GSM (Global System for Mobile Communication)

 GSM or Global System for Mobile Communications (originally called Groupe

Special Mobile), is a standard developed by the European Telecommunications
Standards Institute (ETSI) for second generation digital cellular networks.

 GSM employs a combination of TDMA (Time Division Multiple Access) and

FDMA (Frequency Division Multiple Access) as the access method.

 The specifications were expanded over time to include packet data transport via
GPRS (General Packet Radio services) for access to the Internet. Packet data
transmission speeds were subsequently improved with EDGE (Enhanced Data rates
for GSM Evolution).

 GPRS provides 12.0KBps per TS, while EDGE provides 22.4KBps per TS. In a
BTS, two or three time slots are reserved for Data.

 The GSM standards further evolved with the specifications of the third generation
UMTS standard developed by the 3GPP, which employs WCDMA as the access
method, specifies a higher Band Width, thus improving upon the Data Speed and
providing a host of many new services, like, Video Calls, Faster Internet browsing,
Video Streaming and mobile TV. 1
GSM Radio Frequency Specifications
 Three bands of operation :
GSM 900
GSM 1800
GSM 1900 (used in USA)

 BSNL operates in the GSM900 & 1800 band.

 GSM 900 has its up-link and down-link frequencies in the 900MHz band :
Up-link frequency band : 890MHz to 915MHz (25MHz BW)
Down-link frequency band : 935MHz to 960MHz (25MHz BW)

 The 25MHz up-link and down-link frequency band is divided into 125 RF
Channels or radio carriers with an inter-carrier spacing of 200KHz.

2
 GSM900 Up-link & Down-Link Frequency Band

200KHz

890MHz 915MHz 935MHz 960MHz

0 124 0 124
BW = 25MHz BW = 25MHz
125 Channels of 200KHz BW 125 Channels of 200KHz BW

Pair of an Up-Link and a Down-Link Frequency - ARFCN 3

 ARFCN (Absolute Radio Frequency Channel Number)
 Absolute Radio Frequency Channel Number (ARFCN) is a Number given to
pairs of the Up-link and Down-link Frequencies, 0 through 124.

 One ARFCN corresponds to a pair of an Up-link frequency and a Down-link

frequency 45MHz apart.

 BSNL has been allotted 31 such ARFCNs in the GSM 900 band.

45MHz
890MHz 915MHz 935MHz 960MHz

0 124 0 124

ARFCN 0 ARFCN 1 ARFCN 124

4
ARFCNs allotted to BSNL ARFCN
FREQUENCY IN MHz

Uplink Downlink

63 902.6 947.6

64 902.8 947.8

66 903.2 948.2

67 903.4 948.4

68 903.6 948.6

69 903.8 948.8

70 904.0 949.0

71 904.2 949.2

73 904.6 949.6

74 904.8 949.8

75 905.0 950.0

76 905.2 950.2

77 905.4 950.4

78 905.6 950.6

80 906.0 951.0

81 906.2 951.2

82 906.4 951.4

87 907.4 952.4

88 907.6 952.6

111 912.2 957.2

112 912.4 957.4

113 912.6 957.6

115 913.0 958.0

116 913.2 958.2

117 913.4 958.4

118 913.6 958.6

119 913.8 958.8

120 914.0 959.0

122 914.4 959.4

123 914.6 959.6 5

124 914.8 959.8
 Access methods in GSM
 The access method in GSM is a combination of FDMA and TDMA

 FDMA (Frequency Division Multiple Access) : achieved by dividing the available radio
spectrum into 125 sub-channels, each of 200KHz bandwidth so that multiple users can
access the system at the same time using different carriers.

 TDMA (Time Division Multiple Access) : each carrier is divided into 8 Time Slots so
that each Frequency Channel is shared by 8 users at a time on time sharing basis.

 One Time Slot in a GSM TDMA frame has a duration of 0.577mS (and 148 bits), and 8
timeslots (8 x 0.577 = 4.615 ms) form a TDMA frame.

Carrier-124

Carrier-1

Carrier-0

TS0 TS1 TS7 t 6

One TDMA frame
The Cell
The cell is the basic unit of the Cellular System. It is the Geographical area covered
a BTS.

Why is the Cellular structure needed? The answer is :

Cellular structure increases capacity : In GSM Eight Subscribers can share
an ARFCN using TDMA. And we have only 31 ARFCNs. So if we had only
one BTS covering the whole service area, we would end up with only 31 x 8
= 248 Subscribers talking simultaneously. So the whole Service area is
divided into many Cells covering only a small area. And cells having similar
frequencies are placed a little distance away so that their frequencies don’t
interfere.

Optimum Spectrum Usage : With only limited number of ARFCNs

avilable the option is to re-use the frequencies a little distance away. This
way we can have hundreds of cells optimally placed so that their frequencies
don’t interfere (using only 31 frequencies).

Lesser transmission power needed for the cell (down-link) and MS (up-link).

7
The Cell
 The capacity of the Cell is limited by the number of TRUs (Trans-
Receiver Units) of the BTS. If a Cell has 4 TRUs (each TRU handles
one ARFCN), the capacity of the Cell becomes :
4 TRU x 8 TS per ARFCN = 32 calls

 Cell size ranges from some 100 m in cities to, e.g., 35 km on the
country side

8
GSM NETWORK ARCHITECTURE

MPBN
BTS
RNC
AUC
BSC––Mobile
SGSN
MGw
MSS
HLR
VLR
STP
GPRS––Signal
––Base
––Base
–Visitor
Radio
Mobile
Authentication
Home
Media
Service
General
Trnsceiver
Station
Packet
Transfer
Network
Location
Switching
Location
Gateway
GPRS
Packet
Back-bone
Controller
Point
Station
Centre
Controller
Support
Register
Register
Radio
CentreNetwork
Services
Node
Server

9
IN – Intelligent
ISDN – IntegratedN/W
Services
ServerDigital
(Prepaid
Network
and Virtual
(Data Private
Network,N/W)
Fax, etc.)
MSS – Mobile Switching Centre Server
MGw – Media Gateway
VLR – Visitor Location Register
HLR – Home Location Register
AUC – Authentication Centre
EIR – Equipment Identity Register
BSC – Base Station Controller
RNC – Radio Network Controller
BTS – Base Trnsceiver Station
PLMN – Public Land Mobile Network (other GSM operators)
PSTN – Public Switched Telephony Network (Land Line N/W)
ISDN – Integrated Services Digital Network (Data Network, Fax, etc.)
IN – Intelligent N/W Server (Prepaid and Virtual Private N/W)
SMSC – Short Message Service Centre
SGSN – Service GPRS Support Node
GPRS – General Packet Radio Services
MPBN – Mobile Packet Back-bone Network
MS – Mobile Station
STP – Signal Transfer Point
10
 GSM NETWORK ELEMENTS
MSS (Mobile Switching Centre Server)
The MSS is the primary node of the GSM cellular network. All the call control functions
lie with it, while the MGw performs the call switching and signaling protocol conversion.
 It contains the call routing tables (A-number and B-number), Routing Case tables
(definition of various routes and route parameters), Charging Case Table, Global Titles
for SCCP (SS7 signaling), definition of BSCs, RNCs, MGws, MSRN table, etc.
 It performs Call Processing like call set up signaling, control of the call, call
termination and charging, etc.
 For call setup, it provides signaling interface of the GSM network to HLR (for SRI
query), SSTP (for LRN query, PRN message), and interrogates the IN Server (gsmSCF)
for processing a Prepaid call.
 It is responsible for SMS delivery to the SMS server at Kolkata.
 It generates Billing related data and routes the Call Detail Records (CDRs) to the
Billing server at Kolkata.
 It handles Location registration, attaching and detaching of mobile to the network.
 It controls the resources in the MGw (AMR speech codecs, Announcements, physical
channels in a route) for routing Calls.
11
 GSM NETWORK ELEMENTS
MGw (Media Gateway)
The MGw is controlled from the server via the GCP (Gateway Control Protocol) protocol.

 It terminates various physical media, like, electrical E1s and optical TMs, thus providing
interface to various BSCs, RNCs and PSTN TAXs.

 It provides IP interface to the MPBN over GE ports, which in turn connects to the
IP/MPLS cloud.

 It houses media stream resources like transcoders (AMR speech codecs), echo cancellers
and announcements for speech calls.

 The MGw also supports functions of Signaling Gateway (conversion between various
protocols, like, SS7 over TDM to SS7 over IP or ATM, etc.).

 The MGw is responsible for the actual call routing, the whole process being controlled
or supervised by the MSS (the signaling, device allocation, call set up, maintenance,
charging and termination).

12
 GSM NETWORK ELEMENTS
MPBN (Mobile Packet Back-bone Network)
The MPBN is a high level packet (over IP) transport solution supporting both the Circuit
Switched data (both user and control traffic) and the Packet Switched data (browsing the
internet) from the Core Network.
 It connects to the MSS and MGw over GE (Gigabit Ethernet) ports.

 It has two site routers and two site switches terminating three un-channelised optical
TMs in each site switch. These connect to the NEHU and E-10B MPBN switches at
Shillong.

 The transition from TDM to IP transport has an advantage in saving bandwidth and
thus minimising the media requirement.

 As an example, a 4000E traffic in telecommunication (Erlang is a measure of call

volume or call traffic) would require some 3 TMs (or 189 E1s). But with IP
transport, only half a TM is being utilized.

 The above is a practical observation from MPBN switch at Agartala.

13
 GSM NETWORK ELEMENTS
HLR (Home Location Register)
The HLR is a permanent database of the Subscriber Services.

 It stores the permanent and supplementary subscribers' data of all Subscribers and
current VLR address.
 Permanent subscribers data are SMS, calls (local, STD, ISD), Roaming, etc.
 Supplementary subscribers data are Call forwarding, Call waiting, etc.
 The HLR stores
 International Mobile Subscriber Identity (IMSI)
 Users telephone number (MSISDN)
 Current VLR address and LAI (current location of the MS)
 HLR is referred by the MSS for MSRN for routing an incoming call to subscriber.
 HLR queries the serving VLR of a mobile for a routing number (PRN information).
 A subscriber’s data are deleted from the HLR database only when his subscription is
surrendered.
14
 GSM NETWORK ELEMENTS
VLR (Visitor Location Register)
The VLR is a temporary database of the subscribers currently visiting the MSC/VLR
service area.
 When a subscriber (own or roaming) enters the MSC/VLR area a copy of his
subscription details is copied to the VLR database from his home HLR, so that each
time the subscriber establishes a call or has an incoming call, or for SMS, the HLR need
not be queried each time which would increase the Call Processing Time and Signaling
Load.

 It generates and allocates a Temporary Mobile Subscriber Identity (TMSI) used for
paging the mobile station.

 The subscribers database form the VLR is deleted when he moves to another
MSC/VLR.

 Contains Subscriber parameters and location information for all mobile subscribers
currently located in the geographical area controlled by that VLR.

 Identity of Mobile Subscriber (MSISDN, IMSI, etc).

 Contains the IMEI of the MS.

15
 GSM NETWORK ELEMENTS
AuC (Authentication Centre)
It authenticates the subscriber’s IMSI to receive service in the MSS/VLR area (own
subscribers or from MSSs with whom there is a Roaming agreement, like BSNL allover
India, MTNL Delhi and Mumbai. And not subscribers from Private operators with
whom we don’t have Roaming agreement).
 At subscription time, each subscriber (SIM) is assigned an Authentication Key
(Ki). Ki is stored in the AuC along with the subscriber’s IMSI. The same Ki and
IMSI are also stored in the SIM.

 In an AuC the following steps are carried out :

 A non-predictable Random Number, RAND, is generated.

 RAND and Ki are used to calculate SRES (Signed Response) and Cipher Key (Kc), using
two different algorithms, A3 and A8 respectively.
 RAND, SRES and Kc are delivered together to the HLR as a triplet.

 The MSC/VLR transmits the RAND to the MS

 The MS computes the Kc and SRES using RAND and the authentication key (Ki)

 The SRES is sent back to MSS/VLR, which performs authentication, by checking whether
the SRES from the MS and the SRES from the AUC match. If so, the subscriber is
16
permitted to latch to the network. If not, the subscriber is barred from network access.
 GSM NETWORK ELEMENTS
EIR (Equipment Identity Register)
EIR The equipment identification procedure uses the identity of the equipment (IMEI)
to ensure that the MS terminal equipment is valid.

 EIR is a database that contains a list of all valid mobile station equipment within
the network, where each mobile station is identified by its International Mobile
Equipment Identity (IMEI).

 EIR has three databases:

White list - For all known, good IMEIs
Black list - For all bad or stolen handsets
Grey list - For handsets/IMEI’s that are faulty or non-approved mobile
equipment, like the Chinese Mobile handsets.

17
 GSM NETWORK ELEMENTS
BSC (Base Station Controller)
The BSC is a high capacity switch that manages all the radio-related functions of a GSM
network. It also terminates the physical links to the MGw and BTSs.

 The BSC monitors and controls several BTSs

 Manages channel allocation on the radio interface during a call process
 Alarm Handling from the external interfaces and BTSs
 Performs inter-cell Call Handover
 Interface to OMC (Operation & Maintenance Centre) for BSS (Base Station
system) Management
 It contains the Cell configuration data (like Cell Identity, Frequencies/BCCH
list, Handover parameters, Neighbour cells, BTS power data, etc.)
 The BTS collects data on signal strength and quality of the neighbouring cells.
The BSC uses these data to allocate a channel during call setup or call handover
 Several BSCs can be controlled by an MSC

18
 GSM NETWORK ELEMENTS
BTS (Base Transceiver Station)
The BTS is the radio equipment (trans-receivers) needed to serve each cell in the
network. A group of BTSs are controlled by a BSC.

 The main function of the BTS is to provide radio connection with the MS over
the air interface.
 Consists of one or more radio terminals (called TRU – Transceiver Unit) for
transmission and reception.
 Each Radio terminal/TRU handles an RF Channel/ARFCN.
 Receiption of channel requests (through RACH) from MSs (during a call setup,
handover, etc.)
 The BTS is responsible for the processing of signals before transmission and after
reception. This includes:
Ciphering using the ciphering key (Kc)
Modulation and Demodulation (GSM uses GMSK-Gaussian Minimum Shift Keying).

19
SIM (Subscriber Identity Module)
• Portable Card with memory (ROM-6KB to 16KB-has A3/A8 algorithms,
RAM- 128KB TO 256KB, EEPROM- 3KB to 8KB )
• It contains:
– International Mobile Subscriber Identity (IMSI)
– Personal Identification Number (PIN)
– Pin Unlock Key (PUK)
– Authentication Key (Ki)
• It stores the Location Area Identity (LAI) the MS is currently
located.

20
Location Area
 A group of Cells is called a Location Area. It is this location information about
the MS that is stored in the VLR and the SIM.

 When an MS has an Incoming Call or a Mobile Terminated SMS, in response to

the paging command initiated by the MSS, the BSC pages all the Cells in the
Location Area where the MS is located. When the MS responds to the paging
message, the BTS adds the cell identity (CGI) to it. All Call Setup procedure is then
initiated in that particular Cell only.

 The size of LA can not be too BIG, as then for an Incoming Call or MT SMS, a
lot of Cells would have to be Paged, which would increase the Processor Load on
BSC.

 It can not be too SMALL either, as this would result in frequent Location
Updation of the Mobile, increasing again the Processor Load on BSC.

 So the LAI would be a compromise between being too Big or too Small. A very
tedious exercise is required involving some complex calculations and subsequent
observations from the Paging Performance reports to design an optimum size of the
Location Area.

21
Location Area
 Grouping of Cells into Location Area is required, as otherwise the VLR would
have to keep track of the Cells wherever the MSs move, thus necessitating very
frequent and huge Location Registrations, which would overload the processor
causing the system to crash.

LAI-2

LAI-1

LAI-3 22
 SUBSCRIBER IDENTIFICATION IN GSM NETWORK
There are few numbering schemes for identification of a subscriber in the GSM network.

Mobile Station ISDN Number (MSISDN)

91 94 36102025

Country Code (CC) National Destination Code Subscriber Number (SN)

(NDC)
91 for India 36102025 for a subscriber
94 for BSNL

 MSISDN uniquely identifies a subscriber in the GSM Network and it is the

number used for dialing a Subscriber.

 The HLR and VLR stores the MSISDN Number.

23
 SUBSCRIBER IDENTIFICATION IN GSM NETWORK

International Mobile Subscriber Identity (IMSI)

404 77 1210002025

Mobile Country Code Mobile Network Code Mobile Station Identification Number
(MCC) (MNC) (MSIN)
404 for India 77 for BSNL NE
 IMSI is a unique identity allocated to each SIM.
 All network-related subscriber information is connected to the IMSI.
 The IMSI is stored in the SIM, in the HLR and VLR.
 Interestingly, the MS does not know its MSISDN number, but only the IMSI.
Whenever the MS approaches the system, it does it with its IMSI, like, for
Location Registration on Mobile switching on.
 This is because, the SIM has only the IMSI burnt in it. The MSISDN is linked to
the IMSI at the HLR during subscriber creation. The MSS also keeps a record of
the IMSI-MSISDN linkage.
 We, as subscribers, do not need to know anything about the IMSI either.
 IMSI has a maximum length of 15 digits. 24
Mobile Station Roaming Number (MSRN)
 The MSRN is a number temporarily allocated to a mobile station for routing a
Call to it.

 MSRN is allocated by the serving VLR of the Mobile Station.

 The HLR stores address of the current VLR where the subscriber is located.
When a call is made to a mobile subscriber, the HLR requests the serving VLR for
an MSRN (PRN query).

 Upon reception of the MSRN (PRN response), the HLR sends it to the MSS
which can now use this number to route the call to the VLR where the called
subscriber is currently registered.

 MSRN has the same format as of MSISDN.

 In an MSS/VLR some thousands of Numbers are reserved to be used as MSRN

during Call Setup. These numbers are not allotted as MSISDN to Subscribers.

The MSRN is released soon after the Call establishment.

25
International Mobile Equipment Identity (IMEI)

• The IMEI is a uniquely identity of a Mobile Equipment.

• The IMEI can be seen by pressing

*#06#

• The IMEI consists of the following parts:

IMEI = TAC + FAC + SNR + SVN

– TAC : Type Approval Code - determined by a central GSM body (6 digits)

– FAC : Final Assembly Code - identifies the manufacturer (2 digits)

– SNR : Serial Number - an individual serial number of six digits uniquely

identifies all equipment within each TAC and FAC (6digits)

– SVN : Software Version Number - allows the manufacturer to identify

different versions of a given type of approved mobile (2 digits)

26
 Location Updation

Location Updation is a process by which a Mobile handset registers its presence in

an MSS/VLR area thus seeking Network Access.

1. When the MS is powered on in an MSC/VLR service area or when the MS

detects that the broadcast Location Area Identity is different from the one
stored in the SIM-card, it performs a Location Update.

2. The MS does not know its MSISDN, and thus sends the IMSI of the SIM to
the network to seeks access to it (In the SIM the IMSI is burnt, and not the
MSISDN, which is linked to IMSI in the HLR).

3. The VLR modifies the IMSI to MGT (Mobile Global Title), which is used to
route the MAP messages to the subscriber's own HLR.

4. The VLR requests subscriber information from the HLR where the MS’s
subscription is held. (The MGT is analyzed in the GT translation and GT
routing table. The MTP function is then used to transport the Location
Update MAP message to the subscriber’s HLR.)

27
 Location Updation

Location Updation is a process by which a Mobile handset registers its presence in

an MSS/VLR area thus seeking Network Access.

5. The HLR checks if the subscriber is roaming in a permitted area. If yes,

the HLR stores the new MSC/VLR address, fetches the subscription data
and sends the “INSERT SUBSCRIBER DATA” message back to the
serving VLR.

6. The HLR orders the old serving MSC/VLR to cancel all information
about the subscriber since the MS is now served by a new MSC/VLR.

7. The VLR stores the subscriber data and sends a Location Updating
confirmation message to the MS, which now gets access to the system
and signal in the Handset.

8. The HLR updates new VLR address of the subscriber.

The whole process is a very complex one and requires many parameters to be
predefined in both the MSSs and HLRs when a Roaming agreement is
made between the two operators.
28
 Channel Concept

 The Time slots in a TDMA Frame in GSM are called Physical Channels.

 Logical Channels are Mapped in the Physical Channels.

 Logical Channels are used for communication between the MS and the BTS,
like :
– transmission of user data and voice,
– call setup and Handover signaling,
– system informations like LAI, BCCH frequency, Power to use, etc.
– Neighbouring Cells' Signal strength,
– SMS delivery and reception,
– Cell Broadcast Messages (site name display), etc.
TS-0 TS-1 TS-2 TS-3 TS-4 TS-5 TS-6 TS-7

Time slots (physical channels) in a TDMA Frame where the different Logical Channels are
configured

29
 Channel Concept
LOGICAL CHANNELS

TRAFFIC SIGNALLING
(TCH)

BROADCAST COMMON CONTROL DEDICATED CONTROL

FCCH SCH BCCH

RACH
PCH AGCH
FCCH -- FREQUENCY CORRECTION CHANNEL
SCH -- SYNCHRONISATION CHANNEL
BCCH -- BROADCAST CONTROL CHANNEL
PCH -- PAGING CHANNEL SDCCH SACCH FACCH
RACH -- RANDOM ACCESS CHANNEL
AGCH -- ACCESS GRANT CHANNEL DOWN LINK ONLY
SDCCH -- STAND ALONE DEDICATED CONTROL CHANNEL BOTH UP &
SACCH -- SLOW ASSOCIATED CONTROL CHANNEL UPLINK ONLY DOWNLINKS
FACCH -- FAST ASSOCIATED CONTROL CHANNEL
30
 Channel Concept

• Traffic Channel (TCH)

– TCH carries Voice Data
– One TCH is allocated for a full-rate Voice Call
– 2 half-rate calls occupy one TCH
– A TCH Occupies one TS

• Broadcast Control Channel (BCCH) -- broadcasts Cell Informations like:

– Location Area Identity (LAI)
– Maximum Power allowed to be used in the Cell
– Frequency used in the Cell
– Neighbouring Cells’ BCCH Frequencies
– Occupies one TS

• Cell Broadcast Channel (CBCH)

– Downloads the Name of the BTS, like Airport, Lichubagan, etc.
– Each Cell has one CBCH. 1 CBCH and 7 SDCCH occupy one TS

• Stand alone Dedicated Control Channel (SDCCH)

– Used for Call Setup Procedure
– SMS – SMMT and SMMO (when the MS is in idle mode)
– Handover signaling
– 8 SDCCHs occupy one TS
31
 Channel Concept
• Paging Channel (PCH)
– Transmits a MS identity (IMSI/TMSI) for an Incoming Call or SMS
– Each PCH transmits 2 IMSI, 4 TMSI or 1 IMSI and 2TMSI
– The 1st page is with TMSI, and the 2nd page with IMSI

• Random Access Channel (RACH)

– Receives access request from MS for Call setup, Location Updation, SMS
(SMMO)

• Access Grant Channel (AGCH)

– Grants access to the system by allotting an SDCCH to be used during Call
setup, Mobile Originating SMS or Location Updation

• Slow Associated Control Channel (SACCH)

– Transmission of measured value of Signal Strength and quality of the
neighbouring cells
– SMS – when the MS is in Busy Mode

• Fast Associated Control Channel (FACCH)

– Used for Handover Commands
32
 Channel Concept

• Frequency Correction Channel (FCCH)

– Gives information about the BCCH carrier frequency
– Allows MS to synchronize to the BCCH frequency used in the Cell

• Synchronization Channel (SCH)

– Informs the MS about the TDMA frame number
– Base Station Identity Code (BSIC)

33
 Simplified Call Set up Scenario – Call to an MS

PCH : the MS is paged in the LA where it is located

RACH : the MS requests for a Signaling Channel

AGCH : access is granted. An SDCCH and a SACCH is allocated

SDCCH and SACCH are used for Call Setup.

A TCH is assigned
SDCCH is released

34
 Simplified Call Set up Scenario– Call from an MS

RACH : the MS requests for a Signaling Channel

AGCH : access is granted. An SDCCH and a SACCH is allocated

SDCCH : the MS sends a Call setup Request

SDCCH : an idle TCH is allocated

Call establishes on TCH

SDCCH is released

35
Simplified Call Set Up Scenario at Switch Level

36
Thank You
Narayan Bhowmik.
SDE (GSM Core NW), BSNL,
Agartala.

37