GSM Architecture

G roup S pcial M obile

GSM

G lobal S ystem for M obile Communications

GSM Architecture

GSM - Public Land Mobile Network

INDIA has adopted GSM standard. Digital Cellular System based on

Narrowband ISDN. Operates at 900 MHz range. International Roaming facility. Power class 0.8 to 20W. Cell Radius upto 30 Kms. Maximum mobility speed 250 Km/hr.
4

Design Objectives of GSM

Good speech quality. Security and privacy. Low terminal and service cost. Handheld terminals. International roaming. Range of new services & facilities. Digital radio. Spectral efficiency.
5

Communication PSTN

Subscriber Line (2W)

Inter-Exchange Junction

Subscriber Line (2W)

Telephone Exchanges

Communication - PLMN

Subscriber Line (2W)

Inter-Exchange Junction

BSC
Telephone Exchange Mobile Switching Centre (MSC)

BTS

MS

Mobility Issues

Demand on scarce Radio Resources. Authentication. Security and Privacy. Providing service across networks. Maintain UNIQUE Service Profile. Keep track of users. Maintain established communication. Power & Timing management of MS. Roaming and Billing & Accounting
8

Wired Vs Wireless SAN

WIRED NETWORK
Telephon e Exchange

Lay as much cable as needed to meet the demand.

Subscriber Line (2W)

Space Division Multiplexing Available space much more than required and hence dedicated access to each. Teledensity of an area does not pose any problem. Static Network snapshots.
9

Wired Vs Wireless SAN

WIRELESS NETWORK
Mobile Switching Centre (MSC)

ONLY a window of RF Spectrum is available

RF Channels

MS

BSC

BTS

Frequency/Time Division Multiplexing Limited RF spectrum and hence RF channels assigned on demand Dynamically changing teledensity in each area. Dynamic Network snapshots.
10

7 Cell Cluster Structure

F3 F4 F1 F5 F6 F7 F2 F4 F1 F5
11

GSM - Cell layout

F3
F1 F5 F7 F6 F6 F7

F4 F4

F2

F3
F1

F2

F5

Farthest Separation
12

GSM Terminology
Home network Visited network Location Area Roaming Handover POI
13

System Architecture
Functional Architecture broadly divided into six parts:
Mobile Station. Base Station Subsystem (BSS). Network Switching Subsystem

(NSS). Operation and Maintenance Subsystem. Enhanced Services System

14

GSM Network Overview

A Um
SIM ME

Abis
BTS

BSC

HLR

VLR

OMC

MSC BSC BTS EIR AuC

PSTN ISDN PSPDN CSPDN

Mobile Station

Base Station Subsystem

Network Subsystem
15

GSM Network Architecture

AuC

OMC
RS-232 EIA Air Interface X.25 SS7 Mtce SS7 Call Proc

HLR
MAP MAP

EIR

BSS
BTS BSC

MS

X & Mtce C D R Voice SS7

VLR

HLR AuC EIR

MAP ISUP X.25

Other MSCs

MSC

Voice Path Signalling Path

PSTN

ETSI BRA Enhanced Service Node

Billing Centre 16

GSM Network Architecture

AuC

OMS
HLR EIR

Air Interface

BSS
BTS BSC

MS

X C D R

VLR

HLR AuC EIR

Other MSCs

MSC

Voice Path Signalling Path

PSTN

Enhanced Service Nodes

B&CCS

17

GSM Reference Model

G

A
Um
MS

OMC B

VLR D

VLR

Abis
BTS BSC MSC

HLR C F

AuC

E MSC PSTN ISDN EIR

18

Mobile Station
Mobile Station is really two distinct

entities. Mobile equipment or Mobile

terminal. SIM Card.

Mobile equipment, which is the actual

Hardware, is almost anonymous. SIM card, implemented as a smart card holds the subscriber information.
19

Mobile Terminal
Different terminals distinguished

principally by their power and application. Fixed terminals 20W Portable terminals for cars 8W Handheld terminals 2W Sophisticated terminals 0.8W Every terminal has an International Mobile Equipment Identity (IMEI).
20

The SIM
SIM provides Personal Mobility. Holds a unique identifier called

International Mobile Subscriber Identity (IMSI), Service profile, Secret key for authentication, etc. Provides user access to all subscribed services. SIM makes the terminal operational. Can be password protected by a 4 to 8 digit Personal Identification Number.
21

The SIM
SIM is classified on the basis of: Operating voltage. RAM capacity. Operating Voltages: 3V and 5V. RAM Capacity: 8K, 16K, 32K and 64K
22

System Architecture
Functional Architecture broadly divided into six parts:
Mobile Station. Base Station Subsystem (BSS). Network Switching Subsystem

(NSS). Operation and Maintenance Subsystem. Enhanced Services System

23

BSS Connectivity
BTS

BTS

BSC

XCDR

To MSC

BTS

24

Base Station Subsystem

BSS connects the MS and the NSS. Composed of three parts:

The Base Transceiver Station (BTS)

also called Base Station (BS) Transcoder and. Base Station Controller (BSC). BSS provides the radio interface functions. Completely digital.
25

Base Transceiver Station (BTS)

BTS houses the radio transceivers that

define a cell. Handles the radio-link protocols with the Mobile Station Each BTS can support a number of transceivers depending on the density of subscribers in the cell. Needs to be rugged, reliable, portable.
26

Base Station Controller

BSC manages the radio resources

for one or a group of BTSs. Handles radio-channel setup, frequency hopping, handovers, and control of the RF power levels. Establishes connection between the mobile station and the MSC.
27

System Architecture
Functional Architecture broadly divided into six parts:
Mobile Station. Base Station Subsystem (BSS). Network Switching Subsystem

(NSS). Operation and Maintenance Subsystem. Enhanced Services System

28

Network & Switching Subsystem

Manages the communication between

the mobile users and other users. Provides all the functionality needed to handle a mobile subscriber such as: Registration. Authentication and security. Location updating. Handovers and Routing to roaming subscribers.
29

Network & Switching Subsystem

Central component is the MSC

(Mobile Services Switching Centre). It performs the switching functions of the network. Gateway Mobile Services Switching Centre interfaces between the mobile network and PSTN.
30

Network & Switching Subsystem

Services provided in conjunction with four intelligent databases.
Home Location Register (HLR) Visitor Location Register (VLR) Authentication Centre (AuC) Equipment Identity Register (EIR)
31

Home Location Register

Contains all administrative

information of each subscriber registered in an GSM network. Logically there is one HLR per GSM/PLMN network. Can be implemented as distributed database also.
32

Home Location Register

International Mobile Subscriber Identity

(IMSI). Also in SIM of MS as IMSI/TMSI. Mobile Subscriber ISDN Number (MSISDN). Permanent copy of subscriber data. Mobile Station Roaming Number (MSRN), typically the CCS#7 SP code of the visited MSC/VLR.
33

Visitor Location Register

For managing originating and

terminating calls under its coverage area, each MSC need subscriber data held in HLR. To avoid high signalling load between MSCs and HLR, subscriber data are downloaded at registration and held in a local database called VLR.
34

Visitor Location Register

VLR Contains selected administrative information from HLR needed for call control and provision of subscribed services for each mobile located in the geographical area controlled by the MSC.
35

Visitor Location Register

In the canonical architecture, each VLR

corresponds to one MSC, even though a VLR can hold data for one or several MSCs of the same PLMN. Holds IMSI, MSRN, HLR copy (Sub data). Temporary Mobile Subscriber Identity (TMSI). Location Area Code (LAC) of MS.
36

Authentication Centre
A protected database used for security

purposes. Replicates the copy of the secret key (Authentication Key Ki) stored in each subscribers SIM card. Provides all the parameters needed for authentication and encryption over radio channels. Considered to be part of HLR.
37

Equipment Identity Register

A database that contains a list of all valid

mobile equipment in the network. Generates Valid, Suspect & Fraudulent lists of Mobile Equipment through the use of International Mobile Equipment Identity (IMEI). Forbid calls from unauthorised terminals (non-standard terminals)
38

System Architecture
Functional Architecture broadly divided into six parts:
Mobile Station. Base Station Subsystem (BSS). Network Switching Subsystem

(NSS). Operation and Maintenance Subsystem. Enhanced Services System

39

Operation & Support Subsystem

OMS comprises of : Operation and Maintenance Centre (OMC) for Radio OMC-R. OMC for Switch OMC-S Configures, controls and monitors

the GSM system. Controls the traffic load in BSSs.

40

OMC
The maintenance control point for all

network elements in a GSM system. Office Data Management. Operation and Administration. Data and Software storage for network elements. Traffic reporting and analysis. Must comply with TMN architecture.
41

Enhanced Services System

Unified Messaging Services (UMS) Voice Mail (VM) FAX Mail (FM) E-Mail (EM) Short Message Service (SMS) Wireless Application Protocol (WAP) Intelligent Network (IN)
42

Billing & Customer Care System

Mediation Device Interconnect Billing Subsystem Billing Subsystem

Rating Module Billing Module Roaming settlement subsystem Customer Service Module Order Management Module Smart Card Handling Module

Service Provisioning Subsystem Networking Subsystem Printing Subsystem

43

GSM Functions
GSM functions are broadly classified into 5 main functional Blocks: Transmission Radio Resources Management (RR) Mobility Management (MM) Communication Management (CM) Operation, Administration and Maintenance (OAM)
44

Spectral Allocation in GSM

890-915 MHz

UP

K IN L N LI N K

OW D

935-960 MHz

45

Interconnection of GSM Functions

Um
MS MS
CM MM RR LAPDm PHY RR LAPDm PHY BTSM LAPDm PHY BTSM LAPDm PHY BSSAP SCCP MTP

Abis
BTS BTS BSC BSC

A
MSC MSC
CM MM BSSAP SCCP MTP

46

Transmission
A combination of FDMA and TDMA is

used. 25MHz band divided into 125 carrier frequencies spaced 200KHz apart. One or more carrier assigned to each base station. Each carrier band divided using TDMA.
47

Transmission
Organisation of physical channels into

traffic and control channels. Speech coding (RPE-LPC) 13Kbps Channel coding and modulation Organisation of hierarchical multiframe structures. Burst structure and assembly. Multipath equalisation.
48

FDMA/TDMA Scheme
915

891.2 891.0 890.8 890.6 890.4 890.2 890.0 BP1 BP2 BP3 BP4 GUARD BAND BP5 BP6 BP7 BP8 BP1 BP2 SLOT

t
49

Logical Channel Architecture

P H Y S I C A L C H A N N E L S

Control channels (CCH) Traffic channels (TCH)

Paging Access User Speech/Data Associated control and Supervision

50

Logical Channel Architecture

P H Y S I C A L C H A N N E L S

Synchronisation (DL)

Broadcast Broadcast channels (BCH) channels (BCH) Common Control Common Control channels (CCH) channels (CCH) Traffic channels Traffic channels (TCH) (TCH)

Frequency Correction (DL) Broadcast Control(DL) Paging (DL) Access and Grant (BW) User Speech/Data Associated control and Supervision
51

Speech - Radio Waves Speech

Speech Coding Speech decoding Channel Coding Channel decoding

Interleaving

De-interleaving

Burst Assembling

Burst disassembling

Ciphering

De-ciphering

Modulation

De-modulation 52

Speech Coding
Analog to Digital conversion. RPE-LPC with long term predictor loop

based on the assumption that samples does not change very quickly. Speech divided into 20mSec samples, each of which is encoded as 260 bits. The total bit rate is 13Kbps.
53

Speech Coding
13Kbps coding is called the Full-Rate

speech coding. Enhanced Full-Rate (EFR) speech coding algorithms implemented in GSM1900 provide improved speech quality at 13Kbps. Half Rate codecs are available and can double RF channel capacity.
54

Channel Coding
260 bits classified as Class Ia 50 bits Most sensitive Class Ib 132 bits Moderately sensitive to bit errors. Class II 78 bits Least sensitive to bit errors Coding adapted to needs.
55

Channel Coding
Block Convolutional Codes
Used for basic error correction. Allows classical
decoding methods. Able to use soft information provided by modulation

Fire Codes

Used for error detection/correction for signalling.

Decoder can detect/correct errors in bursts.

Simple Codes

Used for error detection, for signalling and for

highly significant bits in the speech frames.
56

Frequency Hopping
915

891.2 891.0 890.8 890.6 890.4 890.2 890.0 GUARD BAND

BP1 BP2 BP3 BP4 BP5 BP6 BP7 BP8 BP1 BP2 BP3 BP4 BP5 BP6 BP7 BP8 BP1 BP2 BP3 BP4 BP5 BP6 BP7 BP8

57

Frequency Hopping
MS is frequency agile for transmit

and receive bursts. Slow frequency hopping to: Randomise the co-channel
interference effect. Alleviate multipath fading.

FH algorithm broadcast on BCCH.

58

Interleaving
Convolutional codes work better when

errors are evenly spread. Modulation and transmission are such that errors after demodulation tend to come in bursts. Interleaving avoids both proximity in the burst as well as in coding the data.
59

Interleaving
A code word (456 bits) on 4 bursts

Block rectangular interleaver. A code word on 8 half bursts Block diagonal interleaver. A complex interleaving used for high rate data (TCH/F9.6 and TCH/H4.8)

60

Burst Assembly
Hyperframe = 2048 Superframes
3 Hours 28 Minutes 53 Seconds and 760 milliseconds 0 2047

Superframe = 26 51 multiframes
6.12 Seconds 0 0 50 25

26 Multiframe
120 mS 0 1 2 24 25 0 1

51 Multiframe
Approx 235 mS 48 49 50

TDMA frame
4.615 mS

7
61

Organisation of Speech & Data

Frames 0-11 : TCH 0 1 2 3 4 5 6 Frames 12 : SACCH Frames 13-24 : TCH Frames 25 : Unused 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

26 frame multiframe Duration: 120 ms TDMA frame Duration: 60/13 ms =4.615 ms

BP 0 BP 1 BP 2 BP 3 BP 4 BP 5 BP 6 BP 7

3
Tail bits

57
Data bits

26

57
Data bits

3
Tail bits

8.25
Guard bits

Stealing Training Stealing sequence bit bit

Normal burst Duration 15/26 ms

62

Ciphering
Used to protect signalling and user

data. Ciphering Key (Kc) computed using algorithm A8 + Ki + RAND. Kc + Algorithm A5 + burst number 114 bits sequence. 114 bits sequence is XORed with two 54 bit blocks of data included in the normal burst.
63

Modulation and Demodulation

Gaussion-filtered Minimum Shift

Keying (GMSK). Modulation rate is 270 5/6 Kbauds for 270 5/6 Kbits. Minimised side lobes by limiting spurious emissions.
64

Modulation and Demodulation

Constant envelope Spectrum compactness and Demodulation performance Demodulation Equalisation Correct quality of reception with multipath spread upto 20Sec.
65

GMSK Modulator
GAUSSUAN MINIMUM SHIFT KEYING
COS Cos t

+
Cos( t+f)

Integration

Gaussian Filter

SIN

Sin t

66

Radio Resources Management

Channel Assignment Handover Frequency Hopping Power-level control Discontinuous Transmission Discontinuous Reception Timing Advance
67

Handover
Intra-cell handover Intra-BSC handover Inter-BSC/intra-MSC handover Inter-MSC handover Minimum acceptable performance Power budget algorithm
68

Discontinuous Transmission (DTX)

Speech activity only 40% of time. Needs Voice activity detection. Determination of voice threshold vis--vis noise. Annoying clicks/inefficient DTX. Generation of Comfort Noise at receiver to avoid the feeling of the set being dead.

69

Discontinuous Reception
Used to conserve mobile stations

power Paging channel divided into subchannels Assign specific sub-channel to each mobile station. Listen to the sub-channel Sleep until next sub-channel slot.
70

Timing Advance
BP0 BP1 BP2 BP6 BP7

BP2

BP7

BP0

71

Timing Advance
Mobiles at different distances from the

base station cause different delay for signal arrival at BS. Timing advance is to synchronise the arrival of signal at BS. BS measures the time delay and advise MS to advance the transmission of its bursts appropriately.
72

Power Control
BS while performing measurement of

timing also performs the measurement of the power level of each MS. Power control commands are send to mobiles to adjust the transmit power level of each mobile station so as to ensure that BS receives all the bursts almost at the same power.
73

Mobility Management (MM)

MM layer is built on top of the RR layer. Handles all functions arising out of the mobility of the subscriber. Handles authentication & security. Concerned with the procedures to know the current location of the powered-on mobile.

74

Network Areas in GSM

PUBLIC LAND MOBILE NETWORK (PLMN) AREA
MSC Area
Location Area

MSC Area
Location Area

Location Area Location Area

Cell

Location Area Location Area

Cell

75

Mobility Management (MM)

Hierarchical area for paging Page every cell Vs location update Reliability through periodic location

updating procedure. Trade off between signalling load and speed of recovery. IMSI attach and detach procedure

76

Authentication and Security

Is the user the one he claims to be Authentication involves: SIM in the mobile. Authentication Centre. Secret Key stored in SIM & AuC Generation of Signed Response by

both and verification.

77

Directory Number Allocation

MSC
LOCAL EXCHANGE

PSTN MSC

MSISDN

Used to refer home subscribers

MSRN

Used to refer roaming subscribers

78

Home Location Register (HLR)

MSISDN

x
IMSI

x
x

MSISDN IMSI MSRN Subscriber Data

79

Visitor Location Register (VLR)

MSRN

x
IMSI

x
TMSI

MSISDN IMSI MSRN LAC TMSI Subscriber Data

80

System Security
Equipment identity confidentiality. Data confidentiality User identity confidentiality.

81

Authentication and Security

Computation of Ciphering key Kc + FDMA FN + A5 generate 114 bits sequence XORed with burst data bits Interleaving, encoding enable further security Use of IMEI white, grey & black listed mobile terminals

82

Communication Management
Responsible for Call Control (CC) Supplementary Services Management Short Message Service Management Call control as per ISDN specification recommended in Q.931 Mobility & Roaming incorporated CC manage call setup, service mgt & call release
83

Call Routing
Mobile Subscriber ISDN number

defined by E.164 Numbering Plan. Call Routing involve: MSISDN MSRN IMSI TMSI
84

Numbering Plan
3
MOBILE COUNTRY CODE

2
MOBILE NETWORK CODE

Maximum 10 digits
MOBILE SUBSCRIBER IDENTIFICATION NUMBER

TMSI 1-3
COUNTRY CODE

1-3
NATIONAL DESTINATION CODE

Maximum 10 digits
SUBSCRIBER NUMBER

98 XYZ - ABCDE

MSISDN/MSRN
85

Numbering Plan
3
MOBILE COUNTRY CODE

2
MOBILE NETWORK CODE

4 Hex
LOCATION AREA CODE

4 Hex
TMSI

TMSI with in a LA 1-3

MCC

1-3
MNC

4 Hex
LAC

Flexible length CELL INDENTITY

GCI
86

Numbering Plan
6
TYPE APPROVAL CODE (TAC)

2
FINAL ASSEMBLY CODE(FAC)

6
SERIAL NUMBER (SNR)

1
SPARE (SP)

IMEI 3Bits PLMN Colour Code NCC BSIC

87

3Bits BS Colour Code BCC

Services Provided by GSM

Design objective is to have

interoperability with ISDN. Services provided are a subset of ISDN services. Support for various data services upto 9600 bps.
88

GSM Services
TELECOMMUNICATION SERVICES Bearer Services Teleservices

Supplementary Services

89

Classification of GSM Services

E1 introduced at the start of the service. E2 introduced at the end of 1991. Eh introduced on availability of half-rate

channels. A services that are optional.

90

Teleservices in GSM

Telephony (E1 & Eh). Facsimile Group 3 (E1). Emergency Calls (E1 & Eh). Teletex. Short Message Services (E1,E2 & A). Fax mail. Voice mail.
91

Bearer Services in GSM

300 to 9600 bps (E1) Asynchronous and synchronous data Alternate speech and data Asynchronous PAD access 2400-9600 bps (E2) Synchronous dedicated packet data
access

92

Supplementary Services (E1)

Call Forwarding Busy (CFB) Call Forwarding Unreachable (CFNRc) Call Forwarding No reply (CFNRy) Call Forwarding Unconditional (CFU) Barring of All Outgoing Calls (BAOC) Barring of Outgoing International Calls (BOIC) BOIC except those directed towards Home PLMN Country (BOIC-exHC) Barring of All Incoming Calls (BAIC)

93

Supplementary Services (E2)

Call Hold (CH) Call Waiting (CW) Advice of Charge (AoC) Multi-party service

94

Supplementary Services (A)

Barring of Incoming Calls while roaming Closed User Group (CUG) Calling Line Identification Presentation (CLIP) Calling Line Identification Restriction (CLIR)
Connected Line Identification Presentation (COLP)

Connected Line Identification Restriction (COLR) Operator Determined Barring

95

Fixed to Mobile Call Routing

HLR
MSISDN PST N MSISDN MSISDN MSRN

BSS BSS
IMSI/TMSI

MSC MSC

IMSI/TMSI

MSRN

IMSI/TMSI

VLR

96

Fixed to Mobile Call Routing

HLR
MSISDN MSISDN
MSRN

MSRN

MSC MSC
MSRN
(HOME) MSISDN

BSS BSS

MSISDN

PST N

MSRN
(VISITED)

IMSI/TMSI

MSC MSC
IMSI/TMSI

BSS BSS

IMSI/TMSI

MSRN

VLR
97

Call Management Request for

Service
MS MS
1

Um
BSS BSS Channel Request Dedicated Sig. Chl. assignment Service Request

A
MSC MSC

B
VLR VLR

3 4 5

Service Request Service Request

98

Call Management Authentication

B
MS MS
6 7 8 9 10 11 12 13

D
VLR VLR Get Auth parameters HLR HLR AuC AuC

MSC MSC

Authenticate Mobile Stn Authentication Response Authentication Response

99

Authenticate Mobile Stn

Get Auth parameters

Get Auth parameters Auth parameters

Call Management Ciphering

Um
MS MS
14

A
BSS BSS MSC MSC

B
VLR VLR Set Ciphering

15 16 17 18

Cipher Command Cipher mode Command Cipher mode Complete

Cipher mode Complete

100

Call Management Eqt Validation

F
MS MS
19 20

MSC MSC IMEI Request IMEI Response Check IMEI IMEI Check Results

EIR EIR

21

22

101

PSTN Call Setup with Mobile

Um
MS MS
Select best access CCH

A
BSS BSS Call setup Request MSC MSC

B
VLR VLR

Access Sub data Sub data

Validate

Call Proceeding TCH Assign

Tune to TCH

Assign TK & Radio

TCH Confirm

TK & Radio Confirm

102

PSTN Call Setup with Land NW

Um
MS MS BSS BSS

A
MSC MSC
Select OG Trunk

B
PSTN PSTN

Outpulse digits
Connect path

Alert Mobile Connect Connect ACK Answer

103

Incoming Call to Mobile Station

Um
MS MS
Listening on PCCH

A
BSS BSS MSC MSC

B
PSTN PSTN Incoming Call

Page
Tune to best ACCH

Page in LA

Validate

Ring Back

Page Response TCH Assign TCH Confirm Alert

Page Response Validate Set Up

MS Ring

Answer

Remove RBT Connect Path

104

Cellular Call Setup

Mobile Originated Call.
Key in the correct number to be dialled in
the cellular phone before connecting to the network. Press the send button to originate the call. Base station identifies the celfone and passes the information to the MSC. MSC sets up the call. When the called party answers, voice connection is completed.

105

Cellular Call Setup

Mobile Terminated Call.
Call arrives at the home MSC. MSC converts received digits to Mobile
identification number. Broadcast a paging message over the location area. Celfone recognises the page and responds. MSC selects an idle voice channel. Celfone switches to the assigned voice chl. Celfone alerted and RBT connected to caller. When Celfone answers, connection established.
106

Sanjay.walter.myrthong@e ricsson.com

Thanks

107