISC frame is used to take a layer 2 connection out of service.
UA Frame
The UA frame is used to answer a SAMBE frame or a DISC frame.
It acknowledges a layer 2 connection being brought into service as well as one taken out of
service
FRMR Frame
The FRMR frame indicates that a received message was garbled, wrong or unexpected (Protocol
Error). That is different from the REJ frame which indicates to the peer entity that the I frame
have to be repeated starting at N(R).
This kind of error cannot be corrected by retransmission of a frame.
SM
SM
FRMR Frame
The FRMR frame indicates that a received message was garbled, wrong or unexpected (Protocol
Error). That is different from the REJ frame which indicates to the peer entity that the I frame
have to be repeated starting at N(R).
This kind of error cannot be corrected by retransmission of a frame.
FRMR frame may be sent as an answer to any frame and its use is not restricted to being a
response to faulty I frames.
XID Frames
The XID frame is used to synchronize the various transmission parameters between the user and
the network.
It coordinates the various timers when the layer 2 connection is brought into service.
SM
SM
Layer 3
Layer 3 information within the I and UI frames follows the Layer 2 header. Because the
difference in format it is particularly important to distinguish between the layer 3 information for
administrative tasks (SAPI =63, 62) and the layer 3 information for connection setup and release
(SAPI=0)
SAPI=0 is allocated to Radio Signaling Layer (RSL) and carries all the messages for connection
setup and release. On the Abis interface messages for SMS and supplementary services SS also
are dedicated to SAPI =0 which differs from handling on the Air-Interface.
Administrative data on the other hand are assigned to SAPI 62 and 63. Administrative tasks are
control commands from the BSC (OMC) to the BTS as well as complete software packages and
files which the BSC (OMC) sends to BTS.
SM
SM
Layer 3 Radio Signaling Link SAPI=0
SM
SM
Message Discrimination and the T-bit
The message discriminator classifies all messages defined in layer 3 of the Abis-interface into
groups or classes.
The purpose of T bit indicates whether the BTS should process an incoming message or if the
message should be transparent to the BTS (T=1). The distinction applies to uplink and downlink
both.
The classes organize message according to their use
RLM- This group contains all the messages necessary for the control of a layer 2 connection between the
MS and the BTS. That include connection setup, release as well as reporting of layer 2 problems on the air-
interface to BSC.
CCM and TRX- All the messages that carry common control channel (CCCH) signaling data to and from
the air interface are assigned to CCM. That includes the transfer of cell broadcast information to the BTS.
Messages used for the TRXM also belong to this group.
DCM- All messages that are used to control layer 1 of the air interface belong to DCM.
SM
SM
Channel Number
The channel number is a parameter that identifies that channel type the time slot and the
subchannel that are used for the connection on the air interface.
The channel number only indirectly corresponds to the terrestrial channel used on the Abis
interface.
The S bit specify the subchannel(if required) and can take a value in the range of 0 to 7.
The X bit identify the time slot on the air interface and can take a value in the range of 0 to 7.
SM
SM
Layer 3 Operation and Maintenance Link (SAPI=62)
This layer data format varies from manufacturer to manufacturer. The most common one
is discussed here.
Different data format have to be used on the OML the connection between the BSC and
the O&M unit in the BTS from those used for connection setup and release.
The transfer of operations software (Requires segmentation and sequencing of messages)
to the BTS and forwarding of maintenance commands fall into this category.
SM
SM
SM
SM
The first octet of the O&M layer 3 is an identifier, Which distinguishes between the HMI
data and the O&M data.
Next octet is a placing octet which indicates to the recipient whether a message is
segmented that is whether it is made up of a number of sub-messages.
The next parameter is the sequence number which numbers the segmented messages.
The last octet of the header is a length indicator which indicates how many octets of O&M
data follow
SM
SM
Difference between LAPD and LAPDm
LAPDm frames exist in modulo 8 format only.
The address filed of LAPDm is only 1 octet long and does not contain a TEI. The reason is that when a
channel is already assigned the connection on the air-interface is always point to point connection.
Several simultaneous users on a terrestrial point to multipoint connection do not exist which makes the
TEI superfluous.
LAPDm frame don't contain CRC because channel coding and interleaving of layer 1 already provide
data security.
LAPDm frames do not have a flag to indicate the start and end of the frame. This functionality is
provided by layer 1in particular by burst segmentation.
Unlink LAPD. SABM frames and UA frames of the LAPDm may even carry layer 3 data. That saves
time during connection setup.
The maximum length of LAPD and LAPDm frames are very different while LAPD frames can transport
up to 260 octets of signaling data,LAPDm allows only 23 octets. If larger amount of data is required
LAPDm uses segmentation.
LAPDm frame does not have length indicator
In LAPDm no fill-in octets are used when the data area is not completely occupied with signaling data.
SM
SM
A-Interface
SM
SM
A-Interface
On the physical level the A-interface consists of one or more PCM links between the MSC and
the BSC, each with the transmission capacity of 2 Mbps.
The TRAU which is typically located between the MSC and the BSC has to be taken into account
when examining A interface.
A-Interface is divided into two parts
The first part is between the BTS and TRAU where the transmitted payload still is compressed.
The second part is between the TRAU and the MSC where all the data is uncompressed.
SM
SM
A-Interface
The MTP and the SCCP are used to support signaling messages between the Mobile
Services Switching Center (MSC) and the Base Station System (BSS).
One user function of the SCCP, called BSS Application Part (BSSAP) is defined.
In the case of point-to-point calls the BSSAP uses one signaling connection per active
mobile station having one or more active transactions for the transfer of layer 3 messages.
In the case of a voice group or broadcast call there is always one connection per cell
involved in the call and one additional connection per BSS for the transmission of layer 3
messages.
There is an additional connection for the speaker in a broadcast call or the first speaker in
a voice group call up to the point at which the network decides to transfer them to a
common channel.
SM
SM
A-Interface
Additional connections may also be required for any mobile stations in the voice group or
broadcast call which the network decides to place on a dedicated connection.
The BSSAP user function is further subdivided into two separate functions:
The Direct Transfer Application sub-Part (DTAP), also called GSM L3, is used to transfer
messages between the MSC and the MS (Mobile Station); the layer-3 information in these
messages is not interpreted by the BSS. The descriptions of the layer 3 protocols for the MS-MSC
information exchange are contained in the 04- series of GSM Technical Specifications.
The BSS Management Application sub-Part (BSSMAP) supports other procedures between the
MSC and the BSS related to the MS (resource management, handover control), or to a cell within
the BSS, or to the whole BSS. The description of the layer 3 protocol for the BSSMAP
information exchange is contained in Recommendation GSM 08.08.
Both connectionless and connection-oriented procedures are used to support the
BSSMAP.
Connection oriented procedures are used to support the DTAP.
SM
SM
A-Interface
A distribution function located in BSSAP, which is reflected in the protocol specification
by the layer 3 header, performs the discrimination between the data related to those two
subparts.
BSSAP messages include the following fields:
Discrimination
Distribution between the two sub-protocols: BSSMAP and DTAP.
DLCI
Only for DTAP. Used in MSC to BSS messages to indicate the type of origination data
link connection over the radio interface.
Length
Subsequent Layer3 message parameter length.
SM
SM
A-Interface
SM
SM
A-Interface
SM
SM
A-Interface
BSSMAP
The BSS Management Application Part (BSSMAP) supports all of the procedures between
the MSC and the BSS that require interpretation and processing of information related to
single calls, and resource management.
Some of the BSSMAP procedures result in, or are triggered by, Radio Resource (RR)
management messages defined in GSM 04.08.
The format of the BSSMAP protocol is as follows:
Message Type
A one octet field defining the message type. This mandatory field uniquely defines the function and format
of each BSSMAP message.
Information Element
Each IE has an identifier which is coded as a single octet. The length of an IE may be fixed or variable and
may or may not include a length indicator.
Message Type 1 Byte
Information Element
SM
SM
A-Interface
BTSM
BTSM is the Base Station Controller to Base Transceiver Station (BSC - BTS) interface
protocol (the A-bis interface). BTSM allows sending messages between the Base Station
Controller and the Base Transceiver Station. Protocol messages consist of a series of
information elements. For each message there are mandatory information elements and
optional information elements. BTSM messages are transmitted on the A-bis interface
using the I format of LAPD, except for the Measurement Result message which is sent in
UI format.
The structure of BTSM messages is shown in the following diagram
Message Type 1 Byte
Information Element
Message Discriminator 1 Byte
SM
SM
A-Interface
BTSM
Message discriminator
1-octet field used in all messages to discriminate between Transparent and Non-
Transparent messages and also between Radio Link Layer Management, Dedicated
Channel Management, Common Channel Management and TRX Management messages.
Message type
Uniquely identifies the function of the message being sent. It is a single octet field.
Message Type 1 Byte
Information Element
Message Discriminator 1 Byte
SM
SM
A-Interface
DTAP
The Direct Transfer Application Part (DTAP) is used to transfer call control and mobility
management messages between the MSC and the MS.
The DTAP information in these messages is not interpreted by the BSS. Messages
received from the MS are identified as DTAP by the Protocol Discriminator Information
Element.
The majority of radio interface messages are transferred across the BSS MSC interface by
DTAP, except for messages belonging to the Radio Resource (RR) management protocol.
The DTAP function is in charge of transferring layer 3 messages from the MS (or from
the MSC) to the MSC (or to the MS) without any analysis of the message contents.
The interworking between the layer 2 protocol on the radio side and signaling system 7 at
the landside is based on the use of individual SCCP connections for each MS and on the
distribution function.
SM
SM
A-Interface
The format of the DTAP header is shown in the following illustration:
Transaction ID / Skip identifier
Either a transaction identifier, or a skip indictor depending on the level 3 protocol. The
transaction identifier contains the transaction value and flag which identifies who
allocated the TI.
N(SD)
For MM and CM, N(SD) is set to the value of the send state variable. In other level 3
messages, bit 7 is set to 0 by the sending side. Messages received with bit 7 set to 1 are
ignored.
Protocol Discriminator
Transaction ID /Skip Indicator
0
N(SD) Message Type
Common Information Element (Variable Length)
SM
SM
A-Interface
Message type
Uniquely defines the function and format of each GSM L3 message. The message type is
mandatory for all messages. The meaning of the message type is therefore dependent on
the protocol (the same value may have different meanings in different protocols) and
direction (the same value may have different meanings in the same protocol, when sent
from the Mobile Station to the network and when sent from the network to the Mobile
Station).
Information elements
The message type may be followed by various information elements depending on the
protocol.

SM
SM
SM
SM
SM
SM
GSM Network Protocols -SS7 Signaling
Common Channel Signaling System No. 7 (i.e., SS7 or C7) is a global standard for
telecommunications defined by the International Telecommunication (ITU)
Telecommunication Standardization Sector (ITU-T). The standard defines the procedures
and protocol by which network elements in the public switched telephone network
(PSTN) exchange information over a digital signaling network to effect wireless (cellular)
and wireline call setup, routing and control. The ITU definition of SS7 allows for national
variants such as the American National Standards Institute (ANSI) and Bell
Communication Research (Telcordia Technologies) standards used in North America and
the European Telecommunications Standards Institute (ETSI) standard used in Europe.
The SS7 network and protocol are used for:
basic call setup, management, and tear down
wireless services such as personal communications services (PCS), wireless roaming, and mobile
subscriber authentication
local number portability (LNP)
toll-free (800/888) and toll (900) wireline services
enhanced call features such as call forwarding, calling party name/number display, and three-way
calling
efficient and secure worldwide telecommunications
SM
SM
GSM Network Protocols-SS 7 Signaling
Signaling Links
SS7 messages are exchanged between network elements over 56 or 64 kilobit per second
(kbps) bi-directional channels called signaling links. Signaling occurs out-of-band on
dedicated channels rather than in-band on voice channels. Compared to in-band signaling,
out-of-band signaling provides:
faster call setup times (compared to in-band signaling using multi-frequency (MF) signaling
tones)
more efficient use of voice circuits
support for Intelligent Network (IN) services which require signaling to network elements
without voice trunks (e.g., database systems)
improved control over fraudulent network usage
SM
SM
Signaling Points
Each signaling point in the SS7 network is uniquely identified by a numeric point code.
Point codes are carried in signaling messages exchanged between signaling points to
identify the source and destination of each message. Each signaling point uses a routing
table to select the appropriate signaling path for each message.
There are three kinds of signaling points in the SS7 network
SSP (Service Switching Point)
STP (Signal Transfer Point)
SCP (Service Control Point)
SM
SM
Signaling Points
SSPs are switches that originate, terminate, or tandem calls.
An SSP sends signaling messages to other SSPs to setup, manage, and release voice
circuits required to complete a call.
An SSP may also send a query message to a centralized database (an SCP) to determine
how to route a call (e.g., a toll-free 1-800/888 call in North America).
An SCP sends a response to the originating SSP containing the routing number(s)
associated with the dialed number. An alternate routing number may be used by the SSP if
the primary number is busy or the call is unanswered within a specified time.
Actual call features vary from network to network and from service to service.
SM
SM
Signaling Points
Network traffic between signaling points may be routed via a packet switch called an STP.
An STP routes each incoming message to an outgoing signaling link based on routing information
contained in the SS7 message.
Because it acts as a network hub, an STP provides improved utilization of the SS7 network by
eliminating the need for direct links between signaling points.
An STP may perform global title translation, a procedure by which the destination signaling point
is determined from digits present in the signaling message (e.g., the dialed 800 number, calling card
number, or mobile subscriber identification number).
An STP can also act as a "firewall" to screen SS7 messages exchanged with other networks.
Because the SS7 network is critical to call processing, SCPs and STPs are usually deployed in
mated pair configurations in separate physical locations to ensure network-wide service in the event
of an isolated failure. Links between signaling points are also provisioned in pairs. Traffic is shared
across all links in the linkset. If one of the links fails, the signaling traffic is rerouted over another
link in the linkset. The SS7 protocol provides both error correction and retransmission capabilities
to allow continued service in the event of signaling point or link failures.
SM
SM
Signaling Points
Because the SS7 network is critical to call processing, SCPs and STPs are usually
deployed in mated pair configurations in separate physical locations to ensure network-
wide service in the event of an isolated failure.
Links between signaling points are also provisioned in pairs. Traffic is shared across all
links in the linkset.
If one of the links fails, the signaling traffic is rerouted over another link in the linkset.
The SS7 protocol provides both error correction and retransmission capabilities to allow
continued service in the event of signaling point or link failures.
SM
SM
Signaling links are logically organized by link type ("A" through "F") according to their
use in the SS7 signaling network.
A Link:
An "A" (access) link connects a signaling end point (e.g., an SCP or SSP) to an STP. Only
messages originating from or destined to the signaling end point are transmitted on an "A"
link.
B Link:
A "B" (bridge) link connects an STP to another STP. Typically, a quad of "B" links
interconnect peer (or primary) STPs (e.g., the STPs from one network to the STPs of
another network). The distinction between a "B" link and a "D" link is rather arbitrary. For
this reason, such links may be referred to as "B/D" links.
C Link:
A "C" (cross) link connects STPs performing identical functions into a mated pair. A "C"
link is used only when an STP has no other route available to a destination signaling point
due to link failure(s). Note that SCPs may also be deployed in pairs to improve reliability;
unlike STPs, however, mated SCPs are not interconnected by signaling links.
SM
SM
SM
SM
D Link:
A "D" (diagonal) link connects a secondary (e.g., local or regional) STP pair to a primary
(e.g., inter-network gateway) STP pair in a quad-link configuration. Secondary STPs
within the same network are connected via a quad of "D" links. The distinction between a
"B" link and a "D" link is rather arbitrary. For this reason, such links may be referred to as
"B/D" links.
E Link:
An "E" (extended) link connects an SSP to an alternate STP. "E" links provide an
alternate signaling path if an SSP's "home" STP cannot be reached via an "A" link. "E"
links are not usually provisioned unless the benefit of a marginally higher degree of
reliability justifies the added expense.
F Link:
An "F" (fully associated) link connects two signaling end points (i.e., SSPs and SCPs). "F"
links are not usually used in networks with STPs. In networks without STPs, "F" links
directly connect signaling points.
SM
SM
SS7 Protocol Stack
The hardware and software functions of the SS7 protocol are divided into functional
abstractions called "levels". These levels map loosely to the Open Systems Interconnect
(OSI) 7-layer model defined by the International Standards Organization (ISO).
SM
SM
SS7 Protocol Stack
Message Transfer Part
The Message Transfer Part (MTP) is divided into three levels.
MTP Level 1, is equivalent to the OSI Physical Layer. MTP Level 1 defines the physical,
electrical, and functional characteristics of the digital signaling link. Physical interfaces
defined include E-1 (2048 kb/s; 32 64 kb/s channels), DS-1 (1544 kb/s; 24 64kb/s
channels), V.35 (64 kb/s), DS-0 (64 kb/s), and DS-0A (56 kb/s)
MTP Level 2 ensures accurate end-to-end transmission of a message across a signaling
link. Level 2 implements flow control, message sequence validation, and error checking.
When an error occurs on a signaling link, the message (or set of messages) is
retransmitted. MTP Level 2 is equivalent to the OSI Data Link Layer.
SM
SM
SS7 Protocol Stack Message Transfer Part
An SS7 message is called
a signal unit (SU). There
are three kinds of signal
units: Fill-In Signal
Units (FISUs), Link
Status Signal Units
(LSSUs), and Message
Signal Units (MSUs)
SM
SM
SS7 Protocol Stack- Message Transfer Part
Fill-In Signal Units (FISUs) are transmitted continuously on a signaling link in both
directions unless other signal units (MSUs or LSSUs) are present. FISUs carry basic level
2 information only (e.g., acknowledgment of signal unit receipt by a remote signaling
point). Because a CRC checksum is calculated for each FISU, signaling link quality is
checked continuously by both signaling points at either end of the link. (Note: In the ITU-
T J apan variant, signaling link quality is checked by the continuous transmission of flag
octets (8-bit bytes) rather than FISUs; FISUs are sent only at predefined timer intervals
(e.g., once every 150 milliseconds).
Link Status Signal Units (LSSUs) carry one or two octets (8-bit bytes) of link status
information between signaling points at either end of a link. The link status is used to
control link alignment and to indicate the status of a signaling point (e.g., local processor
outage) to the remote signaling point.
Message Signal Units (MSUs) carry all call control, database query and response,
network management, and network maintenance data in the signaling information field
SIF. MSUs have a routing label which allows an originating signaling point to send
information to a destination signaling point across the network.
SM
SM
The value of the LI (Length Indicator) field determines the signal unit type:
The 6-bit LI can store values between zero and 63. If the number of octets which follow
the LI and precede the CRC is less than 63, the LI contains this number.
Otherwise, the LI is set to 63. An LI of 63 indicates that the message length is equal to or
greater than 63 octets (up to a maximum of 273 octets).
The maximum length of a signal unit is 279 octets: 273 octets (data) +1 octet (flag) +1
octet (BSN +BIB) +1 octet (FSN +FIB) +1 octet (LI +2 bits spare) +2 octets (CRC).
LI Val ue Si gnal Uni t Type
0
Fi l l -In Si gnal Uni t
(FISU)
1..2
Li nk Status Si gnal
Uni t (LSSU)
3..63
Message Si gnal Uni t
(MSU)
SM
SM
Flag
The flag indicates the beginning of a new signal unit and implies the end of the previous signal unit
(if any).
The binary value of the flag is 0111 1110. Before transmitting a signal unit, MTP Level 2 removes
"false flags" by adding a zero-bit after any sequence of five one-bits.
Upon receiving a signal unit and stripping the flag, MTP Level 2 removes any zero-bit following a
sequence of five one-bits to restore the original contents of the message.
Duplicate flags are removed between signal units.
BSN (Backward Sequence Number)
The BSN is used to acknowledge the receipt of signal units by the remote signaling point.
The BSN contains the sequence number of the signal unit being acknowledged.
BIB (Backward Indicator Bit)
The BIB indicates a negative acknowledgment by the remote signaling point when toggled.
CRC (Cyclic Redundancy Check)
The CRC value is used to detect and correct data transmission errors
SM
SM
FSN (Forward Sequence Number)
The FSN contains the sequence number of the signal unit.
FIB (Forward Indicator Bit)
The FIB is used in error recovery like the BIB. When a signal unit is ready for transmission, the
signaling point increments the FSN (forward sequence number) by 1 (FSN =0..127).
The CRC (cyclic redundancy check) checksum value is calculated and appended to the forward
message. Upon receiving the message, the remote signaling point checks the CRC and copies the
value of the FSN into the BSN of the next available message scheduled for transmission back to
the initiating signaling point.
If the CRC is correct, the backward message is transmitted. If the CRC is incorrect, the remote
signaling point indicates negative acknowledgment by toggling the BIB prior to sending the
backward message.
When the originating signaling point receives a negative acknowledgment, it retransmits all
forward messages, beginning with the corrupted message, with the FIB toggled.
Because the 7-bit FSN can store values between zero and 127, a signaling point can send up to
128 signal units before requiring acknowledgment from the remote signaling point. The BSN
indicates the last in-sequence signal unit received correctly by the remote signaling point.
SM
SM
The BSN acknowledges all previously received signal units as well. For example, if a signaling
point receives a signal unit with BSN =5 followed by another with BSN =10 (and the BIB is not
toggled), the latter BSN implies successful receipt of signal units 6 through 9 as well.
SIO (Service Information Octet)
The SIO field in an MSU contains the 4-bit subservice field followed by the 4-bit service
indicator. FISUs and LSSUs do not contain an SIO.
The sub-service field contains the network indicator (e.g., national or international) and the
message priority (0..3 with 3 being the highest priority).
Message priority is considered only under congestion conditions, not to control the order in which
messages are transmitted.
Low priority messages may be discarded during periods of congestion. Signaling link test
messages receive a higher priority than call setup messages.
SM
SM
The service indicator specifies the MTP user thereby allowing the decoding of the
information contained in the SIF
SIF (Signaling Information Field)
The SIF in an MSU contains the routing label and signaling information (e.g., SCCP,
TCAP and ISUP message data). LSSUs and FISUs contain neither a routing label nor an
SIO as they are sent between two directly connected signaling points.
Service
Indicator
MTP User
0 Signaling Network Management Message (SNM)
1 Maintenance Regular Message (MTN)
2 Maintenance Special Message (MTNS)
3
4
5
6
7
Data User Part(call and circuit-related messages)
Data User Part(facility registration/cancellation messages)
Signaling Connection Control Part
Telephone User Part
ISDN User Part
SM
SM
MTP Level 3 provides message routing between signaling points in the SS7 network.
MTP Level 3 re-routes traffic away from failed links and signaling points and controls
traffic when congestion occurs. MTP Level 3 is equivalent to the OSI Network Layer.
MTP Level 3 routes messages based on the routing label in the signaling information field
(SIF) of message signal units. The routing label is comprised of the destination point
code (DPC), originating point code (OPC), and signaling link selection (SLS) field.
Points codes are numeric addresses which uniquely identify each signaling point in the
SS7 network.
When the destination point code in a message indicates the receiving signaling point, the
message is distributed to the appropriate user part (e.g., ISUP or SCCP) indicated by the
service indicator in the SIO.
Messages destined for other signaling points are transferred provided that the receiving
signaling point has message transfer capabilities (like an STP). The selection of outgoing
link is based on information in the DPC and SLS.
SM
SM
MTP Level 3 An ANSI routing label uses 7 octets; an ITU-T routing label uses 4 octets
SM
SM
MTP Level 3
ANSI point codes use 24-bits (three octets); ITU-T point codes typically use 14-bits. For this
reason, signaling information exchanged between ANSI and ITU-T networks must be routed
through a gateway STP, protocol converter, or other signaling point which has both an ANSI and
an ITU-T point code.
(Note: China uses 24-bit ITU-T point codes which are incompatible with both ANSI and other
ITU-T networks).
Interaction between ANSI and ITU-T networks is further complicated by different
implementations of higher level protocols and procedures.
An ANSI point code consists of network, cluster, and member octets (e.g., 245-16-0). An octet is
an 8-bit byte which can contain any value between zero and 255.
Telcos with large networks have unique network identifiers while smaller operators are assigned
a unique cluster number within networks 1 through 4 (e.g., 1-123-9). Network number 0 is not
used; network number 255 is reserved for future use.
ITU-T point codes are pure binary numbers which may be stated in terms of zone, area/network,
and signaling point identification numbers. For example, the point code 5557 (decimal) may be
stated as 2-182-5 (binary 010 10110110 101).
SM
SM
Signaling Link Selection (SLS)
The selection of outgoing link is based on information in the DPC and Signaling Link
Selection field. The SLS is used to:
Ensure message sequencing. Any two messages sent with the same SLS will always arrive at the
destination in the same order in which they were originally sent.
Allow equal load sharing of traffic among all available links. In theory, if a user part sends
messages at regular intervals and assigns the SLS values in a round-robin fashion, the traffic level
should be equal among all links (within the combined linkset) to that destination.
In ANSI networks, the size of the SLS field was originally 5 bits (32 values). In
configurations with two links in each linkset of a combined linkset (totaling 4 links), 8
SLS values were assigned to each link to allow an equal balance of traffic.
SM
SM
Signaling Link Selection (SLS)
A problem arose when growing networks provisioned linksets beyond 4 links. With a 5 bit
SLS, a configuration with 5 links in each linkset of a combined linkset (totaling 10 links)
results in an uneven assignment of 3 SLS values for 8 links and 4 SLS values for the
remaining 2 links. To eliminate this problem, both ANSI and Bellcore moved to adopt an
8-bit SLS (256 values) to provide better load sharing across signaling links.
In ITU-T implementations, the SLS is interpreted as the signaling link code in MTP
messages. In ITU-T Telephone User Part message, a portion of the circuit identification
code is stored in the SLS field.
MTP Level 3 re-routes traffic away from failed links and signaling points and controls
traffic when congestion occurs.
MTP Levels 2 and 1 can be replaced by ATM (Asynchronous Transfer Mode), a simple
broadband protocol which uses fixed-length 53 octet cells. MTP Level 3 interfaces to
ATM using the Signaling ATM Adaptation Layer (SAAL)
SM
SM
SS7 Protocol Stack- ISDN User Part (ISUP)
The ISDN User Part (ISUP) defines the protocol used to set-up, manage, and release trunk
circuits that carry voice and data between terminating line exchanges (e.g., between a
calling party and a called party). ISUP is used for both ISDN and non-ISDN calls.
However, calls that originate and terminate at the same switch do not use ISUP signaling.
Basic ISUP Call Control
When a call is placed to an out-of-switch number, the originating SSP transmits an ISUP initial
address message (IAM) to reserve an idle trunk circuit from the originating switch to the
destination switch (1a). The IAM includes the originating point code ,destination point code,
circuit identification code, dialed digits and, optionally, the calling party number and name.
In the following example, the IAM is routed via the home STP of the originating switch to the
destination switch (1b). Note that the same signaling link(s) are used for the duration of the call
unless a link failure condition forces a switch to use an alternate signaling link.
The destination switch examines the dialed number, determines that it serves the called party, and
that the line is available for ringing. The destination switch rings the called party line and
transmits an ISUP address complete message (ACM) to the originating switch (2a) (via its home
STP) to indicate that the remote end of the trunk circuit has been reserved. The STP routes the
ACM to the originating switch (2b) which rings the calling party's line and connects it to the trunk
to complete the voice circuit from the calling party to the called party.
SM
SM
SS7 Protocol Stack-ISDN User Part (ISUP)
SM
SM
In the example shown above, the originating and destination switches are directly connected with
trunks. If the originating and destination switches are not directly connected with trunks, the
originating switch transmits an IAM to reserve a trunk circuit to an intermediate switch. The
intermediate switch sends an ACM to acknowledge the circuit reservation request and then
transmits an IAM to reserve a trunk circuit to another switch. This processes continues until all
trunks required to complete the voice circuit from the originating switch to the destination switch
are reserved.
When the called party picks up the phone, the destination switch terminates the ringing tone and
transmits an ISUP answer message (ANM) to the originating switch via its home STP (3a). The
STP routes the ANM to the originating switch (3b) which verifies that the calling party's line is
connected to the reserved trunk and, if so, initiates billing.
If the calling party hangs-up first, the originating switch sends an ISUP release message (REL) to
release the trunk circuit between the switches (4a). The STP routes the REL to the destination
switch (4b). If the called party hangs up first, or if the line is busy, the destination switch sends an
REL to the originating switch indicating the release cause (e.g., normal release or busy).
SM
SM
Upon receiving the REL, the destination switch disconnects the trunk from the called party's line,
sets the trunk state to idle, and transmits an ISUP release complete message (RLC) to the
originating switch (5a) to acknowledge the release of the remote end of the trunk circuit. When
the originating switch receives (or generates) the RLC (5b), it terminates the billing cycle and sets
the trunk state to idle in preparation for the next call.
ISUP messages may also be transmitted during the connection phase of the call (i.e.,
between the ISUP Answer (ANM) and Release (REL) messages.
SM
SM
ISUP Message Format
ISUP information is carried in the Signaling Information Field (SIF) of an MSU.
The SIF contains the routing label followed by a 14-bit (ANSI) or 12-bit (ITU) circuit
identification code (CIC).
The CIC indicates the trunk circuit reserved by the originating switch to carry the call. The CIC
is followed by the message type field (e.g., IAM, ACM, ANM, REL, RLC) which defines the
contents of the remainder of the message
Each ISUP message contains a mandatory fixed part containing mandatory fixed-length
parameters. Sometimes the mandatory fixed part is comprised only of the message type field.
The mandatory fixed part may be followed by the mandatory variable part and/or the optional
part.
The mandatory variable part contains mandatory variable-length parameters.
The optional part contains optional parameters which are identified by a one-octet parameter code
followed by a length indicator ("octets to follow") field. Optional parameters may occur in any order. If
optional parameters are included, the end of the optional parameters is indicated by an octet containing
all zeros.
SM
SM
SS7 Protocol Stack-ISDN User Part (ISUP) ISUP Message Format
SM
SM
Initial Address Message
An Initial Address Message (IAM) is sent in the "forward" direction by each switch needed to
complete the circuit between the calling party and called party until the circuit connects to the
destination switch. An IAM contains the called party number in the mandatory variable part and
may contain the calling party name and number in the optional part.
SM
SM
SS7 Protocol Stack-ISDN User Part (ISUP) Initial Address Message
ANSI and ITU-T Initial Address Message (IAM) Format
SM
SM
Address Complete Message
An Address Complete Message (ACM) is sent in the "backward" direction to indicate that the remote end of
a trunk circuit has been reserved. The originating switch responds to an ACM message by connecting the
calling party's line to the trunk to complete the voice circuit from the calling party to the called party. The
originating switch also sends a ringing tone to the calling party's line.
ANSI and ITU-T Address Complete Message (ACM) Format
SM
SM
Address Complete Message
When the called party answers, the destination switch terminates the ringing tone and sends an
Answer Message (ANM) to the originating switch. The originating switch initiates billing after
verifying that the calling party's line is connected to the reserved trunk.
ANSI and ITU-T Answer Message (ANM) Format
SM
SM
Release Message
A Release Message (REL) is sent in either direction indicating that the circuit is being released
due to the cause indicator specified. An REL is sent when either the calling or called party
"hangs up" the call (cause =16). An REL is also sent in the backward direction if the called party
line is busy (cause =17).
ANSI and ITU-T Release (REL) Message Format
SM
SM
Release Complete Message
A Release Complete Message (RLC) is sent in the opposite direction of the REL to acknowledge
the release of the remote end of a trunk circuit and end the billing cycle as appropriate.
ANSI and ITU-T Release Complete (RLC) Message Format
SM
SM
SS7 Protocol Stack
Telephone User Part (TUP)
In some parts of the world (e.g., China, Brazil), the Telephone User Part (TUP) is used
to support basic call setup and tear-down. TUP handles analog circuits only. In many
countries, ISUP has replaced TUP for call management.
SM
SM
SS7 Protocol Stack-Signaling Connection Control Part (SCCP)
In contrast the MTP1 through 3 Which is responsible for the transport and address
functionality between the two network nodes the SCCP by means of layer 3 functions
offers end to end addressing even across several network nodes and countries.
Additionally The SCCP allows for a distinction among the various applications within the
network node,internally the SCCP refers to these applications as subsystems.
SCCP provides connectionless and connection-oriented network services and global title
translation (GTT) capabilities above MTP Level 3. While MTP Level 3 provides point
codes to allow messages to be addressed to specific signaling points, SCCP provides
subsystem numbers to allow messages to be addressed to specific applications (called
subsystems) at these signaling points.
SCCP is used as the transport layer for TCAP based services such as free-phone
(800/888), calling card, local number portability, wireless roaming, and personal
communications services (PCS).
A global title is an address (e.g., a dialed 800 number, calling card number, or mobile
subscriber identification number) which is translated by SCCP into a destination point
code and subsystem number.
SM
SM
.
SM
SM
SCCP is mainly used by the GSM A interface and provides global title translation function for the
NSS.
The SCCP offers two connection-Oriented and two connectionless service classes to the users.
The difference between the two is as follows
Two networks nodes establish a virtual connection between the two subsystems for transaction 1, 2 or 3,
in case of connection oriented mode.
The identification of the connection is achieved via reference numbers, the source local reference (SLR)
and the destination local reference (DLR).
While such a connection is active it is possible not only to exchange data between the two network nodes
but also to address individual transactions.
The SCCP analyze the data received from the MTP and forwards the data to the addresses subsystem
where the input data is associated with the various active transactions. Typical examples in GSM for the
connection-oriented transactions are location update and the mobile originated call within BSSAP.
In case of connectionless service classes the SCCP provides no referencing , the recipient of a message
must assign it to active process . Examples for connectionless services are Paging in BSSAP, SCCP
management and the TCAP protocol.
The difference between connection oriented and the connectionless service within SCCP is achieved by a
parameter called protocol class.
.
SM
SM
Network Node 1 Network Node 2
SM
SM
Connection oriented versus connection less service- A simple example
The difference between the two services can be best explained by the example of sending a letter.
Postal services provides for the physical means for the mail transfer. The individual envelope correspond to
the MSUs and the letter inside the envelope corresponds to the SCCP message.
Connection Oriented Service
When two parties of any particular company corresponds via mail, they typically address many issues.
References for each issue need to be assigned, so that the recipient can distinguish among them.
That corresponds to a virtual connection setup. The various issues that arises could be an unpaid bill or a
new order.
Each side tries to make the issue clear, for example by adding a headline or a reference line to establish a
unique reference (SLR and DLR in SCCP)
A virtual connection between the sender and the recipient is set up in both the cases. (No dedicated physical
path between the two parties.
Connection Less Service
A person who vacations in a far away country typically sends postcards to relatives and friends. Each
postcards needs a address to enable delivery, but there is no reference to a specific issue and no answer
expected.
It is therefore a conversation that does not requires an immediate reference or connection setup.
SM
SM
SCCP is mainly used by the GSM A interface and provides global title translation
function for the NSS.
Connection oriented service
The messages are not directly related to a single mobile
Reset or overload indications
Connection less service
Separate independent connection for each MS
To distinguish transaction for each MS
The connections are established on the needed bases by the BSC or MSC and release when the
transactions complete
.
SM
SM
SS7 Protocol Stack- Signaling Connection Control Part (SCCP)
Global Title Translation
SCCP also provides the means by which an STP can perform global title translation
(GTT), a procedure by which the destination signaling point and subsystem number (SSN)
is determined from digits (i.e., the global title) present in the signaling message.
The global title digits may be any sequence of digits (e.g., the dialed 800/888 number,
calling card number, or mobile subscriber identification number) pertinent to the service
requested.
Because an STP provides global title translation, originating signaling points do not need
to know the destination point code or subsystem number of the associated service.
Only the STPs need to maintain a database of destination point codes and subsystem
numbers associated with specific services and possible destinations.
SM
SM
SCCP Message Format
The Service Indicator of the Service Information Octet (SIO) is coded 3 (binary 0011) for
SCCP. SCCP messages are contained within the Signaling Information Field of an MSU.
The SIF contains the routing label followed by the SCCP message contents. The SCCP
message is comprised of a one-octet message type field which defines the contents of the
remainder of the message
Each SCCP message contains a mandatory fixed part (mandatory fixed-length
parameters), mandatory variable part (mandatory variable-length parameters), and an
optional part which may contain fixed-length and variable-length fields.
Each optional part parameter is identified by a one-octet parameter code followed by a
length indicator ("octets to follow") field. Optional parameters may occur in any order. If
optional parameters are included, the end of the optional parameters is indicated by an
octet containing all zeros.
SM
SM
SCCP Message Format
.
SM
SM
SS7 Protocol Stack
Transaction Capabilities Applications Part (TCAP)
TCAP supports the exchange of non-circuit related data between applications across the
SS7 network using the SCCP connectionless service.
Queries and responses sent between SSPs and SCPs are carried in TCAP messages. For
example, an SSP sends a TCAP query to determine the routing number associated with a
dialed 800/888 number and to check the personal identification number (PIN) of a calling
card user.
In mobile networks (IS-41 and GSM), TCAP carries Mobile Application Part (MAP)
messages sent between mobile switches and databases to support user authentication,
equipment identification, and roaming.
When a mobile subscriber roams into a new mobile switching center (MSC) area, the
integrated visitor location register requests service profile information from the
subscriber's home location register (HLR) using mobile application part (MAP)
information carried within TCAP messages.
.
SM
SM
SS7 Protocol Stack
Two types of Mobile application signaling takes advantage of TCAP
Mobile Application Part MAP, GSM DCS1800 and DCS900. MAP defines the interfaces
between different component in the GSM, (MSC <->HLR, MSC<->MSC)
IS41 Interim Standard 41 the TIA (U.S standard) and recently introduce as the ITU-R
standard. This standard defines the interfaces between different component (MSC<-
>HLR, MSC<->MSC etc.)
SM
SM
SS7 Protocol Stack
SM
SM
SS7 Protocol Stack
The TCAP protocol is the most important piece of the protocol stack of GSM or any other
mobile system because it provides the core functionality to support roaming.
Like the SCCP ,TCAP is not restricted to being used only by mobile services but is utilized by
many other applications for the database access and similar tasks.
TCAP is the typically implementation of the OSI layers 4 through 6. In that function it allow
integration of some translation functionality into a message for instance provide a means for users
of a transaction to discuss or synchronize on an application protocol.
The figure in the next slide shows the generic communication process via TCAP, where initially
both the partners need to agree on the protocol to be used. The receiving side finds the respective
information in the dialog control information which in TCAP is called the dialog portion. The
figure shows the component portion(parameter part). The component portion carries the actual
user data. In GSM this is MAP traffic.
TCAP Addressing
With respect to addressing, TCAP relies completely on the services of the SCCP. TCAP uses the
connectionless services of the SCCP.
SM
SM
SS7 Protocol Stack
SM
SM
SS7 Protocol Stack-Transaction Capabilities Applications Part (TCAP)
A TCAP message is comprised of a transaction portion and a component portion
Transaction Portion
The transaction layer is the OSI layer 4 deals with setting up and maintaining an end-to-
end communications. It expects sufficient information from the user about the sender and
the addresses of a message.This information is not used by TCAP but pass on to SCCP for
addressing.In most cases, the transaction layer assigns to a process an additional TCAP-
internal identifier, the transaction Id, which is comparable to SLR and DLR of the
connection oriented mode of the SCCP. The transaction portion contains the package
type identifier. There are seven package types:
Unidirectional: Transfers component(s) in one direction only (no reply expected).
Query with Permission: Initiates a TCAP transaction (e.g., a 1-800 query). The destination node
may end the transaction.
Query without Permission: Initiates a TCAP transaction. The destination node may not end the
transaction.
Response: Ends the TCAP transaction. A response to an 1-800 query with permission may
contain the routing number(s) associated with the 800 number.
SM
SM
Transaction Portion
The transaction portion contains the package type identifier. There are seven package
types:
Conversation without Permission: Continues a TCAP transaction. The destination node may not
end the transaction.
Abort: Terminates a transaction due to an abnormal situation.
The transaction portion also contains the Originating Transaction ID and Responding
Transaction ID fields which associate the TCAP transaction with a specific application at the
originating and destination signaling points respectively.
SM
SM
Component Portion
The component Layer in the OSI layers 5 and 6 is responsible for synchronization and
coordination of a communications. It also provides a uniform data interface to its users,
represented by the application protocol data unit (APDU) refer to as components. They
transport the payload which MAP and the component layer exchanges.
SM
SM
Component Portion
There are six kinds of components:
Invoke (Last): Invokes an operation. For example, a Query with Permission transaction may
include an Invoke (Last) component to request SCP translation of a dialed 800 number. The
component is the "last" component in the query.
Invoke (Not Last): Similar to the Invoke (Last) component except that the component is
followed by one or more components.
Return Result (Last): Returns the result of an invoked operation. The component is the "last"
component in the response.
Return Result (Not Last): Similar to the Return Result (Last) component except that the
component is followed by one or more components.
Return Error: Reports the unsuccessful completion of an invoked operation.
Reject: Indicates that an incorrect package type or component was received.
Components include parameters which contain application-specific data carried
unexamined by TCAP.
SM
SM
Mobile SS7 network elements
The MSC is connected to both STP via A quad links. Each link (logical) run at 40%
utilization.
STPs are connected via the C link and A quad links to PSTN to avoid a single point of
failure within a network.
The SCP/HLR is also connected via A quad links to STPs.
The PSTN to MSC is connected via the F link.
ISUP application is used on these types of links.
SM
SM
GSM SS7 Network
MSC
MSC
A
A
A
F
A
D
D D
D
C
STP
STP
HLR
HLR
A
A
A
A
PSTN
SP
A
A
A A
F
Signaling Point (SP)
Is a switching system that interconnects input devices
(e.g. telephones, service terminals) with the SS7
Network.
SP is able to originate call control messages only
SM
SM
GSM Network Protocols-Mobile Application Part
All the signaling protocols introduced so far from LAPD to TCAP are peer to peer
protocols, that is horizontal protocols in the way OSI Reference Model consider them.
Nevertheless LAPD,SCCP and TACP all need primitives ( the carrier of the vertical data)
to communicates with the adjacent higher or lower layers.But in these protocols primitives
are of less importance.
Because the applications itself (HLR,VLR etc) is not a part of the OSI model so called
MAP services are required for control tasks and the data exchange between the different
applications and MAP.
The MAP services actually are primitives. There are two types of MAP services
Common MAP Service for pure communication control between MAP and applications.
Special MAP Service as the carrier of Signaling Data
SM
SM
SM
SM
Direction Dependency of Map Services
The tasks of layer 1 through 7 of the OSI model are transparent for the MAP application,
The MAP application sees only the communications with the MAP, which is performed by MAP
services.
MAP in layer 7 receive commands and answers from the applications that are conveyed to the
peer entity via TCAP and remaining layers of OSI model.
On the other hand , MAP receives commands and answers from TCAP that actually come from
the peer entity and need to be forwarded to the application.
It is important for MAP and for the MAP applications to distinguish not only between the various
MAP services but also between the two possible directions of those services.
For that reason up to four different variants were defined for the MAP services.
Let the initiating MAP application is A and the responding MAP application be B.
A send a request which translates into an indication on the side of the MAP application B.
Bs answer is sent back in a response and translated into a confirmation from the MAP to A.

SM
SM
SM
SM
Common Map Services
Six common map services can be used to control communications between MAP and its
applications.
Depending on the task of the MAP service all four or only some of the primitives Request,
Indication, Response and Conformation are needed.
MAP DELIMITER Service
By sending this primitive the application indicates that a data packet is complete and ready
to be passed to the peer entity.
Such data packet may contain a MAP-OPEN service for communication control, special
MAP services (with signaling data) or both.
Only the request and indication variants are defined for the MAP-DELIMITER service.
SM
SM
MAP-OPEN Service
By means of this primitive, an application requests MAP to establish a dialog with another
application.
The MAP-OPEN service includes the specification of the requested transaction (application
context name) and identifies sender and addressee.
Neither parameter not data are included. All four primitives- Request, Indication, Response and
Confirmation are defined for the MAP -OPEN service.
MAP-CLOSE Service
MAP-CLOSE service is used to terminating an existing process. The primitive is passed to the
MAP and then forwarded to the TCAP when a MAP application intends to terminates a dialog.
Only the Request and Indication variants are defined for the MAP-CLOSE service.
SM
SM
MAP-U-ABORT Service
MAP-USER-ABORT indicates that an application wants to interrupt a dialog.
Only the Request and Indication variant is defined for the MAP-U-ABORT service.
MAP-P-ABORT Service
MAP Service Provider Abort indicates that the TCAP wants to interrupt or has already interrupted
a dialog.
Only the indicate variant is defined for the MAP-P-ABORT service.
MAP-NOTICE service
The MAP-NOTICE service provides an application with information about the problems on the
peer side.
Only the indication variant is defined for the MAP-NOTICE service. Particularly when a TCAP
message with the reject component specific problem codes is received the MAP application gets a
MAP-NOTICE service.
SM
SM
Special Map Services
The purpose of common MAP services is to control the communication between the MAP
and its applications.
Although the MAP-OPEN service already contains the application context name and the
hence the requested protocol for the dialog to be established only a special MAP service
such as updateLocation contain the actual parameter.
Like the message type for the other signaling standrads the local operation codes identify
the special MAP services within MAP.As for all primitives, up to four variants (Request,
Indication, Response and Confirmation are defined for the special MAP services. Two
examples are the following
The local operation code ForwardAccessSignaling is a service for transparent transmission of the
BSSAP data between MSCs after an inter-MSC handover. This service is non-confirmed that is
no acknowledgement is returned when a forwardAccessSignaling code is received. Therefore
only the request and indication variants are necessary for the forwardAcessSignaling service.
The local operation code UpdatLocation is required directly after the location update for the new
VLR to update the location information in the HLR. Because this is confirmed service,it requires
all four varients request, indication, response and confirmation.
SM
SM
An application communicates with MAP by means of common MAP services and special
MAP service.
The term dialog stems from the vocabulary of TCAP and addresses the exchange of data between
two TCAP users. GSM uses only the services of the so-called structured dialog which is used
when upon delivery of data, a reaction ,an acknowledgment or answer is expected from the
recipient.
With respect to data transmission between the MAP, TCAP and application this restriction
simplifies the situation, since the dialog between the MAP applications always has to be
structured.
That requires form the prospective of TCAP that it starts with the BEGIN message and in case of
an error terminates with an END message. A special case is the abortion of a dialog with a
ABORT message which can be sent by either MAP or TCAP.
SM
SM
All non-call-associated signaling in GSM is grouped under MAP.
Non-call-associated signaling implies all signaling dealing with
Mobility management,
Security,
Activation/deactivation of supplementary services, and so on.
All protocols use SS7 lower three layers (i.e., MTP 1,2,3, SCCP layer, and TCAP
layer).These protocols are used primarily for database queries and responses
SM
SM
BSS
MSC
MSC
VLR
VLR
HLR
GMSC
EIR
MAP/E
MAP/H
MAP/C
MAP/D
MAP/B
MAP/F
MAP/I
MAP/G
SMS
Gateway
BSSMAP
MAP/B
MAP/C
SM
SM
MAP- B
MAP-B is the interface between the MSC and
its associated VLR.
Whenever the MSC needs data related to a
given mobile station currently located in its
area, it interrogates the VLR.
When a subscriber activates a specific
supplementary service or modifies some data
attached to a service, the MSC informs(via the
VLR) the HLR that stores these modifications
and updates the VLR if required.
This interface between the MSC and the VLR
is very heavily used, and hence the decision by
several manufacturers to integrate the VLR
functionality with the MSC
MAP - C
MAP-C is the interface between the MSC and
the HLR.
The gateway MSC queries the corresponding
subscriber HLR to determine the routing
information for a call or a short message
directed toward the user.
This messaging is handled by the MAP-C
protocol. Additional SMS and charging
messages also form part of this interface
message set
SM
SM
MAP - D
MAP-D is the interface between the HLR and
the VLR.
It is used to exchange data related to the
location of the mobile station and for the
management of the subscriber.
The VLR informs the HLR of the location of
a mobile station managed by the latter and
provides it with the roaming information for
that subscriber.
Exchanges of data may occur when the
mobile subscriber requires a particular service,
when changes to the subscription have to be
done, or when some parameters of the
subscription are modified by administrative
means
MAP-E
This interface supports the necessary
signaling support for the handover function.
When a short message is to be transferred
between a mobile station and short message
service center, this interface is used to
transfer the message between the MSC
serving the mobile station and the MSC
acting as the interface to the message center.

SM
SM
MAP-F
Is the interface between the MSC and the equipment identity register (EIR).
It is used to exchange data to enable the EIR to verify the mobile subscriber equipment
SM
SM
GSM Network Protocols-Addressing and Routing
Within the GSM network two types of routing can be described
SS7 addressing and message signaling routing
Call Control /number routing
SM
SM
SS7 addressing/routing
The SS7 MTP layer 3 provides the routing function.
This layer is used to route within a local network using the Signaling Point Code (OPC and DPC)
addressing. Considering the OPC and DPC is known to each element.
The routing is performed using the mapping of the DPC to a physical location (port).
To interconnect all the local networks or the national SS7 networks the SCCP Global Title
Translation (GTT) functionality is used.
This SCCP functionality allows a centralized network to hold and maintain all the
addresses and routing tables, centralizing the routing function
Global Title Translation is one of the strong routing capabilities of SS7 SCCP layer.
For an MSC to send a message to a particular HLR, the MSC does not need to know each
Mobiles HLR point code. Only the adjacent STP point code and the dialed digits
(MSISDN) needs to be provided to the STP in order to route the message to the HLR.
The STP will perform the translation of the Dialed digits to physical point code (HLR or
MSC etc.)
SM
SM
SS7 addressing/routing
The STP pair after checking the SCCP header information will determine the message
requires GTT translation. It will then extract from the calling number
address field in the SCCP header the IMSI of the subscriber and from a database table
determines the HLR point code where the validation/authentication should be sent.
As can be seen this will eliminate book keeping on every MSC and centralizes the
routing/translation on the SS7 STP network
SM
SM
Call control and number routing
Two basic number routings are:
Routing of Mobile Terminating Calls (MTC)
Routing of Mobile Origination Calls (MTO)
SM
SM
Routing of MTC
A land line calling party dial the GSM mobile directory number (MS ISDN number) the
PSTN after performing the digits translation routes the call to the home PLMN GMSC.
The GMSC contains either the routing tables to relate the MSISDN number with the
corresponding HLR, or if the GMSC is connected to the SS7 network with the GTT
functionality, theSS7 network will identify the HLR
Once the GMSC interrogate the HLR with the MSISDN number, the HLR determines the
IMSI from MSISDN number. Note the HLR stores the subscribers
information based on IMSI not MSISDN.
The HLR locates the visiting MSC/VLR point code and if an MSRN available it will return
the information to GMSC. If the HLR does not have the MSRN for the subscriber it will
request one from the visiting MSC/VLR. The latter can be done via GTT if an SS7backbone
with GTT (IMSI to point code) functionality is available/supported.
The GMSC once it receives the MSRN and the MSC/VLR point code it will route the call to
the VMSC/VLR.
The MSC/VLR will then page the subscriber
SM
SM
Routing of MTC
GMSC
VMSC
HLR
MSISDN
MSRN
MSRN
MSRN IMSI
SM
SM
Routing of MOC
The call originating information including the dialed digits will be send to the MSC/VLR.
The MSC/VLR with the subscriber's profile information performs digits translation (if
supported) and routes the call either to the PSTN or to other MSCs (if a MTM call within the
network) .
If the MSC can not perform the digits translation it would route the call to GMSC for
translation and routing
SM
SM
IS-41 US standard
It is a US standard that defines the inter-system operation that was develop by TIA, which is
becoming an ITU-R standard.
First revision in 1983 IS-41 Rev 0 only addressed Intersystem HO.
Future revisions A,B,C and D addresses the following issues:
Automatic Roaming and call delivery in addition to
To add new subscribers features to the standardized set
To add functionality to support new network requirements ((IN and digital networks)
To add clarification and remove errors
IS-41
The signaling backbone is based on SS7 protocol
It uses the MTP layer 1,2 and 3 the SCCP connectionless protocol and TCAP layer
Provides mobile application part MAP functionality (MM, CM and RR) but incompatible with GSM
MAP.
Supports the air interfaces of AMPS/NAMPS and CDMA IS-95/IS136(800, 1900MHZ)
Supports the MSC/BS interface IS-634 and IS-653
Support SMS and Authentication functionality
SM
SM
IS-41 US standard
GSM and IS 41 Interworking
Inter-working means the Mobile Application Part successful communications
It requires an inter-working function IWF, a device that coverts protocols as well as
performing database mapping
There are market drivers, I.e international roamers and national roamers that uses a GSM
based network (PCS 1.9)
SM
SM
GSM Networks Future Trends
Second Generation (2G+) Wireless Networks
The virtual explosion of Internet usage has had a tremendous impact on the demand for
advanced wireless data communication services. However, the effective data rate of 2G
circuit-switched wireless systems is relatively slow -- too slow for today's Internet.
As a result, GSM, PDC and other TDMA-based mobile system providers and carriers
have developed 2G+technology that is packet-based and increases the data communication
speeds to as high as 384kbps.
These 2G+systems are based on the following technologies: High Speed Circuit-Switched
Data (HSCSD), General Packet Radio Service (GPRS) and Enhanced Data Rates for Global
Evolution (EDGE) technologies.
SM
SM
HSCSD
HSCSD is one step towards 3G wideband mobile data networks. This circuit-switched
technology improves the data rates up to 57.6kbps by introducing 14.4 Kbps data coding and
by aggregating 4 radio channels timeslots of 14.4 Kbps.
GPRS
GPRS is an intermediate step that is designed to allow the GSM world to implement a full
range of Internet services without waiting for the deployment of full-scale 3G wireless
systems. GPRS technology is packet-based and designed to work in parallel with the 2G
GSM, PDC and TDMA systems that are used for voice communications and for table look-
up to obtain GPRS user profiles in the Location Register databases. GPRS uses a multiple of
the 1 to 8 radio channel timeslots in the 200kHz-frequency band allocated for a carrier
frequency to enable data speeds of up to 115kbps. The data is packetized and transported
over Public Land Mobile Networks (PLMN) using an IP backbone so that mobile users can
access services on the Internet, such as SMTP/POP-based e-mail, ftp and HTTP-based Web
services
SM
SM
EDGE
EDGE technology is a standard that has been specified to enhance the throughput per
timeslot for both HSCSD and GPRS. The enhancement of HSCSD is called ECSD, whereas
the enhancement of GPRS is called EGPRS. In ECSD, the maximum data rate will not
increase from 64 Kbps due to the restrictions in the A interface, but the data rate per timeslot
will triple. Similarly, in EGPRS, the data rate per timeslot will triple and the peak
throughput, including all eight timeslots in the radio interface, will exceed 384 Kbps.
SM
SM
GSM Network Evolution Road Map
GSM
Data
HSCSD
GPRS
EDGE
EGPRS
WCDMA
1999 2000
2002
WCDMA
Phase I
Evolution
9.6 kbps
9.6 - 28.8 kbps
9 - 53.6 kbps
<470 kbps
144 - 384 kbps
384 - 2048 kbps
2001
2003-2005
SM
SM
GSM Network Evolution Road Map
Packet data Equipment
requirements
GSM CSD (Circuit
Switched Data)
GPRS (General
PacketRadio
Service)
EDGE (Enhanced Data
rates for GSM Evolution)
IMT-2000 CDMADirect
Spread (CDMA DS)
Handset No packet data
capability -Single-
Mode phones
New handsets
GPRS-- enabled
handsets will work on
GPRS enabled
networks and
9.6Kbps on GSM
networks using CSD-
Dual Mode phones
New handsets
EDGE-- handsets will work
at up to 384Kbps on EDGE
enabled networks on
GPRS enabled networks
and 9.6Kbps on GSM
networks using CSD-Tri-
Mode phones
New handsets CDMA DS
handsets will work at up to
2Mbps and only on 3G
networks-Quad-Mode
phones
Infrastructure No packet data
capability
New packet overlay/
backbone needed for
circuit switched
network
Further backbone
modifications required
New infrastructure roll out
with existing interconnect
Technology Platform Current GSM TDMA
Technology
GSM TDMA platform
with additional packet
overlay
Modulation changes
required to GSM TDMA
platform
New CDMA infrastructure

GSM Concepts

Enviado por

Dados do documento

Direitos autorais

Formatos disponíveis

Compartilhar este documento

Compartilhar ou incorporar documento

Opções de compartilhamento

Você considera este documento útil?

Este conteúdo é inapropriado?

Direitos autorais:

Formatos disponíveis

GSM Concepts

Enviado por

Direitos autorais:

Formatos disponíveis

Telcom Global Solutions Inc.

t he par t ner of c hoi c e i n t he w i r el ess w or l d

Telcom Global Solutions Inc.

Telcom Global Solutions Inc.

Telcom Global Solutions Inc.

Telcom Global Solutions Inc.

Você também pode gostar