GSM & GPRS Primer
By Erick O’Connor
February 2005
Topics
Background
General Packet Radio System (GPRS)
• The history of cellular communications
• Key statistics
– Worldwide subscribers
• Protocol layers
• Key information
• Dimensioning a Network
– Top 20 global mobile operators
• Mobility Management
Global System for Mobile (GSM)
Third-Generation Systems (UMTS)
• The Radio environment
• Basestation & Network subsystems
• Evolution paths
• Core components
•
•
•
•
Subscriber data & addressing
Circuit-switched network architecture
Overview of PDH transmission
Common Channel Signalling & GSM MAP
©2001 - 2005 Erick O’Connor
The following symbol indicates that the
slide contains animations. Press the
A
space bar to advance the animation
2
History of Cellular Communications
1960s to the Present Day
…the early years
1960 – 1970s
• Idea of a cell-based mobile radio system developed by AT&T’s Bell Labs in late 1960s
• First commercial analogue mobile cellular systems deployed 1978
1980s (1st Generation Analogue Systems)
• Usage in N.America grows rapidly
– Advanced Mobile Phone System (AMPS) becoming the de facto standard
• Europe, run by the PTTs, characterised by multiple incompatible analogue standards
–
–
–
–
–
Nordic Mobile Telecommunications (NMT-450)
Total Access Communications (TAC) – United Kingdom
C-Netz – West Germany
Radiocom 2000 – France
RTM / RTMS – Italy etc. etc.
• Capacity limitations already becoming apparent by end of decade….
©2001 - 2005 Erick O’Connor
4
… going digital
Late 1980s to early 1990s (2nd Generation Digital Systems)
• N.America relies on de facto “let the best technology win” standardisation
• By contrast Europe decides to rely on standardisation & co-operation
– Huge pent-up demand for mobility can not be met by upgrading existing purely analogue systems.
Parallel advances in digital techniques and Very Large Scale Integration (VLSI) chipset
manufacture suggest a new way forward
– However European domestic markets individually too small to achieve the economies of scale
necessary for vendors to take the risk of developing such a risky new solution
– Enter the European Commission with a political agenda – demonstrate Europe’s “technology
leadership” and ensure European manufacturers can compete globally
• New spectrum auctions in USA in early 1990 (PCS 1900) lead to plethora of standards
– D-AMPS IS-54 – Motorola sponsored, TDMA IS-136, CDMA IS-95 – Qualcomm sponsored
– Plus, limited GSM
• Meanwhile in Europe…
©2001 - 2005 Erick O’Connor
5
…GSM is born
Late 1980s to early 1990s (2nd Generation Digital Systems)
• Guided by European Commission & European Telecommunications Standard Institute
• 26 European telecommunication administrations establish the Groupe Spéciale Mobile
(GSM) in 1982 with aim to develop a new specification for a fully digital pan-European
mobile communications network
• The Group notes that the “new industry’s economic future will rely on unprecedented
levels of pan-European co-operation”
• Political decision to force member countries to:
– allocate frequencies at 900 MHz in every EC country (later 1800 MHz)
– specify the exact technology to be used and;
– deploy systems by 1991
• First commercial GSM networks deployed in 1992
– Denmark / Finland / France / Germany / Italy / Portugal / Sweden / United Kingdom
©2001 - 2005 Erick O’Connor
6
…beginning of the GSM success story
By End of 1993
• One million subscribers using GSM
• GSM Association has 70 members, 48 countries
• First non-European operator, Telstra of Australia
And, by technology.…
www.gsmworld.com
….Subscribers
©2001 - 2005 Erick O’Connor
7
…the turn of the century & 3rd generation services
• Multiple operators per country & worldwide (800+)
– intense price based competition
– Huge growth in subscribers thanks to pre-paid but falling ARPU & high churn (c.25%)
– Market close to saturation – slowing subscriber penetration growth rates (c.85%)
• The challenge – what to do in future?
• Europe keen to replicate commercial success of GSM but, Americans & Japanese had
different views and needs
– Japan had run out of spectrum for voice
– Americans unhappy at being “dictated to” by a European standard
– European vision of always on data & rich value added content services
• America & Japan jointly force Europe to open up standardisation process so as not to
once again “lock-out” other trading blocs’ vendors
– Creation of 3rd Gen Partnership Programme (3GPP) body
– Heated standardisation on Wideband CDMA (Qualcomm vs Ericsson)
– Final agreement on Universal Mobile Telecommunications Standard (UMTS) in 1998….
©2001 - 2005 Erick O’Connor
8
The market today – key statistics
©2001 - 2005 Erick O’Connor
9
GSM design
Radio & Network subsystems, Signalling & Transmission
A
Basic GSM network elements
PSTN
Network Subsystem
ISDN
PDN
ISC
BTS
BSC
GMSC SIWF
XCDR
User Data &
Authentication
MSC
BTS
BSC
BTS
MS + SIM
Radio Subsystem
©2001 - 2005 Erick O’Connor
EIR
AUC
HLR
VLR
AUC
BSC
BTS
EIR
GMSC
HLR
ISC
ISDN
MSC
PDN
PSTN
SIWF
VLR
XCDR
Authentication Centre
Basestation Controller
Basestation Transceiver
Equipment Identity Register
Gateway Mobile Switching Centre
Home Location Register
International Switching Centre
Integrated Services Digital Network
Mobile Switching Centre
Packet Data Network (X25)
Public Switched Telephony Network
Shared Interworking Function
Visitor Location Register
Transcoder (16 / 64kbps coding)
11
GSM air interface design
• Access Techniques
–
Time Division Multiple Access
–
Frequency Division Multiple Access
–
Space Division Multiple Access
• Radio characteristics
Gaussian Minimum Shift Keying (GMSK)
–
Slow Frequency Hopping
8 Timeslots per Carrier
–
1 Downlink Timeslot reserved for signalling
–
3 timeslot difference between uplink & downlink
+400 kHz
GMSK Spectrum
8 timeslots
f3
f2
• Logical structure
–
f0
-400 kHz
Frequency
–
Multiple cells
f1
f0
FDMA & TDMA
Time
• Frame structure used for synchronisation
–
51-frame Multiframe (235.4 ms)
–
51 or 26 Multiframe Superframe (6.12 sec)
–
2048 Superframe Hyperframe (3 hr 28 mins)
2
3
4
5
6
7
Downlink
Uplink
0
1
2
3
4
5
0
1
6
7
Delay
©2001 - 2005 Erick O’Connor
12
Radio subsystem (i)
• Basestation Transceiver (BTS) provides radio
channels for signalling & user data
BTS
BSC
• A BTS has 1 to 6 RF carriers per sector and
1(omni) to 6 sectors
–
e.g. 3/3/3 = 3 sector with 3 carriers per sector
–
3 x 7 Timeslots x 3 = 63 Timeslots total
–
c.52 Erlangs @ 2% Grade of Service
–
c.2,000 users per BTS @ 25 mErl / User (90 seconds)
• Frequency reuse depends on terrain,
frequencies available etc.
BTS
BSC
BTS
MS + SIM
2
Frequency reuse &
cluster formation
3
2
1
3
1
f2
f3
f1
K=3
• Paired spectrum shared by Operators
–
900 / 1800 MHz in Europe / Asia (25 & 75 MHz)
6
–
1900 MHz in N.America
5
7
1
4
• 200 kHz channel separation
f6
• 125 Channels @ 900 MHz
f5
©2001 - 2005 Erick O’Connor
XCDR
2
3
f7
f1
f4
6
5
f2
f3
7
1
4
2
3
K=7
13
Radio subsystem (ii)
BTS
BSC
• Basestation Controller (BSC) controls a number of BTS
XCDR
– Acts as a small switch
BTS
– Assists in handover between cells and between BTS
– Manages the Radio Resource, allocating channels on the air interface
BSC
BTS
MS + SIM
• Transcoding (XCDR) function is logically associated with BTS
– But, typically located at BSC to save on transmission costs
– XCDR provides 13 kbps Coding / Decoding between GSM Codec & standard 64 kbps A-law
encoded voice
• Interfaces
– “Abis” – BTS to BSC interface (never fully standardised so vendor-specific variants exist)
– “A” – BSC to MSC interface carrying voice, BSC signalling and Radio
– Traffic Channels are mapped one-to-one between BTS and Transcoder
– BTS can be connected in “Star” or “Daisy-chain” arrangement to BSC (max. 15)
©2001 - 2005 Erick O’Connor
14
Network subsystem (i)
PSTN
ISDN
PDN
ISC
• Core component is Mobile Switching Centre (MSC)
GMSC SIWF
– Performs all switching functions of a fixed-network switch
MSC
– Allocates and administers radio resources & controls mobility of users
– Multiple BSC hosted by one MSC
• Gateway MSC (GMSC) provide interworking with other fixed & mobile networks
– Crucial role in delivering in-coming call to mobile user in association with Home Location
Register (HLR) interrogation
• Shared Interworking Function (SIWF)
– Bearer Services are defined in GSM including 3.1 kHz Voice, ISDN, 9.6 kbps Data & 14.4 kbps
– IWF provides “modem” capabilities to convert between digital bearer & PSTN, ISDN & PDN
• International Switching Centre (ISC)
– Provides switching of calls internationally. Switch may be provided by another carrier
©2001 - 2005 Erick O’Connor
15
Network subsystem (ii)
• Home Location Register (HLR) holds
master database of all subscribers
– Stores all permanent subscriber data &
relevant temporary data including:
•
MS-ISDN (Mobile Subscriber’s telephone no.)
•
MSRN (Mobile Station Roaming no.)
•
Current Mobile Location Area
– Actively involved in incoming call set-up &
supplementary services
• Visitor Location Register (VLR)
associated with individual MSCs
– VLR stores temporary subscriber information
obtained from HLR of mobiles currently
registered in serving area of MSC
EIR
AUC
HLR
VLR
• Authentication Centre (AUC) &
Equipment Identity Register (EIR)
– GSM is inherently secure using
encryption over the air-interface and for
authentication / registration
– AUC holds each subscriber’s secret key
(Ki) & calculates “triplet” for challenge /
respond authentication with mobile
– SIM is sent data and must calculate
appropriate response
– EIR is used to store mobile terminals
serial numbers
– Involved in registration of mobiles
– Assists in delivery of supplementary service
features such as Call Waiting / Call Hold
©2001 - 2005 Erick O’Connor
16
GSM call setup & Signalling
Signalling – Air interface
Air Interface Signalling
• Downlink signalling (to Mobile Station)
– Relies on Bearer Control Channel
(BCCH) set at fixed frequency per cell
•
•
Mobile Stations use this to lock-on to
network
Mobile Stations periodically scan
environment and report back other
BCCH power levels to BSC to assist
in handover
– Access Grant Channel (AGCH) – used
to assign a Control or Traffic Channel to
the mobile
– Paging Channel (PCH) – paging to find
specific mobiles
©2001 - 2005 Erick O’Connor
• Uplink signalling (from MS) more
complicated
– Random Access Channel (RACH) –
competitive multi-access mode using
slotted ALOHA to request dedicated
signalling channel (SDCCH)
• Bidirectional channels include
– Traffic Channels (TCH) – Carrying full
rate voice @ 13 kbps / half-rate voice
– Standalone Dedicated Control Channel
(SDCCH) – used for updating location
information or parts of connection set-up
– Slow Associated Control Channel
(SACCH) – used to report radio conditions
& measurement reports
– Fast Associated Control Channel
(FACCH) – uses “stolen” traffic channel
capacity to add extra signalling capacity
18
Signalling – Mobile Application Part interfaces
Network Signalling
Um
Air interface signalling
Abis
Radio management
A
BSS management, connection
control & mobility management
B
Subscriber data, location
information, supplementary
service settings
C
Routing information requests
D
Exchange of location-dependent
subscriber data & subscriber
management
E
Inter-MSC handover signalling
F
Subscriber & equipment identity
check
G
Inter-MSC handover, transfer of
subscriber data
©2001 - 2005 Erick O’Connor
GSM Specific Signalling Interfaces
(Mobile Application Part)
MSC
EIR
MSC
F
E
BSC
C
A
BTS
B
Abis
D
HLR
VLR
BTS
G
VLR
Um
MS + SIM
19
A
ITU-T Common Channel Signalling System Number 7
Application Parts
GSM interfaces B, C, D, E & G
carried as Mobile Application Part
Most basic CSS7 signalling
MAP
Transaction Control
Application Part –
component responsible for
“carrying” higher level
Application Parts to their
correct destinations
INAP
TCAP
OMAP
ISUP
TUP
SCCP
Signalling Connection
Control Part
Functionally equivalent to TCP
layer, carries “Connectionless”
messages between Network
elements
Standard Telephone
User Part (TUP)
ISDN User Part
MTP Layers 1/2/3
Add functionality to
permit ISDN signalling
(i.e. fully digital)
between networks
ISO Layers 1 thro 7
Actually carry the specific
messages for Mobile (MAP),
Intelligent Network (INAP) or
Operations & Maintenance
(OMAP)
Signalling 101
• Line signalling – “tell the other end you want to make call”
• Register signalling – “tell the other end the destination of the call”
©2001 - 2005 Erick O’Connor
Message Transfer Part
Lowest level, permits
interconnection with
underlying physical
transmission medium
20
PDH transmission …composition of 32 channel E1 bearer
TS 0 Synchronisation
Header
TS16 Signalling
ITU-T G.703 E1 link 2048 kbps
32 x 64 kbps Timeslots
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
140 Mbps
Plesiochronous Digital Hierarchy (PDH)
34 Mbps
Voice / Data Timeslot
2 Mbps
Abis - Voice GSM Codec
4 x 13 kbps Timeslots
STM-16
STM-4
Synchronous Digital Hierarchy (SDH)
(SONET - USA)
STM-1
©2001 - 2005 Erick O’Connor
21
Circuit-switched network architecture
A
(Transmission & Signalling planes)
BSS
CCS7
CO
HLR
MSC
SDH
SSP
STP
Basestation Subsystem
Common Channel Signalling #7
Central Office
Home Location Register
Mobile Switching Centre
Synchronous Digital Hierarchy
Service Switching Point
Signalling Transfer Point
CSS7 Signalling Plane
SSP
HLR
CCS7 Links
CO Switch
STP
MSC
SDH Fibre
Optic Network
Synchronisation
Other Networks
Drop & Insert
Multiplexers
BSS
©2001 - 2005 Erick O’Connor
Transmission Plane
22
A
Call setup
Data held in HLR:
• Subscriber & Subscription Data
–
–
–
–
–
–
–
International Mobile Subscriber
Identity (IMSI)
Mobile Station ISDN (MS-ISDN)
Bearer & teleservice subscriptions
Service restrictions
Parameters for additional services
Information on subscriber
equipment
Authentication data
Using
When
The
HLR
MSC
handset
returns
directs
is
MS-ISDN
MSRN
MSC
assigned
acknowledges
receives
the
the
the
the
BSC
MSRN
at
MSC
registration
the
toroutes
–interrogates
the
page
incoming
a subscriber
“virtual”
incoming
theand
subscriber
call
call
number
the
iscall
to
itby
another
queries
HLR
the
and
and
telling
serving
to
the
“virtual”
find
its
inform
call
VLR
the
MSC.
status
isto
the
CallTMSI
isthe
placed
to
aGMSC
mobile
dialling
the
18765432 handset
established
and
GMSC
obtain
number
location
how
the
used
of
to
TMSI
an
between
of
for
route
incoming
mobile
for
security
the
the
subscriber.
call
subscriber.
call.
two
purposes.
toparties.
the serving
Together
The handset
MSC.
with cell
mayIDalso
mobile
number
(MS-ISDN).
signal theinformation
location
BSC / MSC stored
during in
thethe
call
VLR
to the
set up
MSCsupplementary
now has
sufficientsuch
services
information
as Call Hold,
to be3-way
able to
calling
routeetc.
the call.
MS-ISDN
MSRN
–
–
–
–
Mobile Station Roaming Number
(MSRN)
Temporary Mobile Subscriber
Identity (TMSI)
Current VLR address
Current MSC address
Local Mobile Subscriber Identity
©2001 - 2005 Erick O’Connor
PSTN
4
BTS
BSC
XCDR
GMSC
7
BTS
3 MSRN
5 MSRN
BSC
HLR
7 TMSI
BTS
MS + SIM
2 MS-ISDN
MSC
7
• Tracking & Routing Information
–
1
6
VLR
TMSI
8
TMSI
Principle of routing call to mobile subscribers
23
GPRS Design
A
GPRS network elements
Other GPRS
PLMN
SM-SC
BTS
BSC
GGSN
PCU
BG
SGSN
PDN
GGSN
BTS
BSC
VLR
BTS
GPRS MS + SIM
©2001 - 2005 Erick O’Connor
HLR
BG
BSC
BTS
GGSN
HLR
PCU
PDN
PLMN
SM-SC
SGSN
VLR
Border Gateway
Basestation Controller
Basestation Transceiver
Gateway GPRS Support Node
Home Location Register
Packet Control Unit
Packet Data Network (X25)
Public Land Mobile Network
Short Message Service Centre
Serving GPRS Support Node
Visitor Location Register
25
A
How GSM & GPRS co-exist
X.25 / IP / PDN
PSTN
Internet
De facto interfaces
G.703 E1 64kbps
DHCP
Radius
Firewall
DNS
Gi (IP)
SMSC
OSS
GMSC
MAP C
MAP E
VLR
GSM
MAP Gr
SGSN
A (G.703 E1 16kbps)
BTS
Cells
PCU
Gb (Frame Relay)
Abis (G.703 E1)
Voice or Data link
Signalling & Name of Interface
©2001 - 2005 Erick O’Connor
DNS
MAP Ga
GPRS
XCDR
BSC
LIAN
Gn (IP)
HLR
MAP D
SMSC
CG
GGSN
IWF
BSC
BTS
CCS7
CG
DHCP
DNS
GSN
HLR
IWF
LIAN
MAP
MSC
OSS
PCU
PSTN
VLR
XCDR
Basestation Controller
Basestation Transceiver
Common Channel Signalling #7
Charging Gateway
Dynamic Host Configuration Protocol
Domain Name Server
GPRS Serving Node (Serving / Gateway)
Home Location Register
Interworking Function (Circuit / Packet)
Legal Intercept Attendance Node
Mobile Application Part (CCS7)
Mobile Switching Centre (Serving / Gateway)
Operational Support System
Packet Control Unit
Public Switched Telephony Network
Visitor Location Register
Transcoder (16 / 64kbps coding)
26
GPRS key information
• Four Coding Schemes defined
– CS1 9.05 kbit / second per timeslot
– CS2 13.40
– CS3 15.60
– CS4 21.40
– Higher speed = Trade off of Forward Error
Correction & hence quality
• Three Handset Types defined
– Class A – simultaneous voice & data
– Class B – voice or data only at one time
– Class C – data only
• GSM offsets uplink timeslots (Ts) from
downlink by 3 to save on radio transmit /
receive hardware
– Therefore today’s handsets are typically:
•
1 Ts downlink
•
2 to 3 Ts uplink
•
Class B
•
CS1 & CS2 capable
•
Equals 3 x 13.40 = 40.20 kbit/s maximum
– Handsets can exceed this limit
•
But cost more…
•
Use more power etc,
GPRS
0 1 2 3 4 5 6 7 8
Downlink
Signalling
Uplink
GPRS
©2001 - 2005 Erick O’Connor
27
Protocol layers in GPRS
Application Protocol (http / ftp)
Transmission Control Protocol (TCP)
TCP
IP
Laptop
/ PDA
IP
TCP
TCP
IP
IP
SNDCP
SNDCP
GTP
GTP
LLC
LLC
UDP /
TCP
UDP /
TCP
IP
IP
RLC
RLC
BSSGP
BSSGP
MAC
MAC
Network
Service
Network
Service
L2
L2
GSM RF
GSM
RF
L1 bis
L1 Bis
L1
L1
GPRS MS
©2001 - 2005 Erick O’Connor
BSS
SGSN
GGSN
BSSGP
GSM RF
GTP
LLC
MAC
RLC
SNDCP
Basestation System GPRS Protocol
Radio Frequency
Gateway Tunnelling Protocol
Logical Link Control
Medium Access Control
Radio Link Control
Subnetwork Dependent Convergence Protocol
28
Mobility management
• Mobility management
–
–
–
Attach
• Know who is the MS
• Know what the user is allowed to do
Detach
• Leave the system
Location updates
• Know location of MS
• Route mobile terminated (MT) packets to MS
• Packet Data Protocol (PDP) Contexts
–
–
–
–
Every mobile must have an address for each
PDP Context in use
Addresses are statically or dynamically assigned
Context information includes:
• PDP Type
• PDP address (optional)
• Quality of Service (5 classes – Service
Precedence / Reliability / Delay /
Throughput Maximum & Mean)
SGSN has main control of QoS
• GPRS Service Descriptions
–
–
–
Point-to-Point
• Connection-orientated (X25)
• Connection-less (IPv4 / IPv6)
Point-to-Multipoint (Release 2)
• Multicast
• Groupcast
Short Message Service (SMS)
©2001 - 2005 Erick O’Connor
29
GPRS dimensioning
• 900MHz UK Network
• Dimensioning
– 7 Timeslots per Carrier
– 8 million subscribers
– 1 to 6 RF carriers / cell
– 10% GPRS handset penetration
– 1 to 3 cells / BTS
– 800,000 users
– 5,000 BTS
– 10:1 Activity factor
– 250 BSC
– 10:1 x 800,000 = 80,000 simultaneous users
– 50 MSC
– 8 SGSN / 2 GGSN
– 10 GMSC
• Exact dimensioning depends on:
• GPRS
– Number of users
– SGSN c.10,000 simultaneous users
– Geography
– GGSN c.45,000 simultaneous users
– Population density
– 10 to 1 contention ratio
– Data profile & activity
– GPRS growth
©2001 - 2005 Erick O’Connor
30
Evolution towards UMTS – All IP core
Internet
GSM & GPRS
PSTN
Packet Data
Packet
Gateway
HLR
Circuit
Gateway
CAMEL
All IP Packet
Network
Call Control
Server
BTS
RNC Server
BTS
BSC
UMTS
Node B
BTS
3rd Generation UMTS
©2001 - 2005 Erick O’Connor
31
Further Reading
• ‘GSM Switching, Services and Protocols’ – Jörg Eberspöcher & Hans-Jörg
Vögel, John Wiley & Sons, 2000
• ‘GPRS General Packet Radio Service’ – Regis J. “Bud” Bates, McGraw-Hill
Telecom Professional, 2002
• ‘GPRS Networks’ – Geoff Sanders, Lionel Thorens, Manfred Reisky, Oliver
Rulik, Stefan Deylitz, John Wiley & Sons, 2003
©2001 - 2005 Erick O’Connor
32