GSM (Global System for Mobile communi-

cations or Groupe Speciale Mobile) com-

11
munications, initiated by the ETSI (European
Telecommunications Standardisation
Institute), is the second-generation pan-
European digital mobile cellular communi-
cation standard with international roaming.
Global System for
It is used in the 900-MHz cellular band
as well as 1800-MHz PCS band in Europe
and most parts of Asia, whereas in the
Mobile (GSM)
1900-MHz PCS band in North America. This
chapter gives a detailed description of GSM
which includes architectures and interfaces
of GSM systems and subsystems, signaling
protocol architecture, logical channels and 11.1 GSM NETWORK ARCHITECTURE
frame structure, GSM security aspects, and
GSM uses two 25-MHz frequency bands, that is, the 890-MHz
various services offered by the system.
to 915-MHz band is used for mobile subscriber unit to base
station transmissions (reverse-link transmissions), and the
935-MHz to 960-MHz frequency band is used for base station
to mobile subscriber unit transmission (forward-link transmis-
sions). GSM uses Frequency-Division Duplexing (FDD) and
a combination of TDMA and FDMA techniques to provide
simultaneous access to multiple mobile subscriber units.
Facts to Know !
The GSM system has an allocation of
50 MHz in the 900-MHz frequency band.
Using FDMA, this band is divided into
124 RF channels, each with a carrier chan-
nel bandwidth of 200 kHz. Using TDMA, each of these
carrier channels is further divided into 8 time slots.
Thus, with the combination of FDMA and TDMA, a
maximum of 992 channels can be realised for transmit
and receive.

The GSM network architecture consists of three major

subsystems:
– Mobile Station (MS)
– Base Station Subsystem (BSS)
– Network and Switching Subsystem (NSS)
The wireless link interface is between the MS and the Base
Transceiver Station (BTS), which is a part of BSS. Many BTSs
 Global System for Mobile (GSM) 401

M
se
M ile s i n
M ile
s i n n r ller er i n nd
s i in
en er m in en n e en er
M M
M
se s i n
e r nd s i in
s s s em
M er s s s s em

M ile
s i n
P
er s

isi r l i n re is er
en i i n en er
M M ile e i men i men iden i re is er
M s ri er iden i m d le me l i n re is er
se r ns eiver s i n P P li s i ed ele ne ne r

Fig. 11.1 GSM network architecture

are controlled by a Base Station Controller (BSC). BSC is connected to the Mobile Switching Center (MSC),
which is a part of NSS. Figure 11.1 shows the key functional elements in the GSM network architecture.

11.1.1 Mobile Station (MS)

A mobile station communicates across the air interface with a base station transceiver in the same cell
in which the mobile subscriber unit is located. The MS communicates the information with the user and
modifies it to the transmission protocols of the air-interface to communicate with the BSS. The user’s
voice information is interfaced with the MS through a microphone and speaker for the speech, keypad, and
display for short messaging, and the cable connection for other data terminals. The MS has two elements.
The Mobile Equipment (ME) refers to the physical device, which comprises of the transceiver, digital signal
processors, and the antenna.
The second element of the MS in the GSM is the Subscriber Identity Module (SIM) that is a smart card
issued at the subscription time identifying the specifications of a user such as a unique number and the type of
service. The SIM card is unique to the GSM system. It is about postage-stamp size with 32 k bytes of memory
that can be plugged into any GSM mobile phone. From the user’s point of view, one of the most remarkable
features of GSM is the SIM card, which is a portable device in the form of a smart card or plug-in module
memory device that stores information such as the subscriber’s identification number, privacy keys, the cel-
lular networks and regions where the subscriber is authorised to service, and other user-specific information.
The GSM subscriber units are totally generic until a SIM is inserted. Therefore, a subscriber need only to
carry a SIM card to use a wide variety of mobile equipments simply by inserting the SIM in the device to be
used. In fact, except for certain emergency communications, the subscriber units will not work without a SIM
inserted. Thus, the mobile equipment does not roam, it is the SIM which roams. The calls in the GSM are
directed to the SIM inserted in any mobile phone. Short messages are also stored in the SIM card.
402 Wireless Communications

Facts to Know ! The SIM card allows a mobile subscriber to

use any GSM mobile phone anywhere in the world
The Mobile Station is the technical name
of the mobile or the cellphone. Although
where GSM services are available. Alternatively,
modern cellphones have become smaller people visiting different GSM-enabled countries
and lighter, they are still called Mobile that are not keen on making calls at their home
Stations as these were called so in early days due to their number can always carry their own mobile phone
being bulky and sometimes installed in vehicles. and purchase a SIM card in any other country. This
way they avoid roaming charges and the expense of
Facts to Know ! having a different contact number. Several users can
also share a mobile phone with different SIM cards.
The 32 kbytes SIM card has inherent secu-
rity features that make wireless transactions Because SIM cards carry the private informa-
more secure than conducting transac- tion for a user, a security mechanism is imple-
tions over the Internet. mented in the GSM that asks for a four-digit PIN
number to make the information on the SIM card
available to the user. The SIM card also offers some protection against fraudulent use. A GSM mobile phone
is useless without a SIM.
For example, if the mobile subscriber removes the SIM card when leaving the mobile phone in a vehicle,
the mobile phone cannot be used unless another person has a valid SIM. Unfortunately, the SIM cards can be
stolen too. The SIM can be set up to require the user to enter a Personal Identification Number (PIN) when-
ever the mobile phone is switched on to provide some security in case the card is lost or stolen.
Once a mobile phone user has a valid SIM, buying a new GSM mobile phone is easy. No set-up or programming
is required. Similarly, a user can have a permanently vehicle-installed mobile phone and a handheld mobile phone
with the same phone number, provided that only one is used at a time. The phone number of a mobile subscriber is
usually of 10–15 digits. The first three digits are the country code; the next two are the digits for the specific MSC,
and the rest are the telephone number. The IMSI of the same user is totally different from the ISDN telephone
number. The first three digits of the IMSI identify the country, and the next two digits, the service provider.
Besides the SIM card, the next most remarkable feature of GSM is the on-the-air privacy which is
provided by the system. Unlike analog FM cellular phone systems which can be readily monitored, it is virtually
impossible to eavesdrop on a GSM radio transmission. The privacy is made possible by encrypting the digital
bit stream sent by a GSM transmitter, according to a specific secret cryptographic key which changes with time
for each user that is known only to the service provider.

EXAMPLE 11.1 GSM air-interface standards

List the important GSM air-interface standard specifications.
Solution
The GSM standard specifications are given in Table 11.1.
Table 11.1 GSM standard air-interface specifications

S. No. Parameter Specification

1. Frequency band Uplink 890-MHz to 915-MHz

Downlink 935-MHz to 960-MHz
2. Spectral allocation 50-MHz (25 MHz each for uplink and downlink)
3. Forward and reverse channel frequency spacing 45-MHz
4. Tx/Rx time slot spacing 3 time slots
5. RF channel bandwidth 200-kHz (ARFCN channel spacing)
(Continued )
 Global System for Mobile (GSM) 403

Table 11.1 (Continued )

S. No. Parameter Specification

6. ARFCN number 0 to 124 and 975 to 1023
7. Multiple-access technique TDMA/FDMA
8. Duplexing technique FDD
9. Modulation scheme GMSK (B × Tb = 0.3)
10. Number of time-slots per RF channel bandwidth 8 (users per frame full rate)
11. Number of voice channels 1000
12. Modulation data rate 270.833 kbps
13. Spectrum efficiency 1.35 bps/Hz
14. Frame period 4.615 ms
15. Time slot period 577 μs
16. Bit period 3.692 μs
17. Interleaving (max. delay) 40 ms
18. Speech coding RELP-LTP @ 13.4 kbps
19. Channel coding CRC with r = ; L = 5 convolutional coding
20. Type of equalisers Adaptive
21. Handheld mobile Tx power 1 W max; 125 mW avg.

11.1.2 Base Station Subsystem (BSS)

A base station subsystem consists of a base station controller and one or more base transceiver stations. Each
Base Transceiver Station (BTS) defines a single cell. A cell can have a radius of between 100 m and 35 km,
depending on the environment. A Base Station Controller (BSC) may be collocated with a BTS. It may control
multiple BTS units and hence multiple cells. The BSC reserves radio frequencies, manages the hand-off of a
mobile unit from one cell to another within the BSS, and controls paging. The BSS manages the radio interface
between the mobile stations and all other subsystems of GSM such as MSC.
The BSS translates between the wireless-interface and fixed wired infrastructure protocols. The needs for
the wireless and wired media are different because the wireless medium is unreliable, bandwidth limited, and
needs to support mobility. As a result, protocols used in the wireless medium and wired medium are different.
The BSS provides for the translation among these protocols.
There are two main architectural elements in the BSS––the Base Transceiver Subsystem (BTS), and the
Base Station Controller (BSC). The BSS consists of many BSCs which connect to a single MSC, and each
BSC typically controls up to several hundred BTSs. Some of the BTSs may be co-located at the BSC, and
others may be remotely distributed and physically connected to the BSC by microwave links or dedicated
leased lines. The BTS is the counterpart of the MS for physical communication over the air-interface. The BTS
components include a transmitter, a receiver, and signaling equipment to operate over the air-interface, and it
is physically located in the centre of the cells where the BSS antenna is installed. One BSS may have from one
up to several hundred BTSs under its control. The hand-offs of calls between two BTSs under the control of the
same BSC are handled by the BSC, and not the MSC. This greatly reduces the switching burden of the MSC.
The interface that connects a BTS to a BSC is called the A-bis interface. The A-bis interface carries traffic
and maintenance data. The main function of the BSC is to look over a certain number of BTSs to ensure proper
operation. The BSC is a small switch inside the BSS in charge of frequency administration, maintains appropriate
power levels of the signal and hand-off among the BTSs inside a BSS. The hardware of the BSC in a single BTS
site is located at the antenna and in the multi-BTS systems, in a switching centre where other hardware elements
404 Wireless Communications

Facts to Know !
In a metropolitan city, a large number
of BTSs are potentially deployed. A BTS
is usually placed in the centre of a cell
and its transmitting power defines the
size of a cell.

of NSS are located. The interface between a BSC and an MSC is

called the A interface, which is standardised within GSM.
The user’s speech signal is converted into 13 kbps-digitised
voice with a speech coder and communicated over the air-interface
to provide a bandwidth efficient air-interface. The backbone
wired network uses a 64 kbps PCM digitised voice in the PSTN hier-
archy. Conversion from analog speech signal to 13 kbps digitised
voice signal takes place at the mobile station, and the change from
13 kbps to 64 kbps coding takes place at the BSS. The call is
established through the exchange of a number of packets.

11.1.3 Network and Switching Subsystem (NSS)

The NSS is responsible for the network operation. It provides
the link between the cellular network and the Public Switched
Telecommunications Networks (PSTN or ISDN or Data
Networks). The NSS controls hand-offs between cells in different
BSSs, authenticates users and validates their accounts, and
includes functions for enabling worldwide roaming of mobile subscribers. The NSS could be interpreted as a
wireless specific switch that communicates with other switches in the PSTN and at the same time supports
functionalities that are needed for a cellular mobile environment. The NSS interconnects to the PSTN through
ISDN protocols. The NSS provides communications with other wired and wireless networks, as well as support
for registration and maintenance of the connection with the MSs via BSCs in the radio subsystem.
The network and the switching subsystem together include the main switching functions of GSM as well
as the databases needed for subscriber data and mobility management. In particular, the switching subsystem
consists of
– Mobile Switch Centre (MSC)
– Home Location Register (HLR)
– Visitor Location Register (VLR)
– Authentication Centre (AuC)
– Equipment Identity Register (EIR)
– Interworking Function (IWF)
The NSS is the most elaborate element of the GSM network, and it has one hardware, Mobile Switching
Centre (MSC), and four software database elements: Home Location Register (HLR), Visitor Location Register
(VLR), Equipment Identification Register (EIR), and Authentication Centre (AuC). An MSC is the hardware
part of the wireless switch that can communicate with PSTN switches using the signaling system-7 (SS-7)
protocol, as well as other MSCs in the coverage area of a service provider. If the MSC has an interface to the
PSTN then it is called a Gateway MSC (GMSC). The MSC also provides the network the specific information
on the status of the mobile terminals. The MSC basically performs the switching functions of the system by
 Global System for Mobile (GSM) 405

controlling calls to and from other telephone and Facts to Know !

data systems. It also does functions such as network
NSS acts like a normal switching node for
interfacing and common channel signaling.
mobile subscribers of the same GSM network
Because the GSM represents an independent or for the PSTN fixed telephone or for ISDN,
network, it must dispose of entities which pro- and provides all the functionality such as
vide connection to other users. Therefore, the registration, authentication, location updating, handovers
main component of the switching subsystem is the and call routing to handle a mobile subscriber.
Mobile Switching Centre, MSC. The main role of
the MSC is to manage the communications between the GSM users and other telecommunications network
users. The basic switching function is performed by the MSC, whose main function is to coordinate setting up
calls to and from GSM users. The MSC has interfaces with the BSS on one side (through which MSC VLR is
in contact with GSM users) and the external networks on the other side (ISDN/PSTN). An MSC is generally
connected to several BSSs, which provide radio coverage to the MSC area. The MSC is also connected to other
GSM Public Land Mobile Network (PLMN) entities such as other MSCs and HLR through a fixed network.
The MSC is the telephone switching office for mobile-originated or terminated traffic. The MSC controls the
call set-up and routing procedures in a manner similar to the functions of a land network end office. The MSC
provides call set-up, routing, and handover between BSCs in its own area and to/from other MSCs; an interface
to the fixed PSTN; and other functions such as billing. It also performs such functions as toll ticketing, network
interfacing, common channel signaling, and others.
The HLR is database software that handles the management of the mobile subscriber account. It stores
the subscriber’s address, service type, current location, forwarding address, authentication/ciphering keys,
and billing information. In addition to the ISDN telephone number for the terminal, the SIM card is identi-
fied with an International Mobile Subscriber Identity (IMSI) number that is totally different from the ISDN
telephone number. The IMSI is used totally for internal networking applications. Each HLR is identified by
the HLR number which is sent to all the required VLRs. The HLR is the reference database that permanently
stores data related to subscribers, including a subscriber’s service profile, location information, and activity
status. When an individual user buys a subscription from one of the GSM service providers, he is registered
in the HLR of that service provider.
Various identification numbers and addresses Facts to Know !
as well as authentication parameters, services sub- When a cellphone is powered off, the
scribed, and special routing information are stored administrative information such as current
in the HLR. Current subscriber status, including a location of the mobile, all the service pro-
subscriber’s temporary roaming number and asso- visioning information and authentication
ciated VLR if the mobile is roaming, are main- data is stored in the HLR.
tained. Location registration is performed by HLR.
The HLR provides data needed to route calls to all MS-SIMs home based in its MSC area, even when they are
roaming out of area or in other GSM networks. The HLR provides the current location data needed to support
searching for and paging the MS-SIM for incoming calls, wherever the MS-SIM may be. The HLR is respon-
sible for storage and provision of SIM authentication and encryption parameters needed by the MSC where the
MS-SIM is operating. It obtains these parameters from the AuC. The HLR maintains records of which
supplementary services each user has subscribed to and provides
Facts to Know !
permission control in granting access to these services.
Based on described functions, different types of data are Although an HLR may be
stored in the HLR. Some data are permanent; that is, they are implemented as a distributed
database, yet there is logically
modified only for administrative reasons, while others are tem-
one HLR per GSM network.
porary and modified automatically by other network entities
406 Wireless Communications

depending on the movements and actions performed by the subscriber. Some data are mandatory, other data
are optional. Both the HLR and the VLR can be implemented in the same equipment in an MSC (collocated).
A PLMN may contain one or several HLRs.
The VLR is a temporary database software similar to the HLR identifying the mobile subscribers visiting
inside the coverage area of an MSC. The VLR assigns a Temporary Mobile Subscriber Identity (TMSI) that is
used to avoid using IMSI on the air. The location of the mobile subscriber is determined by the VLR into which
the mobile subscriber is entered. The visitor location register maintains information about mobile subscribers that
are currently physically in the region covered by the switching centre. It records whether or not the subscriber
is active and other parameters associated with the subscriber. For a call coming to the mobile subscriber, the
system uses the mobile phone number associated to identify the home switching centre of the mobile subscriber.
The home switching centre can find in its HLR the switching centre in which the mobile subscriber is presently
located. For a call coming from the mobile subscriber, the VLR is used to initiate the call. Even if the mobile sub-
scriber is in the area covered by its home switching centre, it is also represented in the switching centre’s VLR.
A VLR is linked to one or more MSCs. The function of the VLR is to memorise temporarily information
about the mobiles which are currently located in the geographical area controlled by the linked MSC. The
VLR is a database that contains temporary information about subscribers that is needed by the MSC in order
to service visiting subscribers. The VLR supports a mobile paging-and-tracking subsystem in the local area
where the mobile is presently roaming. The VLR is always integrated with the MSC. A VLR may be in charge
of one or several MSC LAs (Location Areas).
When a mobile subscriber roams from one LA
Facts to Know ! to another, their current location is automatically
updated in their VLR. When a mobile station roams
The VLR can be considered as a temporary
copy of some of the important information into a new MSC area, if the old and new LAs are
(selected administrative information neces- under the control of two different VLRs, the VLR
sary for call control and provisioning of the connected to that MSC will request data about the
subscribed services) stored in the HLR. HLR is the persis- mobile station from the HLR. The entry on the old
tent storage whereas VLR is similar to a cache. VLR is deleted and an entry is created in the new
VLR by copying the basic data from the HLR.
Later, if the mobile station makes a call, the VLR will have the information needed for call set-up without having
to interrogate the HLR each time. The subscriber’s current VLR address, stored at the HLR, is also updated. This
provides the information necessary to complete calls to roaming mobiles. These two databases, HLR and VLR,
are used to keep track of the current location of an MS in GSM. Maintenance of two databases at home and at
the visiting location allows a mechanism to support dialing and call routing in a roaming situation where the MS
Facts to Know ! is visiting the coverage area of a different MSC.
GSM transmission is encrypted. The AuC data-
The HLR is always fixed and remains in the base holds different algorithms that are used for
home network, whereas the VLR logically
authentication and encryption of the mobile sub-
moves with the subscriber. For example, if
a subscriber of a GSM network in Mumbai scribers that verify the mobile user’s identity and
is roaming in Kolkata, the HLR data of the subscriber will ensure the confidentiality of each call. The AuC
remain in Mumbai with the home network; however, protects network cellular operators from differ-
the VLR data will be copied to the roaming network in ent types of frauds and spoofing found in today’s
Kolkata. This enables the subscribed services without cellular world. AuC holds the authentication and
needing to refer to the HLR each time a communication encryption keys for all the subscribers in both
is established. Though the visiting network in Kolkata the home and visitor location registers. A stream
will provide the user services, the billing will be done by cipher, A5, is used to encrypt the transmission
the home network in Mumbai.
from subscriber to base transceiver. However,
 Global System for Mobile (GSM) 407

the conversation is in the clear in the landline network. Another cipher, A3, is used for authentication. Different
classes of SIM cards have their own algorithms, and the AuC collects all of these algorithms to allow the NSS
to operate with different mobile terminals from different geographic areas.
The EIR is another database that keeps the information about the identity of mobile equipment such as
the International Mobile Equipment Identity (IMEI) that reveals the details about the manufacturer, country
of production, and device type. This information is used to prevent calls from being misused, to prevent
unauthorised or defective MSs, to report stolen mobile phones or check if the mobile phone is operating
according to the specification of its type.
Each mobile equipment is identified by IMEI which is memorised by the manufacturer and cannot be
removed. By the registration mechanism the MS always sends the IMEI to the network, so that the EIR can
memorise and assign them to three different lists:
White List This list contains the IMEI of the phones who are allowed to enter in the network.
Black List This list on the contrary contains the IMEI of the phones who are not allowed to enter in the
network, for example because they are stolen. Those phones are not able to enter in all the GSM networks
which dispose of an EIR.
Grey List This list contains the IMEI of the phones momentarily not allowed to enter in the network, for
example because the software version is too old or because they are in repair.
By the registration mechanism, the MSC checks if the MS is contained in the black or grey list; if so, the
mobile cannot enter the network. One EIR per GSM network is enough. In the future there will be an intercon-
nection between all the EIRs to avoid the situation where a mobile stolen in one country can be used in a GSM
network from a different country. Both AuC and EIR can be implemented as individual stand-alone nodes or
as a combined AuC/EIR node. The implementation of the EIR is left optional to the service provider.
IWF-Interworking Function It is a subsystem in the PLMN that allows for non-speech communication
between the GSM and the other networks. The tasks of an IWF are particularly to adapt transmission param-
eters and protocol conversion. The physical manifestation of an IWF may be through a modem which is
activated by the MSC dependent on the bearer service and the destination network.
The SS supports operation and maintenance of the system and allows engineers to monitor, diagnose,
and troubleshoot every aspect of the GSM network. The OSS supports one or several Operation Maintenance
Centres (OMC) that are used to monitor and maintain the performance of each MS, BS, BSC, and MSC
within a GSM system. The OSS has three main functions, which are to maintain all telecommunications
hardware and network operations with a particular service area, manage all mobile equipment in the system,
and manage all charging and billing procedures. Within each GSM system, an OMC is dedicated to each of
these tasks and has provisions for adjusting all base-station parameters and billing procedures, as well as for
providing system operators with the ability to determine the performance and integrity of each unit of mobile
subscriber equipment in the system.

11.2 GSM SIGNALING PROTOCOL ARCHITECTURE

Figure 11.2 shows the signaling protocol architecture for communication between the main hardware
elements of the GSM network architecture and the associated interfaces.
The GSM standard specifies the interfaces among all the elements of the architecture. The air-interface
‘Um’, which specifies communication between the MS and BTS, is the wireless related interface. Messages
between the BTS and BSC flow through the A-bis interface. The support on this interface is for voice traffic
at 64 kbps and data/signaling traffic at 16 kbps. Both types of traffic are carried over LAPD (which is a data
link protocol used in ISDN).
408 Wireless Communications

is
ir in er e in er e in er e

M M

MM MM

M M M M

P P

P P P P M P M P

di di 4 s 4 s 4 s 4 s
M M

M nne i n m n emen
MM M ili m n emen P in ess r l
M di res r e m n emen P i n l nne i n n r l r
P in ess r l rm ile M P Mess e r ns er r

Fig. 11.2 The GSM signaling protocol architecture

The interface between a BSC and a MSC is called the A’ interface, which is standardised within GSM.
The A’ interface uses an SS7 protocol called the Signaling Connection Control Part (SCCP) which supports
communication between the MSC and the BSS, as well as network messages between the individual mobile
subscribers and the MSC. The A’ interface allows a service provider to use base stations and switching equip-
ment made by different manufacturers.
A number of control messages are exchanged between the key entities of GSM network architecture that
deal with radio resources, mobility management, and connection management. The protocol stack is divided
into three layers:
Layer 1 Physical Layer
Layer 2 Data Link Layer (DLL)
Layer 3 Networking or Messaging Layer

11.2.1 Layer I: Physical Layer

The physical layer defined in the GSM specifications is for the Um air-interface. The radio link carries higher-
level data inside the TDMA format between the mobile station and the base transceiver station. This layer speci-
fies how the information from different voice and data services are formatted into packets and sent through the
radio channel. It specifies the radio modem details, the packaging of a variety of services into the bits of a packet,
traffic structure and control packets. This layer specifies modulation and coding techniques, power control meth-
odology, and time synchronisation approaches which enable establishment and maintenance of the channels. The
physical layer of the A and A-bis interfaces follow the ISDN standard with 64 kbps digital data per voice user.

11.2.2 Layer II: Data Link Layer

The control and signaling data transfer may be through the same physical channels or through separate physi-
cal channels. Signaling and control data are conveyed through Layer II and Layer III messages. At the link
 Global System for Mobile (GSM) 409

layer, a data link control protocol known as LAPDm is used where m refers to the modified version of LAPD
adapted to the mobile environment. In essence, LAPD is designed to convert a potentially unreliable physical
link into a reliable data link. It does this by using a cyclic redundancy check to perform error detection and
Automatic Repeat Request (ARQ) to retransmit damaged frames. The LAPD protocol is used for the A-bis
and A interfaces connecting the BTS to BSC and BSC to MSC, respectively.
The overall purpose of DLL is to check the flow of packets for Layer III and allow multiple Service
Access Points (SAP) with one physical layer. The remaining links use the normal LAPD protocol. The DLL
checks the address and sequence number for Layer III and manages acknowledgments for transmission of the
packets. In addition, the DLL allows two SAPs for signaling and Short Messages (SMS). The SMS traffic
channel in the GSM is not communicated through voice channels. In GSM, the SMS is transmitted through
a fake signaling packet that carries user information over signaling channels. The DLL in GSM provides this
mechanism for multiplexing the SMS data into signaling streams.
Signaling packets delivered to the physical layer are each 184 bits, same as that of the length of the DLL
packets in the LAPD protocol used in the ISDN networks. The length of the LAPDm packets, shown in
Fig. 11.3, is the same as LAPD, but the format is slightly adjusted to fit the mobile environment.

1 4 i s ixed

ddress ield n r l ield en indi r n rm i n i s ill in i s

is is is v ri le v ri le

Fig. 11.3 Frame format of the Layer II in LAPDm

Since GSM has the time synchronisation and strong coding at the physical layer, the synchronisation bits
and CRC codes in LAPD are eliminated in the LAPDm. The address field is optional, and it identifies the
SAP, protocol revision type, and nature of the message. The control field is also optional, and it holds the type
of the frame (command or response) and the transmitted and received sequence numbers.
The length indicator identifies the length of the information field. Fill-in bits are all 1s bits to extend the
length to the desired 184 bits. In peer-to-peer Layer II communications, such as DLL acknowledgments, there is
no Layer III payload and fill-in bits cover this field. The information field carries the Layer III payload data.
The peer-to-peer Layer II messages are unnumbered acknowledgment, receiver ready, receiver not ready,
disconnect, and reject. These messages do not have Layer III information bits and are referred to as Layer II
messages. The information bits in Layer II packets specify Layer III operations implemented on the logical
signaling channels. These information bits are different for different operations.
11.2.3 Layer III: Networking or Signaling Layer
The networking or signaling layer implements the protocols needed to support the mechanisms required to
establish, maintain, and terminate a mobile communication session. It is also responsible for control func-
tions for supplementary and SMS services. The traffic channels are carried by normal bursts in different
formats associated with different speech or data services. The signaling information uses other bursts and
more complicated DLL packaging. A signaling procedure such as the registration process is composed of a
sequence of communication events or messages between hardware elements of the systems that are imple-
mented on the logical channels encapsulated in the DLL frames.
Layer III defines the details of implementation of messages on the logical channels encapsulated in DLL
frames. Among all messages communicated between two elements of the network only a few, such as
DLL acknowledgment, do not carry Layer III information. Information bits of the Layer II packets specify
the operation of a Layer III message. As shown in Fig. 11.4, these bits are further divided into several fields.
410 Wireless Communications

n rm i n d is

r ns i n Pr l n rm i n n rm i n
Mess e e
iden i ier dis rimin r elemen s elemen s iden i ier

Fig. 11.4 Typical Layer III message format

The Transaction Identifier (TI) field is used to identify a procedure or protocol that consists of a sequence
of messages. This field allows multiple procedures to operate in parallel. The Protocol Discriminator (PD)
identifies the category of the operation (management, supplementary services, call control, and test proce-
dure). The Message Type (MT) identifies the type of message for a given PD. Information Elements (IE) is
an optional field for the time that an instruction carries some information that is specified by an IE Identifier
(IEI). The number of Layer III messages is much larger than the number of Layer II messages.
To further simplify the description of the Layer III messages, GSM standard divides the messages into
three sublayers that provide specific functions:
– Radio Resource Management (RRM)
– Mobility Management (MM)
– Communication Management (CM)
The RRM sublayer of Layer III manages the frequency of operation and the quality of the radio link. Radio
resource management establishes and releases connections between MSs and an MSC and maintains them
despite subscriber movements. The RRM functions are mainly performed by the MS and the BSC. The main
responsibilities of the RRM are to assign the radio channel and hop to new channels in implementation of the
slow frequency-hopping option, to manage hand-off procedure and measurement reports from MS for hand-
off decision, to implement power control procedure, and to adapt to timing advance for synchronisation.
The major functions of Mobility Management (MM) sublayer are location update, registration procedures,
authentication procedure, TMSI handling, and attachment and detachment procedures for the IMSI. This
sublayer handles mobility issues that are not directly related to the radio, and include management of security
functions. Mobility management functions are handled by the MS/SIM, the MSC/VLR, and the HLR/AuC.
The Communication Management (CM) sublayer is used to establish, maintain, and release the circuit-
switched connection between the calling and called subscribers of GSM network. Specific procedures for the
CM sublayer include mobile-originated and mobile-terminated call establishment, change of transmission
mode during the call, control of dialing using dual-tones, and call reestablishment. In addition to call manage-
ment, it includes supplementary services management and SMS management.
The Mobile Application Part (MAP) handles most of the signaling between different entities in the fixed
part of the network, such as between the HLR and VLR. It runs on top of two intermediate protocols––Signal
Connection Control Part (SCCP) and Message Transfer Part (MTP). SCCP and MTP protocols are part of
Signaling System Number 7, which is a set of protocols designed to provide control signaling within digital
circuit-switching networks.
Facts to Know !
11.2.4 SS7 Signaling
SS7 is also used for many other Common Channel Signaling System No. 7 (SS7 or CC7)
Intelligent Network Services (like
is a global standard that defines the procedures and
virtual calling card service and local
number portability) within the GSM. protocol by which network elements in PSTN exchange
information over a digital signaling network to effect
wireless (cellular) and wireline call set-up, routing and control. The SS7 signaling protocols are mainly used
for basic call set-up, call management, wireless services such as PCS, wireless roaming, mobile subscriber
 Global System for Mobile (GSM) 411

authentication, local number portability, toll-free and toll wireline services, enhanced call features such as
call forwarding, calling party name/number display, and three-way calling, efficient and secure worldwide
telecommunications. The SS7 protocol provides both error correction and retransmission capabilities to allow
continued service in the event of signaling point or link failures.
SS7 messages are exchanged between network elements over 64 kbps bi-directional channels called sig-
naling links. Signaling occurs out-of-band on dedicated channels rather than in-band on voice channels.
Compared to in-band signaling, out-of-band signaling provides faster call set-up times, more efficient use
of voice circuits, support for Intelligent Network (IN) services which require signaling to network elements
without voice trunks (for example, database systems), and improved control over fraudulent network usage.
There are three kinds of signaling points in the SS7 network:
– Service Switching Point (SSP)
– Signal Transfer Point (STP)
– Service Control Point (SCP)
SSPs are switches that originate, terminate, or tandem calls. An SSP sends signaling messages to other
SSPs to set up, manage, and release voice circuits required to complete a call. An SSP may also send a query
message to a centralised database, an SCP, to determine how to route a call. An SCP sends a response to the
originating SSP containing the routing number(s) associated with the dialed number. An alternate routing
number may be used by the SSP if the primary number is busy or the call is unanswered within a specified
time. Actual call features vary from network to network and from service to service.
Network traffic between signaling points may be routed via a packet switch called STP. The STP routes
each incoming message to an outgoing signaling link based on routing information contained in the SS7 mes-
sage. Because it acts as a network hub, STP provides improved utilisation of the SS7 network by eliminating
the need for direct links between signaling points. The STP may perform global title translation, a proce-
dure by which the destination signaling point is determined from digits present in the signaling message.
The STP can also act as a firewall to screen SS7 mes-
sages exchanged with other networks. Because the SS7 Facts to Know !
network is critical to call processing, SCPs and STPs are SCPs provide the access mechanism
usually deployed in pair configurations in separate physi- required for a service. These are used
cal locations to ensure network-wide service in the event for a variety of applications such
of an isolated failure. as calling card verification, toll-free
calls, and premium tariff calls.
11.2.5 Addressing and Routing
Within the GSM network, two types of routing can be described:
– SS7 addressing and message signaling routing
– Call control/number routing
The SS7 MTP layer 3 provides the routing function. This layer is used to route within a local network using
the Signaling Point Code addressing. To interconnect all the local networks on the national SS7 networks,
the SCCP Global Title Translation (GTT) functionality is used. Global Title Translation is one of the strong
routing capabilities of SS7 SCCP layer. This SCCP functionality allows a centralised network to hold and
maintain all the addresses and routing tables, centralising the routing function. For MSC to send a message
to a particular HLR, the MSC does not need to know each Mobile’s HLR point code. Only the adjacent STP
point code and the dialed digits (MSISDN) needs to be provided to the STP in order to route the message to
the HLR. The STP will perform the translation of the dialed digits to physical point code (HLR or MSC).
The STP pair after checking the SCCP header information will determine if the message requires GTT trans-
lation. It will then extract the IMSI of the subscriber from the calling number address field in the SCCP header
412 Wireless Communications

Facts to Know ! and from a database table determine the HLR point code
where the validation/authentication should be sent. This will
STP is similar to a switch or a node in
eliminate book-keeping on every MSC and centralise the
the SS7 signaling network performing
the basic routing functions. For fault routing/translation on the SS7 STP network.
tolerance, STPs are always installed in A landline calling party dials the GSM mobile
pairs with cross-connections. directory number (MS ISDN number). The PSTN after
performing the digits translation routes the call to the
home PLMN GMSC. The GMSC contains either the routing tables to relate the MSISDN number with the
corresponding HLR, or if the GMSC is connected to the SS7 network with the GTT functionality, the SS7
network will identify the HLR. Once the GMSC interrogates the HLR with the MSISDN number, the HLR
determines the IMSI from the MSISDN number. The HLR stores the subscriber’s information based on IMSI,
not MSISDN. The HLR locates the visiting MSC/VLR point code and if the MSRN is available, it will return
the information to GMSC. If the HLR does not have the MSRN for the subscriber it will request one from
the visiting MSC/VLR. The latter can be done via GTT if an SS7 backbone with GTT (IMSI to point code)
functionality is available/supported. The GMSC once it receives the MSRN and the MSC/VLR point code,
will route the call to the VMSC/VLR. The MSC/VLR will then page the mobile subscriber.
The call-originating information including the dialed digits will be sent to the MSC/VLR. The MSC/VLR
with the subscriber’s profile information performs digits translation (if supported) and routes the call either
to the PSTN or to other MSCs. If the MSC cannot perform the digits translation it would route the call to
GMSC for translation and routing.

11.2.6 Location Update

A list of relevant functions of a mobile station includes provision of location updates. The location-updating
procedures, and subsequent call routing, use the MSC and two location registers: HLR and VLR. When a
mobile station is switched on in a new location area, or
Facts to Know ! it moves to a new location area or different operator’s
The reason a routing number is not nor- PLMN, it must register with the network to indicate its
mally assigned, even though it would current location. In the normal case, a location update
reduce signaling, is that there is only message is sent to the new MSC/VLR, which records
a limited number of routing numbers the location area information, and then sends the loca-
available in the new MSC/VLR and they are allocated tion information to the subscriber’s HLR. The infor-
on demand for incoming calls.
mation sent to the HLR is normally the SS7 address of
the new VLR, although it may be a routing number.
If the subscriber is entitled to service, the HLR sends a subset of the subscriber information, needed for
call control, to the new MSC/VLR, and sends a message to the old MSC/VLR to cancel the old registration.
For reliability reasons, the GSM also has a periodic location updating procedure. If an HLR or MSC/VLR
fails, to have each mobile register simultaneously to make the database up-to-date would cause overloading.
Therefore, the database is updated as location updating events occur. The enabling of periodic updating, and
the time period between periodic updates, is controlled by the operator, and is a trade-off between signaling
traffic and speed of recovery. If a mobile does not register after the updating time period, it is de-registered.
A procedure related to location updating is the IMSI attach and detach. A detach permits the network to
know that the mobile station is unreachable, and avoids having to needlessly allocate channels and send paging
messages. An attach is similar to a location update, and informs the system that the mobile is reachable again.
The activation of IMSI attach/detach is up to the operator on an individual cell basis. Location update is a typical
example for the connection-oriented transactions in GSM. The local operation code UpdatLocation is required
directly after the location update for the new VLR to update the location information in the HLR. Because this
is a confirmed service, it requires all four variants: request, indication, response and confirmation.
 Global System for Mobile (GSM) 413

11.3 IDENTIFIERS USED IN GSM SYSTEM

Several identity numbers are associated with a GSM system, which are briefly described below.

11.3.1 IMSI
The International Mobile Subscriber Identity (IMSI) number is usually 15 digits or less. When an MS attempts
a call, it needs to contact a BS. The BS can offer its service only if it identifies the MS as a valid subscriber. For
this, the MS needs to store certain values uniquely defined for the MS, like the country of subscription, network
type, subscriber ID, and so on. These values are called the International Mobile Subscriber Identity (IMSI). The
structure of an IMSI is shown in Fig. 11.5. The first three digits specify the country code, the next two specify the
network provider code, and the rest are the mobile subscriber identification code (the customer ID number).
Another use of IMSI is to find information about the subscriber’s home Public Land Mobile Network
(PLMN). All such information is placed on the SIM card.

11.3.2 Subscriber Identity Module (SIM)

Every time the MS has to communicate with a BS, it must correctly identify itself. An MS does this by stor-
ing the mobile phone number, personal identification number for the mobile station, authentication param-
eters, and so on, in the SIM card. Smart SIM cards also have a flash memory that can be used to store small
messages sent to the unit.
The main advantage of SIM is that it supports roaming with or without a cellphone, also called SIM roam-
ing. All a user needs to do is to carry the SIM card alone, and insert it into any GSM mobile phone to make
it work as per customised MS. In other words, the SIM card is the heart of a GSM mobile phone, and the MS
hardware equipment is unusable without it.

11.3.3 Mobile System ISDN (MSISDN)

MSISDN is the number that identifies a particular MS’s subscriber, with the format shown in Fig. 11.6.
The GSM actually does not identify a particular mobile phone, but a particular HLR. It is the responsibil-
ity of the HLR to contact the mobile phone.

11.3.4 Location Area Identity (LAI)

As shown in Fig. 11.7, the GSM service area is usually divided into a hierarchical structure that facilitates the
system to access any MS quickly.

15 di i s r less
3 di i s 2 di i s di i s

M ile nr de M ile ne r de M ile s s ri er

M M iden i i i n de M

Fig. 11.5 Format of IMSI

15 di i s r less
1 3 di i s ri le ri le

M ile nr de i n l des in i n de s ri er n m er
M

Fig. 11.6 Format of MSISDN

414 Wireless Communications

Each PLMN area is divided into many MSCs.

Each MSC typically contains a VLR to inform the
system if a particular cellphone is roaming, and if it
ell re is roaming, the VLR of the MSC, in which the cell-
phone is, reflects the fact. Each MSC is divided into
i n re many Location Areas (LAs). An LA is a cell or a
group of cells and is useful when the MS is roaming
ne M re
in a different cell but the same LA. Since any LA has
to be identified as a part of the hierarchical structure,
P M re the identifier should contain the country code, the
ne r m re mobile network code, and the LA code.

M servi e re 11.3.5 IMSEI

Each manufactured GSM mobile phone equipment
is assigned a 15-bit long International MS Equipment
Fig. 11.7 GSM system hierarchy
Identity (IMSEI) number to contain manufacturing
information, as shown in Fig. 11.8. Conceptually, when the mobile phone equipment passes the interoper-
ability tests, it is assigned a type approval code. Since a single mobile unit may not be manufactured at the
same place, a field in IMSEI, called the final assembly code, identifies the final assembly place of the mobile
unit. To identify uniquely a unit manufactured, a Serial Number (SN) is assigned. A spare digit is available to
allow further assignment depending on requirements.
11.3.6 MS Roaming Number (MSRN)
When an MS roams into another MSC, that unit has to be identified based on the numbering scheme format
used in that MSC. Hence, the MS is given a temporary roaming number called the MS Roaming Number
(MSRN), with the format shown in Fig. 11.9. This MSRN is stored by the HLR, and any calls coming to that
MS are rerouted to the cell where the MS is currently located.
11.3.7 TMSI
As all transmission is sent through the air interface, there is a constant threat to the security of information
sent. A temporary identity Temporary Mobile Subscriber Identity (TMSI) is usually sent in place of IMSEI.

15 di i s r less
3 di i s 1 r 2 di i s di i s

e r v l de in l ssem l de eri l n m er

re 1 di i

Fig. 11.8 Format of IMSEI

15 di i s r less
1 3 di i s ri le ri le

M ile nr de i n l des in i n de s ri er n m er
M

Fig. 11.9 Format of MSRN

 Global System for Mobile (GSM) 415

11.4 GSM CHANNELS

GSM-900 has been allocated an operational frequency from 890 MHz to 960 MHz. GSM uses the frequency
band 890 MHz–915 MHz for uplink (reverse) transmission, and for downlink (forward) transmission, it uses
the frequency band 935 MHz–960 MHz. The available 25-MHz spectrum for each direction is divided into
124 Frequency Division Multiplexing (FDM) channels, each occupying 200 kHz with 100 kHz guard band at
two edges of the spectrum. This is shown in Fig. 11.10.

1 2 3 124
rrier nnel nd id : 200 rd nd : 100

Fig. 11.10 Frequency channels in GSM-900

GSM uses FDD and a combination of TDMA and FDMA schemes to provide multiple access to mobile
subscribers. The available forward and reverse frequency bands are divided into 200-kHz wide channels
called ARFCNs (Absolute Radio Frequency Channel Numbers). The ARFCN denotes a forward and reverse
channel pair that is separated in frequency by 45 MHz and each channel is time shared between as many as
eight subscribers using TDMA.
The total number of available channels within a 25-MHz bandwidth is 125 (assuming no guard band).
Since each radio channel consists of eight time slots, there are thus a total of 1000 traffic channels within
a GSM. In practical implementations, a guard band of 100 kHz is provided at the upper and lower end of the
GSM spectrum, and only 124 channels are available for use.
Each carrier supports eight time slots for the TDMA operation. Each of the eight subscribers uses the
same ARFCN and occupies a unique Time Slot (TS) per frame. A guard frame of 8.25 bits is used in between
any two frames transmitted either by the BS or the MS. The data rate of each carrier is 270.833 kbps that is
provided with a modulation scheme known as GMSK (Gaussian Minimum Shift Keying) that is a variant of
FSK having a frequency deviation of ± 67.71 kHz. The channel data rate of GSM is 270.833 kbps, which is
exactly four times the RF frequency shift. This minimises the bandwidth occupied by the modulation spec-
trum and hence improves channel capacity. The MSK modulated signal is passed through a Gaussian filter
to smooth the rapid frequency transitions that would otherwise spread energy into adjacent channels. The
bandwidth-time product (B × Tb) of GMSK is standardised at 0.3, a normalised bandwidth expansion factor
where 0.3 describes the 3 dB bandwidth of the Gaussian pulse shaping filter with relation to the bit rate,
which provides the best compromise between increased bandwidth occupancy and resistance to cochannel
interference. Ninety-nine per cent of the RF power of GMSK signals so specified is confined to a bandwidth
of 250 kHz, which means that, for all practical purposes, the sidelobes of the GMSK signal are insignificant,
and outside this frequency band.

EXAMPLE 11.2 GMSK signal bandwidth in GSM

Show that the 3-dB bandwidth for a Gaussian LPF used to produce B × Tb = 0.3 GMSK modulation in GSM standard is
81.3 kHz. The channel data rate is 270.833 kbps.
Solution
Channel data rate, Rb = 270.833 kbps (given)
Baseband symbol duration, Tb = 1/Rb
Baseband symbol duration, Tb = 1/270.833 kbps = 3.69 μs
Product of 3-dB bandwidth and baseband symbol duration, B × Tb = 0.3 (given)
Therefore, 3-dB bandwidth, B = 0.3/Tb
416 Wireless Communications

Hence, 3-dB bandwidth, B = 0.3/3.69 μs = 81.3 kHz

Hence, the 3-dB bandwidth for a Gaussian LPF used to produce B × Tb = 0.3 GMSK modulation in
GSM standard is 81.3 kHz.

With the channel data rate of 270.833 kbps, the duration of each bit is 3.69 μs, and the effective channel
transmission rate per user is 33.854 kbps (270.833 kpbs/8 users). With overhead, user data is actually trans-
mitted at a maximum rate of 24.7 kbps. The user transmission packet burst is fixed at 577 μs, which accom-
modates information bits and a time gap between the packets for duration equivalent to 156.25 channel bits
times the bit duration of 3.69 μs.

EXAMPLE 11.3 Theoretical S/N in GSM

The channel data rate is 270.833 kbps in GSM standard that is 40% (say) of theoretical maximum data rate that can be
supported in a 200-kHz channel bandwidth. Calculate the corresponding theoretical S/N required.
Solution
Step 1. To calculate theoretical maximum data rate, C
Channel data rate, Rb = 270.833 kbps (given)
Channel data rate, Rb is 40% of theoretical maximum data rate, C (given)
Or, Channel data rate, Rb = 0.4 × C
Theoretical maximum data rate, C = Rb /0.4
Hence, theoretical maximum data rate, C = 270.833 kbps/0.4 = 677 kbps
Step 2. To calculate the corresponding theoretical S/N required
The channel bandwidth, B = 200 kHz (given)
The maximum possible theoretical data rate, C is given by Shannon’s channel capacity formula
C = B × log2 (1+ S/N )
Or, log2 (1+ S/N ) = C/B
Or, log2 (1+ S/N ) = 677 kbps/200 kHz
Or, log2 (1+ S/N ) = 3.385
Or, S/N = 23.385 – 1 = 9.447
Or, S/N (dB) = 10 log10 (9.447) = 9.75 dB
Hence, the corresponding theoretical S required is 9.75 dB

EXAMPLE 11.4 Bandwidth efficiency in GSM

The GSM system uses the GMSK modulation scheme. Show that the bandwidth efficiency of the standard GSM system is
1.35 bps/Hz.
Solution
The channel bandwidth = 200 kHz (standard)
The channel data rate = 270.833 kbps (standard)
Bandwidth efficiency = Channel data rate/Channel bandwidth
Therefore, bandwidth efficiency = 270.833 kbps /200 kHz
Hence, bandwidth efficiency = 270.833 kbps /200 kHz = 1.35 bps/Hz

GSM employs a moderately complicated, 13-kbps regular pulse-excited speech codec (coder/decoder) with
a long-term predictor. To provide error protection for the speech-encoded bits, concatenated convolutional
codes and multilayer interleaving are employed. An overall speech delay of 57.5 ms occurs in the system.
 Global System for Mobile (GSM) 417

11.4.1 GSM Logical Channels

The combination of a time slot number and an ARFCN constitutes a physical channel for both the forward
and reverse links. Each physical channel in a GSM system can be mapped into different logical channels at
different times. That is, each specific time slot or frame may be dedicated to either handling traffic data (user
data such as speech, facsimile, or teletext data), signaling data, or control channel data (from the MSC, base
station, or mobile subscriber).
Communication between the mobile subscriber and the base station is involved with both voice as well
as signaling and control. Voice and signaling packets are inserted in a hierarchy and mobile subscribers use
counters to identify the location of specific packet bursts in the overall structure of the frames. The entire
communication system can be thought of as a distributed real-time computer that uses a number of instruc-
tions to transfer information packets from one location to another. Initial signaling is needed for registration
and call establishment, followed by maintaining the synchronisation among the mobile subscribers, mobility
management, and need to transfer the data traffic.
There is a need of a set of instructions and ports to instruct different elements of the cellular network to
perform their specified duties. In cellular communication systems, these ports are referred to as logical chan-
nels. Logical channels use a physical TDMA slot or a portion of a physical slot to specify an operation in the
network in GSM. GSM uses a variety of multiplexing techniques to create a collection of logical channels.
The GSM specification defines a wide variety of logical channels that can be used to link the physical layer
with the data link layer of the GSM network. These logical channels efficiently transmit user data while simulta-
neously providing control of the network on each ARFCN. GSM provides explicit assignments of time slots and
frames for specific logical channels. The logical channels used by a GSM system are shown in Table 11.2.

Table 11.2 Logical channels in GSM

Channel type Channel group Channel Direction

Control Channel Broadcast Channel (BCH) Broadcast Control Channel (BCCH) Downlink
(CCH) (BS → MS)
Frequency Correction Channel Downlink
(FCCH) (BS → MS)
Synchronisation Channel (SCH) Downlink
(BS → MS)
Common control Channel Paging Channel (PCH) Downlink
(CCCH) (BS → MS)
Random Access Channel (RACH) Uplink
(MS → BS)
Access Grant Channel (AGCH) Downlink
(BS → MS)
Dedicated control Channel Standalone Dedicated Control Uplink and Downlink
(DCCH) Channel (SDCCH) (BS ↔ MS)
Slow Associated Control Channel Uplink and Downlink
(SACCH) (BS ↔ MS)
Fast Associated Control Channel Uplink and Downlink
(FACCH) (BS ↔ MS)
Traffic Channel Traffic Channel (TCH) Full-rate Traffic Channel (TCH/F) Uplink and Downlink
(TCH) (BS ↔ MS)
Half-rate Traffic Channel (TCH/H) Uplink and Downlink
(BS ↔ MS)
418 Wireless Communications

The logical channels in the GSM network are divided into two principal categories: Control Channels
(CCHs) and Traffic Channels (TCHs). Control channels carry signaling and synchronising commands
between the base station and the mobile station. Certain types of control channels are defined for just the
forward or reverse link. Traffic channels carry digitally encoded user speech or user data and have identical
functions and formats on both the forward and reverse link. GSM system uses a variety of logical control
channels to ensure uninterrupted communication between MSs and the BS.

11.4.2 GSM Control Channels

There are three classes of control channels defined in GSM: Broadcast Channels (BCH), Common Control
Channels (CCCH), and Dedicated Control Channels (DCCH). Each control channel consists of several logi-
cal channels that are distributed in time to provide the necessary GSM control functions.
Specifically, the BCH and CCCH forward control channels are
Facts to Know ! allocated only TS 0 and are broadcast only during certain frames
The BCH and CCCH forward within a repetitive fifty-one frame sequence (called the control
control channels in GSM are channel multiframe) on those ARFCNs which are designated as
implemented only on certain broadcast channels. TS1 through TS7 carry regular TCH traffic,
ARFCN channels and are allo- so that ARFCNs that are designated as control channels are still
cated time slots in a very specific manner. able to carry full-rate users on seven of the eight time slots.
The GSM specification defines thirty-four ARFCNs as standard
broadcast channels. For each broadcast channel, the frame number 51 does not contain any BCH/CCCH forward
channel data and is considered to be an idle frame. However, the reverse channel CCCH is able to receive sub-
scriber transmissions during TS 0 of any frame (even the idle frame). On the other hand, DCCH data may be sent
during any time slot and any frame, and entire frames are specifically dedicated to certain DCCH transmissions.
The BCH channels are broadcast from the BTS to MSs in the coverage area of the BTS, and thus are one-
way channels. The broadcast channel operates on the forward link of a specific ARFCN within each cell, and
transmits data only in the first time slot (TS 0) of certain GSM frames. The BCH provides synchronisation
for all mobiles within the cell and is occasionally monitored by mobiles in neighbouring cells so that received
power and MAHO decisions may be made by out-of-cell users. Although BCH data is transmitted in TS 0,
the other seven time slots in a GSM frame for that same ARFCN are available for TCH data, DCCH data, or
are filled with dummy bursts. Furthermore, all eight time slots on all other ARFCNs within the cell are avail-
able for TCH or DCCH data. There are three separate broadcast channels that are given access to TS 0 during
various frames of the 51-frame sequence.
(a) The Broadcast Control Channel (BCCH) is used by BTS to broadcast system parameters such as the
frequency of operation in the cell, operator identifiers, cell ID, and available services to all the MSs. Once
the carrier, bit, and frame synchronisation between the BTS and MS are established, the BCCH informs the
MS about the environment parameters associated with the BTS covering that area such as current control
channel structure, channel availability, and congestion. The BCCH also broadcasts a list of channels that
are currently in use within the cell. Frames 2 through frame 5 in a control multiframe (4 out of every 51
frames) contain BCCH data. The BCCH is physically implemented over the Normal Burst (NB). The
BCCH is also a continuously keyed channel, and it is used for signal strength measurements for hand-off.
(b) The Frequency Correction Control Channel (FCCH) is used by the BTS to broadcast frequency refer-
ences and frequency correction burst of 148 bits length. An MS in the coverage area of a BTS uses the
broadcast FCCH signal to synchronise its carrier frequency and bit timing. The FCCH is a special data
burst that occupies TS 0 for the very first GSM frame (Frame 0) and is repeated every ten frames within
a control channel multiframe. The physical Frequency Correction Burst (FCB) is used to implement
the logical FCCH.
 Global System for Mobile (GSM) 419

(c) The Synchronisation Channel (SCH) is used by the BTS to broadcast frame synchronisation signals
containing the synchronisation training sequences burst of 64 bits length to all MSs. Using SCH, MSs
will synchronise their counters to specify the location of arriving packets in the TDMA hierarchy. SCH
is broadcast in TS 0 of the frame immediately following the FCCH frame and is used to identify the
serving base station while allowing each mobile to frame-synchronise with the base station. The frame
number, which ranges from 0 to 2,715,647, is sent with the Base Station Identity Code (BSIC) during
the SCH burst. The BSIC is uniquely assigned to each BTS in a GSM system. Since a mobile may be as
far as 30 km away from a serving base station, it is often necessary to adjust the timing of a particular
mobile user such that the received signal at the base station is synchronised with the base station clock.
The BSC issues coarse timing advancement commands to the mobile stations over the SCH, as well.
The SCH is transmitted once every ten frames within the control channel multiframe. The physical
Synchronisation Burst (SB) is used to implement SCH.
The Common Control Channels (CCCH) are also one-way channels used for establishing links between the
MS and the BS, as well as for any ongoing call management. CCCHs are the most commonly used control chan-
nels and are used to page specific subscribers, assign signaling channels to specific users, and receive mobile
requests for service. On the broadcast channel ARFCN, the common control channels occupy TS 0 of every
GSM frame that is not otherwise used by the BCH or the Idle frame. There are three CCCH logical channels:
(a) The Paging Channel (PCH) is a forward link channel and is used by the BTS to page or notify a
specific individual MS for an incoming call in the cell. The PCH transmits the IMSI of the target
subscriber, along with a request for acknowledgment from the mobile unit on the RACH. Alternatively,
the PCH may be used to provide cell broadcast ASCII text messages to all subscribers, as part of the
SMS feature of GSM. The PCH is implemented on a Normal Burst (NB).
(b) The Random Access Channel (RACH) is a reverse link channel and is used by the MS either to access
the BTS requesting the dedicated channel for call establishment or to acknowledge a page from the
PCH. The RACH is used with implementation of a slotted-ALOHA protocol, which is used by MSs
to contend for one of the available slots in the GSM traffic frames. The RACH is implemented on the
short Random Access Burst (RAB). All mobiles must request access or respond to a PCH alert within
TS 0 of a GSM frame. At the BTS, every frame (even the idle frame) will accept RACH transmissions
from mobiles during TS 0. In establishing service, the GSM base station must respond to the RACH
transmission by allocating a channel and assigning a Standalone Dedicated Control Channel (SDCCH)
for signaling during a call. This connection is confirmed by the base station over the AGCH.
(c) The Access Grant Channel (AGCH) is used by the base station to provide forward link communication to
the mobile for implementation of the acknowledgement from the BTS to the MS after a successful attempt
by MS using RACH in a previous CCCH frame. AGCH is also used by the BS to send information about
timing and synchronisation to the MS. The AGCH carries data that instructs the mobile to operate in a
particular physical channel (time slot and ARFCN) with a particular dedicated control channel. The AGCH
is the final CCCH message sent by the base station before a subscriber is moved off the control channel. This
channel is implemented on a Normal Burst (NB) and indicates the TCH for access to the GSM network.
The Dedicated Control Channels (DCCH) are two-way channels having the same format and function
on both the forward and reverse links, supporting signaling and control for individual mobile subscribers,
and are used along with voice channels to serve for any control information transmission during actual voice
communication. DCCHs may exist in any time slot and on any ARFCN except TS 0 of the BCH ARFCN.
There are three DCCH logical channels:
(a) The Stand-alone Dedicated Control Channel (SDCCH) is a two-way channel allocated with SACCH to
each mobile terminal to transfer network control and signaling information for call establishment and
420 Wireless Communications

mobility management, just before a TCH assignment is issued by the base station. The SDCCH ensures
that the mobile station and the base station remain connected while the base station and MSC verify
the subscriber unit and allocate resources for the mobile. The SDCCH is used to send authentication
and alert messages (but not speech) as the mobile synchronises itself with the frame structure and waits
for a TCH. SDCCHs may be assigned their own physical channel or may occupy TS 0 of the BCH if
there is low demand for BCH or CCCH traffic. The physical channel for SDCCH occupies four slots
in every 51 control-multiframes with an approximated gross data rate of 2 kbps per mobile terminal.
(b) The Slow Associated Control Channel (SACCH) is a two-way channel always associated with a TCH
or a SDCCH and maps onto the same physical channel. The SACCH is used to exchange the necessary
parameters between the BTS and the MS during the actual transmission to maintain the communi-
cation link. Each ARFCN systematically carries SACCH data for all of its current users. The gross data
rate of the SACCH channel is half of that of the SDCCH. On the forward link, the SACCH is used to
send slow but regularly changing control information to the mobile subscriber, such as transmit power
level instructions and specific timing advance instructions for each user on the ARFCN. The reverse
SACCH carries information about the received signal strength and quality of the TCH, as well as BCH
measurement results from neighbouring cells. The SACCH is transmitted during the thirteenth frame
(and the twenty-sixth frame when half-rate traffic is used) of every speech/dedicated control channel
multiframe, and within this frame, the eight time slots are dedicated to providing SACCH data to each
of the eight full-rate (or sixteen half-rate) users on the ARFCN.
(c) The Fast Associated Control Channel (FACCH) is a two-way channel used to support fast transitions
such as a hand-off request in the channel when SACCH is not adequate. The FACCH is physically
multiplexed with the TCH or SDCCH to provide additional support to the SACCH. In fact, FACCH is
not a dedicated control channel but carries the same information as SDCCH. However, FACCH is a part
of the traffic channel, while SDCCH is a part of the control channel. To facilitate FACCH to steal certain
bursts from the TCH forward channel burst, there are 2 flag bits, called the stealing bits in the message.
If the stealing bits are set, the time slot is known to contain FACCH data, not a TCH, for that frame.
Control information in GSM is mainly on two logical channels––the Broadcast Channel (BCCH) and the
Paging Channel (PCH). As with TDMA, it is unnecessary to use a whole RF channel for this. Instead, one of
the eight time slots on one RF channel in each cell or sector is designated as a control channel. The broadcast
information is transmitted first, followed by paging information. Figure 11.11 shows the structure of a GSM
logical control channel.
The corresponding reverse channel to the forward channels BCCH and PCH is called the Random-Access
Channel (RACH). It is used by the mobile subscribers to communicate with the cell-site. Mobile subscribers
transmit on RACH channel whenever they have information. Transmissions are shorter than the duration of
the time slot to prevent interference caused by the propagation delay between the mobile and cell-site.
The mobile subscriber equipment has only one receiver. It cannot count on receiving the broadcast channel
during a call because both channels may use the same time slot. It is necessary to send control information

r d s nr l P in nnel
1 1 1 nnel P

2 r mes
= re en rre i n = n r nis i n = n en s lis

Fig. 11.11 GSM control channel structure

 Global System for Mobile (GSM) 421

on the voice channels. There are two control channels associated with the voice channel. The slow associated
control channel uses one of every 26 bursts on the voice channel. It is used to inform the serving cell-site
about the measurements of the signal strength of adjacent cells made by the mobile subscriber. The fast asso-
ciated control channel steals bits from the voice signal and is used for urgent messages from the cell-site such
as hand-off instructions.

11.4.3 GSM Traffic Channels

Voice channels are called Traffic Channels (TCH) in GSM. Traffic channels are two-way channels carrying
the voice and data traffic between the MS and BTS. In the GSM standard, TCH data may not be sent in
TS 0 within a TDMA frame on certain ARFCNs that serve as the broadcast station for each cell (since TS 0
is reserved for control channel bursts in every frame). Traffic channels carry digitally encoded user speech
or user data and have identical functions and formats on both the forward and reverse link. One RF channel
is shared by eight voice transmissions using TDMA. In terms of spectral efficiency, GSM works out to 25
kHz per voice channel, compared to about 30 kHz for AMPS and about 10 kHz for TDMA-based IS-54 or
IS-136 systems. This is an approximate comparison as it ignores differences in control-channel overhead.
As in TDMA-based systems, the mobile transmitter operates only during its allotted time slot. Assuming
other parameters similar, a GSM mobile phone has longer battery life than a phone using either AMPS or
IS-54/IS-136 because GSM mobile transmits in one-eighth of the time, compared with one-third of the time
in TDMA-based IS-54/IS-136 system.

15 .25 i s
577 μs

0 1 2 3 4 5 7

4. 15 ms
: ime l
rm l s ee m l i r me 2 M r mes
120 ms

0 1 2 10 11 12 13 14 15 22 23 24 /

: r me
/ : dle r sl ss i ed nr l nnel r me

Fig. 11.12 The TCH frame and multiframe structure

Figure 11.12 illustrates how the TCH data is transmitted in consecutive frames.
Furthermore, frames of TCH data are broken up every thirteenth frame by either Slow Associated Control
Channel Data (SACCH) or idle frames. Each group of twenty-six consecutive TDMA frames is called a
multiframe (or speech multiframe, to distinguish it from the control channel multiframe described later). For
every twenty-six frames, the thirteenth and twenty-sixth frames consist of Slow Associated Control Channel
(SACCH) data, or the idle frame, respectively. The twenty-sixth frame contains idle bits for the case when
full-rate TCHs are used, and contains SACCH data when half-rate TCHs are used. TCH logical channels are
implemented over the normal burst. There are two types of TCH channels:
The full-rate traffic channel (TCH/F) uses a 13 kbps speech-coding scheme and 9,600 bps, 4,800 bps,
and 2,400 bps data. After including signaling overhead, each full-rate traffic channel has a gross bit rate
422 Wireless Communications

of 22.8 kbps for the network. When transmitted as full-rate, user data is contained within one time slot per
frame. The following full-rate speech and data channels are supported:
Full-Rate Traffic Data Channel (TCH/F) The full-rate speech channel carries user speech that is digitised at a
raw data rate of 13 kbps. With GSM channel coding added to the digitised speech, the full-rate speech chan-
nel carries 22.8 kbps.
Full-Rate Data Channel at 9600 bps (TCH/F9.6) The full-rate traffic data channel carries raw user data that is
sent at 9600 bps. With additional forward-error-correction coding applied by the GSM standard, the 9600 bps
data is sent at 22.8 kbps.
Full-Rate Data Channel at 4800 bps (TCH/F4.8) The full-rate traffic data channel carries raw user data that is
sent at 4800 bps. With additional forward-error-correction coding applied by the GSM standard, the 4800 bps
is sent at 22.8 kbps.
Full-Rate Data Channel at 2400 bps (TCH/F2.4) The full-rate traffic data channel carries raw user data that is
sent at 2400 bps. With additional forward error correction coding applied by the GSM standard, the 2400 bps
is sent at 22.8 kbps.
The half-rate traffic channel (TCH/H) uses 16 time slots per frame that has a gross bit rate of 11.4 kbps
(half of gross bit rate of full-rate traffic channel). The half-rate TCH supports 4800 bps and 2400 bps data
rate only. When transmitted as half-rate, user data is mapped onto the same time slot, but is sent in alternate
frames. That is, two half-rate channel users would share the same time slot, but would alternately transmit
during every other frame. The following half-rate speech and data channels are supported:
Half-Rate Traffic Data Channel (TCH/H) The half-rate speech channel has been designed to carry digitised
speech which is sampled at a rate half that of the full-rate channel. GSM anticipates the availability of speech
coders that can digitise speech at about 6.5 kbps. With GSM channel coding added to the digitised speech,
the half-rate speech channel will carry 11.4 kbps.
Half-Rate Traffic Data Channel at 4800 bps (TCH/H4.8) The half-rate traffic data channel carries raw user data
that is sent at 4800 bps. With additional forward-error-correction coding applied by the GSM standard, the
4800 bps data is sent at 11.4 kbps.
Half-Rate Traffic Data Channel at 2400 bps (TCH/H2.4) The half-rate traffic data channel carries raw user data
that is sent at 2400 bps. With additional forward-error-correction coding applied by the GSM standard, the
2400 bps data is sent at 11.4 kbps.
The cell-site instructs the mobile subscriber to advance or retard the timing of its transmissions to com-
pensate for the changes in propagation delay as it moves about in the cell. In this way, the transmission delay
problem is avoided on the traffic channels.

11.5 FRAME STRUCTURE FOR GSM

Transmission in any TDMA-based wireless communication system is in the form of a repetitive sequence of
frames. Each TDMA frame is divided into a number of uniform time slots. Each time slot position across the
sequence of frames forms a separate logical channel. It is very critical to determine the length and composi-
tion of the logical channel time slot that will provide effective speech and data transmission with efficient
use of the available frequency spectrum. In designing an appropriate frame structure in TDMA, the following
requirements are generally considered:
Frequency Band of Operation The most common spectrum allocated to cellular mobile communication
applications is around 900 MHz.
 Global System for Mobile (GSM) 423

Number of Logical Channels or Number of Time Slots in TDMA Frame In order to justify the additional costs of mul-
tiplexing, let the minimum number of time slots per TDMA frame be 8 so as to serve eight simultaneous users.
Channel Bandwidth The current channel bandwidth being used for analog FM cellular systems in Europe
is 25 kHz. To serve 8 mobile subscribers using TDMA technique, the channel bandwidth should not exceed
200 kHz.
Maximum Cell Radius (R) To provide radio service to high traffic in rural areas, let the maximum cell radius
be 35 km.
Maximum Vehicle Speed ( Vm ) To accommodate mobile subscriber units traveling on expressways or high-
speed trains, the maximum vehicle speed be 250 km/h.
Maximum Delay Spread (Δm ) Delay spread is the difference in propagation delay among different multipath
signals arriving at the same Rx antenna. Typical delay spread in mountainous regions is about 10 seconds.
Maximum Coding Delay To avoid unnecessary delays within the fixed wireless network, which may involve
satellite links, maximum coding delay be approximately 20 milliseconds.
Figure 11.13 suggests the general steps to be considered in designing the time slot in a TDMA frame.

ee rr r ee
s m lin rre i n l
din en din rm i n

rs in l
desi n rs
ield desi n
M xim m r inin
d r i n se en e r
s ee d ive
ield il er

Fig. 11.13 Steps in design of TDMA time slot

In the design of time slot of a TDMA frame, an appropriate data rate of the speech coder should be decided
first. It is desirable that the speech coder must provide satisfactory speech quality at minimum data rate. The
PCM speech coder has a data rate of 64 kbps, which is undesirably high for use with wireless systems. A data
rate of 12 kbps is reasonable for reproducing good-quality speech. Since the coding delay is restricted to
20 milliseconds, the encoded speech can be formed into blocks of 20 ms duration. This converts the speech
samples of 12 kbps × 20 ms = 240 bits.
Error correction can then be applied to the 240-bit blocks. Using a convolutional error-correcting tech-
nique with a code rate of , the number of bits in a block of 20-ms speech at 12 kbps rate increases to
(2 × 240 bits =) 480-bits. With a constraint length of 5, 4 bits per block of 240 bits are added to account for
the length of the shift register. This brings the speech block length to (480 + 2 × 8 =) 488 bits. With these
parameters, the minimum bit rate for an eight-channel TDMA system can be computed as follows:
Number of bits in one channel = 488 bits
Number of channels or time sots = 8
Total number of bits in 8 time slots = 488 bits × 8 = 3904 bits
Duration of one speech block = 20 ms
Overall minimum channel bit rate =3904 bits/20 ms = 195.2 kbps
424 Wireless Communications

To take care of other design considerations, the gross channel bit rate will be slightly higher, and let it be
greater than 200 kbps in the available channel bandwidth of 200 kHz. In a mobile radio environment, such
data rates can be achieved with the use of adaptive equalisation. Adaptive equalisation will require the inclu-
sion of a new training sequence in each time slot when the mobile subscriber moves a sufficient distance
to potentially cause changes in the characteristics of transmission path. Assume that the phase angle of the
carrier signal changes by λc /20 of the maximum vehicle speed. Thus, at 900 MHz (λc = 0.333m), we have
Maximum transmission duration (one-way) = (λc / 20)/Vm
Maximum transmission duration (one-way) = (0.333m/20)/250 km/h
Maximum transmission duration (one-way) = 0.24 ms
Or, Maximum transmission duration (two-way) = 2 × 0.24 = 0.48 ms
Hence, Duration for data transmission in a time slot, d = 0.48 ms
Assuming the number of taps on the adaptive equaliser to be equal to 6 times the number of bits transmit-
ted in the maximum dispersal time (Δm = 0.01 ms), the amount of time needed for the training sequence in
the time slot, t = 0.06 ms.
To account for the differing amounts of delay between different mobile units and the base station, a guard
interval is needed at the end of each time slot. Because eight mobile subscriber units share the same TDMA frame,
it is necessary to adjust the timing of the transmissions of the mobile subscriber units so that the transmission from
one mobile subscriber does not interfere with adjacent time slots. The guard time can be computed as follows.
Let the average duration of the voice call = 120 seconds
Maximum vehicle speed of the mobile = 250 km/h
Therefore, the radial distance a mobile moving toward or away from the base station located at the centre of
the cell = (250 km/h) × (120 s) = 8333 m
The change in propagation delay = 8333 m/(3 × 108 m/s) ≈ 0.03 ms
Or, Required duration for guard interval, g = 0.03 ms
Figure 11.14 shows the tentative design of a time slot, depicting time duration of two blocks of data before
and after the training sequence and guard time.

2 0.24 s 2 0.24 s
0.0 ms 0.03 ms

Fig. 11.14 TDMA time slot—approximate field durations

So, Maximum time duration of a time slot, Ts = Td + Tts + Tg

Maximum time duration of a time slot, Ts = 0.48 ms + 0.06 ms + 0.03 ms
Maximum time duration of a time slot, Ts = 0.57 ms
Number of time sots in a TDMA frame = 8
Duration of a TDMA frame = 8 × 0.57 ms = 4.6 ms
This is quite close to actual design of a TDMA time slot and frame structure used in GSM. Fundamentally,
each 200-kHz frequency band is divided into 8 logical channels defined by the repetitive occurrence of time
slots. The GSM system uses the TDMA scheme shown in Fig. 11.15 with a 4.615 ms-long frame, divided into
eight time slots each of 557 μs. Each frame is 156.25 bits long, of which 8.25 bits are guard bits.
At the lowest level is the time slot or a burst period, which has a duration of approximately 577 μs. With a bit
rate of 270.833 kbps, each time slot has a length of 156.25 bits. The time slot includes the following fields:
Tail Bits, T (3 Bits each at the Beginning and End of a Time Slot Excluding Guard Bits) It allows synchronisation
of transmissions from mobile units located at different distances from the base station.
Encrypted Data (114 Bits) Data is encrypted in blocks by conventional encryption of 114 plaintext bits into
114 ciphertext bits; the encrypted bits are then placed in two 57-bit data fields in the time slot.
 Global System for Mobile (GSM) 425

M r me 4. 15 ms

0 1 2 3 4 5 7

ime sl 0.557 ms

il i s n ded d r inin n ded d il i s

3 5 2 5 3

ne rs 14 is

ime sl 15 .25 i s in l din .25 rd i s

Fig. 11.15 GSM basic frame structure

Stealing Bit, S (1 Bit each at the End of Two 57-Bit Data Fields in the Time Slot) It is used to indicate whether this
block contains data or is stolen for urgent control signaling purpose during the call.
Training Data (26 Bits) It is used to adapt the parameters of the receiver to the current path-propagation
characteristics and to select the strongest signal in case of multipath propagation. The training sequence is a
known bit pattern that differs for different adjacent cells. It enables the mobile subscriber units and base sta-
tions to determine that the received signal is from the desired base station and not from a strong interfering
base station. In addition, the training sequence is used for multipath equalisation, which is used to extract the
desired signal from unwanted reflections.
Guard Bits, G (8.25 Bits) It is used to avoid overlapping with other bursts due to different path delays.
The 148 bits of a data burst are used to transmit the information. Delimited by tail bits (consisting of 0s),
the frame contains 26 training bits sandwiched between two bursts of data bits. These training bits allow the
receiver to synchronise itself.
Moving up the frame format hierarchy, 8-time slots TDMA frames are typically organised into a 26-frame
multiframe. One of the frames in the multiframe is used for control/signaling and another is currently unused,
leaving 24 frames for data traffic. Thus, each traffic channel receives one slot per frame and 24 frames per
120-ms multiframe.
The gross channel data rate can be calculated as follows:
Number of data bits per time slot = 114 bits
Number of time slots per multiframe = 24
So, Number of bits per multiframe = 24 × 114 bits = 2736 bits
Time duration of one multiframe = 120 ms
So, Gross data rate = 2736 bits/120 ms = 22.8 kbps
GSM uses a complex hierarchy of TDMA frames to define logical channels, as shown in Fig. 11.16.
The GSM specification also allows half-rate traffic channels, with two traffic channels each occupying
one time slot in 12 of the 26 frames. With the use of half-rate speech coders, this effectively doubles the
capacity of the system. There is also a 51-frame multiframe used for control traffic. Thus, many frames are
combined to constitute multiframe, superframe, and hyperframes.

EXAMPLE 11.5 Frame duration in GSM

GSM uses a frame structure where each frame consists of 8 time slots, and each time slot contains 156.25 bits and
data is transmitted over a channel at 270.833 kbps. Find time duration of a bit; time duration of a time slot; time
duration of a TDMA frame; and how long must a user wait when occupying a single time slot between two successive
transmissions.
426 Wireless Communications

1 er r me = 204 s er r mes 3 rs 2 min es

0 1 2 3 .. 204 2047

1s er r me = 51 m l i r mes .12 s 1s er r me = 2 m l i r mes .12 s

0 1 2 4 50 0 1 2 24 25

1 m l i r me = 2 r mes 120 ms 1 m l i r me = 51 r mes 235 ms

0 1 2 24 25 0 1 2 4 50

1 M r me = 4. 15 ms
0 1 2 3 4 5 7

1 ime sl = 15 .25 i 577 μs

T n ded d r inin d n ded d T

T: il i s 3 : l i 1 : rd i s .25

Fig. 11.16 GSM hyperframe format

Solution
Step 1. To find time duration of a bit, Tb
Channel data rate = 270.833 kbps (given)
Time duration of a bit, Tb = 1/Data rate
Hence, time duration of a bit, Tb = 1/270.833 kbps = 3.69 s
Step 2. To find time duration of a time slot, Tslot
No. of bits per time slot = 156.25 bits (given)
Time duration of a time slot, Tslot = 156.25 bits × Tb
Time duration of a time slot, Tslot = 156.25 bits × 3.69 μs = 577 s
Step 3. To find time duration of a TDMA frame, Tf
No. of time slots per TDMA frame = 8 (given)
Time duration of a frame, Tf = No. of time slots × Tslot
Time duration of a frame, Tf = 8 × 577 μs = 4.616 ms
Step 4. To find time duration for a user occupying a single time slot between two successive transmissions
A user occupying a single time slot between two successive transmissions has to wait for the time duration
of a frame. Hence, a user has to wait for 4.616 ms between two successive transmissions.

11.5.1 Physical Data Bursts in GSM

Each user transmits a burst of data during the time slot assigned to it. GSM supports five types of packet data
bursts used for control and traffic signaling.
The normal burst, shown in Fig. 11.17, is used for TCH and DCCH transmissions on both the forward
and reverse link.
The normal burst consists of three bits each at the beginning and at the end of the data burst, 8.25 bits
of guard period, two sets of 58 bits encrypted bits (a total of 116 bits), and a 26-bits training sequence.
 Global System for Mobile (GSM) 427

r is n r ed d r inin is n r ed d is rd eri d
3 5 2 5 3 .25 i s

Fig. 11.17 The normal data burst in GSM

The start bits are 000 providing a gap time for the digital radio circuitry to cover the uncertainty period to
ramp on and off for the radiated power and to initiate the convolutional decoding of the data. The 26-bit
training sequence is used to train the adaptive equaliser at the receiver. The training of the equaliser is in the
middle of the burst because the channel behaviour is constantly changing during the transmission of the data
burst. The 116 encrypted data bits include 114 bits of data and two flag bits at the end of each part of the
data that indicates whether data is user traffic or signaling and control information during the call.
The Frequency-Correction (FCCH) burst is used
in TS 0 of specific frames to broadcast the frequency
r is is rd eri d
synchronisation control messages by the BTS on 3
ixed i s ll 0s 142
3 .25 i s
the forward link. MSs use it to synchronise with the
master clock in the system. The frame format of the Fig. 11.18 The FCCH data burst in GSM
FCCH data burst is shown in Fig. 11.18.
The FCCH burst has three bits at the start and the end of the data field. The rest of the data burst contains
all 0s that allows transmission of the unmodulated carrier frequency. Guard period equivalent to 8.25-bits
duration is used between two bursts.
The synchronisation (SCH) burst, as shown in Fig. 11.19, is very similar to the normal burst except that
the training sequence is longer and the coded data are used for the specific task of identifying the network.
The SCH burst is used in TS 0 of specific frames to broadcast the frequency and time synchronisation control
messages on the forward link.

r is n r ed d r inin is n r ed d is rd eri d
3 3 4 3 3 .25 i s

Fig. 11.19 The SCH data burst in GSM

The BTS broadcasts the SCH burst, and the MSs use it for initial training of the equaliser, initial learning
of the network identity and to synchronise the time slots.
The random access (RACH) burst, as shown in Fig. 11.20, is used by the MS to access the BS as it registers
to the network.

r is n r nis i n n r ed d is x ended rd eri d

41 3 3 .25

Fig. 11.20 The RACH data burst in GSM

The overall structure of the RACH data burst is similar to the normal data burst except that a longer
start bits and synchronisation sequence is used to initiate the equaliser. A much longer guard period of
68.25 bits allows approximate estimation of the distance of the MS from its serving BTS. The distance can
be computed from the arrival time of the RACH burst. A guard period of 68.25 bits translates to 252 μs.
The signal transmitted from a MS should travel more than 75.5 km (at the signal speed of 300,000 km/sec)
before arriving at the BTS to exceed this guard period.
428 Wireless Communications

r is Mixed i s r inin is Mixed i s is rd eri d

3 5 2 5 3 .25 i s

Fig. 11.21 The dummy burst in GSM

The dummy burst, as shown in Fig. 11.21, is used as filler information for unused time slots on the
forward link.

EXAMPLE 11.6 GSM frame hierarchy

Explain the concept of GSM superframe, multiframe, TDMA frame and time slot in a GSM channel. Give suitable illustration
for GSM frame hierarchy.
Solution
When a number of different time slots carry various types of control signals and user data traffic, a hierarchy
is needed to identify the location of certain type of bursts among the large stream of bursts that are directed
toward different mobile subscribers. Each mobile subscriber needs a number of counters to track the related
frames at different levels of the frame hierarchy. Figure 11.22 illustrates the frame structure.

.12 s
1 er r me = 51 M l i r mes

120 ms
1 M l i r me = 2 r mes

4. ms
1 r me = ime sl s 0 1 2 3 4 5 7

577 μs

1 ime sl 3 57 1 2 1 57 3 .25 is

Fig. 11.22 GSM superframe structure

The Concept of Time Slot in GSM Channel A time slot consists of 156.25 bits that are transmitted at a rate of
270.833 kbps. In one time slot, 114 bits are encrypted data bits transmitted as two times 57 data bits each.
The training sequence in the middle of the time slot consists of 26 bits. It allows the adaptive equaliser in
the receivers of the base station and mobile unit to analyse the characteristics of the wireless channel before
decoding the user data. On either side of the training sequence, there are control bits called stealing flags.
The bit value of these two flags distinguishes the time slot to contain either the voice or control information
during the call.
The Concept of TDMA Frames in GSM Channel During a frame, one time slot is used to transmit only and
another time slot is used to receive only. The remaining six time slots of a frame can be used to measure
received signal level from its serving base station as well as that from up to five adjacent base stations.
 Global System for Mobile (GSM) 429

1 er r me = 204 s er r me 3 r 2 min 53.7 s

1 er r me = 2 n r l r 51 r i m l i r mes .12 s

1 M l i r me = 51 r mes 235.4 ms 1 M l i r me = 2 r mes 120 ms

1 r me = 4. 15 ms

1 =15 .25 i s 577 μs

Fig. 11.23 GSM frame hierarchy

The GSM radio-interface standard provides a variety of control channels and traffic channels defined
in a hierarchy built upon the basic eight-slot TDMA transmission format. The frame hierarchy, depicted in
Fig. 11.23, shows the TDMA hierarchy of the GSM network from a normal data burst of 577 μs interval to a
hyperframe of length of around three-and-half hours.
The basic building block of the GSM frame hierarchy is a 4.615-ms TDMA frame. Each frame comprises
of eight data bursts or time slots. The time-slot interval is equivalent to the transmission time for about
156.25 bits, comprising of 114 bits user data and the remaining overhead bits. A TDMA frame contains
8 × 156.25 bits = 1250 bits. The frame rate is 270.833 kbps/1250 bits/frame = 216.66 frames per second.
The Concept of Multiframes in GSM Channel Each of the normal speech frames are grouped into larger struc-
tures called multiframes, superframes and hyperframes. The 13th or 26th frames are used for control data
only. Each 120-ms multiframe is composed of 26 frames––24 frames carry user information, and two frames
carry system control information related to individual users. The gross data rate per user is 24 × 114 bits /
120 ms = 22.8 kbps. The speech coder has a net data rate of 13 kbps, and the addition of error-correction
coding results into gross transmission data rate up to 22.8 kbps per user. The eight-slot TDMA frames may be
also organised into control multiframes. Control multiframes are used to establish several types of signaling
and control channels used for system access, call set-up, synchronisation, and other system control functions.
The control multiframes span 51 TDMA frames.
The Concept of Superframes in GSM Channel Either traffic or control multiframes are grouped into super-
frames, which are in turn grouped into hyperframes. One traffic multiframe contains 26 frames, and one traf-
fic superframe contains 51 traffic multiframes, or 1326 frames. A hyperframe contains 2048 superframes, or
2,715,648 frames. A complete hyperframe takes about every 3 hours, 28 minutes, and 54 seconds. The encryp-
tion algorithms rely on the particular frame number, and sufficient security can only be obtained by using
a large number of frames as provided by the hyperframe. Counters at the mobile subscribers need to track the
frame numbers at hyperframe, superframe, and multiframe levels to communicate with the network.

11.6 GSM SPEECH CODING

The speech signal is compressed using an algorithm known as Regular Pulse Excited-Linear Predictive
Coder (RPE-LPE). In essence, data from previous data samples are used to predict the current data
434 Wireless Communications

When the MS requests for any service, the MSC sends it a random number. It also uses an authenticate
algorithm to encrypt with the IMSI and the key stored in its memory. In the MS, the received random number
is encrypted using IMSI and the same key is transmitted to the system, which compares it with the original
value sent by the fixed network. If they match then the MS is authentic.

11.8 GSM CALL PROCEDURES

There are three mechanisms of call establishment which are embedded in all voice-oriented cellular com-
munication networks that allow a mobile subscriber to establish and maintain a connection with the network.
These mechanisms are registration of the mobile subscriber, call establishment, and hand-off procedures.
Registration takes place as soon as the mobile subscriber unit is switched on. Call establishment occurs when
the mobile subscriber initiates or receives a call. Hand-off mechanism enables the MS to change its connec-
tion link from one part of the network to another part.

11.8.1 Registration
For an MS to operate in an MSC, it must be registered by accessing the BTS. The MSC assigns a TMSI
to the MS and updates the information in VLR and HLR. Whenever the MS is switched on, there is a
need to possibly establish a new registration with the cellular network. Sometimes a mobile subscriber is
required to connect to the cellular network at different locations through a BS that may not be owned by its
home service provider. Technically speaking, the MS passively synchronises to the frequency, bit, and frame
timings of the nearest BS to get ready for information exchange.
The MS receives the cell identity, and system parameters determine its location in the cellular network. If
the present location is not the same as before, the MS initiates a registration procedure. During a registration
procedure, the system provides the MS with a control channel for preliminary signaling. The MS provides its
own identity, and finally the system authenticates the MS.
The MS registration process is described in Table 11.3 when a mobile subscriber is switched on in a new
MSC area.
Firstly, a radio communication link is established between the MS and BTS to process the registration. It
is followed by an authentication process by the system, and assignment of TMSI. Records are updated in the
VLR and HLR. After successful registration, the temporary radio communication link is released.

Table 11.3 MS registration procedure

Step No. Action taken Signal path

1. MS requests a channel MS → BTS → BSC

2. Channel activation response BSC → BTS
3. Acknowledgement for activation BTS → BSC
4. Assignment of channel BSC → BTS → MS
5. Location update request MS → BTS → BSC → MSC
6. Requests for authentication MSC → BSC → BTS → MS
7. MS authenticates MS → BTS → BSC → MSC
8. Verification of authentication MSC ↔ VLR
9. Assigns TMSI MSC → BSC → BTS → MS
10. TMSI acknowledgement MS → BTS → BSC → MSC
11. VLR/HLR updation MSC ↔ VLR ↔ HLR
12. Channel release BSC → BTS → MS
 Global System for Mobile (GSM) 435

In the mobile communication environment, there are two separate call-establishment procedures for
mobile-to-network and network-to-mobile calls. Mobile-to-mobile calls are a combination of these two. The
detailed procedure for both types of call establishment in the GSM network is described next.

11.8.2 Mobile-to-Network Call

The mobile subscriber monitors the BCH and gets synchronised to the nearest base station. By receiving
the BCCH, FCCH, and SCH messages, the mobile subscriber is locked on to the system. To initiate a call, the
mobile subscriber first dials the called subscriber number and presses the send button on the GSM mobile
phone. The mobile subscriber transmits a burst of RACH data on the same ARFCN as the base station.
The base station then responds with an AGCH message on the CCCH which assigns the mobile subscriber to
a new channel for SDCCH connection. The mobile subscriber, receives its ARFCN and TS assignment from
the AGCH on TS 0 of the BCH, and then immediately shifts to the new ARFCN and TS.
The step-by-step procedure for mobile-originated call establishment is described in Table 11.4.

Table 11.4 Mobile-to-network call procedure

Step No. Action taken Signal Path

1. MS requests a channel MS → BTS → BSC

2. Assignment of channel BSC → BTS → MS
3. Call-establishment request MS → BTS → BSC → MSC
4. Requests for authentication MSC → BSC → BTS → MS
5. MS authenticates MS → BTS → BSC → MSC
6. Ciphering process MSC → BSC → BTS → MS
7. Ciphering successful MS → BTS → BSC → MSC
8. Called subscriber number MS → BTS → BSC → MSC
9. Call routing confirmation MSC → BSC → BTS → MS
10. Traffic channel request MS → BTS → BSC
11. Traffic channel assigned BSC → BTS → MS
12. Free/busy signal BTS → MS
13. Acceptance of call MSC → BSC → BTS → MS
14. Connection established MS → BTS → BSC → MSC
15. Conversation MS ↔ BTS ↔ BSC ↔ MSC

The mobile subscriber first waits for the SACCH frame on the SDCCH, to inform the mobile subscriber of
any required timing advance and transmitter power command. The mobile subscriber is now able to transmit
normal burst messages as required for speech traffic. The SDCCH sends messages such as authentication and
user validation between the mobile subscriber and the base station. The PSTN connects the called landline sub-
scriber to the MSC. The MSC switches the voice connection to the serving base station. The mobile subscriber
receives a command by the base station via the SDCCH to retune to a new ARFCN and TS for the TCH assign-
ment. Speech data is transferred on both the forward and reverse channels, and the SDCCH is released.

11.8.3 Network-to-Mobile Call

To make a call from a landline telephone subscriber, the call-request information is processed through the
gateway MSC to the destination MSC after getting the information from the home HLR of the called mobile
436 Wireless Communications

M
in r s r re
M
P

Fig. 11.29 Network-to-mobile call scenario in a visiting network

subscriber. Then the called mobile subscriber is contacted through the BSS. The base station broadcasts a PCH
message on the BCH. The mobile subscriber locks on to the same ARFCN, decodes its page and responds with
an RACH message. The base station then uses the AGCH on the CCCH to assign the mobile subscriber unit to
a new channel for connection to the SDCCH and SACCH while the network and the serving base station are
connected. Once the subscriber establishes timing advance and authentication on the SDCCH, the base station
assigns the TCH. As shown in Fig. 11.29, the PSTN directs the call initiated by the calling landline telephone
subscriber to the MSC identified by the dialed phone number of the called mobile subscriber.
The MSC requests routing information from the HLR. Since the mobile subscriber is roaming in the area
of a different MSC, the gateway MSC contacts the destination MSC. The VLR initiates a paging procedure
in all BSSs under the control of the MSC. After getting response from the MS, the VLR sends the necessary
system parameters to the MSC to establish the link to the MS.

EXAMPLE 11.8 GSM Layer III sublayer categories used for call establishment
Illustrate the step-by-step procedure for mobile-initiated call-establishment procedure, giving the type of logical
channel used along with sublayer categories of GSM Layer III.
Solution
Table 11.5 shows the mobile-initiated call-establishment procedure. The second column identifies the action taken
or the message type. The third column identifies the logical channel that is used to carry the message. The fourth
column identifies the sublayer of the Layer III in which GSM standard describes the message. Note that Layer III
does not handle the traffic message, and therefore there is no sublayer associated for that part of the procedure.
Table 11.5 Layer III sublayer categories for mobile-initiated call

Step No. Message type Logical channel used Layer III sublayer category

1. Request for a channel RACH RRM

2. Immediate assignment AGCH RRM
3. Request for Call establishment SDCCH CM
4. Request for authentication SDCCH MM
5. Authentication response SDCCH MM
6. Ciphering command SDCCH RRM
7. Ciphering response SDCCH RRM

(Continued )
 Global System for Mobile (GSM) 437

Table 11.5 (Continued )

Step No. Message type Logical channel used Layer III sublayer category
8. Send called number SDCCH CM
9. Routing response SDCCH CM
10. Traffic channel assigned SDCCH RRM
11. Traffic channel established FACCH RRM
12. Free/busy signal FACCH CM
13. Acceptance of call FACCH CM
14. Connection established FACCH CM
15. Conversation TCH ----

11.9 GSM HAND-OFF PROCEDURES

Hand-off is usually initiated because of signal strength deterioration at the edge of a cell boundary. Hand-off
in GSM is divided into four major categories:
(a) Intracell-Cum-Intra-BTS Hand-off This type of hand-off is necessary when high interference occurs during
the call. The channel for the connection is changed within the cell by moving to another frequency of the same
cell or to another time slot of the same frequency. The hand-off process is initiated by the base station.
(b) Intercell-Cum-Intra-BSC Hand-off In this type of hand-off, the change is in the radio channel between
two cells that are served by the same BSC. Initially, the hand-off request is initiated by the serving BSS to
the MSC. The MSC transmits the hand-off request to the destination BSS. After receiving acknowledgement, the
MSC gives the hand-off command. The mobile subscriber transmits a hand-off complete message to the new
BSS, which relays it to the MSC for releasing the earlier occupied channel.
(c) Inter-BSC-Cum-Intra-MSC Hand-off A call connection is changed between two cells that are served by
different BSCs but operate in the same MSC. When the measured value of the received signal strength at the
mobile subscriber is lower than the threshold value, it informs the serving BSC which initiates the hand-off
command to the MSC of that area. The MSC relays the hand-off request to the BSC, which sends a channel
activation request to its BTS. It is then possible for the hand-off call to be handled in the new MSC.
The BTS provides the MS with a list of available channels in neighbouring cells via the BCCH. The
mobile subscriber monitors the received signal strength from the BCCHs of these neighbouring cells and
reports these measured data to the MSC using the SACCH. This is called mobile-assisted hand-off. The BTS
also monitors the received signal strength from the mobile subscriber to make a hand-off decision. The MSC
negotiates a new channel with the new BSS and indicates to the mobile subscriber that a hand-off should be
made using a hand-off command. Upon completion of the hand-off, the mobile subscriber confirms with a
hand-off complete message to MSC.
Figure 11.30 shows the hand-off procedure between two BSSs that are controlled by one MSC.
(d) Inter-MSC Hand-off A connection is changed between two cells that are in different MSCs. This situation
occurs in case of roaming. This hand-off occurs wherein the home MSC is notified of the hand-off condition
through the PSTN, and the home MSC sends the necessary data to the new MSC through the PSTN again.

11.10 GSM SERVICES AND FEATURES

GSM is an integrated voice-data service that provides a number of value-added services. A telecommunication
service supported by the GSM is defined as a group of communication capabilities that the service provider
438 Wireless Communications

MS SS 1 MSC SS 2
Me s red si n l level
nd needed
nd re es
nd re es
nd mm nd
nd mm nd
nd rren e nd rren e

nd rren e
nd s ess l

le r nnel mm nd

nnel rele sed

Fig. 11.30 Hand-off involving a single MSC and two BSSs

offers to the mobile subscribers. As per ISDN guidelines, GSM services are classified mainly into three catego-
ries: telephone services or teleservices, data or bearer services, and supplementary ISDN services.
Teleservices provides the mobile subscribers with necessary capabilities which enable them to commu-
nicate with other subscribers. Bearer services give the mobile subscribers the capacity required to transmit
appropriate signals between network access points. Supplement services supplement basic teleservices and
are offered together or in association with other services. Table 11.6 lists the GSM services.
Telephone services provide full-duplex voice communication applications between the calling and called
subscribers according to a standard protocol.
Data or bearer services provide capabilities to transmit information among user-network-interfaces.
Traditional bearer services include a variety of asynchronous and synchronous data access to PSTN/ISDN
and packet switched public data networks either in a transparent mode (where GSM provides standard chan-
nel coding for the user data) or nontransparent mode (where GSM offers special coding efficiencies based on
the particular data interface).
Supplementary ISDN services are not standalone services but they are digital signaling services that
supplement telephone services or data services. Short Messaging Service (SMS) allows GSM subscribers
and base stations to transmit alphanumeric pages of limited length (160 7-bit ASCII characters). SMS also
provides cell broadcast, which allows GSM base stations to repetitively transmit messages with as many
as fifteen 93-character strings in a concatenated fashion. SMS may be used for advertisement, safety, and
advisory applications including broadcast of highway traffic conditions or weather information to all GSM
subscribers within reception range.

11.10.1 Short Message Service (SMS)

Facts to Know !
The Short Message Service (SMS) is the ability to send
SMS is a proactive bearer and is an or receive a text message to or from mobile subscriber
always ON network. Through SMS, the phones. GSM system supports SMS messages using
popular value-added services such unused available bandwidth and has several unique
as news/stock quotes service, email
features. These features include automatic confirma-
through SMS, health-care services, alert services can
be provided. tion of message delivery. SMS can be transmitted and
received simultaneously with voice, data, or fax calls.
 Global System for Mobile (GSM) 439

Table 11.6 GSM services

Service category Service type with comments

Telephone services – Telephony voice at 13 kbps (full rate)

– Emergency calls at specific emergency number
– Short Messaging Service (SMS): Point to point and cell broadcast types
– Message handling and storage services
– Videotext, Teletex, FAX transmission
– Half-rate speech coder, and Enhanced full rate: Optional implementation
Data or bearer services – Rate adapted subrate information circuit-switched asynchronous duplex data @
300 bps –9,600 bps (transparent/nontransparent)
– Rate adapted subrate information circuit-switched synchronous data @
2400 bps –9,600 bps transparent
– Access to X.25 public data networks packet service for synchronous duplex
packet data @ 2400 bps –9,600 bps
– Access to PAD (Packet Assembler/Disassembler) functions for asynchronous
data @ 300 bps –9,600 bps
– Speech and data swapping during a call
– Support of ARQ technique for improved error rates
– Modem selection of 3.1 kHz audio service when interworking with ISDN
Supplementary ISDN Services – Call forwarding or call diversion: All calls, when subscriber is not available
– Call barring Outgoing calls with specifications
– Caller or Calling Number Identification Presentation (CNIP) or restriction of
displaying the caller’s ID (CNIR)
– Connected number ID Presentation (CNOP) or restriction of displaying the
called ID (CNOR)
– Malicious Call Identification (MCI)
– Call orwarding Unconditional or when mobile busy or no reply or mobile not
reachable
– Call transfer to another mobile phone
– Mobile access hunting allows multiple phones to be called in sequence
– Call Waiting Incoming call during current conversation
– Call Holding Put current call on hold to answer another
– Completion of call to busy subscriber
– Multiparty communication Up to five ongoing calls can be included in
conference-type conversation
– Closed user group
– Advice of charge Online charge information, free phone service, reverse charging
– Operator determined call barring Barring all originating calls or all incoming
calls or outgoing international calls or incoming calls when roaming or
restriction of certain features from individual subscribers by the operator
– User-to-user signalling for sending user data to another GSM or ISDN phone

This is possible because voice/data/fax calls utilise dedicated voice channels for the duration of the call, while
short messages occupy the control channels.
SMS is basically a store and forward service. If the recipient mobile subscriber is not available, the message
can be stored with the system. Each mobile cellular network that supports SMS has one or more messaging
centres to handle and manage the short messages. This means that SMS message is not sent directly from a
sender to the receiver but always processed via an SMS centre at MSC.
440 Wireless Communications

A single SMS can be up to 160 characters of text in length. The characters may comprise of a combination
of words, numbers, or alphanumeric characters. Nontext-based SMSs (binary format) are also supported.
There are ways of sending multiple SMSs also. For example, SMSs concatenation and SMS compression
within single short message features are available.

11.10.2 GSM Service Quality Requirements

The GSM standards specify various requirements on the quality of service delivered to the mobile users.
Some of these service requirements are
– The time from switching to service ready of 4 seconds in the home service area
– The time from switching to service ready of 10 seconds in the visiting service area
– A connect time of 4 seconds to the called network
– A release time of 2 seconds to the called network
– The time to alert a called mobile subscriber of an incoming call of 4 seconds in the first attempt and
15 seconds in the subsequent attempts
– A maximum time gap due to hand-off of 150 ms in intercell handover
– A maximum time gap due to hand-off of 100 ms in intracell handover
– A maximum one-way speech delay of 90 ms
– An intelligibility of speech of 90%
– Probability of call release failure rate of less than 0.02%
– Probability of misconnection, incorrect charging, no tone or similar failure of less than 0.01%
– Probability of losing HLR/VLR messages of less than 0.000001%
– Mean accumulated downtime for one cell-site of less than 30 minutes per year
On the average, a fault that causes more than 50% of the established calls to be disconnected prema-
turely will occur less than once a year. The service availability of an MSC is expressed in terms of the
frequency or duration of loss of service. The loss of service to particular switching circuits, groups of
switching circuits, subsystems, or the complete MSC is determined by the nature of faults in the MSC.
The average cumulative duration of service denial due to faults affecting more than 50% of the switch-
ing circuits will not exceed three minutes during the first year of operation and two minutes during each
subsequent year.

11.10.3 Power Classes in GSM

Power management in the system helps the service provider to control the interference among the mobile
subscribers and minimise the power consumption at the mobile unit. Therefore, power management has direct
impact on quality of service and the battery life. There are three major classes of mobile phones: vehicle
mounted, portable, and handheld mobile phones. Vehicle-mounted mobile phones use the car battery, por-
table mobile phones use larger rechargeable batteries, and handheld mobile phones use low-capacity smaller
rechargeable batteries. The antenna for the vehicle-mounted mobile phones is mounted outside the car, which is
away from the user’s body. The antenna for the portable mobile phones is mounted along with the transceiver.
GSM cells have radii ranging from 300 m to 35 km.
Facts to Know ! The size of the cell determines the required transmitted
power for the BTS and the MS. To allow manufacturers
The antenna in handheld mobile
phones is next to the ear and brain of
and service providers to accommodate the diversified
the user which raises health concerns requirements for different BTS and MS, a number
for high-radiated powers. of radiated power classes are identified by the
GSM standard. There are five power classes for the
 Global System for Mobile (GSM) 441

mobile phones from +29 dBm (0.8 W) up to +44 dBm (20 W) with a 4-dB separation between consecutive
mobile classes. There are eight classes for the BTS radiated power ranging from +34 dBm (2.5 W) up to
+55 dBm (320 W) in 3-dB steps.

EXAMPLE 11.9 GSM transmitter powers

Tabulate the transmitter powers EIRP (watts) for all classes of GSM base stations and mobile stations.
Solution
Table 11.7 shows EIRP levels for all eight classes of GSM base stations and five classes of GSM mobile
phone equipments.

Table 11.7 GSM transmitter power classes

Power class Base station power ( Watts) Mobile phone power ( Watts)

I 320 20
II 160 8
III 80 5
IV 40 2
V 20 0.8
VI 10 ---
VII 5 ---
VIII 2.5 ---

The mobile subscriber Tx power is always controlled to its minimum required value to minimise the
interference and maximise the battery life. Power adjustments in both directions are made using closed-
loop power control. The mobile subscriber is allowed to reduce its peak output power down to 20 mW in
2 dB steps. The BSS calculates the optimum Tx power level for individual mobile subscribers by monitoring
certain metrics of performance such as the received signal power level, received signal-to-noise ratio, or received
bit error rate, and sends this information through control signaling packets to the mobile subscriber.

11.10.4 Frequency Hopping in GSM

In voice-oriented cellular networks, corrupted data packets are either discarded or retained with incorrect
value. In both these cases, distortion occurs in the voice signal at the receiver. If the frequency channel coin-
cides with a deep frequency selective fading or when the cochannel interference is excessive, the distortion in
the received voice signal will persist until the mobile subscriber moves to some other location such that the
frequency selective fading pattern is changed or the cochannel interference is reduced.
One method to reduce the effect of the frequency selective fade or excessive cochannel interference is to
provide for a slow frequency-hopping pattern. This option is exercised in the GSM system that supports an
optional frequency-hopping pattern of 217.6 hops per second. When multipath fading is a problem, the GSM
system allows for frequency hopping. All GSM mobile phones are capable of frequency hopping, but only
those cells that are located in areas of severe fading are designated as hopping cells. The system can hop
only among the frequencies that are assigned to the cell, so there will be only a few hopping possibilities.
Thus GSM is not really a true spread-spectrum system, but rather a TDMA/FDM system with some spread-
spectrum capability added on.
442 Wireless Communications

EXAMPLE 11.10 Maximum frequency hopping in GSM

In Europe, GSM uses the frequency band of 890 to 915 MHz for uplink transmission, and the frequency band of 935 to
960 MHz for downlink transmission. Determine the maximum frequency hop from one frame to the next for uplink
transmission and downlink transmission. Express it as a percentage of the mean carrier frequency.
Solution
Step 1. To find RF bandwidth for uplink transmission
Frequency band for uplink transmission = 890 MHz – 915 MHz (given)
RF Bandwidth for uplink transmission = 915 – 890 = 25 MHz
Step 2. To find RF bandwidth for downlink transmission
Frequency band for downlink transmission = 935 MHz – 960 MHz (given)
RF Bandwidth for downlink transmission = 960 – 930 = 25 MHz
Step 3. To find maximum frequency hop
Therefore, in either case, the maximum frequency hop or change from one frame to the next could be 25 MHz.
Step 4. To express maximum frequency hop in %age.
For uplink transmission,
Mean carrier frequency = 890 + (915 – 890)/2 = 902.5 MHz
Maximum frequency hopping = 25/902.5
Hence, maximum frequency hopping = 0.0277 or 2.77%
For downlink transmission,
Mean carrier frequency = 935 + (960 – 935)/2 = 947.5 MHz
Maximum frequency hopping = 25/947.5
Hence, maximum frequency hopping = 0.0264 or 2.64%

The maximum RF spectrum bandwidth for uplink or downlink transmission is 25 MHz. Expressed as a
percentage of the mean carrier frequency of 900 MHz, the maximum frequency hopping for the downlink is
approximately 25/900 × 100 = 2.8%.
With this percentage of maximum frequency hopping, it turns out that the time spent by a rapidly moving
mobile user in a deep fade is reduced to about 4.6 ms. This incidentally matches with the frame duration. In
the case of slowly moving mobile subscribers such as pedestrians, the frequency-hopping algorithm produces
substantial gains against fades. Each successive frame in a given channel is carried on a different carrier
frequency. Thus, the transmission frequency is changed once every 4.615 ms.

Key Terms
• Air interface • Frequency Division Multiple • Privacy
• Authentication Access • Registration
• Authentication Centre (AuC) • Frequency hopping • Short Message Service (SMS)
• Authorisation • Global System For Mobile • Subscriber Identity Module
• Base Station (BS) (GSM) (SIM)
• Base Station Subsystem (BSS) • Hand-off • Superframe
• BCCH • Mobile Station (MS) • Time Division Multiple Access
• Downlink • Network and Switching (TDMA)
• Encryption Subsystem (NSS) • Time slots
• Frame • Packet • Uplink