1

GSM Basics
Annamalai Maheswaran
maheswaran@nanocellindia.com
2
Cellular Concepts
3
Cellular Concepts
Cellular concepts involve using a base station
radiating less power and serving a smaller area
called cell
The geographical area to be covered is divided
into large number of such cells
The coverage areas of cells are overlapping
Vehicle moving from one cell to another is
handled by the serving base station handing it
over to another base station in adjoining cell
Frequencies used in one cell are reused after
some distance
Neighbouring cells use different frequencies
Large capacities can be built by having large
number of smaller cells
4
7 Cell Frequency Reuse
Pattern Can Be
Replicated
Indefinitely
Many Cells Can Share
Same Frequencies If
Separated In Space
1
2 3
4
5 6
7
1
2 3
4
5 6
7
1
2 3
4
5 6
7
1
2 3
4
5 6
7
1
2 3
4
5 6
7
n
n indicates the
frequency set used
Cell radius
Frequency
reuse
distance
5
3 Cell Reuse
D2
B2
D1
E2
D3
B1
B3
A2
E1
E3
C2
A1
A3
F2
C1
C3
G2
F1
F3
G1
G3
6
Cellular Concepts Key Factors
Overlapping cells, each covering smaller area
Neigbouring cells use different carrier
frequencies
Reuse of frequencies
Mobility of mobiles handled by handover
Paging for incoming calls
Tracking of idle mobiles
7
Cell Clusters
SOURCE: IEC.ORG
Actual Coverage
Area Of Cell 1
Actual Coverage
Area Of Cell 3
Cell 1 Overlaps 6 Others

Different Frequencies
Must Be Used In Adjacent
Cells

Seven Different Sets Of
Frequencies Required
8
Cell Handover
SOURCE: R. C. LEVINE, SMU
As Phone Moves From Cell A To Cell B:
Cell A Must Hand The Call Over To B
Phone Must Change Frequencies
Cell A Must Stop Transmitting
Minimum
performance
contour
Handover threshold
contour
A
B x y
z
9
Cellular System Architecture
.
.
.
M
S
M
S
M
S
M
S
M
S
M
S
MSC
BS1
BS2
BSn
PSTN
Air Interface
.
.
10
BS1 BS2
1 1
BS1

BS2


. A B .
Level at point A
Level at point B (Call is terminated)
Handover threshold
Minimum acceptable signal
to maintain the call
Improper
Handover
Proper
Handover
Level at point B
Level at which handover is made
(call properly transferred to BS2)
Handover In Cellular Networks
11
Handover in a Cellular System
User is moving from Cell A to B
B
A
Power Received
from B
Power Received
from A
Distance
12
Capacity & Interference
Capacity of cellular systems is limited by
interference
There are two types of interference called co-
channel interference and adjacent channel
interference
Co-channel interference is created by users
operating at the same set of frequencies in the
adjoining clusters
Adjacent channel interference is created by users
operating at different but close by frequencies
(or different TDMA slots) due to imperfect
receiver filters that allow these to leak into the
receiver band
13
A Simplified Network View
PSTN
MSC
14
Concept of Network
Consists of interconnected Network Elements
Covers large contiguous geographic area
Multiple networks in one area
Base stations continuously transmit system info
Mobile receives this info and select network
Mobile can transmit, when needed
For making outgoing call
For receiving incoming call
Transmission & reception through wireless medium
15
Concept of Network (Contd.)
Transmission takes place in two directions
Downlink from Base Station to Mobil Station
Uplink from MS to BS
Physical channel is capable of transmission in one
direction
Either Downlink or Uplink
Subdivided into specialised channels called
logical channels
Paging channels, traffic channels, etc
MS accesses the network through these channels
Call established by conveying MS identity, dialled
number & other info
Traffic channel used during conversation
Mobility handled by handover
16
Challenges In Mobile Communication
System Objectives
Cover large contiguous areas
Provide uninterrupted service while moving in a
vehicles
Serve maximum users within allotted spectrum
Provide good grade of service (minimum
blocking)
Also less dropped calls
Dropped calls perceived in bad light (as
against blocked calls)
Achieve reasonable voice quality
Minimise infrastructure cost
Optimise no of base stations
Ability to enhance the service capability on an
evolutionary basis
17
Cellular systems the GSM view
Analog
Cellular
GSM
GPRS
EDGE
WCDMA
1980s 1990 Late 90s
ETACS
NMT
Digital
systems
Voice Based
Packet
switched
data
Higher
speed
Data
New
Spectrum3G
2000 2003
HSPA
Optimised
for High
speed Data
18
Cellular systems the CDMA view
Analog
Cellular
IS-95
CDMA
CDMA
2000
1x-
EVDO
1980s 1990 Late 90s
AMPS
Early
2000
To
come
IS-54
IS-136
1x-
EVDV
Predominantly
voice and circuit
switched data
Pkt-switched
Data support
Optimized
for Data
only (HDR)
Co-
existence of
Data and
voice
19
GSM Architecture, Subsystems &
Interfaces
20
History of GSM
1982 - Started As Group Speciale Mobile
Has Been Renamed As Global System for Mobile
Communication
1985 - Decision to Design Digital System
1986 - Paris Trial for Field Testing
1987 - MOU Signed by 12 Countries
1988 - GSM Becomes ETSI Committee
1990 - Phase 1 GSM Specifications Frozen
1991 - First GSM Network Launched
Continuous Enhancements & Upgrades
Gprs, Edge
Has Global Foot Print Including Usa
Very Popular for Voice & Data Applications
Current Market Share >80 %
21
HLR
EIR
AUC
Op & Maint
center
U
m

to PSTN
B
S.
C
B
S
C
B
S
C
.
.
.
VLR
M
S
C
M
S
C
VLR
to
PSTN
E
1
/
S
S
7

.
.
M
S
M
S
M
S
GSM Network Architecture
A
BSS
B
C
.
.
.
BTS
BTS
BTS
BTS
22
GSM Subsystems & Interfaces
MS BTS BSC
MSC
HLR
AUC
VLR
OMC
Other
MSCs
Other
Network
EIR
Other
MSCs
VLR
BSS
U
m

A
bis

A
E
G
F
D
B
C
23
GSM Network Elements
Mobile Station (MS)
Consists of Mobile Equipment (ME) & Subscriber
Identity Modlule (SIM)
Base Station Subsystem (BSS)
Base Transceiver Station (BTS) + Base Station
Controller (BSC)
BTS contains one or more Transmitter / Receiver (TRX)
each covering one or more cells
Network Switching Subsystem (NSS)
Consists of one or more Mobile Switching Centre (MSC)
+ Home Location Receiver (HLR) + Visitor Location
Receiver (VLR) + Authentication Centre (AuC) +
Equipment Identification Register (EIR)
24
Mobile Station (MS)
Mobile Equipment (ME) containing all hardware and
software for the operation of handset
Hardware - battery, antenna, transmit / receive
switch, transmitter, receiver, modulator,
demodulator, processor, memory, keypad, display,
speaker, microphone, a/d and d/a converter, buzzer,
etc.
Software operating system, channel coding, source
coding, various protocols, applications, etc
Subscriber Identification Module (SIM) is a detachable
memory module that contains all the information related to
a specific subscriber this is supplied to subscriber at the
time of subscription
25
Mobile Station (MS) (Contd.)
Performs all physical layer related functions source
coding, channel coding, encryption, frequency & time
synchronization, equalization, timing advance, etc.
Supports call management functions to support
transmission of voice & data
Monitors of power & signal quality of surrounding cells
for optimum handover (facilitate MAHO)
Performs idle mode procedure
Selecting cell
Helping network track MS by registration, location
area updating, power up/down registration
26
Functions Of BTS
Serves a single cell
Encodes, encrypts, multiplexes, modulates and
feeds RF signals to the antenna for transmission
Transcoding and rate adaptation
Time and frequency synchronization
Demodulates, decrypts, demultiplexes, decodes the
signal received through antenna
Detecting the random access
Computing timing advance for mobiles
Does slow frequency hopping as per hopping
sequence
Acts as slave to BSC in radio resource management
(RRM)
27
Functions of BSC
It controls a group of BTS and provides them
connectivity through Abis interface
It is responsible for managing radio resources
(RR) of all BTS coming under it like allocation /
deallocation of various channels, performing
paging, etc
It is responsible for intra BSC handover
It controls frequency hopping
BSC is responsible for allocation of frequencies
among BTSs
It manages power levels of BTSs
28
Functions of MSC
MSC covers a geographic area (one and only one
in every area)
It is responsible for tracking mobiles by
performing mobility management (MM) functions
registration, location updating, TMSI allocation,
authentication, arranging for paging for MS, etc
It is responsible for coordination of call set up
(both incoming and outgoing)
It provides interworking functions with different
networks
It handles inter BSC handovers
It provides support for billing of MSs in its area
29
GSM Entities
Since GSM systems are deployed worldwide in many
countries there is a need to standardise how the
GSM entities (like MS, GSM network, etc.,) will be
addressed in a uniform and consistent manner.
Some of the entities are
PLMN Identity: A Public Land Mobile Network
(PLMN) is uniquely identified by a 3 digit Mobile
Country Code (MCC) and a 2 digit Mobile Network
Code (MNC) within the country
MNC
(2 digits)
MCC
(3 digits)
PLMN Code Format
30
Concept Of Location Area
Should a paging message go on PCH channels of
all BTSs?
Results in heavy load on PCH
We can reduce load if network knows approximate
location of MS
Concept of Location Area
LA is a group of neighbouring cells
All cells must belong to same MSC
Can each cell be called a LA?
Will result in too much updating load
Compromise is to club 5 to 20 cells as one LA
MS listens to LA ID from BCCH
MS registers itself in the LA with MSC
31
GSM Entities (Contd.)
Location Area Identity (LAI): The service area of a
PLMN is divided into a number of MSC service
areas and each of these is subdivided into
location areas that consist of a number of
adjacent cells. Each location area is assigned a
Location Area Code (LAC), that can be upto 4
hexadecimal digits. LAI identifies the GSM
location area
LAI = MCC + MNC + LAC
LAC is used in all messages
MNC
(2 digits)
MCC
(3 digits)
LAC
(2 octets)
LAI
CI
(2 octets)
CGI (Cell Global
Identity)
32
Arrangement of Location Areas
(1)
Cells belonging to LA1
(MSC!)
(2)
2(3)
2(1)
6(3)
5(3)
4(1)
3(3)
1(1)
3(1)
5(1)
3(2)
4(3)
1(2)
1(3)
5(2)
4(2)
2(2)
7(1)
6(2)
6(1)
7(2)
8(1)
MSC1
MSC2
Cells belonging to LA2
(MSC1)
(3)
Cells belonging to LA3
(MSC2)
33
GSM Service Area Hierarchy
cell
Location Area
MSC/VLR
PLMN Service Area
(one per operator)
GSM Service Area
34
GSM Entities (Contd.)
SIM is a small memory package containing
permanent and temporary information about the
mobile user
SIM adds personality to Mobile Equipment
It carries the following information
IMSI
Authentication Key (K
i
)
Subscriber Information
Access Control Class
Cipher Key (K
c
*)
TMSI*
Location Area Identity (LAI*)
Forbidden PLMN*
* Updated by network
35
GSM Entities (Contd.)
International Mobile Station Identity
(IMSI): This uniquely identifies a MS in any
GSM network
IMSI = MCC + MNC + MSIN
Where the 10 digit BCD number MSIN (Mobile
Subscriber Identity Number) identifies a MS
in that PLMN. IMSI is allocated by PLMN
operator and entered into permanent memory
of SIM
MCC MNC MSIN (10 digits)
IMSI Format
36
GSM Entities (Contd.)
Temporary Mobile Station Identity (TMSI):
is a 32 bit number that uniquely identifies the
MS within one location area of a PLMN
TMSI is a temporary identification and has
only local significance within location area
Has no validity after MS has left the
location area
This offers protection against cloning of
TMSI
LAI and TMSI are stored in temporary SIM
memory
Most messages on the U
m
interface identify a
MS by TMSI and LAI
TMSI (Max 4 Octets)
37
GSM Entities (Contd.)
Mobile Station ISDN Number (MSISDN):
This could be upto 15 digits
Numbers for routing a call from
international location & local location



CC NDC SN
International MSISDN (15 digits)
National Mobile Number
CC Country Code 1 to 3 digits
NDC National Destination Code 2 to 3 digits
SN Subscriber Number
38
GSM Entities (Contd.)
Base Station Identity Code (BSIC) is used
to distinguish between neighbouring BSs - 6 bit
consisting of 3 bits Network Colour Code (NCC)
and 3 bits Base Transceiver Colour Code (BCC)
Mobile Subscriber Roaming Number
(MSRN) is used to route a call to a mobile
station when this has gone to another network
(roaming network)
MSRN = CC + NDC + SN
Identity of Roaming
PLMN
39
Multiple Identities of MS

External
Networks
MSISDN
GSM
Networks
Mobile
Station
MSRN
(for Roaming MS_
40
GSM Air Interface
41
GSM Air Interface Specifications
Parameter Specifications
Uplink Channel Frequency 890 - 915 MHz
Downlink Channel Frequency 935 - 960 MHz
ARFCN Number 0 to 124
Tx/Rx Frequency Spacing
Tx/Rx Time Slot Spacing
45 MHz
3 Time Slots
Modulation Data Rate 270.833 kbps
Frame Period 4.615 msec
Users per Frame (Full Rate) 8
Time Slot Duration
576.9
m
sec
Bit Period
3.692
m
sec
Modulation 0.3 GMSK
ARFCN Channel Spacing 200 kHz

Voice Coder Bit Rate

13 kbps


42
GSM Variants
Variant Uplink (MHz) Downlink
(MHz)
Total
Bandwidth
Duplex-
frequency
separation
Channels
GSM-400 451-458 and
479-486
461-468 and
489-496
Twice 14 MHz 10 MHz Twice 72
GSM-900
(primary
band)
890-915 935-960 Twice 25 MHz 45 MHz Twice 124
Extended
GSM-900
880-915 925-960 Twice 35 MHz 45 MHz Twice 174
GSM-R 876-880 921-925 Twice 4 MHz 45 MHz Twice 19
DCS-1800 1,710-1,785 1,805-1,880 Twice 75 MHz 95 MHz Twice 373
PCS-1900 1,850-1,910 1,930-1,990 Twice 60 MHz 80 MHz Twice 300
Source: Bekkers, 299
43
Modulation Scheme In GSM
Data rate in GSM is about 270 kbps & carrier spacing in
GSM is 200 kHz, with bandwidth slightly less than this
GSM uses 0.3 GMSK, where 0.3 describes the 3 dB
bandwidth of the Gaussian pulse shaping filter with
relation to the bit rate (BT=0.3)
GMSK is a special type of digital frequency modulation
binary ones and zeros are represented in GSM by
shifting the RF carrier by 67.708 kHz
Channel data rate is exactly 4 times this
This minimises the bandwidth occupied by the
modulation spectrum
This improves the channel capacity
MSK modulated signal is passed through a Gaussian
filter to smooth the rapid frequency transitions which
would otherwise spread energy into the adjacent
channels
44
GSM Frame & Burst Format
2
One Slot
(156.25 symbols for 576.92msecs)
1 3 4 5 6
One Frame = 4.615msecs (216.66 frames/sec)
7 0
Normal Slot on DL and UL
Stealing (flag) Bits Tail Bits
TB TB
Training
sequence
Guard
Bits
3 26 3 8.25
Payload Payload
57
57
1 1
45
GSM Frame Arrangement In Downlink & Uplink
2 1 3 4 5 6
Downlink Transmission
7
0
Uplink Transmission
2 1 3 4 5 6
Uplink Frame
7 0
Downlink Frame
0 1
2
7 6 5
Downlink - Uplink Offset
(3 Time Slots)
Duplex Transmission
46
Physical & Logical Channels
Physical Channel is a way of specifying a carrier
frequency number (called ARFCN - Absolute Radio
Frequency Channel Number), time slot number,
TDMA frame number and the direction (DL/UL)
This channel is capable of carrying any payload
consisting of traffic or control data
Logical Channel refers to the use to which a
particular physical channel is put
Control Channel - A physical channel that has
been logically used for carrying control data -
there are many different types of control
channels
Broadcast Channels consisting of Frequency
Correction Channel (FCCH), Synchronisation
Channel (SCH) and Broadcast Control
Channel (BCCH)
47
Physical & Logical Channels (Contd.)
Common Control Channels consisting of
Paging Channel (PCH), Random Access
Channel (RACH) and Access Grant Channel
(AGCH)
Dedicated Control Channel - Stand-alone
Dedicated Control Channel (SDCCH)
Traffic Channel - A physical channel that used
for carrying user traffic (usually voice) and
signalling
Traffic channel can be full rate traffic channel
(TCH/F) or half rate traffic channel (TCH/H)
Traffic channel also has associated Slow
Associated Control Channel (SACCH) and Fast
Associated Control Channel (FACCH)
48
Control Multiframe Format
Slot 0 of beacon is transmitted continuously by BTS
Empty bursts are filled with dummy data
0 1 2
Broadcast +
Paging +
Access Grant
9 10 11 40 41 50
F S F
S
F S
Idle
In slot 0 of specific beacon carriers (frequencies
stored in SIM) with 51-multiframe format
MS can tune to control slot during idle slot even
when TCH is present
49
Frequency Correction Channel (FCCH)
Frames 0, 10, 40 of control multiframe (x 51)
contain FCCH for frequency offset estimation and
correction
All zero data constant frequency
When MS is turned on, it hunts continuously for
FCCH on beacon of all carriers in its SIM list
FCCH allows mobile to acquire the carrier frequency
of the base station
Mobile then looks in the next frame for
Synchronisation Channel
142 all zeros 3
TB
3
TB
8.25
G
One beacon per cell
50
Synchronisation Channel (SCH)
This is the first data reception after turning MS on
Long training sequence (64 bits)
78 bits containing information about frame
number and BSIC
Can determine slot number (SCH is on slot #
0), multiframe, and hyperframe numbers
BSIC is 6 bit colour code for the beacon
frequency - adjacent cells will have different
colours (BSICs)
3
TB
39
message
64
Training

39
message
3
TB
8.25
G
Synchronisation burst
51
Purposes Of Various Group of Bits In GSM
Burst
The various groups are Training Bits, Tail Bits,
Stealing Bits and Guard Bits
Training bits (also called midamble in a normal
burst since this occurs in the middle) are used to
allow the receiver to characterise the mobile
channel
This is done by transmitting a known sequence
of bits this varies depending upon the type of
channel and for traffic channel this is 26 bits
long
The receiver can model the channel using the
received response through the channel
This process is called equalisation
52
Purposes Of Various Group of Bits In GSM
Burst (Contd.)
Having modeled the channel using the training
sequence, the receiver can demodulate the
unknown bits using this model
Since the mobile channel changes all the time
due the mobility of the user, the midamble has
to be transmitted in every burst
Also, since the training sequence is in the
middle of the burst, the channel condition at
the middle of the burst is captured, thus
resulting in less RMS error
Training sequence is chosen to have good
autocorrelation property
53
Purposes Of Various Group of Bits In GSM
Burst (Contd.)
Tail bits are used to indicate to the receiver
about the start and end of the burst to help the
equaliser in its function tail bit values are all
set to 000 in the case of traffic burst
Guard bits duration is idle period during which
no body should transmit this is a no mans
land to facility different entities who are only
approximately time synchronised to each other
to have a smooth functioning without any
collision
Guard bit in RACH channel is increased to
accommodate mobile that has not been
ranged
54
Purposes Of Various Group of Bits In GSM
Burst (Contd.)
Mobiles in traffic state have been ranged (or
they have been told about timing advance to
take care of their position relative to BTS)
Stealing bit helps the sender to use the
payload of 57 bits either for traffic (normally) or
for signalling (when the stealing bit is set)
The signalling channel obtained by setting
the stealing bits is called FACCH
FACCH is used for emergency situations
like when handover has arisen, when call has
to be disconnected or when an incoming
message is received during a call
55
Synchronisation Channel Message Format
NCC
(3)
T
1
Superframe
(11)
T
2
Multiframe
(5)
BCC
(3)
T
3
Block
Frame (3)
NCC Network Colour Code
BCC Base Station Colour Code
T
1
(11 bits) = Frame Number / 26 x 51 Range from 0 to 2047
T
2
(5 bits) = Frame Number mod 26 Range from 0 to 25

T
3
(3 bits) = (Frame Number mod 51 1) / 10 Range from 0 to 4
BSIC
56
Broadcast Control Channel (BCCH)
BCCH is a downlink control channel that is used to
broadcast information such as cell and network
identity (CGI), operating characteristics of the cell
- current control channel structure, channel
availability and congestion
BCCH also broadcasts a list of channels that are
currently in use within the cell
Frame 2 through frame 5 in a control multiframe
(4 out of 51 frames) contain BCCH data
BCCH and other control channel are transmitted in
time slot 0 of a particular ARFCN (Absolute Radio
Frequency Number)
57
Paging Channel (PCH)
PCH is a downlink channel used by the base station
for paging purpose to inform a MS about an
incoming call
PCH uses 4 consecutive frames to send a
message
PCH transmits TMSI (usually) or IMSI (on rare
occasions)
PCH may also be used to provide cell broadcast
(ASCII text messages) to all subscribers as part of
the SMS feature of GSM
58
Random Access Channel (RACH)


TB TB Training sequence
8 41 3
36
Additional
Guard Bits
60
Message
RACH is uplink channel used by MS to access network
To acknowledge a paging done through PCH
To request a channel to originate a call, send SMS, etc.
MS accesses RACH after acquiring freq & timing sync
This burst includes 48 bit synchronisation sequence and 36
bit message
RACH uses slotted ALOHA scheme
This burst has a longer guard period of 58 bits
Allows transmission of MS that has not acquired the
time synchronisation does not collide with other bursts
if it is within 35 km ( distance for 58 x 3.69 msec)
8.25
Guard
Bits
59
Access Grant Channel (AGCH)
AGCH is a downlink control channel used by base
station to allocate SDCCH for bidirectional
communication path between BS and MS
AGCH instructs the MS to operate in a
particular physical channel (time slot and
ARFCN)
AGCH is sent in response to a RACH request by
MS
This assigns a SDCCH to the MS for carrying
the signaling messages related to call set up,
registration, etc.
ACGH uses 4 consecutive frames for sending
acknowledgement message
60
Stand-alone Dedicated Control Channel
(SDCCH)
SDCCH is a duplex signalling channel allotted
through AGCH message for carrying signaling data &
for user services (like messaging not requiring TCH)
SDCCH enables the base station and MS to remain
connected till the MS identity is verified
SDCCH is deallocated once TCH is assigned
(SACCH becomes available)
SDCCH is used to send authentication and alert
messages
SDCCH may be carried on a traffic multiframe basis
or control multiframe basis
61
Associated Control Channel (ACCH)
ACCH used for conveying signalling and other
information bidirectionally between BS and MS
There are two types of ACCH
Slow Associated Control Channel (SACCH)
that is available on frame # 12 in a traffic
multiframe
[184 bits (23 bytes) message + 40 parity bits]
x 2 due to rate 1/2 convolutional code will result
in 456 bits in 480 msec
Slow ACCH (184 bits every 480 msec ~380
bits/sec)
SACCH multiframes for different time slots are
offset to achieve load balancing at BSC
Fast Associated Control Channel (FACCH) is
made use of during handover by setting the steal
bits of traffic channel. In every frame there are 2
sets of 57 bits and by stealing in 8 slots you get
456 bits
62
Traffic Multiframe Format
Traffic Channel (TCH/F) transmission occurs in a
particular time slot of every traffic frame except in
frame numbers 12 and 25 of traffic multiframe
Speech codec generates 13 kbps data (260 bits
every 20 msec) and with FEC this gets enhanced
to 456 bits
24 bursts every 120 msec with 114 bits per
burst gives a pay load of 24 x 114 = 2736 bits
which equals the data rate of codec (456 x 6)
Traffic
Frame
Number
0
. . . . . .
12 13
Signaling
idle
25 1
63
Traffic Multiframe Format (Contd.)
Signaling (SACCH) is done in frame # 12 and
frame # 25 is not used
In the case of half rate traffic channel TCH/H
alternate frames are made use of
Codec rate is 5.6 kbps (112 bits / 20 msec)
and this after FEC gets enhanced to 228 bits
One MS uses frame # 12 for signaling with
frame # 25 being idle and the other uses
frame # 25 with frame # 12 being idle
Downlink frames offset by exactly 3 time slots to
avoid simultaneous transmission and reception in
MS
This eliminates the need for duplexer based
design
64
0 4 3 2
1 5
49
50
0 1 24 25
Multiframe Structure
0 1
2
3 4 2045
2046 2047
1 hyperframe=2048 superframes (3h 28m 53s 760 msec)
0 1 3 2
6
7
5 4
0 1 2 25 0 1 50
1 frame= 8 slots
traffic multiframe=26 frames Control multiframe = 51 frames
1 superframe = 51 traffic multiframes
= 26 control multiframes (6.12 sec)
3
T B
57
bits
1
F
26
T
1
F
57
bits
8.25
G
576.92 m sec
3
T B
TB: Tail Bits
F: Flag
G: Guard
65
Logical Channels Purposes & Formats
Name of Logical
Channel & direction
Purpose of Channel Format of
Channel
Frequency Correction
Channel (FCCH) DL
Enables MS to acquire
carrier frequency of
BTS
142 0s
Synchronization
Channel (SCH) DL
Allows MS to acquire
frame synchronisation
& BSIC
39 bits + 64
training bits + 39
bits
Broadcast Control
Channel (BCCH) DL
Broadcasts Network &
System information
Normal Bursts (4
frames)
Paging Channel
(PCH) DL
Paging for MS(s) Normal Bursts (4
frames)
Random Access
Channel (RACH) - UL
MS sending access
request
36 bits + 48
training bits + 56
extra guard bits
Access Grant Channel
(AGCH) DL
Allocating SDCCH to
MS
Normal Bursts (4
frames)
66
GSM Logical Channels
Group Channel
Name
Function Direction
Traffic Channel
(TCH)
TCH/F
TCH/H
Full Rate TCH
Hall Rate TCH
UL & DL
UL & DL
Broadcast
Control Channel
BCCH
FCCH
SCH
Broadcast Control
Frequency Correction
Synchronisation
DL
DL
DL
Common
Control Channel
RACH
AGCH
PCH
NCH
Random Access
Access Grant
Paging
Notification
UL
DL
DL
DL
Dedicated
Control Channel
SDCCH

SACCH
FACCH
Stand-alone Control
Channel
Slow Associated Control
Fast Associated Control
UL & DL

UL & DL
UL & DL


67
Summary of Channel Coding

Channel
Bits / Block
Data + Parity +
Tail
Channel
Coding
Rate
Coded bits /
block
Sent over
Frames
TCH
Class I
Class II

182+3+4 = 189
78+0+0 = 78

Rate

378
78 = 456

8
FACCH
SACCH
SDCCH

184+40+4=228

Rate

456

4
BCCH
AGCH
PCH

184+40+4=228

Rate

456

4
RACH 8 + 6 + 4 Rate 36 1
SCH 25 + 10 + 4 Rate 78 1
68
Details Of GSM TDMA Frame Transmission
Bit time 3.69 msec Smallest unit
Time slot 0.577 msec 156.25 bits
TDMA frame 4.615 msec 8 time slots
Traffic Multiframe 120 msec 26 TDMA frames
Control Multiframe 235.385 msec 51 TDMA frames
Super Frame 6.12 sec 1326 TDMA frames
Hyper Frames 3h 28mt 53.76 s 2048 Superframes
69
Channel Coding For Voice Bits
20msec
Speech
(8KHz, 13bit
Linear PCM)
RPE-LTP
Speech
Coder
3-bit
CRC
-rate
Convul-
Utional
Coder
Class-1 bits (182)
50 most
significant
Class-1 bits 3 bits
4 tail bits
Coded
Class-1
378 bits
Class-2 bits (78)
8-burst
Inter-
Leaver
456 bits
2080 bits
Source coding
generates 13
kbps
Channel coded
data
rate is 22.8 kbps

70
Interleaving Scheme
1 2 3 4 5 6 7 8
Stream of bursts with each burst of 114 bits
1 2 3 4 5 6 7 8
1 2 3 4 5 6 7 8
Channel Coder
456 bits
Channel Coder
RPE-LTP Coder

456 bits
RPE-LTP Coder
260 bits 260 bits
Expanded burst Data 57 bits
Data 57 bits
156.25 bits
71
Ciphering In TCH/F
TB TB
Sync.
(Midamble)
Guard
Bits
3 26 3 8.25
Payload Payload
57
57
1 1
114 bit encryption bits obtained
using A5 algorithm
XOR Block (57bits) XOR Block (57bits)
57 bits each
Outgoing TCH Burst
57 Block A
bits after
Interleaving
57 Block B
bits after
Interleaving
72
Deciphering In TCH/F
TB TB
Sync.
(Midamble)
Guard
Bits
3 26 3 8.25
Payload Payload
57
57
1 1
114 bit decryption bits obtained
using A5 algorithm
XOR Block (57bits) XOR Block (57bits)
57 bits each
57 bit block B
data for
deinterleaving
57 bit block A
data for
deinterleaving
Incoming TCH Burst
73
Block Schematic Of Functions Of MS
A/D
Conversion
Voice
Coding &
Blocking
Channel
Coding
Inter
leaving
Ciphering
Burst
Formatting
Modulator
Transmitter
D/A
Conversion
Voice
Decoding
Viterbi
Decoding
Deinter
leaving
Deciphering Receiver
Demodulator
Equaliser
Microphone
Earphone
8 kHz 13 bits
13 kbps
22.8 kbps
74
Block Schematic Of Functions Of BTS / BSC
Trans
coding
Voice
Coding &
Blocking
Channel
Coding
Inter
leaving
Ciphering
Burst
Formatting
Modulator
Transmitter
Trans
coding
Voice
Decoding
Viterbi
Decoding
Deinter
leaving
Deciphering Receiver
Demodulator
Equaliser
8 kHz 13 bits
Linear
13 kbps
22.8 kbps
64 kbps
PCM
TRAU
Functions
75
Capacity Enhancement
Capacity can be increased by reducing the cell size
Reducing cell size will increase interference and hence
interference reduction is required for enhancing capacity
Some of the techniques area
Adaptive Power Control:
Less power reduced interference
Key is to transmit just enough power
Discontinuous Transmission (DTX):
Speech has long periods of silence and transmitter
can be switched off during silence
Slow Frequency Hopping (SFH):
Averages influence of interference by changing
carrier frequency periodically
Sectorising:
Transmitting in a narrow beam
Reduces the number of transmitters directed at MS
76
Cell Splitting
Macro Cells
Large Sized cells 10s of km
Capacity less
Less handover due to mobility
Can support high speeds
Micro Cells
Medium sized cells few kms
Moderate capacity & speeds
Pico Cells
Small sized cells few 100s of
meter
High capacity & pedestrian speeds
77
Hierarchical Layered Cells
Same area covered by multiple layered cells
Macro, Micro & Pico cells
Handover can happen
horizontally (or laterally) or
vertically (or hierarchically)
Can handle hot spot regions
Results in improved
Coverage
Quality
Capacity
Disadvantages
Increased # sites (cost)
Increased signaling load to MSC and hand-offs
Stringent power planning necessary
Macro cells,
low density
Micro cells,
high density
Pico cells,
higher density
78
Authentication & Tracking MS
79
Security Issues
Due to vulnerability of air interface
IMSI is rarely used on air interface
TMSI is always used in all messages between MS
& BS
TMSI has validity only in LAI
All critical information like dialed digit, calling
number, etc. exchanged over air are encrypted
Two distinct processes exist in GSM
Authentication: This is the process of sending
RAND and challenging MS to return a correct
SRES.
Encryption: As part of the authentication a
Cipher key K
c
is produced and this is used in
encrypting and decrypting process for all data
exchanged between MS & BS
80
Authentication & Encryption
Network Mobile station
A3
?
A8
A5
A8
A5
A3
SRES
Ki
Ki
Frame #
K
c

RAND (128 bits)
SRES (32 bits)
Encrypted traffic
Frame #
RAND
Ki
RAND
Ki
Kc
A
u
t
h
e
n
t
i
c
a
t
i
o
n

E
n
c
r
y
p
t
i
o
n

RAND
81
Authentication & Encryption (Contd.,)
Authentication
Network sends RAND (128 bits)
K
i
is secret key
K
i
, RAND used with Algorithm A3 to produce
SRES (32 bits)
K
i
, RAND used with Algorithm A8 to produce K
c

(128 bits)
A
3
& A
8
are operator-dependent
K
i
cannot be accessed by user
When SRES sent by MS matches MS is
authenticated
82
Authentication & Encryption (Contd.,)
Encryption
K
c
cipher key (64 bits)
Frame number (22 bits), K
c
used with
Algorithm A5
Produce two 114-bit sequences (encryption /
decryption bits)
Algorithm A5 is universal to all operators
Each burst has 114 data bits and these bits are
generated by XORing with encryption bits on
data bits
Received 114 bits are XORed with decryption
bits to get the original data
83
Functions of MS Idle Mode
MS chooses Home PLMN, when present
Tunes to beacon frequencies listed in SIM
Chooses the strongest carrier among these
Gets timing information from FCCH
Gets frame information from SCH
Gets PLMN identity, identity of neighbouring
BS, configuration of the channels, CGI, etc
from BCCH
Performs Location Area Update / Authentication
/ Registration as needed
Locks on to PCH
If Home PLMN is not available, looks for other
PLMNs and performs above steps
84
Functions of MS Call Establishment
When MS wants to make an outgoing call it accesses
network through RACH
Network responds though AGCH & allocates SDCCH
MS and BS communicate privately in SDCCH
When call matures TCH is allocated for
conversation
Routing due to movement of mobile is handled by
means of handovers
When an incoming call is received for MS, it is paged
in PCH
MS responds by accessing RACH
Steps above are repeated
After completing the call TCH is released and again
performs Idle Mode functions
85
PLMN must accept incoming calls at one fixed
exchange, called Gateway MSC (GMSC)
GMSC has information about location area of MS
and mobile is paged in this area
Call is completed on MS responding
In case MS is visiting another PLMN area, the
call is forwarded to visited PLMN and call is
completed there
MS can make outgoing calls in Home / Visited PLMN
and these gets routed to nearest interconnect point
Call Routing To And From MS
86
Incoming Call to a Roaming MS
MS
BS
Visited
MSC
VLR HLR GMSC
Originating
Switch
User dials
MS number
IAM (MSISDN)
HLR Query
(MSISDN)
HLR Response
(MSRN)
IAM (MSRN)
87
Paging Procedure (Mobile Terminated)
Paging Request Message on PCH
(TMSI or IMSI)
MS
BSS
Channel Request on RACH
Response on SDCCH
Assign SDCCH on AGCH
88
Random Access Channel Procedure (Mobile
Originated)
Access Request Message
on RACH
MS
BSS
Response
on SDCCH
Assign SDCCH
on AGCH
89
Functions of HLR & VLR
HLR & VLR are data bases
The data in HLR / VLR can be accessed by SS7 queries
Addressing is through Global Title
Absolute address obtained by GT translation
functionality of SCCP
HLR contains database of all subscribers who are
registered in a PLMN area
Usually there is one HLR per PLMN & this can be split
for operational convenience
Data contained include MSISDN, IMSI, IMEI, LAI,
TMSI, Access Profile,
Database is of permanent nature
Once created, remains for the life time of MS
subscription
90
Functions of HLR & VLR (Contd.)
VLR contains database of all subscribers who are
currently located in a MSC area
One VLR can serve one MSC or multiple MSCs
Data contained will be similar to VLR database
This database is dynamically updated
New entries are made when new subscriber
visits MSC area
Entries deleted as a result of LA updating or
time out
HLR and VLR play complementary roles
VLR / HLR track movement of MS
HLR helps in routing incoming calls to MS
VLR helps in handling outgoing calls from MS
91
Tracking MS
MS can freely roam in GSM coverage area
Due to reasons of security, MS uses TMSI in
messages in clear (unciphered) mode
IMSI is used in exceptional cases
MS updates network about Location Area (LA)
Location Area is group of contiguous cells
coming under one MSC
MS updates whenever it moves into new LA and
acquires a new TMSI
This is done by revealing its previous identity
(TMSI & LAI)
Since it is not possible to track MS to cell level, MS
is tracked to level of Location Area (LA)
92
Location Area Updating
MS captures LAI and TMSI in its SIM
Whenever it enters a new cell area, it compares LAI
contained in BCCH with LAI stored in SIM
Initiates a Location Area Updating if these are
different
Sends access request in RACH & getting SDCCH
assigned
Conveys the previous LAI & TMSI on SDCCH
and requests a new TMSI
Network allocates new TMSI
HLR captures this information (LAI & TMSI) for
routing incoming calls
Now MS can freely roam in the new LA since it can
make and receive calls in this area
93
Different Scenarios of Location Updating
Scene 1: MS movement within same MSC area
LA updating done in the same VLR and new TMSI
assigned & HLR updated
Scene 2: MS movement from one MSC to another
MSC within same PLMN
LA updating results in message flow between VLRs
New TMSI assigned by new visited VLR and entry
deleted in old visited VLR
HLR entry updated
Scene 3: MS movement from one PLMN to another
PLMN
May need fresh authentication in the new PLMN
Same procedure as Scene 2
94
Signalling And Call Processing
95
GSM Functional Planes
OAM
CM
MM
RR
transmission
operator user
CM
MM
RR
trans
MS BTS BSC
MSC/
VLR
HLR
GMSC
BTS
BSC
MSC
VLR
HLR GMSC
96
GSM Signaling Protocol Architecture
BSSAP
MM
CM
BSSAP
CM
BTS
MS
BSC
MSC
A U
m
A
bis

B/C/D/E/F
MTP
SCCP
MTP
SCCP SCCP
MM
RRM
RRM
RRM
LAPD LAPD LAPD
m

LAPD
m

Signaling
Layer1
Signaling
Layer1
Signaling
Layer1
Signaling
Layer1
BTSM BTSM
I
S
U
P
M
A
P
TCAP
Relay
MTP
97
GSM System Model Signaling View
VLR
VLR
MAP/G
MAP/B
MAP/C
MAP/
D
MAP
MAP/F
MAP/E / ISUP
EIR
MAP /
ISUP
MAP /
ISUP
MSC
BSC
BTS
MS
PSTN/
ISDN
PLMN
BSSAP /
Q.931
BSS
LAPD / Q.931
LAPDm / Q.931
MSC
HLR AUC
98
What Are RRM Functions?
RRM functions cover all activities related to
physical layer (air interface)
These relate functions like
Channel assignment
Channel release
Channel change and handover
Change of channel frequencies, hopping
sequences (algorithms) and frequency tables
Measurement reports from the MS
Power control and Time Advance
Modification of channel modes (speech and
data)
Cipher mode setting
99
Some RRM Messages
Name of
Message
Sent by &
sent to
Carried on
Channel
Purpose of Message
Assignment
Command
BSC to MS SDCCH Allocation of TCH
(ARFCN & TS#)
Assignment
Complete
MS to BSC SDCCH Acknowledge for
Assignment Command
Channel Request MS to BSC RACH Request for channel
Channel Release BSC to MS SDCCH or
TCH
Release of SDCCH or
TCH
Cipher Mode
Command
BSC to MS SDCCH To indicate to MS that
ciphering will start
100
Some RRM Messages (Contd.)
Name of Message Sent by &
sent to
Carried on
Channel
Purpose of Message
Cipher Mode
Complete
MS to BSC SDCCH Acknowledge that MS
will also start
ciphering
Immediate
Assignment
Command
BSC to MS AGCH Allocation of TCH
(ARFCN & TS#)
Paging Request BSC to MS PCH To inform MS about
incoming call / SMS
Paging Response MS to BSC SDCCH To respond to paging
by revealing MS
identity (TMSI)
System
Information
Messages
BSC to all
MSs
BCCH To broadcast CGI,
System information,
neighbouring cell
description
101
Some RRM Messages (Contd.)
Name of Message Sent by &
sent to
Carried on
Channel
Purpose of Message
Measurement
Report
MS to BSC SACCH MS reporting on
signal strength
measurement
Handover
Command
BSC to MS FACCH /
SACCH
Change of MS channel
allocation (will include
new ARFCN & TS#)
Handover Access MS to BSC
(new)
FACCH /
SACCH
Initial message sent
on the new TCH about
presence of MS
Handover
Complete
MS to BSC
(new)
FACCH /
SACCH
MS informs new BSC
that handover has
been completed
Handover Failure MS to BSC
(old)
SACCH /
FACCH
MS indicates that
handover has failed
102
What Are MM Functions?
All activities connected with mobility of MS are
MM functions
Location updating
Periodic registration
Authentication procedure
IMSI attach procedure (on power up a MS will
present its IMSI to network and get a TMSI)
IMSI detach ( on power off of a MS, detach
procedure to tell network it is no longer in
service.
TMSI reallocation
Identification
103
Some MM Messages
Name of
Message
Sent by &
sent to
Carried on
Channel
Purpose of Message
Authentication
Request
MSC to
MS
SDCCH Sending RAND for
authenticating MS
Authentication
Response
MS to
MSC
SDCCH MS response by
sending SRES
Authentication
Reject
MSC to
MS
SDCCH MSC informing MS
that authentication
has failed
Location
Updating
Request
MS to
MSC
SDCCH To update location by
including TMSI and
LAI
Location Update
Accept Command
MSC to
MS
SDCCH To indicate that
location updating has
been done
104
Some MM Messages (Contd.)
Name of
Message
Sent by &
sent to
Carried on
Channel
Purpose of Message
TMSI
Reallocation
Command
MSC to MS SDCCH To indicate that location
updating has been done
and will include new TMSI
TMSI
Reallocation
Complete
MS to MSC SDCCH Acknowledgement of
TMSI Reallocation
Command by MS
IMSI Detach
Indication
MS to MSC SDCCH Indication to MSC that its
identity be removed from
MSC/VLR
IMSI Attach
Command
MS to MSC SDCCH To inform MSC that MS is
again powered up
Identity
Request
MSC to MS SDCCH MSC requesting MS to
send its identity (IMSI)
Identity
Response
MS to MSC SDCCH MS sends its identity
(IMSI)
105
What are CM Functions?
CM functions relate to establishing, releasing call
and status indication

Call establishment for mobile-originated calls
Call establishment for mobile-terminated calls
Indication of status
Changes of transmission mode during an
ongoing call
Call reestablishment after interruption of an
MM connection
Dual-tone multifrequency (DTMF) control
procedure for DTMF transmission
106
Flow of CM Messages
MSC /
GMSC
PSTN /
PLMN

MS A
NNI
ISUP messages
UNI
Q.931 messages
Interface between MS and MSC is called User to
Network Interface (UNI)
Q.931 messages are used in this interface
Interface between MSC / GMSC and external
network is called Network to Network Interface
(NNI)
ISUP messages are used in this interface
107
Message name
Starting a call
Transmitted by
SETUP
EMERGENCY SETUP
CALL PROCEEDING
PROGRESS
CALL CONFIRMED
ALERTING
CONNECT
MS/MSC
MS
MSC
MSC
MS
MS/MSC
MS/MSC
During a call
START DTMF
STOP DTMF
MODIFY
USER INFORMATION
MS
MS
MS/MSC
MS/MSC
Ending a call
DISCONNECT
RELEASE
RELEASE COMPLET
MS/MSC
MS/MSC
MS/MSC
Abnormal conditions
STATUS
STATUS ENQUIRY
CONGESTION CONROL
MS/MSC
MS/MSC
MS/MSC
Call Management Messages
108
Important ISUP Messages
There are 3 important ISDN User Part (ISUP)
messages
IAM (Initial Address Message) is sent by the
calling network to initiate a call sending
complete information about the call calling
number, called number, type of call and other
information
ACM (Address Complete Message) is sent by
terminating network to confirm that the called
number is free and is being alerted
ANM (ANswer with Metering) is sent by
terminating network once the called subscriber
answers the call. Now the conversation can
begin and metering starts
109
Important Q.931 Messages
There are 3 important ISDN User Part (ISUP)
messages
Setup message is sent by user or network
(originating side) to initiate a call by sending
information about the call calling number,
called number, type of call and other
information this is equivalent to IAM
Alerting is sent by the other side (terminating
side) to confirm that the called number is free
and is being alerted this is equivalent to ACM
Connect message is sent by the terminating
side that the called subscriber has answered the
call this is equivalent to ANM
110
Mobile Originated Call
MS
BSC MSC
VLR PSTN
Setup (dialled digits + encryption)
Assignment of TCH (SDCCH)
Assignment Complete
Assignment Complete
(voice path from MS to MSC)
Assignment of trunk
on A channel
Call Proceed (on SDCCH)
Send info for Outgoing Call
(call restriction query)l
Alerting
Connect
Connect Acknowledge
Complete Call
Route Establishment
Answer
1
2
3
4
5
6
7
8
9
10
11
12
13
14
ringback heard by MS
Call Establishment to PSTN no.
(IAM)
(ACM)
(ANM)
111
Messages In Mobile Originated Call
1. When user dials the number and presses ok
button MS sends Setup message transferring this
info to MSC
2. MSC sends a message to VLR for accessing
subscription information of MS
3. VLR checks the database of MS to determine
whether the call can be allowed or not and returns
a message
4. MSC send Call Proceeding message to MS
5. MSC allocates a trunk between BSC &MSC and
asks BSC to assign TCH for MS
6. BSC allocates TCH, sends Assignment message
to MS
7. MS tunes to the TCH and sends Assignment
Complete message to BSC
112
Messages In Mobile Originated Call
8. BSC deallocates SDCCH, connects TCH to the
trunk and sends Assignment Complete
message to MSC
9. MSC sends Initial Address Message (IAM) to
PSTN containing the digits dialed
10. PSTN sets up the call and returns Address
Complete Message(ACM)
11. MSC informs MS that destination number is being
alerted, subscriber hears ringing tone
12. When called subscriber answers PSTN sends
Answer message
13. MSC informs MS that connection has been
established through the Connect message
14. MS returns a Connect Acknowledge message
and conversation can proceed
113
Page Request (TMSI)
Alerting
Call Confirmed
Page Message to
appropriate BSCs
Setup
Connect
Connect Acknowledge
Setup Complete
Answer
Channel Request (on RACH)
SDCCH Assignment (on AGCH)
Page Response on SDCCH
Page Response
Process Access Request
Complete Call
Page
LA & TMSI
Send info for Incoming Call
Routing Information
Send Routing Information (VLR)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
MS BSC VLR PSTN HLR
end of MSC-VLR
dialogue
Call Establishment Message
Mobile Terminated Call
MSC
GMSC
(IAM)
(ACM)
(ANM)
114
Messages In Mobile Terminated Call
1. GMSC receives IAM for an incoming call from
PSTN to MS with directory no MSISDN
2. MSC requests routing information from HLR
through Routing Information Message by
including MSISDN
3. HLR acknowledges by returning MSRN / MSISDN
and address of serving VLR
4. MSC queries VLR with Send Info for Incoming
Call message
5. VLR responds with a Page message that specifies
the LAI & TMSI of MS
If incoming calls are barred VLR will inform the
MSC and MSC would connect to an appropriate
announcement
115
Messages In Mobile Terminated Call (Contd.)
6. MSC determines the BSCs covering LAI and sends
the Page message to each of the BSCs
7. Each BSC broadcasts TMSI of MS in Page Request
message in PCH
8. MS responds with Channel Request message in
RACH
9. BSC allocates SDCCH, sends Channel Assignment
message to MS over AGCH
10. MS sends Page Response message (containing
MSs TMSI & LAI) over SDCCH
11. BSC forwards Page Response message to MSC
12. MSC sends Process Access Request message to
VLR
116
Messages In Mobile Terminated Call (Contd.)
13. VLR responds with a Complete Call message
14. MSC sends Setup message to MS
15. MS responds with Call Confirmed message
16. MS sends Alerting message to MSC indicating
the subscriber is being alerted about incoming
call
17. MSC returns ACM to PSTN
18. When user answers, MS sends Connect
message to MSC
19. MSC returns Connect Acknowledge message
to MS
20. MSC sends Answer message to PSTN
21. VLR closes the dialog with MSC by returning
Send Info for Incoming Call Acknowledge
message
117
MS MSC
Handover Command
Handover Command
+ new BSIC, TCH
Trunk Assignment on A I/F +
Handover Request (BSIC, encr. Key)
1
2
3
4
5
6
7
8
9
10
11
12
13

Periodic Measurement Report
Handover Access (on new TCH)
Physical Information
Handover Request
with ranking of target BTSs
Handover Detected
Handover Request Acknowledge
new TCH ID
Handover Completed (after timing advance, power control)
Release
Release Complete
Handover Completed
Serving
BSC
Target
BSC
INTRA MSC HANDOVER
118
Messages In Intra Msc Handover
1. When MS determines that a handover is required,
it sends Measurement Report message
containing signal strength measurements
2. Serving BSC sends a Handover Request
message to MSC containing rank ordered list of
target BTSs
3. MSC identifies the best candidate cell &
determines whether the handover is intra MSC or
inter MSC and checks about availability of trunk
and radio resources and sends Handover
Request message to target BSC
4. Target BSC sends Handover Request
Acknowledge message indicating the radio
channel
5. MSC sends Handover Command message to
serving BSC
6. Serving BSC forwards this message to MS
119
MESSAGES IN INTRA MSC HANDOVER (Contd.)
7. MS tunes to the new channel and sends Handover
Access message to BSC on the new radio channel
8. Target BSC sends Physical Information message
to MS.
9. Target BSC informs MSC when it begins detecting
the MS handing over with the Handover Detected
message
10. After MS and target BSC establish signaling
connection MS sends Handover Completed
message to target BSC
11. Target BSC sends Handover Completed message
to MSC
12. MSC sends a Release message to the serving BSC
to release the old radio TCH
13. Serving BSC releases all resources with MS and
sends Releases Complete message to MSC
120
Prepare Handover
Send Handover Request
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
MS
Serving
BSC
Target
MSC
Target
VLR
Target
BSC
INTER MSC HANDOVER
Serving
MSC
Measurement Report
Handover Request
Allocation Handover Number
Handover Request
Handover Request
Acknowledge
Prepare Handover
Acknowledge
Send Handover Acknowledge
Handover Command
Handover Command
Send Handover
Acknowledge
Handover Access
Physical Information
Handover Completed
Handover Detected
Handover Completed
Send End Signal
Process Access
Signaling
Send End Signal
Release Complete
Release
121
Messages In Inter MSC Handover
1. Same as step 1 in the intra MSC handover
2. Same as step 2 in the intra MSC handover
3. MSC identifies the target MSC associated with the
best candidate cell and sends Prepare Handover
message
4. Target MSC sends an Allocate Handover
message to its VLR to assign the TMSI
5. Target VLR sends the TMSI in Send Handover
Request message
6. Same as step 3 in the intra MSC handover
7. Same as step 4 in the intra MSC handover
122
Messages In Inter Msc Handover (Contd.)
8. Target MSC sends Prepare Handover
(acknowledge) message to the serving MSC
indicating that it is ready for the handover
9. Serving MSC sends the Send Handover
(acknowledge) message to the target MSC
10. Target MSC sends a Send Handover Request
(acknowledge) message to the target VLR
11. Same as step 5 in the intra MSC handover
12. Same as step 6 in the intra- MSC handover
13. Same as step7 in the intra MSC handover
14. Same as step8 in the intra MSC handover
123
Messages In Inter MSC Handover (Contd.)
15. Same as step 9 in the intraMSC handover
16. Same as step 10 in the intraMSC handover
17. Same as step 11 in the intraMSC handover
18. Target MSC sends a Process Access Signalling
message to the serving MSC
19. At this point the handover has been
completed,and the target MSC sends a Send
End Singling message to the serving MSC
20. Same as step 12 in the intra-MSC handover
21. Same as step13 in the intra MSC handover
22. Serving MSC sends a Send End Signal
(acknowledge) message to the target MSC
124
Call Release Mobile Initiated
MS BSC PSTN MSC
1
2
3
4
5
6
7
8
Disconnect
Clear Command
Release Complete
Release
Release
Channel release
Release Complete
Clear Complete
125
Messages In Call Release Mobile Initiated
1. MS sends the Disconnect message to the MSC
2. MSC sends a Release message to PSTN to release
the call.
3. MSC sends Release message asking MS to begin
clearing procedure
4. MS performs clearing procedure and informs MSC
through Release Complete message
5. PSTN sends a Release Complete message to
MSC
6. MSC sends Clear Command message to BSC
requesting release of allocated resources for a
given SCCP connection
7. BSC sends Channel Release message to MS to
release the TCH
8. BSC sends Clear Complete message to MSC
informing that all allocated resources have been
released
126
Mobile
station
Base
station
Category
Logical
Channel
SYNC CHANNEL INFORMATION
Carrier sine wave
SYSTEM INFORMATION TYPE3
CHANNEL REQUEST
IMMEDIATE ASSIGNMENT
LOCATION UPDATING REQUEST
AUTHENTICATION REQUEST
CIPHERING MODE COMMAND
CIPHERING MODE ACK
LOCATION UPDATING ACCEPT
TMSI ALLOCATION COMPLETE
AUTHENTICATION RESPONSE
CHANNEL RELEASE
RRM
RRM
RRM
RRM
MM
MM
MM
MM
MM
RRM
RRM
RRM
FCCH
SCH
BCCH
RACH
AGCH
SDCCH
SDCCH
SDCCH
SDCCH
SDCCH
SDCCH
SDCCH
SDCCH
Location Updating Procedure
127
Mobile
station
Base
station
Category
Logical
Channel

RRM
RRM
RRM
RRM
RRM
RRM
MM
MM
RRM
RRM
CM
CM
CM
RRM
RRM
CM



CM
CM
CM
RRM
FCCH
SCH
BCCH
PCH
RACH
AGCH
SDCCH
SDCCH
SDCCH
SDCCH
SDCCH
SDCCH
SDCCH
SDCCH
SDCCH
SDCCH
SDCCH
FACCH
TCH
TCH
FACCH
FACCH
FACCH
FACCH
Carrier sine wave
SYNC CHANNEL INFORMATION
SYSTEM INFORMATION
PAGING REQUEST
CHANNEL REQUEST
IMMEDIATE ASSIGNMENT
PAGING RESPONSE
AUTHENTICATION REQUEST
AUTHENTICATION RESPONSE
CIPHERING MODE
CIPHERING MODE ACK
SETUP
CALL CONFIRMED
ALERTING
CONNECT
ASSIGNMENT COMMAND
ASSIGNMENT ACK
CONNECT ACK
conversation
conversation
conversation
DISCONNECT
RELEASE
RELEASE COMPLETE
CHANNEL RELEASE
Mobile Terminated Call Sequence
128
Mobile Assisted Handover
Mobile
station
Base
station
Logical
Channel
TCH
TCH
SACCH
TCH
TCH
TCH
SACCH
TCH
FACCH
new TCH
TCH
TCH
TCH

FACCH
TCH
TCH
SACCH
TCH
TCH
TCH
SACCH
TCH
conversation
conversation
MEASUREMENT REPORT
conversation
conversation
conversation
MEASUREMENT REPORT
conversation
HANDOVER COMMAND
HANDOVER ACCESS
HANDOVER ACCESS
HANDOVER ACCESS
PHYSICAL INFORMATION
HANDOVER COMPLETE
conversation
conversation
MEASUREMENT REPORT
conversation
conversation
conversation
MEASUREMENT REPORT
conversation
129
Short Message Services
Short Message Service (SMS) is a very important
and popular service
Message delivery is by using SDCCH rather a
light load on network resources
There are two types of services
Point to Point
Cell Broadcast (Point to Multipoint)
This service is supported through Type 0 MS &
SMSC (SMS Center)
SMSC can be a separate external element or
could be built into MSC
130
SMS Network Elements
Short Messaging Entity (SME) is any device
capable of sending and receiving short messages
This may be located in fixed network, mobile
network or could be another service centre
Short Message Service Centre (SMSC) is
responsible for relaying, storing and forwarding
between an SME and MS
SMS Inter Working MSC (SMS-IWMSC) is an MSC
capable of receiving short messages from the
mobile network and submitting it to SMSC
SMS Gateway MSC (SMS-GMSC) is an MSC that is
capable of receiving short messages and
interrogating HLR for location information for
delivery
131
Architecture Of SMS
Mobile Network
SMSC
MSC /
VLR
MS
Gateway or
I/W MSC
HLR
132
MS Originated Short Message Message Flow
Message
Transfer
Delivery
forwardShortMessage
sendInfoFor-
MO-SMS
Message Transfer
Delivery Report
Delivery
Report
Report
SMSC SMS-
IWMSC
HLR MSC VLR
Access Request
Authenticate
MS
133
MS Terminated Short Message Message Flow
Message
Transfer
sendRoutingInfo-
Delivery
ForShortMsg
forwardShortMessage
sendInfoFor-
MT-SMS
Message Transfer
Deliver Report
SM-Delivery
ReportStatus
Report
SMSC GMSC HLR MSC VLR
Page
Authenticate
MS
134
Half Rate Traffic Channels (TCH/H)
Half rate traffic Channel (TCH/H) is allocating a time
slot to 2 users with each one using alternate frames
User1 is given all odd frames and User2 is given
all even frames of the same time slot
Speech coding is done at lower rate resulting in
somewhat lower quality of speech
TCH/H allocation is resorted to support two users per
time slot during peak hours of the day or during
emergencies
Frame
Number
0
. . . . . .
12 13
Signaling
idle
25 1
120 mSec
2
User1
User2
idle
Signaling