Chapter Three

Second Generation Systems

 It was recognized in early 80s that there are many
limitations with the 1-G cellular mobile systems
such as:
Capacity limitations.
Quality degradation.
Incompatibility between systems.
Security problems.
There are many mobile systems emerged as a
second generation of the cellular mobile
communication industry as illustrated in Table 3.1;
Table 3.1 : Second generation mobile radio systems.

Frequency Speech
Multiple
Country range coder
System Access
(MHz) (kb/s)
GSM Worldwide 900/1800/ 1900 13 / 5.6 TDMA
D-AMPS US, Canada 800 / 1900 7.95 TDMA
JDC or
Japan 900 / 1500 6.7 TDMA
PDC
US, Canada,
IS-95 800/1700 / 1900 9.4 / 13 CDMA
Eastern Asia
In North America, analog mobile networks
continued to be used for some time before 2-G
networks, with GSM being one of the technologies
used, were introduced.
Unfortunately, however, the 900 MHz as well as
the 1800 MHz band were already in use by other
systems and thus the North American regulating
body chose to open frequency bands for the new
systems in the 1900 MHz band and later on in the
850 MHz band. The disadvantage of this approach
is that many US GSM mobile phones cannot be
used in Europe and vice versa.
Unlike the American 2-G goals, which focused
primarily on seamless integration into the already
extensively deployed AMPS system, GSM was
designed with standardization and roaming as the
key features, with no need to be backward
compatible. GSM uses 200 kHz and CDMA uses
1.2288 MHz, so channel numbers refer to the
center frequency of the carrier. While Europe
converged on a single standard, the United States
split from its original AMPS to time-division
multiple access (TDMA) and CDMA, keeping, and
in some cases even expanding and improving, the
existing analog AMPS networks as illustrated in
figure 3.1.
 Figure 3.1 Second generation systems
GSM system is the most popular one, so an
overview of the GSM system is provided.
3.1 GSM System
The European Community decided the best
option was to start from scratch. It was decided to
adopt a Pan-European digital mobile system. Its
objectives can be summarized as;
Development of a unified international standard
for mobile communications.
Pan-national roaming {the user can change
location, keep connection and be reached in the
entire system range}.
Huge capacity.
Digital encryption techniques (Safeguarding from
interception and subscriber license fraud as well
as data protection).
 Noise and interference robust (Significant
improvement of transmission quality).
Enhanced range of services (data + voice).
Less expensive equipment with a wide range of
possibilities for use.
Low power consumption.
Lightweight, compact, pocket size terminals.
TDMA digital transmission.
Flexibility and compatibility with other networks
such as Integrated Services Digital Network,
ISDN.
In 1982, the Committee of European Post &
Telecoms, CEPT recommended 2 25 MHz
frequency block in the 900 MHz frequency band
for mobile communication.
Group Special Mobile, GSM was established by the
CEPT. In 1987, the essential elements of wireless
transmission are specified and different technical
aspects such as sub-systems, network components,
signaling, test and maintenance aspects, etc. were
devised.
In 1989 ETSI assumed responsibility for GSM, it
was decided that GSM would be released in phases
to put the specifications in action and activation of
GSM networks as shown in figure 3.2.
Figure 3.2 GSM Phases
GSM Services
The primary objective of the GSM system is to allow
mobile subscribers to communicate effectively. The ETSI
standards define the GSM network telecommunication
services in the same way as ISDN. There are two main
types of telecommunications services given in figure 3.8:

PSTN
PLMN

MS

Bearer Services

Teleservices

Figure 3.8: GSM services.

Phase 1 (GSM900, GSM1800 and GSM1900),
consisting of a limited set of common services and
international roaming also incorporated features
such as ciphering and Subscriber Identity Module
(SIM) cards as in Table.
Subscriber Identity Module (SIM) is a memory
device storing ID, networks or countries for
services, privacy keys, etc.
 GSM Phase 1 Services
Category Services Comments
Tele-services Telephony (Speech) Full-rate, 13 kbps
Emergency calls (Speech)
Short-message: point-to-point Alphanumeric inform.,
and P-to-MP (cell broadcast) (U-to-U, N-to-all U)
Tele-fax Group 3
Bearer services Asynchronous data 300 - 9.6 kbps
Synchronous data
Asynchronous POAD (packet
switched, P.Ass/disass. access)
Alternate speech/data

Supplementary Call forwarding User busy, no answer

Services All calls, international
Call barring
 GSM Phase 2 Services
Category Services Comments
Tele-services Telephony Half-rate 6.5 kbps
Short-message Service
Bearer Synchronous dedicated packet 2.4 - 9.6 kbps
services data access
Supplement Calling/connected line identity
ary presentation
services Calling/connection line identity
restriction
Call waiting
Call hold
Multiparty communication Conference call
Closed user group
Advice of charge On-line information
Operator barring
Basic telecommunication services
These are services which are available to all
subscribers in a mobile network. For example, the
ability to make voice telephone calls is a basic service.
Supplementary services
These are additional services that modify or
supplement a basic telecommunication service. They
are available by subscription only. Call forwarding is
an example of a supplementary service.
The basic telecommunication services can be sub-
divided into two main categories:
Teleservices Bearer services
 The Teleservices
They are telecomm. services including terminal
equipment functions that provide comm. between
users; they are user end-to-end services. Teleservices
of GSM offer the complete range of comm. services
between users. The most important categories of
teleservices are represented by voice services
(TS11/12), Short Message Service (SMS: TS21-23),
Teletext (TS51) and Fax transmission (TS61/62).
Voice Services
Voice services had to be implemented by each
operator in the start-up phase by 1991.
This is normal telephony (two-way voice comm.)
with the ability to make and receive calls to/from
fixed and mobile subscribers worldwide.
For transmission of digitally coded signals, both
services use a bidirectional, symmetric, full-
duplex point-to-point connection, which is set up
on user demand.
The regular telephone service TS11 sets up speech
calls between a mobile subscriber (PLMN) and a
fixed network subscriber (ISDN/PSTN) or other
PLMN subscriber.
The emergency service TS12 sets up speech calls
between a mobile subscriber (PLMN) and one in
an emergency service central office which is
allocated to a respective location.

The emergency call function enables a subscriber

to make an emergency call by pressing a
predefined button or by using the emergency
number. With an emergency area origin identifier,
the call is automatically routed to the emergency
center nearest to the subscriber. Emergency calls
can be made by a subscriber without a valid SIM-
card.
Short Message Service, SMS
The capability TS21 and TS22 to receive or send
short messages at MS was supposed to be offered
from 1996 on all GSM networks.
The function TS21 is the point-to-point version of
the SMS, which allows a single station to be sent
(i.e., receive) a message of up to 160 characters.
With TS22, it is possible send short message from
the mobile station.
For SMS, the network operator has to establish a
service center which accepts short messages from
the fixed network or mobile stations and processes
them in a store-and-forward mode.
The transmission of short messages uses a
connectionless, protected, packet-switching
protocol.
The reception of a message must be acknowledged
by the MS or the service center; in case of failure,
retransmission occurs.
TS21 and TS22 are the only teleservices which can
be used simultaneously with other services, i.e.,
short messages can also be received or transmitted
during an ongoing call.
A further variation of the SMS is the Short
Message Service Cell Broadcast, SMSCB TS23.
With the SMSCB service, it is possible to receive
messages of a length up to 93 alphanumeric
characters from a Cell Broadcast Center in a
limited region of the network.
Classically described as "paging", messages on
different topics concerning a particular area can
be received (e.g. traffic; meteorological; stock
information, etc.).
These messages can only be received by MSs in
idle mode, and reception is not acknowledged.
A MS itself cannot send SMSCB messages.
Fax Transmission
As Teleservice for the second implantation phase,
implementation of transparent fax service TS61 for
Group 3 fax was planned.
Because standard fax machines are designed to be
connected to a telephone using analog signals, a
special fax converter is connected to the exchange.
This enables a connected fax to communicate with
any analog fax in the fixed network.
Alternative Speech/Fax
This service allows the subscriber to alternate
between speech and fax within one call setup. The
subscriber can start the call either with speech or
fax and then alternate (several times) between the
two call types within the same call.
The bearer services
The bearer service provides the fundamental
technical facilities at the end terminal interface to
transport user payloads (speech and data as digital
information) . It does not include the end-user
equipment. Every tele-service is associated with a
bearer service.
These services are called transport services or
bearer services as in ISDN and therefore in GSM,
too. The GSM bearer services offer asynchronous
and synchronous data transport capabilities with
circuit-switched or packet-switched data rates of
0.3-9.6 kbps, with a 13 kbps bearer service for
voice.
Bearer services carry only the coding- and
application-independent information transport
between the user-network interfaces. The
application itself is not included in this definition.
The GSM systems offer a wide range of bearer
services include:
Traffic to PSTN
For data traffic external to PLMN such as
internetworking with ISDN or directly to PSTN.
Traffic to ISDN
An entire set of data communication services with
ISDN terminals is available. Unrestricted digital
information is transferred and no modem is
necessary.
Traffic to Packet Switched Public Data Networks
(PSPDN)
This packet service supports synchronous data
transfers with the PSPDN.
With synchronous data transfers a packet mode
terminal can be directly connected to the MS.
Asynchronous data communication between an MS
and a packet switched network is possible via the
Packet Assembler-Dis-assembler, (PAD facility).
Traffic to Circuit Switched Public Data Networks,
(CSPDN)
Data communications with a CSPDN is possible via
the PSTN or ISDN.
Traffic to Internet
The direct access function enables an MSC to
communicate directly with Internet nodes, thus
reducing call set-up time.
ISDN Primary Rate Access, PRA
This function enables an MSC to provide PRA
services to subscribers.
3.4-3 Bearer and teleservices of GSM Phase 2+
Whereas GSM Phase 2 defined essentially a set of
new supplementary services, Phase 2+ is also
addressing new bearer and teleservices. The new
speech and data services significantly improve the
GSM transmission quality and make the utilization
of available radio resources much more efficient.
Improved Codecs for Speech Services
One of the most important services in GSM is voice
service which has to be further improved.
In first place is the development of new speech
codecs with two competing objectives:
better utilization of the frequency bands
assigned to GSM and
improvement of speech quality in the direction
of the quality offered by ISDN networks, which
is primarily requested by professional users. In
1990, the Phase 1 GSM900 specifications (1987-
1990) were closed and cannot be modified.
In 1991, the first GSM networks {P-GSM900 of
225 MHz duplex BW} are launched 890 - 915
MHz (UL) and 935 - 960 MHz in the (DL) as shown
in figure 3.3. The BW of 25 MHz is split into 125
channels with a BW of 200 kHz each.
Figure 3.3 Uplink and downlink in the 900 MHz frequency band

In addition to GSM networks that operate in the

900 MHz frequency band, so-called Personal
Communication Networks, PCN and Personal
Communication Systems, PCS are in operation.
They are using new frequencies around 1800 MHz,
and in NA around 1900 MHz. Apart from the
peculiarities that result from the different
frequency range, PCN/PCS networks are full GSM
International roaming among these networks is
possible based on the standardized interface
between mobile equipment and the SIM card.
In 1992, GSM has changed its name to the Global
System for Mobile Communications for marketing
reasons. Also the E-GSM 900 was introduced with
235 MHz band.
It soon became apparent that the number of
available channels was not sufficient to cope with
the growing demand in many European countries.
Therefore, the regulating bodies assigned an
additional frequency range for GSM which uses the
frequency band from 1710 -1785 MHz (UL) and
1805-1880 MHz (DL) known as DCS, (GSM 1800).
Instead of a total BW of 2x25 MHz as in the 900
MHz range, the 1800 MHz band offers 2x75 MHz
of BW which corresponds to 375 additional
channels those commence to open mobile
communications to all sections of population as a
mass market especially in urban areas.
The frequency bands of GSM is shown in Table 3.3.
While GSM was originally intended only as a
European standard, the system soon spread to
countries in other parts of the globe. In countries
outside Europe, GSM sometimes competes with
other technologies, such as CDMA. Today, only a
few countries, like Japan and South Korea, are not
covered by GSM systems.
However, some of the operators in these countries
operate WCDMA UMTS networks.
Table 3.3 GSM frequency bands
System P-GSM 900 E-GSM 900 GSM(DCS) GSM(PCS)
1800 1900
UL (MS BS) 890 915 MHz 880 915 MHz 1710 1785 MHz 1850 1910 MHz
DL (BS MS) 935 - 960 MHz 925 - 960 MHz 1805 - 1880 MHz 1930 - 1990 MHz

Wavelength 33 cm 33 cm 17 cm 16 cm
Bandwidth 25 M Hz 35 M Hz 75 M Hz 60 M Hz
Duplex distance 45 M Hz 45 M Hz 95 M Hz 80 M Hz
Carrier separation 200 k Hz 200 k Hz 200 k Hz 200 k Hz
Number of 124 174 374 299
carriers
Channel rate 270.8 k bps 270.8 k bps 270.8 k bps 270.8 k bps
Therefore, GSM/UMTS subscribers with dual-
mode phones can also roam in these countries.
Note that the bearer services in GSM Phase 1 are
restricted to a maximum of 9,600 baud per second.
The additional supplements to full implementation
of all the planned services and network features
were called GSM Phase 2 features were activated in
GSM networks in 1994. Table 3.4 gives an overview
of the services available in GSM Phase 2 which also
includes supplementary services. Additional
features were introduced in GSM phase 2 including
additional data communications capabilities.
In 1995, the phase 2 standardization was closed.

Table 3.4
GSM Phase 2
services
In addition, the first GSM (PCS) 1900 Network is
launched in the USA with 260 MHz band. In 1997,
GSM phase 2+ refers to a smooth transition to new
complete update of GSM standards. Beyond GSM
Phase 2, an implementation by the standardization
groups known as Phase 2+ are intended to be
updated on a regular basis according to market
needs and the availability of specifications.
The phase 2+ program cover multiple subscriber
numbers and a variety of business oriented
features. Some of the enhancements offered by
Phase 2+ include:
 Multiple service profiles
Private numbering plans
Access to Centrex services
Inter-working with GSM 1800, GSM 1900 and the
DECT standard
Priorities and time schedules for new features and
functions depend primarily on the interest shown
by operating companies and manufacturers and
technical developments in related areas.
Further Standardization (I)
* New bearer services and data-related
improvements
HSCSD (high-speed circuit-switched data)
14.4 kbps (single-slot) data
GPRS (general packet radio service)
EDGE (enhanced data rates for global
evolution)
* Speech-related
EFR (enhanced full-rate) speech codec
AMR (adaptive multi-rate) codec
TFO (tandem free operation)
3.1-1 GSM Network Architecture
In this section we briefly examine the different
components that together make up a GSM
network. Many of these components are common to
any cellular network; however, a few are peculiar
to GSM. A block diagram showing the simplified
hierarchical structure of the GSM public land
mobile network (PLMN) is given in figure 3.4,
where PLMN is divided into three subsystems.
 O
M
C C
Um
H
L
Abis Asub R
BTS A
B
S TRAU AUC
C
MS
BTS M
B
V
BSS
S L
R

F
C
E
E I
R

M
BSS
S
GMSC
C

PSTN
ISDN
PSDN

Figure 3.4: Components of the GSM system and its interfaces.

 The Radio Subsystem, RSS
The Network Switching Subsystem, NSS
The Operation Subsystem, OSS
The Operation and Maintenance Center for
BSS, OMC-B
The Operation and Maintenance Center for
NSS, OMC-S
The basic sub-systems are identified and its air
interface specifications are addressed.
3.1-1.1 The Radio Subsystem, RSS
It includes the following equipments;
The Mobile Station, MS
The MS is the physical equipment used by the
subscriber to gain access to GSM network. It is the
interface between the user and the mobile system.
The MS Consists of a mobile equipment ME, and a
smart card SIM as shown in figure 3.5.
Mobile Equipment, ME
It is the terminal used by the user. The ME may
be purchased from any store.
Without SIM, the ME can only make emergency
calls.
The ME has an International Mobile Equipment
Identity, IMEI that uniquely identifies the MS
internationally and gives clues about the
manufacturer and the date of manufacturing.

MS

ME SIM

Figure 3.5 The components of MS.

The ME includes the radio equipment and man-
machine interface.
With the aid of the data stored in the SIM card,
the speech is digitized, compressed, secured
against loss of data (through redundancy and
interleaving), encrypted to prevent interception
and modulated into the radio frequency, RF
created by the MS. Directly after, the signal is
amplified and transmitted. At the receiver, the
process runs inversely.
Subscriber Identity Module, SIM smart card
It is an electronic micro-ship for storing
information about the subscription.
It must be purchased from the GSM network
operator.
The SIM card carries the subscriber-related
information and codes, so that a GSM
subscriber with a SIM card can use different
ME.
The main task of the SIM is the storage of data:
permanent and temporary administrative data
as well as data concerning security.
The Base Station System, BSS
It consists of a BSC and one or several
BTSs, as;
 Base Transceiver Station, BTS
A BTS is the module which contains the RF
transmission equipment for radio coverage of
an individual cell.
It has a limited control functionality and
handles the actual radio transmission to and
from the MS.
 It consists of one or several transceivers with
a maximum of 16. It has one BS Identity
Code, BSIC that defines the cell among 64
neighboring cells to enable MS to distinguish
between different BSs.
It has one international Cell Global Identity,
CGI which uniquely defines the cell as seen
from the GSM network.
Several BTSs are located at the same site.
A BTS encompasses all applications
concerning radio transmission (sending,
receiving), as well as the air interface specific
signal processing.
 The BTS is connected via the proprietary
Abis interface with the BSC and via Um
open interface to the MSs.
The Base Station Controller, BSC
It carries out all control functions in the
BSS and therefore represents the heart and
central element of the BSS. The BSC controls
call set-up and operation of BTS. Usually, 20-
30 BTS will be controlled by one BSC that is
responsible for:
Paging
The BSC sends paging messages to the BTSs
defined within the desired location area.
The Location Area (LA)

It is a group of cells that has an identity (LAI).

The cells of a specific LA may be controlled by one or
more BSC, but never belong to different MSC areas.
Purposes of configuring LAs are:
1- Paging
2- Location update.

Location Area
The MSC Service Area
It comprises a number of LAs.
Geographical part of net controlled by one MSC.
Subscribers of the MSC is stored in HLR.

LA_2

LA-2

LA-1
MSC VLR
LA-3
The PLMN Service Area
Entire set of cells served and administered by one network operator.
In one country there may be several PLMN service areas,
one for each operator's network.
Several PLMN service areas can overlap.

LA_2
LA-2
LA_
LA-1
1
MSC VLR
LA-3
The GSM Service Area
Entire geographical area in which a subscriber can gain access to
a GSM network.
Usually, the GSM service area spans dozens of countries across
the world.
International roaming is the term applied when as MS moves from
one PLMN to another.

One per operator

Cell

Location area
MSC service area
PLMN service area
GSM service area
Location Update

56
 Evolution Vs. Time
Functionality
& capabilities
UMTS
capable systems

WCDMA
2 Mbps
EDGE
384 kbps

GPRS
115 kbps
Packet
Switched
HSCSD
57.6 kbps
Circuit
Switched
Circuit
data
9.6 kbps

Speech
Time
1997 1998 1999 2000 2001 2002

Fig 9-1 GSM Data Rates Evolution

57
Channel allocation
The BSC decides upon a call request which channel
will be assigned to the MS and informs the MS.
Dynamic power control in MS and BTS
The BSC calculates adequate MS and BTS output
power based on the received measurements of the
uplink and downlink. This is sent to the BTS and
the MS every 480 ms to maintain good connection
quality.
Locating the MS
The locating function continuously evaluates the
radio connection to the MS, and, if necessary,
suggests a handover to another cell.
Handover
The BSC decides which cell to handover to
and begins the handover process.
Frequency Hopping
The hopping between frequencies is
controlled by the BSC.
Trans-coding and Rate Adaptation Unit,
TRAU
The primary functions of a TRAU are to
perform trans-coding (speech
compression/decompression) and adaptation
of data to the requirements of the air interface
(rate adaptation).
It handles the rate adaptation between the
fixed and mobile parts. It lies between the A
and Asub interfaces.
Transcoding defines the compression of
Speech information from the 64 kb/s ISDN
B-standard format on the A interface to a
GSM speech coding rate of 13 / 12.2 / 5.6
kb/s in the case of full rate/enhanced full
rate, EFR/ half rate, HR, respectively.
 A decompression process is carried out in the
reverse path before they are passed to the
MSC.
3.1-1.2 The Network Switching Subsystem,
NSS
It includes the following equipments;
Mobile Service Switching Center, MSc
The primary node in a GSM network is the
MSC that provides the interface between the
mobile and fixed network.
It represents the gateway to other networks such as
PSTN, PSDN, ISDN, ..etc. It switches the calls
between MSs and between MSs and PSTN.
The MSC is an electronic ISDN computerized
exchange designed for the mobile network. MSC
will not contain subscribers parameters as these
are contained in the VLR associated within the
MSC. The functions of MSC include:
Charging
The MSC contains functions for charging mobile
calls and information about particular charge rate
to apply to a call at any given time or for a given
destination.
It collects call billing data and send them to the
billing center.
Switching and call routing
The MSC controls call set-up, supervision and
release and may interact with other nodes to
successfully establish a call. This includes routing
of calls from MSs to other networks such as a
PSTN.
Communication with HLRs and VLRs
Communication with other MSCs
Control of connected BSCs
The MSC controls the group of BSSs connected
with it through their primary BSS node: BSCs.
 Home Location Register, HLR
The HLR is the reference centralized database
that stores and manages all mobile subscribers
parameters (data) belonging to a specific operator
registered in its area.. It acts as a permanent store
for a persons subscription information until that
subscription is cancelled. The parameters stored in
HLR are:
Subscriber identification numbers, IMSI,
MSISDN
Subscriber current location information, i.e.
MSC/VLR
Subscriber supplementary services.
Addresses.
 Subscriber authentication information.
Temporary MS roaming number, MSRN
Visitor Location Register, VLR
It contains data on all mobile subscribes visiting
its MSC service area.
The role of a VLR is to act as a temporary storage
location for subscription information for MSs
which are within a particular MSC service area.
Each VLR controls a certain set of location areas.
When an MS roams from one location area to
another, his current location is automatically
updated in his VLR.
The additional information stored in VLR are:
Mobile status (busy/free/no answer, etc.
 Location area identity, LAI
Temporary MS identity, TMSI
MS roaming number, MSRN
Supplementary service information.
The Authentication Center, AUC
It handles confidentiality and security facilities
with the system. It is a processor system that
performs the authentication function. It is usually
co-located with the HLR for continuous access and
update. It provides information which is then used
by an MSC/VLR to perform the subscriber
authentication to ensure that no unauthorized users
can access the network, including those which are
attempting to impersonate others. It helps in radio
information ciphering by generating the cipher key
Kc; the MS can only decipher information intended
for itself. The information provided by the AUC is
called a triplet. As shown in figure 3.6, it consists
of:
A non-predictable RANDom number, RAND
A Signed RESponse, SRES
A ciphering key, Kc
 Authentication Center (AUC)

IMSI
Random Data-base
Number IMSI, Ki
Generator

Algorithm Algorithm Request for

A3 A8 triplets from
HLR/VLR

Triplets

RAND SRES Kc
Triplet

Figure 3.6 Generation of the triplets in authentication center.

1- When the VLR recognizes the need for an
authentication, it requests a set of triplets from
the HLR
2- The triplets are generated in the AUC and sent
via HLR to the VLR.
3- The VLR sends the RAND (unencrypted) to the
MS via the MSC and its BSS. The SIM card
calculates the SERS using ki, A3 and RAND.
4- The MS sends the SERS (unencrypted) back to
the VLR.
The VLR compares the SERS in the triplet with the
SERS calculated by the MS. If they are coincide,
the network access will be authorized and the
general procedure will continue.
5- Otherwise, the access will be refused and the
Authentication Refused, message will be sent
to the MS
Prerequisites for authentication and ciphering
The AUC and the SIM store the following data:
IMSI, International Mobile Subscriber Identity
Ki, Individual secret key assigned at the
subscription time
A3, Algorithm for the creation of authentication
parameters
A8, Algorithm for the creation of ciphering
parameters.
- At the subscription time, each subscriber is
assigned a subscriber secret individual key ki.
- The AUC stores ki along with the subscribers
IMSI.
- The same ki and IMSI are also stored in the SIM
card.
- Furthermore, the algorithm A5, that is necessary
for ciphering, is stored in the mobile equipment.
- This algorithm can be found in the BTS, also.
ME
AUC SIM-card
A5, IMSI,
IMSI, Ki,
IMEI
A3, A8 Ki, A3
Authentication and Ciphering Parameters
(Triplets)
When a subscriber is added to a home network for
the first time, a subscriber authentication
individual secret key ki is assigned in addition to
the IMSI to enable the verification (authentication)
of the subscriber identity.
At the network side, the key ki is stored in the
AUC of the home PLMN
At the subscriber side, it is stored on the SIM
card of the subscriber.
The triplets are the parameters being necessary
for authentication and siphering.
They are produced in the AUC and consists of:
RAND; a non-predictable RANDom number.
SERC (Signed RESponse); the reference value
for the authentication.
Kc (Cipher Key); key necessary for ciphering.
 The Equipment Identity Register, EIR
It contains information on all MS equipment in
the system. Because the subscriber and
equipment are separate in GSM, it is necessary
to have a separate authentication process for the
MS equipment. The EIR is a centralized
database for validation of the international
mobile equipment identity, IMEI to ensure that a
mobile terminal which has been stolen is not able
to access the network. EIR database contains 3
lists:
White list for those assigned valid MS equipment.
Black list for those reported stolen or to be denied
service.
Gray list for mal-performance equipment (e.g.,
faulty software).
3.1-1.3 The Operation and Maintenance Center,
OMC
It is a central element to control and monitor other
network elements (BSS, switches, database, etc.)
as well as monitor the quality of service being
provided by the network. OMC is split into two
main functional areas:
Operations and maintenance center - switching
part, OMC-S
It manages switching functions within the network.
Operations and maintenance center Radio part,
OMC-R, manages BSS functions of the network.
The OMC should support the following functions:
Event/alarm/fault management.
Performance management.
Configuration management.
Security management.
GSM Radio Interface
GSM adopts a TDMA technique with 8 channels
per carrier. There are 124 radio carriers in a
paired band of 25 MHz for the P-GSM900 system.
The data rate is 270.833 kb/s per carrier where
the carrier bandwidth is 200 kHz. The TDMA air
interface structure is shown in figure 3.7.
The GSM air interface has the following
specifications:
The bit rate of the radio carrier is 270.833 kbps.
Bit duration = 1/270.833 = 3.69 sec.
A single time slot corresponds to the duration of
156.25 bits.
The duration of a time slot = 156.25 3.69 sec
= 0.577 msec.
The duration of the frame = 0.577 8 = 4.615 msec.
 4.615 msec

0 1 2 3 4 5 6 7

HB SF Training SF TB
Data Data
Sequence

3 57 1 26 1 57 3

148 bits

156.25 bits

0.577 msec

Figure 3.7: GSM frame structure.

One physical channel is made up of the recurrence
of one particular time slot on each frame. This
structure is applied to both uplink and downlink.
The numbering scheme of the time slots is
staggered by 3 time slots as displayed in figure 3.9
to remove the necessity for the MS to transmit and
receive at the same time. Data is transmitted in
bursts which are placed in time slots.
The length of the burst is slightly shorter than the
duration of time slot. This is to allow for:
burst alignment errors,
the time dispersion on the propagation path, and
 the time required for smooth switch on-off the
transmitter.

0 1 2 3 4 5 6 7 0 Uplink

0 1 2 3 4 5 6 7 0 Downlink

Figure 3.9: Time slots in uplink and downlink are staggered.

The normal burst, as shown in figure 3.8 consists of
148 bits that are transmitted at a rate of 270.833
kbps. These bits comprise 114, i.e., (57+57) bits
being available for data transmission in addition to
34 remaining bits being used to assist reception and
detection. The remaining 34 bits compose of:
3 head bits, HB
3 tail bits, TB
These tail bits are transmitted at either end of the
burst for equalizing edge bits with those in the
middle as start and end of burst indicator.
2 stealing flags, SF
The stealing flags (1+1 bits) comprise one bit at
each end of the training sequence.
These bits are used to indicate that a burst which
had initially been assigned to a traffic channel has
been stolen for signaling purposes.
26 training sequence.
These training sequence bits are transmitted in the
middle of the burst. They are used by the receiver
to synchronize and estimate the propagation
characteristics. This allows setting up of an
equalizer to compensate for time dispersion
produced by multi-path propagation.
Basic GSM Radio Channel Structure
GSM technology is a combination of FDMA and
TDMA. Its standard is based on a multi-carrier,
TDMA and FDD, MC/TDMA/FDD. The first GSM
systems (P-GSM) used FDMA technique to divide
the allocated frequency spectrum, 25 MHz of BW
in the 900 MHz band into 124 carrier frequencies
spaced one from each other by a 200 kHz. Each
frequency is then divided using a TDMA scheme
into eight timeslots, as given in figure 3.11
The use of separate timeslots for transmission and
reception simplifies the electronics in the mobile
units.
Multi-frame Structure
Each channel combination requires one single
physical channel. Multi-frame structure made of
a defined number of TDMA fames allows logical
channels to be ordered into time slots.
26-multiframe structure is used for the traffic
channel combinations and 51-multiframe
structure is used for signaling combinations.
Traffic Channel Frame Structure
(26-Multiframe)
For combination I (TCH/FS), the first 12 fames for
traffic data (speech & data), 13rd frame for
SACCH, another 12 frames for traffic, and the last
frame idle for MS to measure etc. 120 ms
totally.
For combination II or III (TCH/HS), 2 half-rate speech
channels are packed onto one 26-multiframe structure.
One logical channel uses every other TDMA frame. Frame
13 for SACCH1 and 26 for SACCH2.
Combination II for one half-rate channel and III for two
half-rate channels.
FACCH may take a position of traffic channel if
Signaling Frame Structure(51 Multi-frame)
not carrying any user data.
more complex as incorporating 4 different
channel combinations and structures.
GSM Radio Subsystem
GSM uses a combination of TDMA and
FHMA, and FDD.
200 kHz wide channels called ARFCNs
(absolute radio frequency channel numbers)
Each ARFCN pair is separated by exactly
45 MHz with 3 time slots spacing.
Channel data rate 270.833 kbps using
BT= 0.3 GMSK.
GSM Traffic Channels (TCH)
Full rate speech at 13 kbps with channel coding
added to 22.8 kbps
Full rate data for 9600/4800/2400 bps. With
FEC, data is sent at 22.8 kbps.
Half-rate speech at 6.5 kbps and can carry up to
11.4 kbps
Half-rate data at 4800/2400 bps.
 960 MHz
959.8 MHz 124
123 0 1 2 3 4 5 6 7

Downlink
3 200 kHz
2
935.2 MHz 1
935 MHz

20 MHz

915 MHz
914.8 MHz 124
123 0 1 2 3 4 5 6 7
45 MHz
separation
Uplink
3 200 kHz
2
890.2 MHz 1
890 MHz

Figure 3.11: Duplexing of carrier frequencies in P-GSM 900. system.

Spectrum Allocation (GSM 900)
Downlink 935 960 MHz

Uplink 890 915 MHz

200 KHz

890.2 890.6
Uplink
1 121
1 2 3 4 121 122 123 124

890 890.4 915 F (MHz)

1 121

935.2 935.6
Downlink

1 2 3 4 121 122 123 124

935 935.4 960 F (MHz)

GSM 900 Frequency Allocation

95
GSM systems operate in the 900 MHz and 1.8 GHz
bands throughout the world with the exception of
the Americas operate in the 1.9 GHz band.
The carrier spacing is 200 kHz allowing, for 124
and 374 radio frequency channels in the 900 and
1800 MHz bands respectively, thus leaving a guard
band of 200 kHz at each end of the sub-bands.
Each radio frequency is time divided into TDMA
frames of 4.615 ms. Each TDMA frame is
subdivided into eight time slots.
Each of these slots can be assigned to a full-rate
(FR) traffic channel (TCH), two half-rate (HR)
TCHs or one of the control channels.
A slot is one time slot on one frequency. The time
and frequency structure is in figure 3.12. The data
transmitted in one slot is denoted as a burst. There
are five different types of bursts:
the normal burst, the access burst, the frequency
correction burst, the synchronization burst and the
dummy burst.

Figure 3.12 the

multiple access
schemes in GSM
The format and information of the individual
bursts depends on the type of channel it belongs to.
Channels can be described at two levels: at the
physical and the logical level. A physical channel
corresponds to one timeslot on one carrier, while a
logical channel refers to the specific type of
information carried by the physical channel.
Different kind of information is carried by different
logical channels, which are then mapped or
multiplexed on physical channels.
Logical channels can be divided into two groups:
control channels and traffic channels.
Traffic channels are used to carry user data, which
can be either speech or data.
A logical traffic channel for speech and circuit-
switched data in a GSM is called a TCH, which can
be either full rate (TCH/F) or half rate (TCH/H).
A logical traffic channel for packet-switched (PS)
data is referred to as packet data traffic channel
(PDTCH).
The full-rate traffic channel (TCH/F) is a 13-kbps
coded speech or data channel with a raw data rate
of 9.6, 4.8 or 2.4 kbps. The half rate supports 7, 4.8
and 2.4 kbps.
The TCH channels support bi-directional
transmission in order to carry speech and data
communication.
A PDTCH/F corresponds to the resource allocated
to a single MS on one physical channel for user
data transmission. Because of the dynamic
multiplexing on to the same physical channel of
different logical channels, a PDTCH/F using
GMSK modulation carries information at an
instantaneous bit rate ranging from 0 to 22.8 kbps.
A PDTCH/F using 8-PSK modulation carries
information (including stealing symbols) at an
instantaneous bit rate ranging from 0 to 69.6 kbps.
These bit rates will then be mapped into certain
user payload depending on the channel coding
scheme applied.
A PDTCH/H corresponds to the resource allocated
to a single MS on half a physical channel for user
data transmission. The maximum instantaneous bit
rate for a PDTCH/H is half that for a PDTCH/F.
All packet data traffic channels are unidirectional,
either uplink (PDTCH/U), for a mobile-originated
packet transfer or downlink (PDTCH/D) for a
mobile-terminated packet transfer.
Signaling and controlling information is carried on
the other type of logical channels, the control
channels. In GSM, there are common as well as
dedicated control channels.
The GSM specifications describe which physical
channels to use for each logical channel.
Several combinations of the different channels are
possible. Figure 3.13 shows the organization of the
TCH/F speech channel and the corresponding slow
associated control channel (SACCH). This 26-
frame multi-frame only considers one timeslot per
TDMA frame.

Figure 3.13 Organization of TCH

and the corresponding channels
Of the 26 frames, 24 are used for traffic. One frame
is used for the SACCH channel, while the last one
is an idle frame. During this idle frame time
interval period, a mobile can receive other control
channels and measure the received signal level
from neighboring cells. The complete GSM frame,
timeslot and burst structure is shown in figure 3.14.
Transmitting and Receiving Chain
Figure 3.15 shows the transmitting and receiving
chain of a GSM receiver. Several successive
operations have to be performed to convert a
speech signal into a radio signal and back.
Figure 3.14 Time
frames, timeslots
and bursts in GSM
The following operations take place on the transmitting side

Figure 3.15
Flow diagram
of the link
operation
 Source coding. Converts the analogue speech signal
into a digital equivalent.
Channel coding. Adds extra bits to the data flow.
This way redundancy is introduced into the data
flow, increasing its rate by adding information
calculated from the source data, in order to allow
detection or even correction of bit errors that might
be introduced during transmission.
Interleaving. Consists of mixing up the bits of the
coded data blocks. The goal is to have adjacent bits
in the modulated signal spread out over several data
blocks.
The error probability of successive bits in the
modulated stream is typically highly correlated,
and the channel coding performance is better when
errors are de-correlated.
Therefore, interleaving improves the coding
performance by de-correlating errors and their
position in the coded blocks.
Ciphering. Modifies the contents of these blocks
through a secret code known only by the MS and
the BS.
Burst formatting. Adds synchronization and
equalization information to the ciphered data.
Part of this is the addition of a training sequence.
Modulation. Transforms the binary signal into an
analogue signal at the right frequency. Thereby
the signal can be transmitted as radio waves.
The receiver side performs the reverse operations
as follows:
Demodulation. Transforms the radio signal
received at the antenna into a binary signal.
Today most demodulators also deliver an estimated
probability of correctness for each bit. This extra
information is referred to as soft decision or soft
information.
Deciphering. Modifies the bits by reversing the
ciphering code.
De-interleaving. Puts the bits of the different
bursts back in order to rebuild the original code
words.
 Channel decoding. Tries to reconstruct the source
information from the output of the demodulator,
using the added coding bits to detect or correct
possible errors, caused between the coding and
the decoding.
Source decoding. Converts the digitally decoded
source information into an analogue signal to
produce the speech.
In GSM the data bits are coded. The channel
coding introduces redundancy into the data flow by
increasing the bit rate. For the TCH/FS mode,
there are three bit-coding classes. The class 1a bits
have a 3-bit cyclic redundancy check (CRC) and all
class 1 bits are encoded by a convolution code.
The class 2 bits remain unprotected. Note that the
coding is different in case of a PDTCH, which is
used to carry packet switched data.
The reordering and interleaving process mixes the
encoded data block of 456 bits, and groups the bits
into eight sub-blocks (half bursts). The eight sub-
blocks are transmitted on eight successive bursts
(interleaving depth equals 8).
3.1-3 GSM Capacity Analysis
Cell planning is to decide the location and
capacity of each new BS to cover increased traffic
demand. It causes cell splitting in urban area and
requires new cell sites in suburban area.
The capacity of a BS has a great improvement due
to the digital modulation, multiple access schemes
and other technological development. AMPS
employs the FDMA technique. It utilizes 50 MHz of
spectrum in the 800 MHz band. Each channel band
of AMPS is 30 kHz. Assuming two competing
carriers in the market, a carrier has 416 channels.
Twenty one channels are used for control and the
rest for traffic channels.
For 7-cell reuse pattern, 56 traffic channels are
available per cell. It corresponds to a BS capacity
of 46 Erlangs when PB is 2%.
GSM uses TDMA with two bands of 25 MHz for
forward and reverse links. The frequency band is
divided into 200 kHz wide channels called ARFCNs
(Absolute Radio Frequency Channel Numbers).
Each channel is time shared between eight
subscribers using TDMA. Since each radio channel
consists of 8 time slots, there are thus a total of
1000 traffic channels within GSM. In practical
implementations, a guard band of 100 kHz is
provided at the upper and lower ends of GSM
spectrum, and only 124 channels are implemented.
By assuming two companies as in AMPS, each
carrier has 62 channels. Assuming the 4-cell reuse
pattern, a BS can use 120 time slots. This
corresponds to 107.4 Erlangs when the blocking
probability is 2 %.