Introduction

The Global System for Mobile Communications (GSM) is a set of recommendations

and specifications for a digital cellular telephone network (known as a Public Land
Mobile Network, or PLMN).
These recommendations ensure the compatibility of equipment from different GSM
manufacturers, and interconnectiity between different administrations, including
operation across international boundaries.
GSM networks are digital and can cater for high system capacities.
They are consistent with the world!wide digiti"ation of the telephone network, and are
an e#tension of the Integrated Serices !igital Network (IS!N), using a digital radio
interface between the cellular network and the mobile subscriber equipment.
GSM $%&'(&)*+&S
GSM systems use radio frequencies between "#$%#&' M() for receie and between
#*'%#+$ M," for transmit.
%$ carriers are spaced eery ,$$ k(), allowing a total of &,- carriers for use.
-n %$ carrier is a pair of radio frequencies, one used in each direction.
Transmit and receie frequencies are always separated by -' M().
&#tended GSM (&GSM)
&GSM has &$M() of bandwidth on both transmit and receie.
-1-
%eceie bandwidth is from ""$ M() to "#$ M().
Transmit bandwidth is from #,' M() to #*' M().
Total %$ carriers in &GSM is '$.
.*S/011 $%&'(&)*+&S
.*S/011 systems use radio frequencies between &/&$%&/"' M() for receie and
between &"$'%&""$ M() for transmit.
%$ carriers are spaced eery ,$$ k(), allowing a total of */* carriers.
There is a /11 k," guard band between /2/1.1 M," and /2/1./ M," and between
/203.4 M," and /205.1 M," for receie, and between /015.1 M," and /015./ M,"
and between /024.4 M," and /001.1 M," for transmit.
Transmit and receie frequencies are always separated by #' M().
-2-
-3-
-4-
-5-
0ase Station Subsystem (0SS)
To understand the paging process, we must analyse the functions of the 6SS.
The 6ase Station Subsystem consists of the following elements7
6S* 6ase Station *ontroller
6TS 6ase Transceier Station
T* Transcoder
The 0ase Station Controller (0SC) is the central network element of the 6SS and it
controls the radio network. This means that the main responsibilities of the 6S* are7
*onnection establishment between MS and )SS, Mobility management, Statistical raw
data collection, -ir and - interface signalling support.
The 0ase 1ransceier Station (01S) is a network element maintaining the -ir
interface. +t takes care of -ir interface signalling, -ir interface ciphering and speech
processing. +n this conte#t, speech processing refers to all the functions the 6TS
performs in order to guarantee an error!free connection between the MS and the 6TS.
The 1ransCoder (1C) is a 6SS element taking care of speech transcoding, i.e. it is
capable of conerting speech from one digital coding format to another and ice ersa.
8e will describe more about the transcoder functions later.
$igure 9./0 The 6ase Station Subsystem (6SS)
The 6TS, 6S* and T* together form the 6ase Station Subsystem (6SS) which is a part of the
GSM network taking care of the following ma:or functions7
-6-
BTS
TC
BSC
BSC
TC
BTS
BTS
2adio Pat3 Control
+n the GSM network, the 6ase Station Subsystem (6SS) is the part of the network
taking care of %adio %esources, i.e. radio channel allocation and quality of the radio
connection. $or this purpose, the GSM Technical Specifications define about /91
different parameters for each 6TS. These parameters define e#actly what kind of 6TS is
in question and how MSs may ;see; the network when moing in this 6TS area. The
6TS parameters handle the following ma:or items7 what kind of handoers (when and
why), paging organisation, radio power leel control and 6TS identification.
01S and 1C Control
+nside the 6SS, all the 6TSs and T*s are connected to the 6S*(s). The 6S* maintains
the 6TSs. +n other words, the 6S* is capable of separating (barring) a 6TS from the
network and collecting alarm information. Transcoders are also maintained by the 6S*,
i.e. the 6S* collects alarms related to the Transcoders.
Sync3ronisation
The 6SS uses hierarchical synchronisation which means that the MS* synchronises
the 6S* and the 6S* further synchronises the 6TSs associated with that particular
6S*. +nside the 6SS, synchronisation is controlled by the 6S*. Synchronisation is a
critical issue in the GSM network due to the nature of the information transferred. +f the
synchronisation chain is not working correctly, calls may be cut or the call quality may
not be the best possible. (ltimately, it may een be impossible to establish a call.
4ir 5 4 Interface Signalling6
+n order to establish a call, the MS must hae a connection through the 6SS. This
connection requires seeral signalling 7rotocols that are e#plained in the Signalling
*hapter.
Connection 8stablis3ment between MS and NSS
The 6SS is located between two interfaces, the -ir and the - interface. $rom the call
establishment point of iew, the MS must hae a connection through these two
interfaces before a call can be established. Generally speaking, this connection may be
either a signalling type of connection or a traffic (speech, data) type of connection.
Mobility Management and s7eec3 transcoding
6SS Mobility Management mainly coers the different cases of handoers. These
handoers and speech transcoding are e#plained in later sections
Collection of Statistical !ata
-7-
The 6SS collects a lot of short!term statistical data that is further sent to the )MS for
post processing purposes. 6y using the tools located in the )MS the operator is able to
create statistical ;iews; and thus obsere the network quality.
- 6ase Station Subsystem is controlled by an MS*. Typically, one MS* contains
seeral 6SSs. - 6SS itself may coer a considerably large geographical area consisting
of many cells. (- cell refers to an area coered by one or more frequency resources).
&ach cell is identified by an identification number called Cell Global Identity (CGI)
which comprises the following elements7
CGI = MCC +
MNC + LAC + CI
M** Mobile *ountry *ode
M)* Mobile )etwork *ode
<-* <ocation -rea *ode
*+ *ell +dentity
There is one 9Mbit=s >*M line resered for each 6TS to proide the connection to )SS.
6ut as you can see, the 6TS?s are used at different times and on different days. 8hy
not use the same line for both of the two 6TSs@ +t can be done, but in this case there
has to be a concentrator between MS* and 6TS. The 0SC acts as a concentrator
(in addition to being the radio network controller). Ane 6S* is capable of sering
seeral 6TSs.
)ote7 That there is no relation between a 6S* area and <ocation -rea and the seres
as a concentrator in addition to its ma:or role of radio network control. The purpose of
the location area is to facilitate the 7aging process (searching for the subscriber),
whereas a 6S* area is related to traffic connections and radio resources.
-8-
4 Mobile 1erminated Call and Paging
<et us go back to our professor. 8e know that he is within the hotel area. Thanks to the
registration system of the hotel, we also know that he went to the restaurant and
registered his presence there. Somebody calls him and the receptionist answers. The
receptionist checks the registration system of the hotel and discoers that the professor
is in the restaurant. - message about an incoming call is sent to the restaurant and one
of the waiters starts looking for the professor. +f the waiter does not know the right table,
he uses the public address system and 97ages9 the professor as follows7 BThere is a
telephone call for Mr. So and So. *ould you please come forward@C Ance the professor
raises his hand, the search is complete and the call is set up.
$igure 9.99 The paging process
-gain, a similar process is used in the cellular network. >aging is a signal that is
transmitted by all the cells in the <ocation -rea (<-). +t contains the identification of the
subscriber. -ll the mobile stations in the <- receie the paging signal, but only one of
them recognises the identification and answers to it. -s a consequence of this answer,
a point to point connection is established. )ow the two subscribers are connected, and
traffic can be carried through the network. <et?s sum up the entire process7
-9-
6TS 6TS
Paging
6TS
Mobile res7onds
to 7aging
<ocation -rea
Paging
Paging
$igure 9.9D Simplified steps in setting up a call
/. - subscriber in a fi#ed network dials a number of a mobile phone. The dialled
number is the MS+S.).
9. The >ublic Switched Telephone )etwork (>ST)) e#change analyses the number
and contacts the Gateway Mobile Serices Switching *entre (GMS*).
D. The Gateway MS* analyses the MS+S.) and sends a message to the ,ome
<ocation %egister (,<%).
3. The ,<% checks its database to determine the current location of the called
subscriber.
5. The ,<% interrogates the MS*=E<% (Eisitor <ocation %egister) that is currently
sering the called subscriber.
F. The sering MS*=E<% generates a temporary MS%) (Mobile Subscriber
%oaming )umber).
2. MS*=E<% sends MS%) to ,<% and the ,<% forwards the MS%) to the GMS*.
0. The GMS* identifies the sering MS*=E<% as the destination for routing the call.
4. .estination MS*=E<% receies MS%). +t identifies the number that is called and
traces the called subscriber.
/1. The destination MS*=E<% initiates a paging process in the <ocation -rea to
locate the called subscriber. The mobile phone of the called subscriber
recognises the paging signal and answers it.
Mobile :riginated Call
8e hae studied the phases of a >ST) originated call and traced the moements of the
subscriber. 8e hae e#amined the functions and architecture of the network elements.
-10-
PS1N
GMSC (L2 MSC;<L2
4%
Subscriber
C4LL S81=P (MSIS!N)
4N4L>S8 N=M082
C4LL S81=P (MSIS!N)
MSIS!N
IMSI
MS2N
MS2N
C4LL S81=P (MS2N)
P4GING
)ow it?s time to inestigate another case7 how is a connection established when the call
is initiated by a mobile subscriber instead of a fi#ed one@
The mobile subscriber dials a number. +n other words, the subscriber issues a serice
request to the network in which he is currently registered as a isitor. -fter receiing the
request, the network analyses the data of the calling subscriber in order to do three
things7
-uthorise or deny the use of the network.
-ctiate the requested serice.
%oute the call.
The call may hae two types of destinations7 a mobile station or a telephone in a fi#ed
network. +f the call is addressed to a telephone in a fi#ed telephone network, it is routed
to the >ST), which in turn routes it to the destination. +f the called number is another
mobile station in the same network, the MS* starts the ,<% &nquiry procedure which is
processed in the same way as in the e#ample of a >ST) originated call.
-11-
$igure 9.93 Mobile Ariginated *all procedure.
+dentifying and locating the called subscriber are the two key preconditions of setting up
a point to point connection. The MS+S.) fulfils the purpose of identification, but locating
requires a quick and comprehensie system for keeping track of the subscriber. +f the
network does not hae up!to!date information about the subscriber?s current location,
setting up a call would mean paging large network areas in order to find the subscriber
and that would be a comple# and time!consuming task. To aoid this, the GSM network
monitors and records the moements of the subscribers all the time. This process is
called Location =7date. 8e hae already discussed it briefly, but now we will analyse
it in detail.
-12-
8?C GMSC (L2 MSC <L2 0SS MS
&. c3annel assignment
,. security 7rocedures
*. call setu7
-. c3eck serices etc.
'. all ok
+. call is 7roceeding
/. traffic c3annel allocated
". set u7 t3e call
#. call set u7 com7lete
&$. alert
&&. 0 answers
Location =7date
1y7es of Location =7date
+n practice, there are three types of location updates7
/. <ocation %egistration (power on)
9. Generic
D. >eriodic
Location registration takes place when a mobile station is turned on. This is also
known as IMSI 4ttac3 because as soon as the mobile station is switched on it informs
the Eisitor <ocation %egister (E<%) that it is now back in serice and is able to receie
calls. -s a result of a successful registration, the network sends the mobile station two
numbers that are stored in the S+M (Subscriber +dentity Module) card of the mobile
station.
These two numbers are the Location 4rea Identity (L4I) and the 1em7orary Mobile
Subscriber Identity (1MSI). The network, ia the control channels of the air interface,
sends the <-+. The TMS+ is used for security purposes, so that the +MS+ of a subscriber
does not hae to be transmitted oer the air interface. The TMS+ is a temporary identity,
which regularly gets changed.
- Location 4rea Identity (L4I) is a globally unique number.
- Location 4rea Code (L4C) is only unique in a particular network.
-13-
<- 9
<- /
<L2
MS*
&ery time the mobile receies data through
the control channels, it reads the <-+ and
compares it with the <-+ stored in its S+M
card. - generic location u7date is
performed if they are different. The mobile
starts a <ocation (pdate process by
accessing the MS*=E<% that sent the
location data.
- c3annel re@uest message is sent that
contains the subscriber identity (i.e.
+MS+=TMS+) and the <-+ stored in the S+M
card. 8hen the target MS*=E<% receies
the request, it reads the old <-+ which identifies the MS*=E<% that has sered the
mobile phone up to this point. - signalling connection is established between the two
MS*=E<%s and the subscriber?s +MS+ is transferred from the old MS* to the new MS*.
(sing this +MS+, the new MS* requests the subscriber data from the ,<% and then
updates the E<% and ,<% after successful authentication.
Air A
O & M
VLR
MSC
VLR
MSC
$igure 9.95 )etwork &lements inoled in location update
Periodic location u7date is carried out when the network does not receie any location
update request from the mobile in a specified time. Such a situation is created when a
mobile is switched on but no traffic is carried, in which case the mobile is only reading
and measuring the information sent by the network. +f the subscriber is moing within a
single location area, there is no need to send a location update request.
-14-
01S 01S
9999
0000 <ocation (pdate %equest
$igure 9.9F &#ample of >eriodic <ocation (pdate
- timer controls the periodic updates and the operator of the E<% sets the timer alue.
The network broadcasts this timer alue so that a mobile station knows the periodic
location update timer alues. Therefore, when the set time is up, the mobile station
initiates a registration process by sending a location u7date re@uest signal. The E<%
receies the request and confirms the registration of the mobile in the same location
area. +f the mobile station does not follow this procedure, it could be that the batteries of
the mobile are e#hausted or the subscriber is in an area where there is no network
coerage. +n such a case, the E<% changes the location data of the mobile station to
AunknownB.
-15-
Procedures
$igure 9.92 <ocation (pdate procedures
-16-
MS 0SS MSC
<L2new <L2old (L2
&. c3annel assignment
*. re@uest subscriber identity
-. re@uest subscriber identity
'. re@uest subscriber data
+. re@uest subscriber data
/. security 7rocedures
,. location u7date re@uest
". u7date location
#. u7date (L2
&$. u7date acknowledgement
&&. cancel old location
&,. location cancelling acce7ted
(andoer
+n a mobile communications network, the subscriber can moe around. ,ow can we
maintain the connection in such cases@ To understand this, we must study the process
of handing oer the calls.
Maintaining the traffic connection with a moing subscriber is made possible with the
help of the 3andoer function. The basic concept is simple7 when the subscriber moes
from the coerage area of one cell to another, a new connection with the target cell has
to be set up and the connection with the old cell has to be released. There are two
reasons for performing a handoer7
/. (andoer due to measurements occurs when the quality or the strength of the
radio signal falls below certain parameters specified in the 6S*. The
deterioration of the signal is detected by the constant signal measurements
carried out by both the mobile station and the 6TS. -s a consequence, the
connection is handed oer to a cell with a stronger signal.
9. (andoer due to traffic reasons occurs when the traffic capacity of a cell has
reached its ma#imum or is approaching it. +n such a case, the mobile stations
near the edges of the cell may be handed oer to neighbouring cells with less
traffic load.
The decision to perform a handoer is always made by the 6S* that is currently sering
the subscriber, e#cept for the handoer for traffic reasons. +n the latter case the MS*
makes the decision. There are four different types of handoer and the best way to
analyse them is to follow the subscriber as he moes7
Intra cell % Intra 0SC 3andoer
The smallest of the handoers is the intra cell handoer where the subscriber is handed
oer to another traffic channel (generally in another frequency) within the same cell. +n
this case the 6S* controlling the cell makes the decision to perform handoer.
Air A
TC
BTS
BSC
N
ew
C
hannel
O
ld C
hannel
$igure 9.90 +ntra *ell ! +ntra 6S* ,andoer
-17-
Inter cell % Intra 0SC 3andoer
The subscriber moes from cell / to cell 9. +n this case the handoer process is
controlled by 6S*. The traffic connection with cell / is released when the connection
with cell 9 is set up successfully.
A i r A
T C
B T S
B T S
B S C
O l d C e l l / B T S N e w C e l l / B T S
$igure 9.94 +nter *ell ! +ntra 6S* handoer
Inter cell % Inter 0SC 3andoer
The subscriber moes from cell 9 to cell D, which is sered by another 6S*. +n this case
the handoer process is carried out by the MS*, but, the decision to make the handoer
is still done by the first 6S*. The connection with the first 6S* (and 6TS) is released
when the connection with the new 6S* (and 6TS) is set up successfully.
A i r A
B T S
O l d C e l l / B T S
N e w C e l l / B T S
B T S
B S C T C
B S C T C
V L R
M S C
$igure9.D17!+nter*ell!+nter6S*,andoer
-18-
Inter MSC 3andoer
The subscriber moes from a cell controlled by one MS*=E<% to a cell in the domain of
another MS*=E<%. This case is a bit more complicated. *onsidering that the first
MS*=E<% is connected to the GMS* ia a link that passes through >ST) lines, it is
eident that the second MS*=E<% can not take oer the first one :ust like that.
The MS*=E<% currently sering the subscriber (also known as the anc3or MSC),
contacts the target MS*=E<% and the traffic connection is transferred to the target
MS*=E<%. -s both MS*s are part of the same network, the connection is established
smoothly. +t is important to notice, howeer, that the target MS* and the source MS*
are two telephone e#changes. The call can be transferred between two e#changes only
if there is a telephone number identifying the target MS*.
A i r A
B T S
O l d C e l l / B T S
N e w C e l l / B T S
B T S
B S C T C
B S C T C
V L R
M S C
V L R
M S C
$igure 9.D/+nter *ell ! +nter MS* ,andoer
Such a situation makes it necessary to generate a new number, the (andoer Number
((:N). The generation and function of the ,A) are e#plained in the following te#t.
The anchor MS*=E<% receies the handoer information from the 6SS. +t recognises
that the destination is within the domain of another MS* and sends a (andoer
2e@uest to the target MS* ia the signalling network. The target MS* answers by
generating a ,A) and sends it to the anchor MS*=E<%, which performs a digit analysis
in order to obtain the necessary routing information. This information allows the sering
MS*=E<% to connect the target MS*=E<%. 8hen the two MS*s are connected, the call
is transferred to a new route.
-19-
+n practice, the handoer number is similar to the roaming number. Moreoer, the
roaming number and the handoer number hae a similar purpose, that is connecting
two MS*s. The structure of the handoer number is shown below7
HON = CC + NDC + SN
**G *ountry *ode
).*G )ational .estination *ode (of the sering network)
S)G Subscriber )umber
The call will not last foreer and the connection has to be released sooner or later. To
understand the process of releasing the connection, we must consider a few things
such as7 8ho pays for the call, which e#change takes care of the charging operation
and where is the subscriber data stored. This will be discussed in the ne#t section but
before that, let us sum up the stages of +nter MS* handoer.
$igure 9.D9 +nter MS* handoer procedure
-20-
MS
0SSold MSCold MSCnew 0SSnew MS (after (:)
&. measurement re7orts
*. re@uest (:N
'. radio resources resered
+. 7roide (:N and target cell info
/. set u7 s7eec3 connection ((:N)
,. 3andoer re@uired
-. re@uest for radio resources
". 3andoer command
#. 3andoer com7lete
&$. 3andoer com7lete
&&. connect
&,. release old connections