gsm overview

© 2002 Hughes Software Systems Ltd.

GSM Overview

Inderpal Singh


Hughes proprietary and Confidential

Contents

• GSM Network Architecture• GSM System Interfaces• Radio Channel coding• Mobility Management• Call Management• Radio Resource Management



GSM Overview

GSM Network Architecture



GSM Reference Model

MSC

MSC

HLR

AuC

BSCBTS GMSC

VLR

OtherVLR

MS

EIR

A-bisUm

A

E

BC

D

G

H

F

H

BSS

OMC



GSM System Entities

• MSC– Switching function, call handling– interfacing with PSTN, other MSC and other PLMN entities like

HLR, VLR, EIR etc.– control of inter BSS and inter-MSC handovers

• HLR– stores identities of mobile subscribers (IMSI, MSISDN),

subscription and service information, location information

• VLR– subscriber parameters for all MS currently located in the

geographical area served by the VLR– TMSI, MSISDN, MSRN, Location Area of the MS



GSM System Entities (Contd.)

• EIR– stores identity of mobile equipment (IMEI)

White or valid list Grey or monitored list Black or prohibited list

• AUC– contains subscriber authentication data called authentication key

(Ki)– generates security related parameters using Ki– cipher key (Kc) for encrypting user speech and data

• OMC– operate, administer and monitor BSS



GSM System Entities (Contd.)

• BSS– One BSC controls one or more BTSs, controls inter-BTS and

intra-BTS handovers– BTS for one or more cells and can have one or more TRXs– TRAU (Transcoder/Rate Adapter Unit) at BSS or MSC

adapts transmission rate at A-interface (64 kbps) to Abis interface (16 Kbps)

– Proprietary interface towards TRAU

• Billing Center• Service Center



GSM Protocol Stack

Connection Management Protocol

Mobility Management Protocol

Radio Resource Management Protocol

Layer 1Layer 1 Layer 1 Layer 1

SCCP’SCCP’ SCCP

MTP’MTP’ MTP

MAP

TCAPBSSAP

DTAP-CM

DTAP-MM

BSSAP

CM

MM

RR

RR’

LAPDm LAPDm LAPDmLAPDLAPD

BTSMBTSM

RR

Um Abis A

BSS

BTS BSC MSCMS

ISUP



• MS - BTS interface (Um)

– Layer 1 : timeslots on radio carrier– Layer 2 : LAPDm (modified version of ISDN LAPD protocol)– Layer 3

RR (Radio Resource management)– Direct MS-BSC communication. Paging, radio channel access, ciphering,

handover, radio signal control MM (Mobility Management)

– MS-MSC communication. Roaming and authentication procedures, location update

CM (Call management)– MS-MSC communication. Call establishment and release and access to

services

– BSS directly transfers MM and CM messages between MS and MSC

GSM Protocol Interfaces



GSM Protocol Interfaces (contd.)

• BTS - BSC interface (Abis)– Layer 1 : Physical layer– Layer 2 : LAPD– Layer 3 : BTSM (BTS Management Part)

control information between BSC and BTS. In BTS, mapping between BTSM and relevant RR messages over radio interface

• BSC - MSC interface (A)– SS No. 7 signaling– Transport part - MTP of ITU-T SS7– Signaling part - connectionless and connection-oriented

SCCP of ITU-T SS7



GSM Protocol Interfaces (contd.)– Application part - BSS application part (BSSAP)

BSSMAP (BSS Management Application Part)– Resource management, maintenance and handover control

procedures between MSC and BSS DTAP (Direct Transfer Application Part)

– direct interface between MSC and MS, not interpreted by BSS– DTAP-MM and DTAP-CM

• MSC - VLR interface (B)– usually VLR integral part of serving MSC and has internal

interface

• MSC - HLR interface (C)– MAP protocol to retrieve routing info during call setup to MS – MAP uses TCAP to manage dialog between two network entities



GSM Protocol Interfaces (contd.)

• VLR - HLR interface (D)– MAP protocol for transfer of subscriber info and instructions

to modify subscriber info

• MSC - MSC interface (E)– SS7 ISUP for trunk signaling– MAP protocol for inter-MSC handovers etc.

• MSC - EIR interface (F)– MAP protocol for IMEI related info

• VLR - VLR interface (G)– MAP is used to transfer subscriber info between VLRs

when MS moves from one VLR to other VLR area



GSM Overview

• GSM System Interfaces



Air Interface• Um interface

– Fully specified to achieve full compatibility between MS of different manufacturers and networks of different operators

– Frequency for Up link and Down link is 45 Mhz apart. – Band for up link and down link

Up link : 935-960 Mhz Down link: 890-915 Mhz

– 124 Frequency channels - ARFCN (Absolute radio Frequency Channel Number)

– 200 Khz channels– 8 mobiles share an ARFCN by TDMA



Air Interface (contd.)

0 1 2 3 4 5 6 7 0

0 1 2 3 4 5 6 7 0

Frequency (MHz)

960

935

915

890

8 Timeslots

TDMA

4.6 msec 0.57 msec

Channel x+1 down link

Channel x down link

124 Channels

0 1 2 3 4 5 6 7 0

0 1 2 3 4 5 6 7 0

8 Timeslots

TDMA

Channel x+1 up link

Channel x up link

Channel spacing 200 KHz

45 MHz

Time



Physical and Logical channels

• Physical channel -– determined by carrier frequency and timeslot number

• Logical channels one or more logical channels on a physical channel

– Traffic Channels TCH/F (Traffic Channel Full rate)

– Gross bit rate of 22.8 Kbps– Net bit rate of 13 Kbps for speech and 12, 6, 3.6 Kbps for data

TCH/H (Traffic Channel Half rate)– Gross bit rate of 11.4 Kbps– net bit rate of 5.6 Kbps for speech and 6 or 3.6 Kbps for data

– Signaling Channels - Broadcast, Common Control and Dedicated Control channels



Broadcast Channels Normally Broadcast and common control channels use Air slot 0

on the Radio interface. They can also use other air slots. (normally air slot 1 and rarely air slot 2 )

• Broadcast Channels (Down link only, point to multi point)

These channels help MS to orient itself to radio network

– BCCH (Broadcast Control Channel) MS is informed about system configuration parameters like LAI,

cell identity and neighbor cells to choose the best cell to attach to. Also known as beacon.

– FCCH (Frequency Correction Channel) to tune to BTS, FCCH transmits a constant frequency shift of the

carrier frequency so that MS can use it for frequency correction



Broadcast Channels

– SCH (Synchronization Channel) Time synch. Of MS carries TDMA frame number and BSIC

– CBCH (Cell Broadcast Channel) This channel used for broadcast type of services provided in a cell The MS may have to subscribe to these services to receive the

information broadcast on this channel



Common Control Channels

• Common Control Channels (UL or DL)– PCH (Paging Channel)

DL direction for paging MS

– AGCH (Access Grant Channel) DL direction for allocating a logical channel to MS for

connection which it requested via RACH

– RACH (Random Access Channel) UL direction, used by MS to request a channel for connection The network listens to RACH all the time. The network replies the RACH in the AGCH



Dedicated Control Channel

• Dedicated Control Channel (Full duplex, point to point)– signaling between particular MS and BTS– SACCH (Slow Associated Control Channel)

always allocated to TCH or SDCCH for transmission of non urgent signaling data, radio link supervision

measurements, power control and timing advance data

– FACCH (Fast Associated Control Channel) used as main signaling link for signaling data like handover

commands, call setup and call release transmitted over allocated TCH and is marked by stealing flag, the

process called pre-emption



Dedicated Control Channel

– SDCCH (Stand-alone Dedicated Control Channel) Duplex, point to point, used between BTS and MS when no

TCH used for location update, authentication, ciphering initiation,

equipment validation, SMS etc. SDCCH/4

– The channel is shared by 4 MS. This is used when the traffic (or no of MS ) in a cell is relatively low

SDCCH/8– The channel is shared by 8 MS. This is useful when the traffic

(or no of MS ) in a cell is high.



Multiplexing logical channels onto physical channels

• Several logical channels onto single physical channel• Some Control Channel Combinations

– FCCH + SCH + BCCH + CCCH

– FCCH + SCH + CCCH + BCCH + SDCCH/4 + SACCH/4

– CCCH + BCCH CCCH carries both PCH and AGCH in downlink and RACH in

uplink



F0

F1

Down Link (timeslot 0)

Multiplexing logical channels onto physical channels



Up link and Down link

• Up link lags down link by 3 TimeSlots• Up link and Down link use the same Time slot

number• Up link and down link use the same channel number

(ARFCN)• Up link and down link use different bands. They are

45 MHz apart for GSM 900



Up link and Down link

ARFCN

ARFCN

DOWNLINK

UPLINK

45 Mhz

2

2

2 2

43 5 76

43 5 76



Frame Types on Um - Interface

3 57 bits 1 26 bits 1 57 bits 3 8.25

Tail bitsTail bitsData Data

Mid amble

Control BitControl Bit

576.92 µ seconds

4.615 milli secs8 Time SlotsFRAME

6.12 secs

26 Frames = 120 msMULTI FRAME

SUPER FRAME 51 Multi frames = 6.12 sec

HYPER FRAME = 2048 Multiframes = 3 hours 28 minutes, 53 seconds and 760 msec

Guard period



Abis Interface

• Based on – PCM 30 (E1), 2048 Kbps, 32 timeslots of 64 Kbps each

for GSM 900 and GSM 1800 One Abis link can carry physical channels from 12 TRXs

– PCM 24 (T1), 1544 Kbps, 24 timeslots of 64 Kbps each for GSM 1900 One Abis link can carry physical channels from 10 TRXs

– Each PCM-30 or PCM 24 channel divided into four sub-timeslots of 16 Kbps. Each of these sub-timeslots carries one traffic channel of 13 Kbps



Identification Numbers

• MSISDN (Mobile Subscriber ISDN Number)– Directory number allocated to subscriber

• MSRN (Mobile Subscriber Roaming Number )– to route an incoming call to a MS that is not under GMSC

control

• IMSI (International Mobile Subscriber Identity)– embodied in SIM – 15 digits - MCC (3) + MNC (2) + MSIN

• TMSI (Temporary Subscriber identity)– Used in place of IMSI on radio link



Location Area

• Location Area - A cluster of one or more cells, – BTSs are controlled by one or more BSCs– BSCs of same MSC– Cells under same BSC make more than one location area– purpose is to limit paging to LA– LAI (Location Area Identity) to identify, stored by MS in SIM– LAI - MCC(3 digit) + MNC (2 digit) + LAC (2 octets)



Location Update

• Normal Location Update– MS detects new LA listening to LAI being transmitted on

BCCH and comparing it with stored LAI

• Periodic Location Update– At regular intervals in addition to normal procedure– from 6 minutes to 25.5 hours

• Power on Location update– After cell identification, PLMN selection, Cell selection



Phases in Location update• Request for Service

– detection of new location area and request to update its location

• Authentication– MS is authenticated with parameters from AuC

• Ciphering– UL and DL ciphered using parameters received during

authentication

• Update HLR/VLR– HLR updated with new MS location, de-registration in old VLR

• TMSI re-allocation - MS assigned new TMSI



Service Request phase

MS BSS New MSC/VLR Old MSC/VLR HLR

Channel Request

RACH

SDCCH Assignment

AGCH

Location Update Request (TMSI, Old LAI)

SDCCH

Request IMSI

Send IMSI



Authentication Phase

MS BSS New MSC/VLR Old MSC/VLR HLR/AuC

Get authentication parameters(IMSI)

Authentication parameters (SRES, Kc, RAND)

Authentication mobile station (RAND)

SDCCH

Authentication response (SRES)

SDCCH



Ciphering Phase


SDCCH

Ciphering completed

Cipher-uplink-channel

BSC ciphers the downlink Channel

SDCCH

Cipher Radio channel (Kc)

Uplink-channel-ciphered



Update HLR/VLR Phase


Location Updated

De-register mobile station

Update location

Mobile station De-registered



TMSI Reallocation phase

MS BSS New MSC/VLR Old MSC/VLR HLR

Location Update Accept (TMSI)

SDCCH

Clear Signaling Connection

SDCCH

Location Update Complete

SDCCH

Clear Complete

Release Radio Signaling Channel



Call Management

GSM Overview



Mobile Originating Call Scenario

• Mobile Originating call– Request for service– Authentication– Ciphering– Equipment Validation– Call setup– Handovers (if any)– Call release



Service Request and Authentication (MO call)

MS BSS MSC/VLR

Channel Request

RACH

SDCCH Assignment

AGCH

Service Request (TMSI, LAI)

SDCCH

HLR/AuC




SDCCH


SDCCH



Ciphering Phase and Equipment Validation (MO call)

MS BSS MSC/VLR EIR

SDCCH

Ciphering completed


BSC ciphers the DL Channel

SDCCH



SDCCH

SDCCH

IMEI Request

IMEI Response (IMEI)

Check IMEI

IMEI Check result



Call setup Phase (MO call)

MS BSS MSC/VLR

SDCCH Trunk & Radio

Assignment complete

Assign TCH

SDCCH

Assign Trunk and Radio (TN)

Radio Assignment Comp.

SDCCH

SDCCH

Call Setup Request

Call proceeding



Call setup with PSTN (MO call)MS BSS MSC/VLR PSTN

Connect (answer)

Alerting

FACCH

Network Setup

FACCH

FACCH

Connect

Connect Acknowledgement

Start Billing

Network Alerting



Call Release-MS initiated(MO call)MS BSS MSC/VLR PSTN

Clear Complete

Release

FACCH

Network Release

FACCH

FACCH

Clear command

Disconnect

Stop Billing

Channel Release

Release Complete

FACCH



Mobile Terminating Call Scenario

• Mobile Terminating call– Routing Analysis– Paging– Authentication– Ciphering– Equipment Validation– Call setup– Handovers (if any)– Call release



Routing Analysis (MT call)MSC/VLR HLR GMSC PSTN

Routing info (MSRN)

Routing info (MSRN)

Incoming Call (MSISDN)

Get Route (MSISDN)

Incoming call (MSISDN)

Get Route (IMSI)



Paging (MT call)

MS BSS MSC/VLR

AGCH

Page response

SDCCH Assignment

RACH

Perform Page (TMSI)

Channel Request

SDCCH

PCH

Page Response (TMSI, LAI)

Page



Authentication and ciphering (MT call)

MS BSS MSC/VLR HLR/AuC




SDCCH


SDCCH


SDCCH




Ciphering Phase and Equipment Validation (MT call)

MS BSS MSC/VLR EIR

Ciphering completed

BSC ciphers the DL Channel

SDCCH

SDCCH

IMEI Request

IMEI Response (IMEI)

Check IMEI

IMEI Check result

SDCCH




Call setup Phase (MT call)

MS BSS MSC/VLR

SDCCH Trunk & Radio

Assignment complete

Assign TCH

SDCCH

Assign Trunk and Radio (TN)

Radio Assignment Comp.

SDCCH

SDCCH

Call Setup

Call Setup Confirm



Call setup with PSTN (MT call)MS BSS MSC/VLR PSTN

Network Alerting

FACCH

Connect Achnowledge

HLR GMSC

FACCH

Mobile Alerting

FACCH

Connect (Off-hook)

Connect



Call Release Network initiated (MT call)

MS BSS MSC/VLR PSTN

FACCH

Disconnect

HLR GMSC

FACCH

Release

Clear Complete

Network Release

FACCH

Release Complete

Clear Command

Channel release

FACCH

Release Complete



Radio Resource Management

GSM Overview



Radio Resource Management

• Radio resource management to manage and dynamically share the limited radio resources– Power Control– Handover– Discontinuous Transmission– Frequency Hopping



Power Control

• Increase or decrease transmitted power on per radio link basis by MS and BTS

• Purpose– to save MS battery, improving carrier-to-interference ratio

• Enabled or disabled on per cell basis– If disabled transmission always at max level by MS and BTS

• Done for UL and DL separately but on BSC commands

• MS and BTS measure the performance of down link and Uplink and report to BSC



Handover• Process of automatically switching a call in progress from

one traffic channel to another to neutralize the effect of user movements

• Usually on TCH, sometimes on SDCCH also• Decision by BSC based on

– Distance (propagation delay) between MS and BTS too big which cannot be corrected by timing advance

– Signal strength on DL or UL too bad– Signal quality on on DL or UL too bad– Path loss (power budget) situation better for MS and another cell

• MS sends list of 6 best neighboring BTS



Handover

• Handover types– Intra-cell handover (BSC controlled)– Inter-cell handover (BSC controlled)– Inter-BSC handover (MSC controlled)– Inter-MSC handover (MSC controlled)

• MS unaware of the type of the Handover



THANK YOU

gsm overview

Documents

gross bit

radio assignment

sdcch trunk

gsm system

gsm protocol

authentication

multiplexing

carry physical