Section 0 Review of GSM Principles

GSM Architecture Overview

Air Interface (Um) Abis Interface A Interface

OMC

MS

BSS
MS
TRX

VLR HLR

BTS

BSC

MSC

AuC

MS
EIR

NSS

PSTN

GSM Mobile Terminal (MT)

Reference Points

Interface

Um

Interface

TA

SIM TE Mobile Terminal (MT) MS

ME

Base Station Subsystem

GSM Core Network

TE - Terminal Equipment TA - Terminal Adaptor MS - Mobile Station ME - Mobile Equipment SIM - Subscriber Identity Module

The Mobile Station (MS)

The mobile station consists of:
mobile equipment (ME) subscriber identity module (SIM)

The SIM stores permanent and temporary data about

The International Mobile Subscribers Identity (IMSI) MS ISDN number of subscriber

the mobile, the subscriber and the network, including:

Authentication key (Ki) and algorithms for authentication check

The mobile equipment has a unique International Mobile

Equipment Identity (IMEI), which is used by the EIR

The Base Station Sub-System (BSS)

The BSS comprises:
Base Station Controller (BSC) One or more Base Transceiver Stations (BTSs) provide radio access to the mobile stations manage the radio access aspects of the system
BTS

The purpose of the BTS is to: BTS contains: Radio Transmitter/Receiver (TRX) Signal processing and control equipment Antennas and feeder cables The BSC:

allocates a channel for the duration of a call maintains the call: monitors quality controls the power transmitted by the BTS or MS generates a handover to another cell when required

BSS

BSC
BTS

BTS BTS

Siting of the BTS is crucial to the provision of acceptable radio coverage

BSS Network Topologies

Chain: cheap, easy to implement
One link failure isolates several BTSs

BSC

Ring: Redundancy gives some protection if a link fails

More difficult to roll-out and extend ring must be closed

BSC

Star: most popular configuration for first GSM systems

Expensive as each BTS has its own link One link failure always results in loss of BTS

BSC

Network Switching System (NSS)

Key elements of the NSS:
Mobile Switching Centre (MSC) with:
Visitor Location Register (VLR) Home Location Register (HLR) with: Authentication Centre (AuC) EIR VLR MSC
PSTN/ISDN

GMSC SS7 Network AuC HLR

Equipment Identity Register (EIR) Gateway MSC (GMSC)

These elements are interconnected by means of an SS7 network

Mobile Switching Centre (MSC)

Functions of the MSC:
Switching calls, controlling calls and logging calls Interface with PSTN, ISDN, PSPDN Mobility management over the radio network and other networks Radio Resource management - handovers between BSCs Billing Information
VLR

MSC

Visitor Location Register (VLR)

Each MSC has a VLR VLR stores data temporarily for mobiles served by the MSC Information stored includes:
IMSI MSISDN MSRN TMSI LAI Supplementary service parameters
MSC VLR

Home Location Register (HLR)

Stores details of all subscribers in the network , such as:
Subscription information Location information: mobile station roaming number, VLR, MSC International Mobile Subscriber Identity (IMSI) MS ISDN number Tele-service and bearer service subscription information Service restrictions Supplementary services
HLR AuC

Together with the AuC, the HLR checks the validity and service
profile of subscribers

HLR Implementation
One HLR in a network May be split regionally Stores details of several thousand subscribers Stand alone computer - no switching capabilities May be located anywhere on the SS7 network Combined with AuC
AuC

HLR

Gateway Mobile Switching Centre (GMSC)

A Gateway Mobile Switching Centre (GMSC) is a device which
routes traffic entering a mobile network to the correct destination

The GMSC accesses the networks HLR to find the location of the
required mobile subscriber

A particular MSC can be assigned to act as a GMSC The operator may decide to assign more than one GMSC

GMSC

Equipment Identity Register (EIR)

EIR is a database that stores a unique International
Mobile Equipment Identity (IMEI) number for each item of mobile equipment
EIR

The EIR controls access to the network by returning the status of a

mobile in response to an IMEI query
White-listed Grey-listed

Possible status levels are:

The terminal is allowed to connect to the network. The terminal is under observation by the network for possible problems. The terminal has either been reported stolen, or is not a type approved for a GSM network. The terminal is not allowed to connect to the network.

Black-listed

GSM Network Interfaces

D C
HLR

MS

VLR

Um
MS
TRX

B Abis A
MSC

H
AuC

BTS

BSC

MS

BSS

F
EIR

NSS

P-GSM Spectrum (Primary GSM)

890 915 935 960 MHz

Uplink

Downlink Duplex spacing = 45 MHz

Range of ARFCN: 1 - 124

Fu(n)

1 2 3 4

n Guard Band 100 kHz wide

Guard Band 100 kHz wide

Channel Numbers (n) (ARFCN) 200 kHz spacing

E-GSM Spectrum (Extended GSM)

880 915 925 960 MHz

Uplink

Downlink Duplex spacing = 45 MHz

Range of ARFCN: 1 124 975 - 1023 Guard Band 100 kHz wide

Fu(n)

1 2 3 4

n Guard Band 100 kHz wide

Channel Numbers (n) (ARFCN) 200 kHz spacing

DCS - 1800 Spectrum

1710 1785 1805 1880 MHz

Uplink

Downlink Duplex spacing = 95 MHz

Range of ARFCN: 512 - 885

Fu(n)

1 2 3 4

n Guard Band 100 kHz wide

Guard Band 100 kHz wide

Channel Numbers (n) (ARFCN) 200 kHz spacing

1800 MHz Utilization in UK

The present distribution of frequencies among UK operator is:

1710 Uplink

1721.5

1751.5 Orange

1781.5 1785 DECT

MHz

Vodafone/ Cellnet Downlink 1805

One 2 One

1816.5 1846.5 One 2 One

1876.5 1880

MHz

DECT: Digital Enhanced Cordless Telecommunications

PCS - 1900 Spectrum

1850 1910 1930 1990 MHz

Uplink

Downlink Duplex spacing = 80 MHz

Range of ARFCN: 512 - 810

Fu(n)

1 2 3 4

n Guard Band 100 kHz wide

Guard Band 100 kHz wide

Channel Numbers (n) (ARFCN) 200 kHz spacing

Multiple Access Techniques

Purpose: to allow several users to share the resources of the air
interface in one cell

Methods:
FDMA - Frequency Division Multiple Access TDMA - Time Division Multiple Access CDMA - Code Division Multiple Access

Frequency Division Multiple Access (FDMA)

Divide available frequency spectrum into channels each of the same bandwidth Channel separation achieved by filters: Guard bands between channels Signalling channel required to allocate a traffic channel to a user Only one user per frequency channel at any time Used in analog systems, such as AMPS, TACS Limitations on: frequency re-use number of subscribers per area
channel bandwidth Frequency

Good selectivity

User 1 User 2 User 3 User 4 User 5

Time

Time Division Multiple Access (TDMA)

Access to available spectrum is limited to timeslots User is allocated the spectrum for the duration of one timeslot Timeslots are repeated in frames

Frequency

Signalling

Signalling

User 3

User 6

User 1

User 2

User 4

User 5

User 7

User 6

User 1

User 2

User 3

User 4

User 5

Frame

Timeslot

Time

User 7

GSM Channels
GSM defines two fundamental channel types:
Physical Channels:
the individual channels carried by a radio frequency carrier Each carrier comprises 8 time-separated channels

Logical Channels:
time-dependant virtual channels carried on a single physical channel one physical channel may support one or multiple logical channels

GSM Physical Channels

GSM employs both FDMA and TDMA at the Air Interface Each BTS may comprise a number of TRXs, with the carrier of each TRX operating on a different frequency (FDM) Each GSM carrier supports 8 time-separated physical channels (TDMA) Each physical channel is allocated to a specific timeslot on the carrier A group of 8 timeslots on a carrier is known as a TDMA frame

1 frame period 4.615 ms 0 1 2 3 4 5 6 7

timeslot = 0.577 ms

GSM Logical Channels

Two types of logical channel are defined; traffic and control channels Each is further sub-divided as shown:
Traffic Traffic Control Control

TCH TCH

BCH BCH

CCCH CCCH

DCCH DCCH

TCH/F TCH/F TCH/H TCH/H

FCCH FCCH SCH SCH BCCH BCCH

PCH PCH RACH RACH AGCH AGCH CBCH CBCH

SDCCH SDCCH SACCH SACCH FACCH FACCH

Traffic Channels (TCH)

One physical channel (1 timeslot) can support:
1 TCH/F or 2 TCH/H

TCH/F: 13 kb/s voice or 9.6 kb/s data TCH/H: 6.5 kb/s voice or 4.8 kb/s data

Uplink / Downlink Synchronisation

The MS transmit burst is delayed by 3 timeslots after the BTS burst.. This delay allows enables: Use of the same UL and DL timeslot number in TDMA frame Avoids simultaneous Tx/Rx requirement Allows for timing advance (TA) Allows time to switch between Tx and Rx

BTS transmits: 0 1 2 3 4 5 6 7

MS transmits: 5 6 7 0 1 2 3 4

Broadcast Channels (BCH)

BCH channels are all downlink and are allocated to timeslot zero. BCH channels include:

FCCH: Frequency control channel sends the MS a burst of all 0 bits

which acts as a beacon and allows MS to fine tune to the downlink frequency and time-synchronise.

SCH: Synchronisation channel enables TDMA-Frame number

synchronisation by sending the absolute value of the frame number (FN), together with the BTSs BSIC such as radio resource management and control messages, Location Area Code etc.

BCCH: Broadcast Control Channel sends network-specific information

Common Control Channels (CCCH)

CCCH contains all point to multi-point downlink channels (BTS to several MSs) and the uplink Random Access Channel:

RACH: Random Access Channel is sent by the MS to request a resources from the network e.g. an SDCCH channel for call setup. AGCH: Access Grant Channel is used to allocate a dedicated channel (SDCCH) to the mobile. PCH: Paging Channel sends paging signal to inform mobile of a call. CBCH: Cell Broadcast Channel is an optional GSM Phase II implementations for SMS broadcast messages, for example road traffic reports or network engineering messages.

Dedicated Control Channels (DCCH)

DCCH comprise the following bi-directional (uplink / downlink) point to point control channels:

SDCCH: Standalone Dedicated Channel is used for call set up,

location updating and also SMS

SACCH: Slow Associated Control Channel is used for link

measurements and signalling during a call

FACCH: Fast Associated Control Channel is used (when

needed) for signalling during a call, mainly for delivering handover messages and for acknowledgement when a TCH is assigned

Logical Channels
Multiframes provide a way of mapping the logical channels on to the
physical channels (timeslots)

A logical channel is a series of consecutive instances of a particular timeslot

Time 0 1

TDMA Frame 2 3 4 5 6 7 0 1

TDMA Frame 2 3 4 5 6 7 0 1

TDMA Frame 2 3 4 5 6 7

Logical Channel

1 1

1 1

A multiframe is a repeating combination of logical channels

Traffic Channel Multiframe

The TCH multiframe consists of 26 timeslots. This multiframe maps the following logical channels:
TCH SACCH FACCH

TCH Multiframe structure:

T 0

T 1

T 2

T 3

T 4

T 5

T 6

T 7

T 8

T 9

10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

T = TCH S = SACCH I = Idle FACCH is not allocated slots in the multiframe. It steals TCH slots when required.

Control Channel Multiframe

The control channel multiframe is formed of 51 timeslots CCH multiframe maps the following logical channels:
Downlink: FCCH SCH BCCH CCCH (combination of PCH and AGCH) Uplink: RACH

Downlink
F
0

F = FCCH
CCCH 6-9

S = SCH
CCCH 42-45

I = Idle
CCCH 46-49

S
1

BCCH 2-5

F
10

S
11

CCCH 12-15

CCCH 16-19

CCCH 22-25

CCCH 26-29

F
30

S
31

CCCH 32-35

CCCH 36-39

F
40

S
41

I
50

20 21

RACH

Uplink

Multiple Signalling Channel Configurations

In a non combined multiframe, up to 7 of the 9 blocks may be reserved for AGCH:

BCCH

CCCH

CCCH

CCCH

CCCH

CCCH

CCCH

CCCH

CCCH

CCCH

In a combined multiframe, up to 2 of the 3 blocks may be reserved for AGCH:

BCCH

CCCH

CCCH

CCCH

SDCCH 0

SDCCH 1

SDCCH 2

SDCCH 3

SACCH 0

SACCH 1

Additional CCCH capacity can be provided on other timeslots (TS 2,4 or 6) of the BCCH carrier if required The number of AGCH blocks reserved is indicated to the MS in the system information messages that the MS reads on the BCCH

Frame Hierarchy
1 timeslot = 0.577 ms 0 1 2 3 4 5 6 7 1 frame = 8 timeslots = 4.615 ms

Multiframe:

= 26 TCH Frames (= 120 ms) or 51 BCCH Frames (= 235 ms) = 26 BCCH Multiframes (= 6.12s) or 51 TCH Multiframes (= 6.12s)

Superframe:

Hyperframe:

= 2048 Superframes (= 3 hr 28 min 53.76 s)

TRAU Configurations
Um
BTS Site
CCU CCU TRAU
64kbps 64kbps

Abis
BSC Site

MSC Site

16kbps

BTS Site
CCU CCU
16kbps

BSC Site
TRAU

MSC Site

B
64kbps

16kbps

BTS Site
CCU CCU
16kbps

BSC Site

MSC Site
TRAU
16kbps 64kbps

CCU

Channel Coding Unit

MSC Node

BSC Node

Air Interface Layer Functions

Speech and Data Layer 3 Signalling CC MM RR Layer 2 CC: Call Control MM: Mobility Management RR: Radio Resources Signalling CC MM RR Speech and Data

Build frames Request acknowledgement

Reconstruct frames Send acknowledgement

Layer 1

Channel coding Error protection Interleaving RF modulation

Error correction De - interleaving Equalization RF demodulation

Radio waves

GSM Voice & Channel Coding Sequence

Speech Coding 8000 Hz sampling

13-bit resolution Quantization 2080-bit (20ms) blocks (note 1) RPE-LTP Speech Coder

8000x13bits = 104 kbps

22.8 kbps 456-bit blocks

Channel Coding

Interleaving

GMSK Modulation 156.25-bit bursts Radio Burst Multiplexing Radio Interface

Channel Coding 260-bit blocks 13 kbps

note 1: 160 samples of 13 bits per 20ms

Encryption

Speech Coding

GSM transmits using digital modulation - speech must be converted to binary digits Coder and decoder must work to the same standard Simplest coding scheme is Pulse Code Modulation (PCM)
Sampling every 125 s Requires data rate of 64 kbps

This is too high for the bandwidth available on the radio channels

1.2 1 0.8 0.6 0.4 0.2 0 -0.2 -0.4 -0.6 -0.8 -1

PCM
Sample analog signal at 8 kHZ Digital pulse train at 64 kbps

Advanced Speech Coding

We cannot send the 64 kbps required by PCM We need alternative speech encoding techniques Estimates are that speech only contains 50 bits per second of information Compare time to speak a word or sentence with time to transmit corresponding text Attempts to encode speech more efficiently: speech consists of periodic waveforms so just send the frequency and amplitude model the vocal tract - phonemes, voiced and unvoiced speech Vocoder - synthetic speech quality

yahoo

GSM Voice Coding Sequence

Speech Coding 8000 Hz sampling

13-bit resolution Quantization 2080-bit (20ms) blocks (note 1) RPE-LTP Speech Coder

8000x13bits = 104 kbps

22.8 kbps 456-bit blocks

Radio Interface GMSK Modulation 156.25-bit bursts

Channel Coding

Interleaving

260-bit blocks 13 kbps

note 1: 160 samples of 13 bits per 20ms

Channel Coding

Encryption

Radio Burst Multiplexing

Speech Digitisation

8000 samples per second

8000 samples per second x 13 bits per sample = 104kbps per second Divided into 20mS blocks = 2080 bits per block

8192 (213) quantisation levels

GSM Channel Coding

Speech Coding 8000 Hz sampling

13-bit resolution Quantization 2080-bit (20ms) blocks (note 1) RPE-LTP Speech Coder

8000x13bits = 104 kbps

22.8 kbps 456-bit blocks

Radio Interface GMSK Modulation 156.25-bit bursts

Channel Coding

Interleaving

260-bit blocks 13 kbps

note 1: 160 samples of 13 bits per 20ms

Encryption

Radio Burst Multiplexing

GSM (TCH/F) Channel Coding

260 bits 50 Class 1a bits 132 Class 1b bits 78 Class 2 bits (side information)

189 bit block coding

53 bits

Inc 3 parity bits

132 bits

4 tail bits

d de co un

x2

-rate convolution encoder

378 convolution encoded bits

78 non-encoded bits

456 bits

Block Interleaving
Speech Coding 8000 Hz sampling

13-bit resolution Quantization 2080-bit (20ms) blocks (note 1) RPE-LTP Speech Coder

8000x13bits = 104 kbps

22.8 kbps 456-bit blocks

Radio Interface GMSK Modulation 156.25-bit bursts

Channel Coding

Interleaving

260-bit blocks 13 kbps

note 1: 160 samples of 13 bits per 20ms

Encryption

Radio Burst Multiplexing

Interleaving - Effects of Burst Noise

Non Interleaved Channels:
1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8

Noise burst
1 1 1

Channel 1 Channel 2 Channel 3

Interleaved Channels:
1 1 1 2 2 2 3 3 3 4 4 4 5 5 5 6 6 6 7 7 7 8 8 8

Noise burst

Interleaving

Channel Coder

Channel Coder

456 bits
1 2 3 4 5 6 7 8 1 2 3

456 bits
4 5 6 7 8

(8 x 57 bit blocks)

1 11

2 22

3 33

4 44

55

66

7 7

GSM Burst Multiplexing

Speech Coding 8000 Hz sampling

13-bit resolution Quantization 2080-bit (20ms) blocks (note 1) RPE-LTP Speech Coder

8000x13bits = 104 kbps

22.8 kbps 456-bit blocks

Radio Interface GMSK Modulation 156.25-bit bursts

Channel Coding

Interleaving

260-bit blocks 13 kbps

note 1: 160 samples of 13 bits per 20ms

Channel Coding

Encryption

Radio Burst Multiplexing

Radio Burst Multiplexing

456 bits
1 2 3 4 5 6 7 8 1 2 3

456 bits
4 5 6 7 8

(8 x 57 bit blocks)

1 11

2 22

33

44

55

66

77

57 data bits

26 training bits

57 data bits

8.25

1 burst = 156.25 bit periods (0.577mS)

Types of Data Burst

The 156.25 bit periods of a timeslot can hold different types of data burst:
Stealing flag bits

Normal Burst (Traffic and most control channels)

57 Data Bits

26 Training Bits

57 Data Bits

8.25

Frequency Correction Burst (FCCH) Data and tail bits are all 0 Synchronisation Burst (SCH) Data to synchronise MS with BTS Dummy Burst
Transmitted on BCCH carrier when there are no other bursts - allows power level measurements

142 fixed bits 64 Training Bits Sync Sequence 26 Training Bits 41 Training Bits

8.25

39 Data Bits

39 Data Bits

8.25

8.25

Access Burst (RACH) Long guard period to avoid collisions

36 Data Bits

68.25

Tail bits

Guard period

GSM Modulation
Speech Coding 8000 Hz sampling

13-bit resolution Quantization 2080-bit (20ms) blocks (note 1) RPE-LTP Speech Coder

8000x13bits = 104 kbps

22.8 kbps 456-bit blocks

Radio Interface GMSK Modulation

Channel Coding

Interleaving

156.25-bit bursts 260-bit blocks 13 kbps

note 1: 160 samples of 13 bits per 20ms

Channel Coding

Encryption

Radio Burst Multiplexing

GSM Voice/Channel Coding Summary

Speech 20ms Block 20ms Block 20ms Block (2080 bits per block)

Speech Coder

Speech Coder

RPE-LTP encoding

13kbps

260 bits

260 bits

Channel Coder

Channel Coder

Block and convolution encoding

22.8kbps
1 2

456 bits
3 4 5 6 7 8 1 2

456 bits
3 4 5 6 7 8

8 x 57-bit blocks

Interleaving
1 11 2 22 3 33 4 44 5 55 6 6 6 7 7 7 8 8

3 57 data bits 1

26 training bits

1 57 data bits 3

8.25

1 burst = 156.25 bit periods (0.577mS)

Mobile-Initiated RR Connection Setup

Mobile
Channel Request Channel Request Channel Request AGCH RACH RACH RACH Immediate Assignment

BSS

Network-Initiated RR Connection Setup

Mobile
PCH Channel Request

BSS
Paging Request RACH

AGCH

Immediate Assignment

RR Connection Release
Initiated by network only Reasons could include:
End of a call Too many errors Removal of channel in favour of higher priority call

MS waits for a short random period and returns to idle state

Mobile
SDCCH
Short random delay Return to idle state

BSS
Channel Release

Handover Types
There are four different types of handover in the GSM system, which involve transferring a call between:
Internal

Channels (time slots) in the same cell Cells within the same BSS (same BSC) Cells in different BSSs (different BSCs) but under the control of the same MSC Cells under the control of different MSCs
BSC VLR MSC BSC

BSC

External

GSM handovers are hard i.e. mobile only communicates VLR with one cell at a time MSC

Handover Causes
Handover can be initiated by either MS or MSC Handover decision is based on the following parameters (in
priority order):
Received signal quality Received signal strength Distance of MS from BTS Drops below power budget margin

Each parameter has a operator-defined threshold and

handover decisions can be based on one or a combination of the parameters

Handover Command Message

Structure of the message sent to MS by original BSS:
MS
Handover Command

Message Type Cell Description Handover Reference Power Command

BSS

Channel Description

Includes Frequency Hopping information if required

Frequency List or Mobile Allocation

Non - Frequency Hopping

Frequency Hopping

Handover Margin

Handover to BTS 1

Handover to BTS 2

BTS 1

Mobile remains with BTS 1 or BTS 2

BTS 2

Nominal cell boundary

Hysteresis due to handover margin

Example of Handover Signalling

Signalling for a basic Inter-BSC handover involving only one MSC (Intra MSC):
MS
Measurement report Measurement report Measurement report Measurement report Handover Required Handover Request Acknowledgement Handover Command Handover Access Physical Information Handover Complete Handover Complete Clear Command Measurement report Clear Complete Measurement report Handover Command

BSS 1

BSS 2

MSC

Handover Detection

Network Areas
Cell: radio coverage area of one base station (BTS) GSM assigns a cell global identity number to each cell

Location Area: Group of cells served by one or more BSCs. When there is an incoming call, the mobile is paged throughout its location area. A unique Location Area Identity (LAI) is assigned to each LA.

MSC Service Area: part of network covered by one MSC. All mobiles in this area will be registered in the VLR associated with the MSC. PLMN Service Area: public land mobile network area - the area served by one network operator

MS Mobility States
A Mobile Station (MS) can be in one of three mobility states: MS turned off MS turned on in idle mode MS turned on in dedicated mode

MS Network Connection Sequence

Power on Scan RF channels Select highest carrier level Scan for FCCH frequency correction burst

Select next highest carrier level NO

NO

FCCH detected?

YES SCH detected? Scan for SCH synchronisation burst

YES

camp-on to BCCH and start decoding

Monitor PCH and adjacent carriers

IMSI Attach

Mobile camps on to best serving BTS Mobile sends IMSI to MSC MSC/VLR is updated in HLR Subscriber data including current location area is added to local VLR
VLR MSC BSC

MSC and HLR carry out authentication check Optionally EIR checks for status of mobile
(white/grey/black)
AuC HLR

challenge and response using Ki

EIR

IMSI Detach

Explicit:
Mobile informs MSC it is switching off HLR stores last location area for mobile VLR records that mobile is no longer available on network Mobile powers down
BSC

Implicit
VLR forces IMSI Detach due to no response
AuC HLR

VLR MSC

Location Update Options

Send location update on every cell change

No paging requirement Excessive signalling traffic load

Page every cell in network

No location update reuqirement Excessive signalling traffic load Requires paging procedure with reduced traffic load Required location updating with reduced traffic load

Subdivide network into paging areas

Location Updates

BSC BSC

Location Area Change Periodic Location Update IMSI Attach Cell change during call TMSI update on LA change
VLR MSC VLR MSC

BSC

Au C

HLR

TMSI Re-allocation
Used to protect a subscribers IMSI TMSI only unique within a Location Area (LA) Outside an LA, TMSI must be combined with LAI to remain unique TMSI re-allocated on LA change (minimum) or as a result of an
exceptional condition.

Normally takes place in encrypted mode Normally tales place in conjunction with another procedure e.g. Location
update, call setup etc

Mobile Originated Call

When the mobile requests access to the network to make a call:
BSS determines the nature of the call - e.g. regular voice call, emergency call, supplementary service

Allocates radio resources to the mobile for the call

NSS determines the destination of the call:
Mobile to mobile on same PLMN Mobile to mobile on another PLMN Mobile to fixed network (PSTN, ISDN)

MSC / GMSC routes the call appropriately and handles signalling

Mobile-Originated Call Setup

Mobile
Channel Request Channel Request
Radio Resource Connection

BSS
RACH RACH RACH Immediate Assignment LAPDm Connection Setup

Channel Request AGCH

SDCCH Service Request

Unnumbered Acknowledgement SDCCH

Mobile-Terminated (Network-Originated) Call

BSS

VLR

3 4 6 10 5

HLR

8 8 9 12 8 9 12 8

7 11
MSC

2 1 PSTN

BSS

GMSC

BSS

Network-Initiated Call Setup

Mobile
PCH Channel Request

BSS
Paging Request RACH

Radio Resource Connection

AGCH

Immediate Assignment

LAPDm Connection Setup Paging Response SDCCH SDCCH Unnumbered Acknowledgement

General Authentication Procedure

AuC MS BSS Access Request [IMSI] Send Authentication info [IMSI] MSC HLR

MS
Ki RAND

HLR/AuC
RAND Ki

A3
SRES2

A3
SRES1 Authentication & ciphering Request SRES1 SRES1/RAND [RAND] Send Authentication info Ack [IMSI, Triplet (RAND SRES1 Kc)]

SRES2

Authentication & ciphering Response [SRES2]

MSC

User Data Encryption

Benefits of user data encryption include:
Provides confidentiality for user data across air interface Selection from seven encryption algorithms

Capability is mandatory for MS and network Implementation is optional Does not provide for end-to-end encryption

General GSM Encryption Procedure

MS
Ki

BTS

MSC

AuC
RAND Ki

A8
Kc Data Kc Data

A8
Kc

A5

A5

Encrypted Data

2.5 Generation GSM

Evolution of GSM towards 3G systems Main requirement is for increased data rates Mobile access to:
Internet E-mail Corporate networks
n tio a er en G .5 38.8 kb/s 2
14.4 kb/s HSCSD

3rd Generation
UMTS ECSD 69.2 kb/s 384 kb/s 2 Mb/s

EDGE
GPRS

EGPRS

21.4 kb/s

9.6 kb/s

CSD SMS

2nd Generation

Circuit Switched Packet Switched

HSCSD

Increases bit rate for GSM by a mainly software upgrade Uses multiple GSM channel coding schemes to give 4.8 kb/s, 9.6 kb/s or 14.4 kb/s per timeslot Multiple timeslots for a connection e.g. using two timeslots gives data rates up to 28.8 kb/s Timeslots may be symmetrical or asymmetrical, e.g. two downlink, one uplink, giving 28.8 kb/s downloads but 14.4 kb/s uploads.

Maximum data rate quoted as 115 kb/s = 14.4 x 8

HSCSD Mobile Equipment

HSCSD handsets are typically limited to 4 timeslots, allowing: 2 up / 2 down (28.8 kb/s in both directions) 3 down and 1 up (43.2 kb/s down 14.4 kb/s up)

This limitation arises because the handset operates in half duplex and needs time to change between transmit and receive modes Nokia cardphone (PCMCIA card for laptops) uses HSCSD (Orange network) - quotes data downloads at 28.8 kb/s

GPRS
General Packet Radio Service Packet switching:
Data divided into packets Packets travel through network individually Connection only exists while packet is transferred from one node to next When packet has passed a node, the network resources become available for another packet
Data packet

User sees an always on virtual

connection through the network

PCU Circuit/Packet Data Separation

Visited MSC/VLR Circuit Switched A Gateway MSC

PSTN

BTS

BSC PCU
Gb Packet Switched Serving GSN

HLR

Gateway GSN

PDN

GPRS Air Interface

New Packet logical channels defined - PBCCH, PDTCH etc. New multiframe structure based on radio blocks of 4 timeslots Allows up to 8 mobiles to share a timeslot For high data rates, several physical channels may be allocated to one user 4 levels of channel coding schemes (CS-1 to CS-4): Decreasing level of error checking Greater data throughput rates
Data throughput

Scheme selected according to interference level (C/I)

CS-4 CS-3 CS-2 CS-1

C/I

Using Spare GSM Capacity

Timeslot Usage

GPRS can use traffic capacity on the GSM network away from the busy hour for non time critical data transfers Even during the busy hour, there is spare capacity that GPRS can make use of:
Voice calls start and finish at random times, leaving short periods when channels are unused Packets of data can be sent when these channels become available - dynamic allocation

Maximum Capacity Available for GPRS Available for GPRS

Circuit Switched Demand

0
Ti m es lot s

24

Time (hours)

Timeslots

Time

Time

Charging for GPRS Services

GPRS allows the user to be always connected - charging by time is not appropriate Some possible methods of charging are:
By volume of data transferred Flat rate for Internet access By Quality of Service For content - operator may provide own pages (value added services) Service Precedence (priority) Reliability Delay Throughput
Internet

Quality of Service parameters:

EDGE
(0,1,0)

Enhanced Data rates for GSM Evolution

Use 8 Phase-Shift Keying (8PSK) modulation - 3 bits per symbol Improved link control allows the system to adapt to variable channel quality - leads to slightly reduced coverage area

(0,1,1) (0,0,1) (0,0,0) (1,0,0)

(1,1,0) (1,1,1) (1,0,1)

Applied to GSM, EDGE allows a maximum data rate of 48 kb/s per timeslot, giving the quoted figure of 384 kb/s per carrier (8 timeslots)

EDGE can be applied to HSCSD (ECSD) and GPRS (EGPRS) EDGE will be expensive for operators to implement:
Each base station will require a new EDGE transceiver Abis interface between BTS and BSC must be upgraded