1. INTRODUCTION
In 1982, the CEPT formed a group called the “Groupe Special Mobile” (GSM) to study
and develop a Pan-European public land mobile system, with the following objectives:





Full reaming capability.
Low cost.
Good speech quality.
ISDN compatibility.
BW efficiency.
-
In 1990 GSM specifications were published and by 1991 phase 1 was ready for
implementation.
-
By 1993, there were 36 GSM networks in 22 countries, and by 1997, GSM was
implemented in 110 countries world wide with over 55 million subscribers.
-
Rogers implemented GSM network in North America and GSM now stands for
“Global System for Mobile Communication”.
2. GSM SPECIFICATION
-
-
-
Frequency bands (Cellular):
 890 – 915 MHz Uplink (Mobile to BS)
 935 – 960 MHz Downlink (BS to Mobile, In Europe)
 GSM PCS Band is 1850 to 1990 MHz (Mobile to BS)
 Bandwidth: 25 MHz, uplink and downlink.
Number of channels: 124
 25 MHz

Channel separation: 200 KHz 
 200 KHz / Ch  , e.g. 890.2, 890.4, … , 915.
 124 Ch

Modulation Method: GMSK (Gaussian Minimum Shift Keying).
Frequency deviation: 67.708 KHz each way from the carrier frequency.
Channel Access: Hybrid FDM / TDM, with 8 time slots per channel, thus each Voice
Channel occupies 25 KHz. Thus, each radio channel carries 8 simultaneous voice
calls on a time shared basis.
Data Rate: 270.833 Kbps total bit rate per radio channel.
Speech Coding: LPC (Linear Predictive Coding), speech is encoded at 13 Kbps.
3. GSM SERVICES
-
All digital Network.
Support telephony service at 13 Kbps.
Provides 3 digits emergency service similar to 911.
Provides a variety of data services at rates up to 9600 bps to POTS, ISDN, packet and
circuit switched Public Data Networks.
-
Provides Facsimile Group 3.
Provides SMS (Short Message Service) up to 160 bytes.
A cell broadcast feature is included in SMS for traffic updates or news updates.
Support advanced features such as call forwarding, call barring, call waiting, caller
ID, multi-party conference, etc.
4. GSM ARCHITECTURE
- Refer to the figure shown:
Um
Abis
A
VLR
SIM
HLR
BTS
MS
BTS
B
S
C
PSTN,
ISDN,
PSDN,
CSPDN
M
S
C
BTS
EIR
BSS
AUC
NSS
Figure 1. GSM Architecture.
-
GSM network can be divided into 3 main sections: the mobile Unit (MS), the Base
Station Subsystem (BSS), and the Network Sub-System (NSS).
The mobile is carried by the user.
The BSS has 2 components: the Base Transceiver Station (BTS) which contains the
radio equipment and the Base Station Controller (BSC).
The NSS contains the Mobile Switching Center (MSC), Home Location Register
(HLR), the Visitor Location Register (VLR), the Equipment Identity Register (EIR),
and the Authentication Center (AUC).
5. MOBILE STATION (MS)
-
-
The MS consistas of the Mobile Phone and a smart card called the Subscriber Identity
Module (SIM).
IMEI: the International Mobile Equipment Identity uniquely identifies the mobile.
The SIM allows mobility and portability. The user can insert the SIM card in any
phone and access services.
The SIM card contains the following information:
 IMSI: the International Mobile Subscriber Identity uniquely identifies the
subscriber.
 A secret key for Authentication.
The IMEI and IMSI are independent, thereby allows mobility and portability.
6. BASE STATION SUB-SYSTEM (BSS)
-
Consist of 2 parts, the BTS and BSC.
The BTS contains radio equipment. that define a cell and handle the radio link with
the mobile user.
Contains TRAU (Transcode Rate Adapter Unit), carries out speech coding and
decoding.
The BSC controls the radio resources for one or more BTS. Performs channel setup,
frequency hopping, hand-over. Interfaces with MSC.
7. NETWORK SUB-SYSTEM (NSS)
-
Contains MSC, HLR, VLR, EIR, AUC.
MSC:
- The heart and brain of the GSM system.
- A complete switching system.
- Performs switching, call setup, registration, authentication, location updating,
handover, call routing, roaming control.
- Also provides connection to land networks.
- Uses SS#7 for signalling.
8. HOME LOCATION REGISTER (HLR)
-
Provide call routing and roaming capabilities.
Contains all the administrative information of each registered subscriber along with
the current location of the mobile.
The location of the mobile is typically in the form of a signalling address of the VLR
associated with the mobile station.
The HLR on a GSM Network contains: IMSI, MSISDN, VLR address and subscriber
data regarding supplementary services.
9. EQUIPMENT IDENTITY REGISTER (EIR)
-
Database that contains the identity of the mobile.
Prevents fraudulent use.
10. AUTENTICATINO CENTER (AUC)
-
Database that stores a copy of the secret key stored in each user’s SIM card.
GSM codes P12 KRIS, GSM Architecture P14K MAX RF power for mobile P15K,
detailed architecture fig 9.2 K
11. GSM CHANNELS FREQUENCIES
-
The BW per channel in GSM is 25 KHz.
The frequency band used are:
- 890 – 915 MHz uplink (from mobile to BS).
- 935 – 960 MHz downlink (from BS to mobile).
- 124 radio channels in each direction with a BW of 200 KHz each.
- The channel frequencies are as follow:
Fu = 890.2 + 0.2(M-1) MHz
Where M = 1, 2, 3, … 124.
Fd = 935.2 + 0.2(M-1) MHz
12. GSM FDM/TDMA FRAME
-
GSM uses hybrid FDM/TDMA for channel access.
Ratio channels are assigned in pairs, one for uplink and one for downlink.
Each pair of radio channels support 8 simultaneous calls (fig 9.4 FDMA/TDMA
structure K)
The figure below shows the Radio Channel structure.
TS0
Ch#1
156.25 bits
0.577 ms
TS1
Ch#2
TS2
Ch#3
TS3
Ch#4
TS4
Ch#5
TS5
Ch#6
TS6
Ch#7
TS7
Ch#8
4.615 ms
Figure 2. GSM Radio Channel Structure.
-
One time slot is called one BURST period.
One frame is transmitted for 0.577 ms x 8 = 4.615 ms.
8 burst periods are grouped into one TDMA frame.
Frames are transmitted in a group of 26 frames called a Multiframe. Thus a
multiframe consists of 26 frames.
The length of a Multiframe = 120 ms.
GSM Superframe is 6.12 s and consists of 51 multiframes.
GSM Hyperframe consists of 2048 Superframes.
F1 - 12 : TCH , F13 : SACCH , F14 – 25 : TCH , F26 : Not used
F1
….
F2
….
F8
F26
Multiframe
TS0
Ch#1
156.25 bits
0.577 ms
TS1
Ch#2
TS2
Ch#3
TS3
Ch#4
TS4
Ch#5
TS5
Ch#6
TS6
Ch#7
TS7
Ch#8
4.615 ms
3 trail
bits
57 Data
bits
1 stealing
bit
26 training
sequence bits
1 stealing
bit
57 data
bits
8.25
guard bit
Traffic Channel = 156.25 bits = 0.577 ms = 270.833 bps
Figure 3. GSM Frame Structure.
13. GSM CHANNELS CLASSIFICATION
GSM has the following logical channels (Fig 9.5 K):
-
Traffic channels (TCH): Used mainly to carry traffic.
Traffic channels are of 2 types:
a. TCH (Full): Allows transmission of 13 Kbps of coded speech or 12.6 or
3.6 Kbps of data traffic.
Fig. on the previous page shows the structure of the traffic channel.
As shown, out of 26 frames, 24 are used for traffic, 1 for SACCH (Slow
Associated Control Channel) to inform the BS of power measurements
made by the mobile of signal strength in the adjacent cell.
The FACCH “steals” bits from the voice signal and is used for urgent
messages from the base such as hand-off instructions.
b. TCH (Half): Allows 7 Kbps of coded voice traffic (doubles the capacity)
or 12.6
-
Control Channels (CCH): Used to carry control information.
Used to transmit control and signal information.
- As in TDMA it is not necessary to use an entire RF channel for control.
- Instead, one of the 8 time slots in one RF channel in each cell or sector is
designated as control channel.
- We have 26 time slots available per multiframe to transmit control info as shown:
TS1
FCCH
TS1
SCH
BCCH
Paging Channel
TS26
Variable Length
Figure 4.
-
Cell Broadcast Channels (CBCH): Is used to broadcast user info from a service center
to the mobile listening in a given cell area. It is a unidirectional (downlink only),
point-to-multipoint channel used for short info messages service such as news
updates.
FCCH and SCH (Frequency Correction Channel and Synchronization Channel).
-
-
Used for carrier frequency correction and for synchronize the mobile to the time
slot structure of a cell by defining the boundaries of burst period and the time slot
numbering.
Every cell in a GSM network broadcast usually one FCCH and one SCH on time
slot 0.
-
Paging Channel (PCH): Used to inform a mobile of an incoming call (forward
channel)
-
Random Access Channel (RACH): Corresponding reverse channel used by the
mobile to communicate with the base station and to access the network.
-
Access Grant Channel (AGCH):
signalling.
-
Stand Alone Dedicated Control Channel (SDCCH): SDCCH are bidirectional pointto-point channels used for service request, subscriber authentication, equipment
validation and assignment of a traffic channel.
Used to allocate an SDCCH to a mobile for
14. GSM SPPECH CODING
-
GSM is a digital system.
-
GSM uses Regular Pulse Excited – Linear Prediction Coding (RPE-LPC)
-
The process consists of using the information for the previous samples to predict the
current sample.
-
The difference between the predicted and the actual sample represents the signal.
-
Speech is divided into 20 ms samples, each of which is encoded as 260 bits, giving a
total bit rate of 13 kbps.
-
Recently, an Enhanced Full Rate (EFR) speech coding algorithm has been
implemented by some North American GSM 1900 MHz operator which gives better
speech quality at 13 kbps.
-
The speech is sampled at 8000 samples/sec, uniformly quantified to 213 levels and
coded using 13 bits/sample which gives 104 kbps.
-
104 kbps stream is then fed into the RPE-LPC encoder, which transcodes the speech
into a 13 kbps.
-
The speech CODEC produces a 260 bit block for every 20 ms speech sample.
-
The signal then modulates the carrier using GMSK modulated scheme.
PLMN (Public Land Mobile Network)
MS ISDN (Mobile ISDN # consists of country code)
LAI :- Mobile Country Code + Mobile Network Code + Location Area Code
15. GSM LAYERS :- Figure below shows GSM LAYERS.
Um
L3
Abis
A
CM
CM
MM
MM
RR
RR
BSSMAP
BSSMAP
L2 Data Link
LAPDm
LAPDm
SCCP
SCCP
L1 Physical
TDMA
TDMA
MTP
MTP
Mobile
Station
BTS
BSC
MSC
Figure 5.
-
LAYER 1 is the physical layer which uses the channel structure described earlier
over the air interface and it is called TDMA.
-
LAYER 2 is the data link layer across the air interface called Um, which is a subset of
ISDN LAPD between the mobile and the BTS.
-
Across the A interface, MTP (Message Transfer Protocol), layer 2 of SS#7 is used.
- Layer 3 of the GSM signalling protocol is divided into 3 sub layers.
a) Radio Resource Management (RR) :- Controls the setup, maintenance and
termination of radio and fixed channels, including handovers.
b) Mobility Management (MM) :- Manages the location updates and registration
procedures, as well as security and authentication.
c) Connection Management (CM) :- Handles general Call Control, using Q.931
messages, and manages supplementary services and Short Message Service.
-
Signalling between fixed parts such as between HLR and VLR is handled by the
Mobile Application Part (MAP).
MAP is built on top of TCAP of SS#7 (Transaction Capabilities Application Point).
16. GSM CALL CONTROL PROCEDURES :1)
2)
3)
4)
5)
Call setup with a Mobile
Call setup with LAND Network
Mobile to LAND call
LAND to mobile call
Paging
Fig. 9.18 is self study.
PAGING THE CALL
Um
MS
A
BSS
B
MSC
VLR
PERM_PAGE
1
PAGE_MESS
2
CHH_REQ
3
DSCH_ASS
4
PAGE_RESP
5
PAGE_RESP
6
PAGE_RESP
7
The MSC uses LAI (if call permitted).
1. Provided by VLR to determine which BSS will page MS. There may be more
than one BSS in the location area.
2. Each BSS broadcast TMSI of the MS in PAGE_MESS.
3. The called mobile responds with CHH_REQ.
4. The BSS allocates SDCCH and sends the DSCH_ASS to MS over AGCH. It is
over the SDCCH that the MS communicates with the BSS until ATCH is
assigned.
5. The MS sends its TMSI and LAI over SDCCH.
6. The BSS forwards this to MSC.
7. MSC forwards this to VLR.
ROUTING LAND CALLS TO MOBILE
C
PSTN
MS
C
HLR
C
VLR
INC_CALL
1
GET_ROUT
2
ROUT_INF
3
INCO_CALL
4
PERM_PAGE
5
1.
2.
3.
4.
5.
INC_CALL contains Mobile ISDN Number (MS ISDN).
MSC request routing info.
HLR returns MS RN if roaming or MS ISDN if not roaming.
MSC informs the VLR about the incoming call that includes MS RN.
The VLR responds PERM_MESSAGE (Permit the call or not permit the call)
containing LAI and TMSI of mobile.
CALL SETUP WITH A MOBILE
Um
MS
A
BSS
B
MSC
VLR
SETUP_REQ
1
Access Subscriber Data
2
SUB_DATA_RESP
3
Call Proceeding
4
Assign Trunk and Radio
Channel
5
Assign Radio Channel
6
Radio Assignment Complete
7
Trunk and Radio
Assignment Complete
8
1.
2.
3.
4.
Call setup request goes to MSC. Includes dialed digits.
MSC requests call validation from VLR.
The VLR checks for call barring. If call is valid, VLR returns response.
MSC send a message CALL_PROCEDING.
THIS DIAGRAM SHOWS HOW A VOICE PATH IS ESTABLISHED FROM
MSC TO PSTN
MS
BSS
MSC
NET_SETUP
1
NET_ALERT
2
Alerting
3
Connect (Answer)
4
Connect
5
Connect Acknowledgment
6
1.
2.
3.
4.
5.
6.
7.
8.
MSC sends the NET_SETUP to PSTN (includes dialed digits and trunk assigned).
PSTN set up the call and notifies the MSC.
MSC alerts the mobile. The mobile hears the ringing.
MSC also allocates a trunk and asks the BSS to assign a radio channel.
Called party goes off hook.
Connect message is sent.
Connect ACK is sent.
Conversation begins.
CALL RELEASE PROCEDURE
Um
MS
BSS
MSC
PSTN
CALL_DISC
1
NET_REL
2
CALL_REL
3
REL_COMP
4
CLR_COMM
5
CHH_REL
6
CLR_COMP
7
1.
2.
3.
4.
5.
6.
7.
CALL_DISC is sent to MSC.
MSC sends NET_REL to PSTN.
MSC instructs the mobile to begin call clearing procedure.
The mobile releases the call and sends REL_COMP.
MSC then instructs the BSS to release the allocated resources.
The BSS sends the CHANNEL_RELEASE to mobile.
BSS informs the MSC that the channel has been released.
INTRA MSC HAND OFF (Signal quality is monitored by both MS and BSS)
Um
A
Serving
BSS
MS
A
Target
VLR
MSC
STRENGTH_MEAS
1
HAND_REQ
2
HAND_REQ
3
HAND_REQ_ACK
4
HAND_COMM
5
HAND_COMM
6
HAND_AC
CHH_INFO
8
HAND_DET
9
HAND_COMP
10
11
A
12
HAND_COMP
REL_RCH
REL_RCH_COMP
13
A
1. STRN_MEAS is sent when hand off is required.
2. BSS sends hand off request to MSC containing a list of targeted BSS.
3. MSC selects the most appropriate BSS and sends the request to target BSS.
4. Target BSS acknowledgement contains new radio channel.
5. Communicates to the serving BSS.
6. Communicates to MS.
7. The mobile retunes to the new channel.
8. The target BSS sends CHH_INFO to the incoming mobile.
9. Informs MSC that it is detecting incoming mobile.
10. Synchronizes in the proper TS and sends HAND_COM.
11. Informs MSC.
12. Old channel release.
13. RELEASE_COMP.
Note 1: Intra Hand Off requires two resources:
a. A trunk between the MSC and the target BSS.
b. A free radio traffic channel in the new cell area.
Note 2: The Hand Off should be completed within 150 ms for 90% of hand off. (The
interval starts when the MS retunes to the new radio channel and ends with
synchronization with the proper TS without loss of info.