7.

GSM
GSM (Global System for Mobile Communications, originally Groupe Spcial Mobile), is a
standard developed by the European Telecommunications Standards Institute (ETSI) to describe
protocols for second generation (2G) digital cellular networks used by mobile phones. It is the de
facto global standard for mobile communications with over 90% market share, and is available in
over 219 countries and territories.
The GSM standard was developed as a replacement for first generation (1G) analog cellular
networks, and originally described a digital, circuit-switched network optimized for full
duplex voice telephony. This was expanded over time to include data communications, first by
circuit-switched transport, then packet data transport via GPRS (General Packet Radio Services)
and EDGE (Enhanced Data rates for GSM Evolution or EGPRS).
Subsequently, the 3GPP developed third generation (3G) UMTS standards followed by fourth
generation (4G) LTE Advanced standards, which are not part of the ETSI GSM standard.
7.1 HISTORY
In 1982, work began to develop a European standard for digital cellular voice telephony when
the European Conference of Postal and Telecommunications Administrations (CEPT) created the
Groupe Spcial Mobile committee and later provided a permanent technical support group based
in Paris. Five years later, in 1987, 15 representatives from 13 European countries signed
a memorandum of understanding in Copenhagen to develop and deploy a common cellular
telephone system across Europe, and EU rules were passed to make GSM a mandatory
standard.[3] The decision to develop a continental standard eventually resulted in a unified, open,
standard-based network which was larger than that in the United States. In 1989, the Groupe
Spcial Mobile committee was transferred from CEPT to the European Telecommunications
Standards Institute (ETSI).
In 1987 Europe produced the very first agreed GSM Technical Specification in February.
Ministers from the four big EU countries cemented their political support for GSM with the
Bonn Declaration on Global Information Networks in May and the GSM MoU was tabled for
signature in September. The MoU drew-in mobile operators from across Europe to pledge to
invest in new GSM networks to an ambitious common date. It got GSM up and running fast.
In this short 37-week period the whole of Europe (countries and industries) had been brought
behind GSM in a rare unity and speed guided by four public officials Armin Silberhorn
(Germany), Stephen Temple (UK), Philippe Dupuis (France), and Renzo Failli (Italy). In 1989
the Groupe Spcial Mobile committee was transferred from CEPT to the European
Telecommunications Standards Institute (ETSI).
In parallel, France and Germany signed a joint development agreement in 1984 and were joined
by Italy and the UK in 1986. In 1986 the European Commission proposed reserving the
900 MHz spectrum band for GSM. The world's first GSM call was made by the

90

former Finnish Prime Minister Harri Holkeri to Kaarina Suonio (mayor in city of Tampere) on
July 1, 1991, on a network built by Telenokia and Siemens and operated by Radiolinja. The
following year in 1992, the first short messaging service (SMS or "text message") message was
sent and Vodafone UK and Telecom Finland signed the first international roaming agreement.
Work began in 1991 to expand the GSM standard to the 1800 MHz frequency band and the first
1800 MHz network became operational in the UK by 1993. Also that year, Telecom
Australia became the first network operator to deploy a GSM network outside Europe and the
first practical hand-held GSM mobile phone became available.
In 1995, fax, data and SMS messaging services were launched commercially, the first 1900 MHz
GSM network became operational in the United States and GSM subscribers worldwide
exceeded 10 million. Also this year, the GSM Association was formed. Pre-paid GSM SIM cards
were launched in 1996 and worldwide GSM subscribers passed 100 million in 1998.
In 2000, the first commercial GPRS services were launched and the first GPRS compatible
handsets became available for sale. In 2001 the first UMTS (W-CDMA) network was launched,
a 3G technology that is not part of GSM. Worldwide GSM subscribers exceeded 500 million. In
2002 the first Multimedia Messaging Service (MMS) were introduced and the first GSM
network in the 800 MHz frequency band became operational. EDGE services first became
operational in a network in 2003 and the number of worldwide GSM subscribers exceeded 1
billion in 2004.
By 2005, GSM networks accounted for more than 75% of the worldwide cellular network
market, serving 1.5 billion subscribers. In 2005 the first HSDPA capable network also became
operational. The first HSUPA network was launched in 2007. High-Speed Packet Access
(HSPA) and its uplink and downlink versions are 3G technologies, not part of GSM. Worldwide
GSM subscribers exceeded three billion in 2008.
The GSM Association estimated in 2010 that technologies defined in the GSM standard serve
80% of the global mobile market, encompassing more than 5 billion people across more than 212
countries and territories, making GSM the most ubiquitous of the many standards for cellular
networks.
It is important to note that GSM is a second-generation (2G) standard employing Time-Division
Multiple-Access (TDMA) spectrum-sharing, issued by the European Telecommunications
Standards Institute (ETSI). The GSM standard does not include the 3G UMTS CDMA-based
technology nor the 4G LTE OFDMA-based technology standards issued by the 3GPP.
Macau planned to phase out its 2G GSM networks as of June 4, 2015, making it the first region
to decommission a GSM network.
7.2 SERVICES
GSM has much more to offer than voice telephony. Additional services allow you greater
flexibility in where and when you use your phone. You should contact your local GSM network
operator for information on the specific services available to you.

91

But there are three basic types of services offered through GSM which you can ask for:

Telephony (also referred to as tele-services) Services

Data (also referred to as bearer services) Services.

Supplementary Services
7.3 TELE-SERVICES OR TELEPHONY SERVICES:

A Tele-service utilizes the capabilities of a Bearer Service to transport data, defining which
capabilities are required and how they should be set up.
Voice calls:
The most basic Tele-service supported by GSM is telephony. This includes Full-rate speech at 13
Kbps and emergency calls, where the nearest emergency- service provider is notified by dialing
three digits. A very basic example of emergency service is 911 services available in USA.
Videotext and facsmile:
Another group of tele-services includes Videotext access, Teletex transmission, Facsimile
alternate speech and facsimile Group 3, Automatic facsimile Group 3 etc.
Short text messages:
SMS (Short Messaging Service) service is a text messaging which allow you to send and receive
text messages on your GSM Mobile phone. Services available from many of the world's GSM
networks today - in addition to simple user generated text message services - include news, sport;
financial, language and location based services, as well as many early examples of mobile
commerce such as stocks and share prices, mobile banking facilities and leisure booking
services.
7.4 BEARER SERVICES OR DATA SERVICES
Using your GSM phone to receive and send data is the essential building block leading to
widespread mobile Internet access and mobile data transfer. GSM currently has a data transfer
rate of 9.6k. New developments that will push up data transfer rates for GSM users are HSCSD
(high speed circuit switched data) and GPRS (general packet radio service) are now available.
7.5 SUPPLEMENTARY SERVICES
Supplementary services are provided on top of tele-services or bearer services, and include
features such as caller identification, call forwarding, call waiting, multi-party conversations,

92

and barring of outgoing (international) calls, among others. A brief description of

supplementary services is given here:
Multiparty Service or conferencing: The multiparty service allows a mobile subscriber
to establish a multiparty conversation, i.e., a simultaneous conversation between three or
more subscribers to setup a conference call. This service is only applicable to normal
telephony.
Call Waiting: This service allows a mobile subscriber to be notified of an incoming call
during a conversation. The subscriber can answer, reject, or ignore the incoming call.
Call waiting is applicable to all GSM telecommunications services using a circuitswitched connection.
Call Hold: This service allows a subscriber to put an incoming call on hold and then
resume this call. The call hold service is only applicable to normal telephony.
Call Forwarding: The Call Forwarding Supplementary Service is used to divert calls
from the original recipient to another number, and is normally set up by the subscriber
himself. It can be used by the subscriber to divert calls from the Mobile Station when the
subscriber is not available, and so to ensure that calls are not lost. A typical scenario
would be a salesperson turns off his mobile phone during a meeting with customers, but
does not wish to lose potential sales leads while he is unavailable.
Call Barring: The concept of barring certain types of calls might seem to be a
supplementary disservice rather than service. However, there are times when the
subscriber is not the actual user of the Mobile Station, and as a consequence may wish to
limit its functionality, so as to limit the charges incurred. Alternatively, if the subscriber
and user are one and the same, the Call Barring may be useful to stop calls being routed
to international destinations when they are routed. The reason for this is because it is
expected that the roaming subscriber will pay the charges incurred for international rerouting of calls. So, GSM devised some flexible services that enable the subscriber to
conditionally bar calls.
Number Identification: There are following supplementary services related to number
identification:
o Calling Line Identification Presentation: This service deals with the
presentation of the calling party's telephone number. The concept is for this
number to be presented, at the start of the phone ringing, so that the called person
can determine who is ringing prior to answering. The person subscribing to the
service receives the telephone number of the calling party.
o Calling Line Identification Restriction: A person not wishing their number to
be presented to others subscribes to this service. In the normal course of event, the
restriction service overrides the presentation service.
o Connected Line Identification Presentation: This service is provided to give
the calling party the telephone number of the person to whom they are connected.
This may seem strange since the person making the call should know the number
they dialed, but there are situations (such as forwarding) where the number
connected is not the number dialed. The person subscribing to the service is the
calling party.
o Connected Line Identification Restriction: There are times when the person
called does not wish to have their number presented and so they would subscribe
to this person. Normally, this overrides the presentation service.

93

o Malicious Call Identification: The malicious call identification service was

provided to combat the spread of obscene or annoying calls. The victim should
subscribe to this service, and then they could cause known malicious calls to be
identified in the GSM network, using a simple command. This identified number
could then be passed to the appropriate authority for action. The definition for this
service is not stable.
Advice of Charge (AoC): This service was designed to give the subscriber an indication
of the cost of the services as they are used. Furthermore, those Service Providers who
wish to offer rental services to subscribers without their own Subscriber Identity Module
(SIM) can also utilize this service in a slightly different form. AoC for data calls is
provided on the basis of time measurements.
Closed User Groups (CUGs): This service is provided on GSM to enable groups of
subscribers to only call each other. These types of services are being offered with special
discount and are limited only to those members who wish to talk to each other.
Unstructured supplementary services data (USSD): This allows operator-defined
individual services.
7.6 GSM ARCHITECTURE
A GSM network consists of several functional entities, whose functions and interfaces are
defined. The GSM network can be divided into following broad parts.

The Mobile Station (MS)

The Base Station Subsystem (BSS)
The Network Switching Subsystem (NSS)
The Operation Support Subsystem (OSS)

Following is the simple architecture diagram of GSM Network:

94

The added components of the GSM architecture include the functions of the databases and
messaging systems:

Home Location Register (HLR)

Visitor Location Register (VLR)
Equipment Identity Register (EIR)
Authentication Center (AuC)
SMS Serving Center (SMS SC)
Gateway MSC (GMSC)
Chargeback Center (CBC)
Transcoder and Adaptation Unit (TRAU)

Following is the diagram of GSM Network along with added elements:

95

The MS and the BSS communicate across the Um interface, also known as the air interface or
radio link. The BSS communicates with the Network Service Switching center across the A
interface.
GSM network areas:
In a GSM network, the following areas are defined:

Cell: Cell is the basic service area: one BTS covers one cell. Each cell is given a Cell Global
Identity (CGI), a number that uniquely identifies the cell.
Location Area: A group of cells form a Location Area. This is the area that is paged when a
subscriber gets an incoming call. Each Location Area is assigned a Location Area Identity (LAI).
Each Location Area is served by one or more BSCs.
MSC/VLR Service Area: The area covered by one MSC is called the MSC/VLR service area.
PLMN: The area covered by one network operator is called PLMN. A PLMN can contain one or
more MSCs.

GSM - The Mobile Station

The MS consists of the physical equipment, such as the radio transceiver, display and digital
signal processors, and the SIM card. It provides the air interface to the user in GSM networks. As
such, other services are also provided, which include:

Voice tele-services

Data bearer services

The features' supplementary services

96

The MS Functions:
The MS also provides the receptor for SMS messages, enabling the user to toggle between the
voice and data use. Moreover, the mobile facilitates access to voice messaging systems. The MS
also provides access to the various data services available in a GSM network. These data services
include:

X.25 packet switching through a synchronous or asynchronous dial-up connection to the

PAD at speeds typically at 9.6 Kbps.

General Packet Radio Services (GPRSs) using either an X.25 or IP based data transfer
method at speeds up to 115 Kbps

High speed, circuit switched data at speeds up to 64 Kbps

What is SIM?
The SIM (Subscriber Identity Module) provides personal mobility so that the user can have
access to all subscribed services irrespective of both the location of the terminal and the use of a
specific terminal. You need to insert the SIM card into another GSM cellular phone to receive
calls at that phone, make calls from that phone, or receive other subscribed services.
GSM - The Base Station Subsystem (BSS)
The BSS is composed of two parts:

The Base Transceiver Station (BTS)

The Base Station Controller (BSC)

The BTS and the BSC communicate across the specified Abis interface, enabling operations
between components that are made by different suppliers. The radio components of a BSS may
consist of four to seven or nine cells. A BSS may have one or more base stations. The BSS uses
the Abis interface between the BTS and the BSC. A separate high-speed line (T1 or E1) is then
connected from the BSS to the Mobile MSC.

97

The Base Transceiver Station (BTS):

The BTS houses the radio transceivers that define a cell and handles the radio link protocols with
the MS. In a large urban area, a large number of BTSs may be deployed.

The BTS corresponds to the transceivers and antennas used in each cell of the network. A BTS is
usually placed in the center of a cell. Its transmitting power defines the size of a cell. Each BTS
has between 1 and 16 transceivers, depending on the density of users in the cell. Each BTS
serves as a single cell. It also includes the following functions:

Encoding, encrypting, multiplexing, modulating, and feeding the RF signals to the antenna
Transcoding and rate adaptation
Time and frequency synchronizing
Voice through full- or half-rate services
Decoding, decrypting, and equalizing received signals
Random access detection
Timing advances

98

Uplink channel measurements

The Base Station Controller (BSC):

The BSC manages the radio resources for one or more BTSs. It handles radio channel setup,
frequency hopping, and handovers. The BSC is the connection between the mobile and the
MSC. The BSC also translates the 13 Kbps voice channel used over the radio link to the standard
64 Kbps channel used by the Public Switched Telephone Network (PSDN) or ISDN.
It assigns and releases frequencies and time slots for the MS. The BSC also handles intercell
handover. It controls the power transmission of the BSS and MS in its area. The function of the
BSC is to allocate the necessary time slots between the BTS and the MSC. It is a switching
device that handles the radio resources. Additional functions include:

Control of frequency hopping

Performing traffic concentration to reduce the number of lines from the MSC
Providing an interface to the Operations and Maintenance Center for the BSS
Reallocation of frequencies among BTSs
Time and frequency synchronization
Power management
Time-delay measurements of received signals from the MS

GSM - The Network Switching Subsystem (NSS)

The Network switching system (NSS), the main part of which is the Mobile Switching Center
(MSC), performs the switching of calls between the mobile and other fixed or mobile network
users, as well as the management of mobile services such as authentication.

The switching system includes the following functional elements:

99

Home Location Register (HLR)

The HLR is a database used for storage and management of subscriptions. The HLR is
considered the most important database, as it stores permanent data about subscribers, including
a subscriber's service profile, location information, and activity status. When an individual buys
a subscription in the form of SIM, then all the information about this subscription is registered in
the HLR of that operator.
Mobile Services Switching Center (MSC)
The central component of the Network Subsystem is the MSC. The MSC performs the switching
of calls between the mobile and other fixed or mobile network users, as well as the management
of mobile services such as registration, authentication, location updating, handovers, and call
routing to a roaming subscriber. It also performs such functions as toll ticketing, network
interfacing, common channel signaling, and others. Every MSC is identified by a unique ID.
Visitor Location Register (VLR)
The VLR is a database that contains temporary information about subscribers that is needed by
the MSC in order to service visiting subscribers. The VLR is always integrated with the MSC.
When a mobile station roams into a new MSC area, the VLR connected to that MSC will request
data about the mobile station from the HLR. Later, if the mobile station makes a call, the VLR
will have the information needed for call setup without having to interrogate the HLR each time.
Authentication Center (AUC)
The Authentication Center is a protected database that stores a copy of the secret key stored in
each subscriber's SIM card, which is used for authentication and ciphering of the radio channel.
The AUC protects network operators from different types of fraud found in today's cellular
world.
Equipment Identity Register (EIR)
The Equipment Identity Register (EIR) is a database that contains a list of all valid mobile
equipment on the network, where its International Mobile Equipment Identity (IMEI) identifies
each MS. An IMEI is marked as invalid if it has been reported stolen or is not type approved.
The Operation Support Subsystem (OSS)
The operations and maintenance center (OMC) is connected to all equipment in the switching
system and to the BSC. The implementation of OMC is called the operation and support system
(OSS).
Here are some of the OMC functions:

100

Administration and commercial operation (subscription, end terminals, charging and

statistics).
Security Management.
Network configuration, Operation and Performance Management.
Maintenance Tasks.

The operation and Maintenance functions are based on the concepts of the Telecommunication
Management Network (TMN), which is standardized in the ITU-T series M.30.
Following is the figure, which shows how OMC system covers all the GSM elements.

The OSS is the functional entity from which the network operator monitors and controls the
system. The purpose of OSS is to offer the customer cost-effective support for centralized,
regional and local operational and maintenance activities that are required for a GSM network.
An important function of OSS is to provide a network overview and support the maintenance
activities of different operation and maintenance organizations.
7.7 RADIO LINK ASPECTS
The International Telecommunication Union (ITU), which manages the international allocation
of radio spectrum (among other functions) allocated the bands 890-915 MHz for the uplink
(mobile station to base station) and 935-960 MHz for the downlink (base station to mobile
station) for mobile networks in Europe. Since this range was already being used in the early
1980s by the analog systems of the day, the CEPT had the foresight to reserve the top 10 MHz
of each band for the GSM network that was still being developed. Eventually, GSM will be
allocated the entire 2x25 MHz bandwidth.
Since radio spectrum is a limited resource shared by all users, a method must be devised to
divide up the bandwidth among as many users as possible. The method chosen by GSM is a
combination of Time and Frequency Division Multiple Access (TDMA/FDMA).
The FDMA part involves the division by frequency of the total 25 MHz bandwidth into 124
carrier frequencies of 200 kHz bandwidth. One or more carrier frequencies are then assigned to
each base station. Each of these carrier frequencies is then divided in time, using a TDMA

101

scheme, into eight time slots. One time slot is used for transmission by the mobile and one for
reception. They are separated in time so that the mobile unit does not receive and transmit at the
same time, a fact that simplifies the electronics.
In the rest of this section, the procedure involved in digitally transmitting a voice signal in a
GSM network is examined, along with some of the features, such as discontinuous transmission
and reception, used to improve voice quality, reduce the mobile unit's power consumption, and
increase
the
overall
capacity
of
the
network.

GSM Time Slot, Frame, & Multiframe

1 Channel structure
The structure of the most common timeslot burst is shown in Figure above. A total of 156.25
bits is transmitted in 0.577 milliseconds, giving a gross bit rate of 270.833 kbps. There are three

102

other types of burst structure for frame and carrier synchronization and frequency
correction. The 26 bit training sequence is used for equalization, as described below. The 8.25
bit guard time allows for some propagation time delay in the arrival of bursts.
Each group of eight time slots is called a TDMA frame, which is transmitted every 4.615
ms. TDMA frames are further grouped into multiframes to carry control signals. There are two
types of multiframe, containing 26 or 51 TDMA frames. The 26 frame multiframe contains 24
Traffic Channels (TCH) and two, Slow Associated Control Channels (SACCH) which supervise
each call in progress. The SACCH in frame 12 contains eight channels, one for each of the
eight connections carried by the TCHs. The SACCH in frame 25 is not currently used, but will
carry eight additional SACCH channels when half rate traffic is implemented. A Fast
Associated Control Channel (FACCH) works by stealing slots from a traffic channel to transmit
power control and handover signalling messages. The channel stealing is done by setting one of
the control bits in the time slot burst.
In addition to the Associated Control Channels, there are several other control channels which
(except for the Stand alone Dedicated Control Channel) are implemented in time slot 0 of
specified TDMA frames in a 51 frame multiframe, implemented on a non-hopping carrier
frequency in each cell. The control channels include:

Broadcast Control Channel (BCCH): Continually broadcasts, on the downlink,

information including base station identity, frequency allocations, and frequency
hopping sequences.
Standalone Dedicated Control Channel (SDCCH): Used for registration, authentication,
call setup, and location updating. Implemented on a time slot, together with its SACCH,
selected by the system operator.
Common Control Channel (CCCH): Comprised of three control channels used during
call origination and call paging.

o
o
o

Random Access Channel (RACH): A slotted Aloha channel to request access to

the network
Paging Channel (PCH): Used to alert the mobile station of incoming call.
Access Grant Channel (AGCH): Used to allocate an SDCCH to a mobile for
signalling, following a request on the RACH.

2 Speech coding
GSM is a digital system, so speech signals, inherently analog, have to be digitized. The method
employed by ISDN, and by current telephone systems for multiplexing voice lines over high
speed trunks and optical fiber lines, is Pulse Coded Modulation (PCM). The output stream from
PCM is 64 kbps, too high a rate to be feasible over a radio link. The 64 kbps signal contains
much redundancy, although it is simple to implement. The GSM group studied several voice
coding algorithms on the basis of subjective speech quality and complexity (which is related to
cost, processing delay, and power consumption once implemented) before arriving at the choice
of a Regular Pulse Excited - Linear Predictive Coder (RPE LPC) with a Long Term Predictor

103

loop. Basically, information from previous samples, which does not change very quickly, is
used to predict the current sample. The coefficients of the linear combination of the previous
samples, plus an encoded form of the residual, the difference between the predicted and actual
sample, represent the signal. Speech is divided into 20 millisecond samples, each of which is
encoded as 260 bits, giving a total bit rate of 13 kbps.

3 Channel coding and modulation

Due to natural or manmade electromagnetic interference, the encoded speech or data transmitted
over the radio interface must be protected as much as is practical. The GSM system uses
convolutional encoding and block interleaving to achieve this protection. The exact algorithms
used differ for speech and for different data rates. The method used for speech blocks will be
described below.
Recall that the speech codec produces a 260 bit block for every 20 ms speech sample. From
subjective testing, it was found that some bits of this block were more important for perceived
speech quality than others. The bits are thus divided into three classes:
Class Ia 50 bits - most sensitive to bit errors
Class Ib 132 bits - moderately sensitive to bit errors
Class II 78 bits - least sensitive to bit errors
Class Ia bits have a 3 bit Cyclic Redundancy Code added for error detection. If an error is
detected, the frame is judged too damaged to be comprehensible and it is discarded. It is
replaced by a slightly attenuated version of the previous correctly received frame. These 53
bits, together with the 132 Class Ib bits and a 4 bit tail sequence (a total of 189 bits), are input
into a 1/2 rate convolutional encoder of constraint length 4. Each input bit is encoded as two
output bits, based on a combination of the previous 4 input bits. The convolutional encoder thus
outputs 378 bits, to which are added the 78 remaining Class II bits, which are unprotected. Thus
every 20 ms speech sample is encoded as 456 bits, giving a bit rate of 22.8 kbps.
To further protect against the burst errors common to the radio interface, each sample is
diagonally interleaved. The 456 bits output by the convolutional encoder are divided into 8
blocks of 57 bits, and these blocks are transmitted in eight consecutive timeslot bursts. Since
each timeslot burst can carry two 57 bit blocks, each burst carries traffic from two different
speech samples.
Recall that each timeslot burst is transmitted at a gross bit rate of 270.833 kbps. This digital
signal is modulated onto the analog carrier frequency, which has a bandwidth of 200 kHz, using
Gaussian filtered Minimum Shift Keying (GMSK). GMSK was selected over other modulation
schemes as a compromise between spectral efficiency, complexity of the transmitter, and
limited spurious emissions. The complexity of the transmitter is related to power consumption,
which should be minimized for the mobile station. The spurious radio emissions, outside of the
allotted bandwidth, must be strictly controlled so as to limit adjacent channel interference, and

104

allow for the coexistence of GSM and the older analog systems (at least for the time being).
4 Multipath equalization
At the 900 MHz range, radio waves bounce off everything - buildings, hills, cars, airplanes,
etc. Thus many reflected signals, each with a different phase, can reach an
antenna. Equalization is used to extract the desired signal from the unwanted reflections.
Equalization works by finding out how a known transmitted signal is modified by multipath
fading, and constructing an inverse filter to extract the rest of the desired signal. This known
signal is the 26 bit training sequence transmitted in the middle of every time slot burst. The
actual implementation of the equalizer is not specified in the GSM specifications.
5 Frequency hopping
The mobile station already has to be frequency agile, meaning it can move between a
transmitter, receiver, and monitor time slot within one TDMA frame, which may be on different
frequencies. GSM makes use of this inherent frequency agility to implement slow frequency
hopping, where the mobile and BTS transmit each TDMA frame on a different carrier
frequency. The frequency hopping algorithm is broadcast on the Broadcast Control
Channel. Since multipath fading is (mildly) dependent on carrier frequency, slow frequency
hopping helps alleviate the problem. In addition, cochannel interference is in effect
randomized.
6 Discontinuous transmission
Minimizing cochannel interference is a goal of any cellular system, since it allows better service
for a given cell size, or the use of smaller cells, thus increasing the overall capacity of the
system. Discontinuous transmission (DTX) is a method that takes advantage of the fact that a
person speaks less that 40 percent of the time in normal conversation, by turning the transmitter
off during silence periods. An added benefit of DTX is that power is conserved at the mobile
unit.
The most important component of DTX is, of course, Voice Activity Detection. It must
distinguish between voice and noise inputs, a task that is not as trivial as it appears, considering
background noise. If a voice signal is misinterpreted as noise, the transmitter is turned off and a
very annoying effect called clipping is heard at the receiving end. If, on the other hand, noise is
misinterpreted as a voice signal too often, the efficiency of DTX is dramatically
decreased. Another factor to consider is that when the transmitter is turned off, there is a very
silent silence heard at the receiving end, due to the digital nature of GSM. To assure the receiver
that the connection is not dead, comfort noise is created at the receiving end by trying to match
the characteristics of the transmitting end's background noise.
7 Discontinuous reception
Another method used to conserve power at the mobile station is discontinuous reception. The
paging channel, used by the base station to signal an incoming call, is structured so that the

105

mobile station knows when it needs to check for a paging signal. In the time between paging
signals, the mobile can go into sleep mode, when almost no power is used.
8 Power control
There are five classes of mobile stations defined, according to their peak transmitter power,
rated at 20, 8, 5, 2, and 0.8 watts. To minimize cochannel interference and to conserve power,
both the mobiles and the Base Transceiver Stations operate at the lowest power level that will
maintain an acceptable signal quality. Power levels can be stepped up or down in steps of 2 dB
from the peak power for the class down to a minimum of 13 dBm (20 milliwatts).
The mobile station measures the signal strength or signal quality (based on the Bit Error Ratio),
and passes the information to the Base Station Controller, which ultimately decides if and when
the power level should be changed. Power control should be handled carefully, since there is
the possibility of instability. This arises from having mobiles in cochannel cells alternatingly
increase their power in response to increased cochannel interference caused by the other mobile
increasing its power. This in unlikely to occur in practice but it is (or was as of 1991) under
study.

106

7.8 NETWORK ASPECTS

Ensuring the transmission of voice or data of a given quality over the radio link is only half
the problem in a cellular mobile network. The fact that the geographical area covered by the
network is divided into cells necessitates the implementation of a handover
mechanism. Also, the fact that the mobile can roam nationally and internationally in GSM
requires that registration, authentication, call routing and location updating functions exist in
the GSM network
The signalling protocol in GSM is structured in three layers , shown in Figure below
. Layer 1 is the physical layer, which uses the channel structures discussed above. Layer 2
is the data link layer. Across the Um interface, the data link layer uses a slight
modification of the LAPD protocol used in ISDN, called LAPDm. Across the A interface,
the lower parts of Signalling System Number 7 are used. Layer 3 is subdivided into 3
sublayers.

Radio Resources Management

controls the setup, maintenance, and termination of radio channels
Mobility Management
manages the location updating, handovers, and registration procedures, discussed
below

107

Connection Management
handles general call control, similar to CCITT Recommendation Q.931, and provides
supplementary services.
Signalling between the different entities in the network, such as between the HLR and VLR,
is accomplished throught the Mobile Application Part (MAP). Application parts are the top
layer of Signalling System Number 7. The specification of the MAP is complex. It is one of
the longest documents in the GSM recommendations, said to be over 600 pages in length .
Described below are the main functions of the Mobility Management sublayer.
1 Handover
Handover, or handoff as it is called in North America, is the switching of an ongoing call to
a different channel or cell. There are four different types of handover in the GSM system,
which involve transferring a call between

channels (time slots) in the same cell,

cells (Base Transceiver Stations) under the control of the same Base Station
Controller (BSC),
cells under the control of different BSCs, but belonging to the same Mobile services
Switching Center (MSC), and
cells under the control of different MSCs.

The first two types of handover, called internal handovers, involve only one Base Station
Controller (BSC). To save signalling bandwidth, they are managed by the BSC without
involving the Mobile service Switching Center (MSC), except to notify it at the completion
of the handover. The last two types of handover, called external handovers, are handled by
the MSCs involved. Note that call control, such as provision of supplementary services and
requests for further handoffs, is handled by the original MSC.
Handovers can be initiated by either the mobile or the MSC (as a means of traffic load
balancing). During its idle time slots, the mobile scans the Broadcast Control Channel of up
to 16 neighboring cells, and forms a list of the six best candidates for possible handover,
based on the received signal strength. This information is passed to the BSC and MSC, and
is used by the handover algorithm.
The algorithm for when a handover decision should be taken is not specified in the GSM
recommendations. There are two basic algorithms used, both closely tied in with power
control. This is because the BSC usually does not know whether the poor signal quality is
due to multipath fading or to the mobile having moved to another cell. This is especially
true in small urban cells.
The 'minimum acceptable performance' algorithm gives precedence to power control over
handover, so that when the signal degrades beyond a certain point, the power level of the
mobile is increased. If further power increases do not improve the signal, then a handover is

108

considered. This is the simpler and more common method, but it creates 'smeared' cell
boundaries when a mobile transmitting at peak power goes some distance beyond its original
cell boundaries into another cell.
The 'power budget' method uses handover to try to maintain or improve a certain level of
signal quality at the same or lower power level. It thus gives precedence to handover over
power control. It avoids the 'smeared' cell boundary problem and reduces cochannel
interference, but it is quite complicated.
2 Location updating and call routing
The MSC provides the interface between the GSM mobile network and the public fixed
network. From the fixed network's point of view, the MSC is just another switching
node. However, switching is a little more complicated in a mobile network since the MSC
has to know where the mobile is currently roaming - and in GSM it could even be roaming
in another country. The way GSM accomplishes location updating and call routing to the
mobile is by using two location registers: the Home Location Register (HLR) and the Visitor
Location Register (VLR).
Location updating is initiated by the mobile when, by monitoring the Broadcast Control
Channel, it notices that the location area broadcast is not the same as the one previously
stored in the mobile's memory. An update request and the IMSI or previous TMSI is sent to
the new VLR via the new MSC. A Mobile Station Roaming Number (MSRN) is allocated
and sent to the mobile's HLR (which always keeps the most current location) by the new
VLR. The MSRN is a regular telephone number that routes the call to the new VLR and is
subsequently translated to the TMSI of the mobile. The HLR sends back the necessary call
control parameters, and also sends a cancel message to the old VLR, so that the previous
MSRN can be reallocated. Finally, a new TMSI is allocated and sent to the mobile, to
identify it in future paging or call initiation requests.

109

With the above location updating procedure, call routing to a roaming mobile is easily
performed. The most general case is shown in Figure above, where a call from a fixed
network (Public Switched Telecommunications Network or Integrated Services Digital
Network) is placed to a mobile subscriber. Using the Mobile Subscriber's telephone number
(MSISDN, the ISDN numbering plan specified in the ITU-T E.164 recommendation), the
call is routed through the fixed land network to a gateway MSC for the GSM network (an
MSC that interfaces with the fixed land network, thus requiring an echo canceller). The
gateway MSC uses the MSISDN to query the Home Location Register, which returns the
current roaming number (MSRN). The MSRN is used by the gateway MSC to route the call
to the current MSC (which is usually coupled with the VLR). The VLR then converts the
roaming number to the mobile's TMSI, and a paging call is broadcast by the cells under the
control of the current BSC to inform the mobile.
3 Authentication and security
Since the radio medium can be accessed by anyone, authentication of users to prove that
they are who they claim to be, is a very important element of a mobile
network. Authentication involves two functional entities, the SIM card in the mobile, and
the Authentication Center (AC). Each subscriber is given a secret key, one copy of which is
stored in the SIM card and the other in the Authentication Center. During authentication,
the AC generates a random number that it sends to the mobile. Both the mobile and the AC
then use the random number, in conjuction with the subscriber's secret key and a ciphering
algorithm called A3, to generate a number that is sent back to the AC. If the number sent by
the mobile is the same as the one calculated by the AC, the subscriber is authenticated.
The above calculated number is also used, together with a TDMA frame number and another
ciphering algorithm called A5, to encipher the data sent over the radio link, preventing
others from listening in. Enciphering is an option for the very paranoid, since the signal is
already coded, interleaved, and transmitted in a TDMA manner, thus providing protection
from all but the most persistent and dedicated eavesdroppers.
Another level of security is performed on the mobile equipment, as opposed to the mobile
subscriber. As mentioned earlier, each GSM terminal is identified by a unique International
Mobile Equipment Identity (IMEI) number. A list of IMEIs in the network is stored in the
Equipment Identity Register (EIR). The status returned in response to an IMEI query to the
EIR is one of the following:
White-listed:The terminal is allowed to connect to the network
Grey-listed: Under observation from the network, possible problems
Black-listed: The terminal has either been reported as stolen, or it is not type approved (the
correct type of terminal for a GSM network). The terminal is not allowed to connect to the
network.

110