GSM SYSTEM

The GSM Network Architecture

• Time division multiple access-TDMA
• 124 radio carriers, inter carrier spacing 200khz.
• 890 to 915MHZ mobile to base - upLINK
• 935 to 960MHZ base to mobile - downLINK
• 8 channels/carrier
• GSM combines FDM and TDM: bandwidth
is subdivided into channels of 200khz,
shared by up to eight stations, assigning
slots for transmission on demand.
 GSM uses paired radio channels

890MHz 915MHz 935MHz 960MHz

0 124 0 124
The GSM Radio Interface

AIR INTERFACE
BASE TRANSCEIVER STATION

Hz
-9 60 M
935
NK
NLI
DOW
MOBILE

Hz
15M
- 9
0
89
N K
LI
UP
Concept of TDMA Frames and
Channels

c
f

• GSM combines FDM and TDM: bandwidth is

subdivided into channels of 200khz, shared by up to
eight stations, assigning slots for transmission on
demand.
 GSM System Architecture PSTN
ISDN
BSC PDN
MS BTS
MSC
GMSC

BTS BSC
VLR
MS

BTS EIR
AUC
MS HLR
• Integrated Services Digital Network (ISDN) is a set of communications
standards for simultaneous digital transmission of voice, video, data, and
other network services over the traditional circuits of the public switched
telephone network. It was first defined in 1988 in the CCITT red book.[1]
Prior to ISDN, the phone system was viewed as a way to transport voice,
with some special services available for data. The key feature of ISDN is
that it integrates speech and data on the same lines, adding features that
were not available in the classic telephone system. There are several kinds
of access interfaces to ISDN defined as Basic Rate Interface (BRI), Primary
Rate Interface (PRI) and Broadband ISDN (B-ISDN).
• ISDN is a circuit-switched telephone network system, which also provides
access to packet switched networks, designed to allow digital transmission
of voice and data over ordinary telephone copper wires, resulting in
potentially better voice quality than an analog phone can provide. It offers
circuit-switched connections (for either voice or data), and packet-switched
connections (for data), in increments of 64 kilobit/s. A major market
application for ISDN in some countries is Internet access, where ISDN
typically provides a maximum of 128 kbit/s in both upstream and
downstream directions. Channel bonding can achieve a greater data rate;
typically the ISDN B-channels of 3 or 4 BRIs (6 to 8 64 kbit/s channels) are
bonded.
• A public data network is a network established and operated by a
telecommunications administration, or a recognized private operating
agency, for the specific purpose of providing data transmission services for
the public.

The public switched telephone network (PSTN) is the network of the world's
public circuit-switched telephone networks. It consists of telephone lines,
fiberoptic cables, microwave transmission links, cellular networks,
communications satellites, and undersea telephone cables all inter-connected
by switching centers which allows any telephone in the world to communicate
with any other. Originally a network of fixed-line analog telephone systems, the
PSTN is now almost entirely digital in its core and includes mobile as well as
fixed telephones.
The technical operation of the PSTN utilises standards created by the ITU-T.
These standards allow different networks in different countries to interconnect
seamlessly. There is also a single global address space for telephone numbers
based on the E.163 and E.164 standards. The combination of the
interconnected networks and the single numbering plan make it possible for
any phone in the world to dial any other phone.
 Cellular Systems
• The geographic area is
MSC VLR divided into cells
HLR • Each cell has a Base Station
land link
land link managing the
communications
VLR MSC • A set of cells managed by a
Radio Base Station single MSC is called
link
Location Area

MSC Mobile Switching Center

VLR Visitor Location Register
HLR Home Location Register
 GSM ARCHITECTURE
NSS Network and Switching
PLMN
Subsystem
Databases
EIR Equipment Identity Register
AuC Authentication Center
EIR VLR VLR HLR AuC

GMSC Gateway MSC

PSTN

MSC MSC GMSC SSP BSS Base Station System

Switches NSS BSC Base Station Controller

SSP
BTS Base Transceiver Station
BSS
BSC
BSS
MS Mobile Station
MS
BTS
Radio Systems SSP Service Switching Point
 Network and switching subsystem
• NSS is the main component of the public mobile network GSM
– switching, mobility management, interconnection to other
networks, system control
• Components
– Mobile Services Switching Center (MSC)
controls all connections via a separated network to/from a
mobile terminal within the domain of the MSC - several BSC
can belong to a MSC
– Databases (important: scalability, high capacity, low delay)
• Home Location Register (HLR)
central master database containing user data, permanent
and semi-permanent data of all subscribers assigned to
the HLR (one provider can have several HLRs)
• Visitor Location Register (VLR)
local database for a subset of user data, including data
about all user currently in the domain of the VLR
 Operation subsystem
• The OSS (Operation Subsystem) enables centralized operation,
management, and maintenance of all GSM subsystems
• Components
– Authentication Center (AUC)
• generates user specific authentication parameters on
request of a VLR
• authentication parameters used for authentication of
mobile terminals and encryption of user data on the air
interface within the GSM system
– Equipment Identity Register (EIR)
• registers GSM mobile stations and user rights
• stolen or malfunctioning mobile stations can be locked
and sometimes even localized (‫)سياه سفيد خاکستری‬
– Operation and Maintenance Center (OMC)
• different control capabilities for the radio subsystem and
the network subsystem
Mobile Handset

TEMPORARY DATA PERMANENT DATA

- Temporary Subscriber Identity Permanent Subscriber Identity

- Current Location Key/Algorithm for Authentication.

- Ciphering Data

Provides access to the GSM n/w

Consists of
Mobile equipment (ME)
Subscriber Identity Module (SIM)
 GSM System Architecture-I
• Mobile Station (MS)
Mobile Equipment (ME)
Subscriber Identity Module (SIM)
• Base Station Subsystem (BSS)
Base Transceiver Station (BTS)
Base Station Controller (BSC)
• Network Switching Subsystem(NSS)
Mobile Switching Center (MSC)
Home Location Register (HLR)
Visitor Location Register (VLR)
Authentication Center (AUC)
Equipment Identity Register (EIR)
 System Architecture
Mobile Station (MS)

The Mobile Station is made up of two entities:

1. Mobile Equipment (ME)

2. Subscriber Identity Module (SIM)
System Architecture Mobile Station (MS)

Mobile Equipment

• Portable,vehicle mounted, hand held device

• Uniquely identified by an IMEI (International Mobile
Equipment Identity)
• Voice and data transmission
• Monitoring power and signal quality of surrounding
cells for optimum handover
• Power level : 0.8W – 20 W
• 160 character long SMS.
 System Architecture Mobile Station (continue)

Subscriber Identity Module (SIM)

• Smart card contains the International Mobile Subscriber

Identity (IMSI)
• Allows user to send and receive calls and receive other
subscribed services
• Encoded network identification details
- Key Ki,Kc and A3,A5 and A8 algorithms
• Protected by a password or PIN
• Can be moved from phone to phone – contains key
information to activate the phone
• A personal identification number (PIN, pronounced "pin") is a
secret numeric password shared between a user and a system that
can be used to authenticate the user to the system. Typically, the
user is required to provide a non-confidential user identifier or token
(the user ID) and a confidential PIN to gain access to the system.
Upon receiving the user ID and PIN, the system looks up the PIN
based upon the user ID and compares the looked-up PIN with the
received PIN. The user is granted access only when the number
entered matches with the number stored in the system. Hence,
despite the name, a PIN does not personally identify the user.[1]
 System Architecture
Base Station Subsystem (BSS)

Base Station Subsystem is composed of two parts that

communicate across the standardized Abis interface
allowing operation between components made by
different suppliers

1. Base Transceiver Station (BTS)

2. Base Station Controller (BSC)
Base Transceiver Station (BTS):

• Encodes,encrypts,multiplexes,modulates and feeds

the RF signals to the antenna.
• Frequency hopping
• Communicates with Mobile station and BSC
• Consists of Transceivers (TRX) units
Base Station Controller (BSC)

• Manages Radio resources for BTS

• Assigns Frequency and time slots for all MS’s in its
area
• Handles call set up
• Transcoding and rate adaptation functionality
• Handover for each MS
• Radio Power control
• It communicates with MSC and BTS
 System Architecture
Network Switching Subsystem(NSS)

Mobile Switching Center (MSC)

• Heart of the network

• Manages communication between GSM and other networks
• Call setup function and basic switching
• Call routing
• Billing information and collection
• Mobility management
- Registration
- Location Updating
- Inter BSS and inter MSC call handoff
• MSC does gateway function while its customer roams to other
network by using HLR/VLR.
 System Architecture Network Switching Subsystem …

• Home Location Registers (HLR)

- permanent database about mobile subscribers in a large service

area(generally one per GSM network operator)
- database contains IMSI,MSISDN,prepaid/postpaid,roaming
restrictions,supplementary services.

• Visitor Location Registers (VLR)

- Temporary database which updates whenever new MS enters its

area, by HLR database
- Controls those mobiles roaming in its area
- Reduces number of queries to HLR
- Database contains IMSI,TMSI,MSISDN,MSRN,Location
Area,authentication key
• An International Mobile Subscriber Identity or IMSI ( /ˈɪmziː/) is a unique
identification associated with all GSM and UMTS network mobile phone
users. It is stored as a 64 bit field in the SIM inside the phone and is sent by
the phone to the network. It is also used for acquiring other details of the
mobile in the Home Location Register (HLR) or as locally copied in the
Visitor Location Register. To prevent eavesdroppers identifying and tracking
the subscriber on the radio interface, the IMSI is sent as rarely as possible
and a randomly-generated TMSI is sent instead.
• The IMSI is used in any mobile network that interconnects with other
networks, in particular CDMA and EVDO networks as well as GSM
networks. This number is provisioned in the phone directly or in the R-UIM
card (a CDMA analogue equivalent to a SIM card in GSM).
• An IMSI is usually presented as a 15 digit long number, but can be shorter.
For example MTN South Africa's old IMSIs that are still being used in the
market are shown as 14 digits. The first 3 digits are the Mobile Country
Code (MCC), and is followed by the Mobile Network Code (MNC), either 2
digits (European standard) or 3 digits (North American standard). The
remaining digits are the Mobile Subscription Identification Number (MSIN)
within the network's customer base.
• The IMSI conforms to the ITU E.212 numbering standard.
• TMSI
• The "Temporary Mobile Subscriber Identity" (TMSI) is the identity that is
most commonly sent between the mobile and the network. TMSI is
randomly assigned by the VLR to every mobile in the area, the moment it is
switched on. The number is local to a location area, and so it has to be
updated each time the mobile moves to a new geographical area.
• The network can also change the TMSI of the mobile at any time. And it
normally does so, in order to avoid the subscriber from being identified, and
tracked by eavesdroppers on the radio interface. This makes it difficult to
trace which mobile is which, except briefly, when the mobile is just switched
on, or when the data in the mobile becomes invalid for one reason or
another. At that point, the global "international mobile subscriber identity"
(IMSI) must be sent to the network. The IMSI is sent as rarely as possible,
to avoid it being identified and tracked.
• A key use of the TMSI is in paging a mobile. "Paging" is the one-to-one
communication between the mobile and the base station. The most
important use of broadcast information is to set up channels for "paging".
Every cellular system has a broadcast mechanism to distribute such
information to a plurality of mobiles.
• Size of TMSI is 4 octet with full hex digits and can't be all 1 because the SIM
uses 4 octets with all bits equal to 1 to indicate that no valid TMSI is
available.[1]
• MSISDN
• MSISDN is a number uniquely identifying a subscription in a GSM or a
UMTS mobile network. Simply put, it is the telephone number of the SIM
card in a mobile/cellular phone. This abbreviation has several
interpretations, the most common one being "Mobile Subscriber Integrated
Services Digital Network Number".[1]
• The MSISDN together with IMSI are two important numbers used for
identifying a mobile subscriber. The latter identifies the SIM, i.e. the card
inserted in to the mobile phone, while the former is used for routing calls to
the subscriber. IMSI is often used as a key in the HLR ("subscriber
database") and MSISDN is the number normally dialed to connect a call to
the mobile phone. A SIM is uniquely associated to an IMSI, while the
MSISDN can change in time (e.g. due to number portability), i.e. different
MSISDNs can be associated to the SIM.
• The MSISDN follows the numbering plan defined in the ITU-T
recommendation E.164.
• [edit] Abbreviation
• Depending on source or standardization body, the abbreviation MSISDN can be written out in
several different ways. These are today the most widespread and common in use.
• An MSISDN is limited to 15 digits, prefixes not included (e.g., 00 prefixes an international MSISDN
when dialing from Sweden).
• MSISDN - Mobile Station International Subscriber Directory Number
• In GSM and its variant DCS 1800, MSISDN is built up as

• MSISDN = CC + NDC + SN
CC = Country Code
NDC = National Destination Code, identifies one or part of a PLMN
SN = Subscriber Number
• In the GSM variant PCS 1900, MSISDN is built up as

• MSISDN = CC + NPA + SN
CC = Country Code
NPA = Number Planning Area
SN = Subscriber Number [edit] Example
• MSISDN: 380561234567
• CC 380 Ukraine NDC 56 Dnipropetrovsk SN 1234567 Subscriber's number For further information
on the MSISDN format, see the ITU-T specification E.164.
• MSRN - Mobile Station Roaming Number
• The Mobile Station Roaming Number is an E.214 defined telephone number
used to route telephone calls in a mobile network from a GMSC (Gateway
Mobile Switching Centre) to the target MSC (see Network Switching
Subsystem). It can also be defined as a directory number temporarily
assigned to a mobile for a mobile terminated call. A MSRN is assigned for
every mobile terminated call, not only the calls where the terminating MS lives
on a different MSC than the originating MS. Although this seems unnecessary
since many vendors' VLR's are integrated with the MSC, the GSM
specification indicates that the MSC and VLR (Visitor Location Register) do
not need to reside on the same switch. They are considered two different
nodes as they have their own routing addresses. i.e.the MSRN is one of the
returned parameters into SRI_ACK message. In particular the MSRN is used
into an MNP scenario (in this case it can be modified as 'RgN + MSISDN').
• Another temporary address that hides the identity of a subscriber. The VLR
generates this address on request from the MSC,and the address is also
stored in the HLR. MSRN contains the current visitor country code(VCC), the
visitor national destination code (VNDC), the identification of the current MSC
together with the subscriber number. If we have all the MSC working as a
GMSC like the latest technologies so what would be the states of the MSRN ?
we can use it only for test to route the calls to a specific MSC otherwise we
don't need it to use it.
 System Architecture Network Switching Subsystem …

• Authentication Center (AUC)

- Protects against intruders in air interface
- Maintains authentication keys and algorithms and
provides security triplets ( RAND,SRES,Kc)
- Generally associated with HLR

• Equipment Identity Register (EIR)

- Database that is used to track handsets using the
IMEI (International Mobile Equipment Identity)
- Made up of three sub-classes: The White List, The
Black List and the Gray List
- Only one EIR per PLMN
- Public land mobile network
 GSM Specifications-1

• RF Spectrum
GSM 900
Mobile to BTS (uplink): 890-915 Mhz
BTS to Mobile(downlink):935-960 Mhz
Bandwidth : 2* 25 Mhz

GSM 1800
Mobile to BTS (?uplink): 1710-1785 Mhz
BTS to Mobile(?downlink) 1805-1880 Mhz
Bandwidth : 2* 75 Mhz
 GSM Specification-II

• Carrier Separation : 200 Khz

• Duplex Distance : 45 Mhz
• No. of RF carriers : 124
• Access Method : TDMA/FDMA
• Modulation Method : GMSK
• Modulation data rate : 270.833 Kbps
 GSM Operation
Speech Speech

Speech coding Speech decoding

13 Kbps
Channel Coding Channel decoding

22.8 Kbps
Interleaving De-interleaving
22.8 Kbps

Burst Formatting Burst Formatting

33.6 Kbps

Ciphering De-ciphering
33.6 Kbps
Radio Interface
Modulation
270.83 Kbps
Demodulation
 Complete GSM system
Multiple
Speech Channel Access
Interleaving Modulation
Coding Coding Burst
Assembling

Wireless
Channel

Multiple
De-
Speech Channel Access
DeInterleaving Modulation/
Decoding Decoding Burst Dis-
Equalization
assembling

*A brief Overview of the GSM Radio Interface, Thierry Turletti

 GSM - TDMA/FDMA
935-960 MHz
124 channels (200 kHz)
downlink

890-915 MHz
124 channels (200 kHz)
uplink
higher GSM frame structures
time

GSM TDMA frame

1 2 3 4 5 6 7 8
4.615 ms

GSM time-slot (normal burst)

guard guard
space tail user data S Training S user data tail space
3 bits 57 bits 1 26 bits 1 57 bits 3
546.5 µs
577 µs
 GSM multiple access scheme = FDMA + TDMA

Uplink spectrum

guard band carrier 1 carrier 2 …… carrier 124

890MHz 200kHz 915MHz

120ms multiframe

frame 1 frame 2 frame 3 …... frame 26

control frames

burst 1 burst 2 …… burst 8

0.577ms

*Wireless Communications, T. Rappaport, Prentice Hall Communications Engineering and Emerging Tech. Series
 Normal Burst Structure in GSM

3 57 1 26 1 57 3
Data bits CTRL CTRL Data bits
Tail bits Equalization Bits Tail bits
Block 1 bit bit Block 2
{000} {1/0} {1/0} {000}

Total number of bits in one GSM burst=

2*(3+57+1)+26=148 bits

Out of 148 bits, 114 bits are pure data bits;

114*(260/456)=65 bits are true information bits
So, the transmission efficiency is 65/148=44%

*Principles & Applications of GSM,Vijay K. Garg, Prentice

Hall Communications Engineering and Emerging Tech. Series
Physical Channel
GSM-Frame Structure
GSM delays uplink TDMA frames
The start of the uplink
TDMA is delayed of TDMA frame (4.615 ms)
three time slots

Downlink TDMA R1 R2 R3 R4 R5 R6 R7 R8
F1MHz
Uplink TDMA
T1 T2 T3 T4 T5 T6 T7 T8 Frame
F1 + 45MHz

R T

R T

Fixed transmit
Delay of three time-slots
 DEFINITION OF TIME SLOT - 156.25 BITS 15/26ms = 0.577ms

NORMAL BURST 3 57 1 26 1 57 3 8.25

- NB

FREQUENCY
CORRECTION 3 142 3 8.25
BURST - FB

SYNCHRONISATION 3 39 64 39 3 8.25
BURST - SB

ACCESS
BURST - AB 6 41 36 3 68.25

FIXED BITS SYNCHRONISATION BITS

TAIL BIT GUARD PERIOD

ENCRYPTION BIT TRAINING BITS FLAG BITS MIXED BITS

 HIERARCHY OF FRAMES
1 HYPER FRAME = 2048 SUPERFRAMES = 2 715 648 TDMA FRAMES ( 3 H 28 MIN 53 S 760 MS )

0 1 2 3 4 5 6 2043 2044 2045 2046 2047

TRAFFIC CHANNELS 1 SUPER FRAME = 1326 TDMA FRAMES ( 6.12 S )

LEFT (OR) RIGHT
1 SUPER FRAME = 51 MULTI FRAMES

0 1 2 3 4 48 49 50 SIGNALLING CHANNELS

1 SUPER FRAME = 26 MULTI FRAMES

0 1 2 24 25
1 MULTIFRAME = 26 TDMA FRAMES ( 120 ms )

0 1 2 3 24 25
1 MULTI FRAME = 51 TDMA FRAMES (235 .4 ms )
0 1 2 3 4 48 49 50

0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0
(4.615ms) TDMA FRAME NO.
0 1
1 TIME SLOT = 156.25 BITS
( 0.577 ms) 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0
(4.615 ms)
1 2 3 4 155 156 0 1
1 bit =36.9 micro sec
 GSM Frame Full rate
channel is
SACCH is idle in 25
transmitted
0 to 11 and 13 to 24 in frame 12
Are used for traffic data Frame
duration =
0 1 2 12 24 25 120ms

Frame
duration =
0 1 2 3 4 5 6 7 60/13ms

Frame
duration =
15/26ms
3 57 1 26 1 57 3 8.25
• 114 bits are available for data transmission.
• The training sequence of 26 bits in the middle of the
burst is used by the receiver to synchronize and
compensate for time dispersion produced by multi-path
propagation.
• 1 stealing bit for each information block (used for
FACCH)
• The GSM System uses a frame structure where each
frame consist of 8 time slots, and each time slot
contains 156.25 bits, and data is transmitted at 270.833
kbps in the channel.
 …Example

1. Time duration of a bit

2. Time duration of a slot
3. Time duration of a frame and
4. How long must a user occupying a
single slot must wait between two
simultaneous transmissions?
 Solution
• Time duration of a bit

1 1
=Tb =   3.692 s
bit-rate 270.833  10 3

• Time duration of a frame

 8  Tslot  4.615ms
• Time duration of a Slot

 Tslot  156.25  Tb  0.577 s

A user has to wait 4.615 ms before next
transmission
 Example
If a normal GSM timeslot consists of 6 trailing bits, 8.25
guard bits, 26 training bits, and 2 traffic bursts of 58
bits of data, find the frame efficiency
Solution
– Time slots have 6 + 8.25 + 26 + 2/58 = 156.25
bits.
– A frame has 8 * 156.25 = 1250 bits / frame.
 …Example

The number of overhead bits per frame is

given by

• bOH = 8(6) + 8(8.25) + 8(26) = 322 bits

• Frame efficiency = (1250 – 322 ) / 1250
= 74.24 %
 Logical Channels
Half rate 11.4kbps
Speech
TCH
(traffic) Full rate 22.8kbps
2.4 kbps
Data
4.8 kbps
9.6 kbps
BCH FCCH(Frequency correction)

SCH(Synchronization)
PCH(Paging)
CCCH
RACH(Random Access)
CCH AGCH(Access Grant)
(control)
SDCCH(Stand Alone)
Dedicated
SACCH(Slow-associated)
FACCH(Fast-associated)
 LOGICAL CHANNELS

TRAFFIC SIGNALLING

FULL RATE HALF RATE

Bm 22.8 Kb/S Lm 11.4 Kb/S
BROADCAST COMMON CONTROL DEDICATED CONTROL

FCCH SCH BCCH

RACH
PCH AGCH
FCCH -- FREQUENCY CORRECTION CHANNEL
SCH -- SYNCHRONISATION CHANNEL
BCCH -- BROADCAST CONTROL CHANNEL
PCH -- PAGING CHANNEL
RACH -- RANDOM ACCESS CHANNEL SDCCH SACCH FACCH
AGCH -- ACCESS GRANTED CHANNEL
SDCCH -- STAND ALONE DEDICATED CONTROL CHANNEL DOWN LINK ONLY
SACCH -- SLOW ASSOCIATED CONTROL CHANNEL BOTH UP &
FACCH -- FAST ASSOCIATED CONTROL CHANNEL UPLINK ONLY DOWNLINKS
 Broadcast Channel - BCH
• Broadcast control channel (BCCH) is a base to
mobile channel which provides general information
about the network, the cell in which the mobile is
currently located and the adjacent cells
• Frequency correction channel (FCCH) is a base to
mobile channel which provides information for
carrier synchronization
• Synchronization channel (SCH) is a base to mobile
channel which carries information for frame
synchronization and identification of the base
station transceiver
Common Control Channel - CCH
• Paging channel (PCH) is a base to mobile channel used
to alert a mobile to a call originating from the network
• Random access channel (RACH) is a mobile to base
channel used to request for dedicated resources
• Access grant channel (AGCH) is a base to mobile
which is used to assign dedicated resources (SDCCH or
TCH)
 Dedicated Control Channel -
DCCH
• Stand-alone dedicated control channel (SDCCH)
is a bi-directional channel allocated to a specific
mobile for exchange of location update
information and call set up information
 Dedicated Control Channel -
DCCH
• Slow associated control channel (SACCH) is a bi-directional
channel used for exchanging control information between base
and a mobile during the progress of a call set up procedure. The
SACCH is associated with a particular traffic channel or stand
alone dedicated control channel
• Fast associated control channel (FACCH) is a bi-directional
channel which is used for exchange of time critical information
between mobile and base station during the progress of a call.
The FACCH transmits control information by stealing capacity
from the associated TCH
• Um logical channels
• Um logical channel types are outlined in GSM 04.03. Broadly speaking, non-GPRS
Um logical channels fall into three categories: traffic channels, dedicated control
channels and non-dedicated control channels.
• [edit] Traffic channels (TCH)
• These point-to-point channels correspond to the ISDN B channel and are referred to
as Bm channels. Traffic channels use 8-burst diagonal interleaving with a new block
starting on every fourth burst and any given burst containing bits from two different
traffic frames. This interleaving pattern makes the TCH robust against single-burst
fades since the loss of a single burst destroys only 1/8 of the frame's channel bits.
The coding of a traffic channel is dependent on the traffic or vocoder type employed,
with most coders capable of overcoming single-burst losses. All traffic channels use a
26-multiframe TDMA structure.
• [edit] Full-rate channels (TCH/F)
• A GSM full rate channel uses 24 frames out of a 26-multiframe. The channel bit rate
of a full-rate GSM channel is 22.7 kbit/s, although the actual payload data rate is 9.6-
14 kbit/s, depending on the channel coding. This channel is normally used with the
GSM 06.10 Full Rate, GSM 06.60 Enhanced Full Rate or GSM 06.90 Adaptive Multi-
Rate speech codec. It can also be used for fax and Circuit Switched Data.
• [edit] Half-rate channels (TCH/H)
• A GSM half rate channel uses 12 frames out of a 26-multiframe. The channel bit rate
of a half-rate GSM channel is 11.4 kbit/s, although the actual data capacity is 4.8-7
kbit/s, depending on the channel coding. This channel is normally used with the GSM
06.20 Half Rate or GSM 06.90 Adaptive Multi-Rate speech codec.
• [edit] Dedicated Control Channels (DCCHs)
• These point-to-point channels correspond to the ISDN D channel and are referred to
as Dm channels.
• [edit] Standalone Dedicated Control Channel (SDCCH)
• The SDCCH is used for most short transactions, including initial call setup step,
registration and SMS transfer. It has a payload data rate of 0.8 kbit/s. Up to eight
SDCCHs can be time-multiplexed onto a single physical channel. The SDCCH uses
4-burst block interleaving in a 51-multiframe.
• [edit] Fast Associated Control Channel (FACCH)
• The FACCH is always paired with a traffic channel. The FACCH is a blank-and-burst
channel that operates by stealing bursts from its associated traffic channel. Bursts
that carry FACCH data are distinguished from traffic bursts by stealing bits at each
end of the midamble. The FACCH is used for in-call signaling, including call
disconnect, handover and the later stages of call setup. It has a payload data rate of
9.2 kbit/s when paired with a full-rate channel (FACCH/F) and 4.6 kbit/s when paired
with a half-rate channel (FACCH/H). The FACCH uses the same interleaving and
multiframe structure as its host TCH.
• [edit] Slow Associated Control Channel (SACCH)
• Every SDCCH or FACCH also has an associated SACCH. Its normal function is to
carry system information messages 5 and 6 on the downlink, carry receiver
measurement reports on the uplink and to perform closed-loop power and timing
control. Closed loop timing and power control are performed with a physical header at
the start of each L1 frame. This 16-bit physical header carries actual power and
timing advance settings in the uplink and ordered power and timing values in the
downlink. The SACCH can also be used for in-call delivery of SMS. It has a payload
data rate of 0.2-0.4 kbit/s, depending on the channel with which it is associated. The
SACCH uses 4-burst block interleaving and the same multiframe type as its host TCH
or SDCCH.
• [edit] Common Control Channels (CCCHs)
• These are unicast and broadcast channels that do not have analogs in ISDN. These
channels are used almost exclusively for radio resource management. The AGCH
and RACH together form the medium access mechanism for Um.
• [edit] Broadcast Control Channel (BCCH)
• The BCCH carries a repeating pattern of system information messages that describe
the identity, configuration and available features of the BTS. BCCH brings the
measurement reports it bring the information about LAI And CGI BCCH frequency are
fixed in BTS
• [edit] Synchronization Channel (SCH)
• The SCH transmits a Base station identity code and the current value of the TDMA
clock. SCH repeats on every 1st, 11th, 21st, 31st and 41st frames of the 51 frame
multi frame. So there are 5 SCH frames in a 51 frame multiframe.
• [edit] Frequency Correction Channel (FCCH)
• The FCCH generates a tone on the radio channel that is used by the mobile station to
discipline its local oscillator. FCCH will repeat on every 0th, 10th, 20th, 30th and 40th
frames of the 51 frame multiframe. So there are 5 FCCH frames in a 51 frame
multiframe.
• [edit] Paging Channel (PCH)
• The PCH carries service notifications (pages) to specific mobiles sent by the network.
A mobile station that is camped to a BTS monitors the PCH for these notifications
sent by the network.
• [edit] Access Grant Channel (AGCH)
• The AGCH carries BTS responses to channel requests sent by mobile stations via
the Random Access Channel.
• [edit] Random Access Channel (RACH)
• The RACH is the uplink counterpart to the AGCH. The RACH is a shared channel on
which the mobile stations transmit random access bursts to request channel
assignments from the BTS.
• [edit] Allowed channel combinations
• The multiplexing rules of GSM 05.02 allow only certain combinations of logical
channels to share a physical channel. The allowed combinations for single-slot
systems are listed in GSM 05.02 Section 6.4.1. Additionally, only certain of these
combinations are allowed on certain timeslots or carriers and only certain sets of
combinations can coexist in a given BTS. These restrictions are intended to exclude
non-sensical BTS configurations and are described in GSM 05.02 Section 6.5.
• The most common combinations are:
• Combination I: TCH/F + FACCH/F + SACCH. This combination is used for full rate
traffic. It can be used anywhere but C0T0.
• Combination II: TCH/H + FACCH/H + SACCH. This combination is used for half rate
traffic when only one channel is needed. It can be used anywhere but C0T0.
• Combination III: 2 TCH/H + 2 FACCH/H + 2 SACCH. This combination is used for
half rate traffic. It can be used anywhere but C0T0.
• Combination IV: FCCH + SCH + BCCH + CCCH. This is the standard C0T0
combination for medium and large cells. It can be used only on C0T0.
• Combination V: FCCH + SCH + BCCH + CCCH + 4 SDCCH + 2 SACCH.
[(5x1)+(5x1)+(1x4)+(3x4)+(4x4)+(2x4)+1idle=51frame multiframe] This is the typical
C0T0 combination for small cells, which allows the BTS to trade unnecessary CCCH
capacity for a pool of 4 SDCCHs. It can be used only on C0T0.
• Combination VI: BCCH + CCCH. This combination is used to provide additional
CCCH capacity in large cells. It can be used on C0T2, C0T4 or C0T6.
• Combination VII: 8 SDCCH + 4 SACCH.[(8x4)+(4x4)+3idle=51frame multiframe]
This combination is used to provide additional SDCCH capacity in medium and large
 Call Routing
• Call Originating from MS
• Call termination to MS
Outgoing Call
1. MS sends dialled number to
BSS
2. BSS sends dialled number to
MSC
3,4 MSC checks VLR if MS is
allowed the requested service.If
so,MSC asks BSS to allocate
resources for call.
5 MSC routes the call to GMSC
6 GMSC routes the call to local
exchange of called user
7, 8,
9,10 Answer back(ring back) tone
is routed from called user to MS
via GMSC,MSC,BSS
Incoming Call
1. Calling a GSM subscribers
2. Forwarding call to GSMC
3. Signal Setup to HLR
4. 5. Request MSRN from VLR
6. Forward responsible MSC to
GMSC
7. Forward Call to current MSC
8. 9. Get current status of MS
10.11. Paging of MS
12.13. MS answers
14.15. Security checks
16.17. Set up connection
Handovers

• Between 1 and 2 – Inter

BTS / Intra BSC
• Between 1 and 3 –
Inter BSC/ Intra MSC
• Between 1 and 4 –
Inter MSC
 LOGICAL CHANNELS

TRAFFIC SIGNALLING

FULL RATE HALF RATE

Bm 22.8 Kb/S Lm 11.4 Kb/S
BROADCAST COMMON CONTROL DEDICATED CONTROL

FCCH SCH BCCH

RACH
PCH AGCH
FCCH -- FREQUENCY CORRECTION CHANNEL
SCH -- SYNCHRONISATION CHANNEL
BCCH -- BROADCAST CONTROL CHANNEL
PCH -- PAGING CHANNEL
RACH -- RANDOM ACCESS CHANNEL SDCCH SACCH FACCH
AGCH -- ACCESS GRANTED CHANNEL
SDCCH -- STAND ALONE DEDICATED CONTROL CHANNEL DOWN LINK ONLY
SACCH -- SLOW ASSOCIATED CONTROL CHANNEL BOTH UP &
FACCH -- FAST ASSOCIATED CONTROL CHANNEL UPLINK ONLY DOWNLINKS
Location update from the mobile
Mobile looks for BCCH after switching on

RACH send channel request

AGCH receive SDCCH

SDCCH request for location updating

SDCCH authenticate

SDCCH authenticate response

SDCCH switch to cipher mode

SDCCH cipher mode acknowledge

SDCCH allocate TMSI

SDCCH acknowledge new TMSI

SDCCH switch idle update mode

 Call establishment from a mobile
Mobile looks for BCCH after switching on

RACH send channel request

AGCH receive SDCCH

SDCCH send call establishment request

SDCCH do the authentication and TMSI allocation

SDCCH send the setup message and desired number

SDCCH require traffic channel assignment

FACCH switch to traffic channel and send ack (steal bits)

FACCH receive alert signal ringing sound

FACCH receive connect message

FACCH acknowledge connect message and use TCH

TCH conversation continues

 Call establishment to a mobile
Mobile looks for BCCH after switching on

Mobile receives paging message on PCH

Generate Channel Request on RACH

Receive signaling channel SDCCH on AGCH

Answer paging message on SDCCH

Receive authentication request on SDCCH

Authenticate on SDCCH

Receive setup message on SDCCH

Receive traffic channel assignment on SDCCH

FACCH switch to traffic channel and send ack (steal bits)

Receive alert signal and generate ringing on FACCH

Receive connect message on FACCH

FACCH acknowledge connect message and switch to TCH
 Security in GSM

• On air interface, GSM uses encryption and TMSI instead

of IMSI.
• SIM is provided 4-8 digit PIN to validate the ownership of
SIM
• 3 algorithms are specified :
- A3 algorithm for authentication
- A5 algorithm for encryption
- A8 algorithm for key generation
Authentication in GSM
Key generation and Encryption
 9. GPRS
General Packet Radio Service: allocate more than one slot

Rx
935MHz

Tx Time
890MHz TDMA frame

Half duplex: emit then transmit (Class 1-12)

Full duplex: simulateous emit/transmit (Class 19-29)
Much more complex mobile phone
Improves data rate up to 4x10kbit/s
 9. GPRS
• GSM radio compatibility (Low cost)
• Reliability Classes : Loss probability 10-9 10-4 10-2
• Delay classes: <0,5s, <5s, <50s, no limit
• Data rate classes 1 to 18 (0,22bit/s up to 111Kb/s)

Question: GSM data rate with 8 slots: only 80kb/s

4 different
data rate
4 different
coding
scheme Strong
protection
Weak protection
9. GPRS

And after?
 Extended GSM life following 2001 telecom crash
 Unexpected SMS success
 2004: GPRS proposed in some towns for high speed
data exchange (Pictures)
 Rising importance of Wi-Fi for data exchange
(2.45GHz)
 GPRS could still be used for low resolution video
 GSM/GPRS network could survive until 2010
 Characteristics of GSM Standard
• Fully digital system using 900,1800 MHz frequency
band.
• TDMA over radio carriers(200 KHz carrier spacing.
• 8 full rate or 16 half rate TDMA channels per carrier.
• User/terminal authentication for fraud control.
• Encryption of speech and data transmission over the
radio path.
• Full international roaming capability.
• Low speed data services (upto 9.6 Kb/s).
• Compatibility with ISDN.
• Support of Short Message Service (SMS).
 Advantages of GSM over Analog system

• Capacity increases
• Reduced RF transmission power and longer battery life.
• International roaming capability.
• Better security against fraud (through terminal validation
and user authentication).
• Encryption capability for information security and privacy.
• Compatibility with ISDN,leading to wider range of
services
 Disadvantages of GSM
• No full ISDN bandwidth of 64 kbit/s to the user
• Reduced concentration while driving
• Electromagnetic radiation
• Abuse of private data possible
• High complexity of the system
• Several incompatibilities within the GSM
standards
 Future Of GSM
 2nd Generation
 GSM -9.6 Kbps (data rate)

 2.5 Generation ( Future of GSM)

HSCSD (High Speed ckt Switched data)
 Data rate : 76.8 Kbps (9.6 x 8 kbps)
GPRS (General Packet Radio service)
 Data rate: 14.4 - 115.2 Kbps
EDGE (Enhanced data rate for GSM Evolution)
 Data rate: 547.2 Kbps (max)
 3 Generation
WCDMA(Wide band CDMA)
 Data rate : 0.348 – 2.0 Mbps
 Bearer Services
• Include various data services for information transfer
between GSM and other networks like PSTN, ISDN etc
at rates from 300 to 9600 bps
• Short Message Service (SMS)
–up to 160 character alphanumeric data transmission
to/from the mobile terminal
• Unified Messaging Services(UMS)
• Group 3 fax
• Voice mailbox
• Electronic mail
 Supplementary Services

Call related services :

• Call Waiting- Notification of an incoming call while on the handset
• Call Hold- Put a caller on hold to take another call
• Call Barring- All calls, outgoing calls, or incoming calls
• Call Forwarding- Calls can be sent to various numbers defined by
the user
• Multi Party Call Conferencing - Link multiple calls together
• CLIP – Caller line identification presentation
• CLIR – Caller line identification restriction
• CUG – Closed user group
GSM speech coding

AIR INTERFACE
BASE TRANSCEIVER STATION

Hz
-9 60 M
935
NK
NLI
DOW
MOBILE

Hz
15M
- 9
0
89
N K
LI
UP
 Transmit Path

BS Side
8 bit A-Law 8 K sps
to
RPE/LTP speech Encoder
13 bit Uniform To Channel Coder 13Kbps

MS Side

8 K sps,
LPF A/D RPE/LTP speech Encoder
To Channel Coder 13Kbps

Sampling Rate - 8K
Encoding - 13 bit Encoding (104 Kbps)
RPE/LTP - Regular Pulse Excitation/Long Term Prediction
RPE/LTP converts the 104 Kbps stream to 13 Kbps
 GSM Speech Coding

• GSM is a digital system, so speech which

is inherently analog, has to be digitized.
• The method employed by current
telephone systems for multiplexing voice
lines over high speed trunks and is pulse
coded modulation (PCM). The output
stream from PCM is 64 kbps, too high a
rate to be feasible over a radio link.
 GSM Speech Coding
• Speech is divided into 20 millisecond
samples, each of which is encoded as 260
bits, giving a total bit rate of 13 kbps.
• Regular pulse excited -- linear predictive
coder (RPE--LPC) with a long term
predictor loop is the speech coding
algorithm.
• The 260 bits are divided into three classes:
– Class Ia 50 bits - most sensitive to bit errors.
– Class Ib 132 bits - moderately sensitive to bit errors.
– Class II 78 bits - least sensitive to bit errors.
• Class Ia bits have a 3 bit cyclic redundancy code added for error
detection = 50+3 bits.
• 132 class Ib bits with 4 bit tail sequence = 132 + 4 = 136.
• Class Ia + class Ib = 53+136=189, input into a 1/2 rate
convolution encoder of constraint length 4. Each input bit is
encoded as two output bits, based on a combination of the
previous 4 input bits. The convolution encoder thus outputs 378
bits, to which are added the 78 remaining class II bits.
• Thus every 20 ms speech sample is encoded as 456 bits, giving
a bit rate of 22.8 kbps.
• To further protect against the burst errors common to
the radio interface, each sample is interleaved. The
456 bits output by the convolution encoder are
divided into 8 blocks of 57 bits, and these blocks are
transmitted in eight consecutive time-slot bursts.
Since each time-slot burst can carry two 57 bit
blocks, each burst carries traffic from two different
speech samples.
3 57 bits 1 26 1 57 bits 3

3 57 bits 1 26 1 57 bits 3

3 57 bits 1 26 1 57 bits 3

3 57 bits 1 26 1 57 bits 3

3 57 bits 1 26 1 57 bits 3

3 57 bits 1 26 1 57 bits 3

3 57 bits 1 26 1 57 bits 3

3 57 bits 1 26 1 57 bits 3
 Bearer Services
• Telecommunication services to transfer data
between access points
• Specification of services up to the terminal
interface (OSI layers 1-3)
• Different data rates for voice and data (original
standard)
– Data service
• Synchronous: 2.4, 4.8 or 9.6 kbit/s
• Asynchronous: 300 - 1200 bit/s
 Tele Services
• Telecommunication services that enable voice communication
via mobile phones.
• All these basic services have to obey cellular functions, security
measurements etc.
• Offered services.
– Mobile telephony
primary goal of GSM was to enable mobile telephony
offering the traditional bandwidth of 3.1 kHz.
– Emergency number
common number throughout Europe (112); Mandatory for all
service providers; Free of charge; Connection with the
highest priority (preemption of other connections possible).
– Multinumbering
several ISDN phone numbers per user possible.
 Performance characteristics of GSM
• Communication
– mobile, wireless communication; support for voice and data
services
• Total mobility
– international access, chip-card enables use of access points
of different providers
• Worldwide connectivity
– one number, the network handles localization
• High capacity
– better frequency efficiency, smaller cells, more customers
per cell
• High transmission quality
– high audio quality and reliability for wireless, uninterrupted
phone calls at higher speeds (e.g., from cars, trains)
• Security functions
– access control, authentication via chip-card and PIN
 4. Voice Sampling
104 Kbit/s
Amplifier Gain
Micro control 8000Hz
Analog to Serial
Filter
Digital data
300Hz-
3KHz converter
13bit
Gain

Clock

• No need to shout, their is an automatic gain control

• High data rate not compatible with GSM
4. Voice Sampling
Voltage
125µs Sound
0.7 FF

0.6 80

0.5
00
Sampled data
Time

• Data rate higher than allowed by GSM

• Needs for data compression
 5. Voice Compression

Short term prediction (8 parameters, 36 bits)

Long Term Prediction (8 parameters, 26 bits) F0

Regular Pulse Excitation (60 parameters, 188 bits)

Parameter
2080 bits 260 bits
computing
20 ms of sampled signal Compression 1/10
5. Voice Compression
Short term prediction

20ms

Linear Predictive Coder for short term

(20ms) prediction of the sound
5. Voice Compression
Short term prediction
Energie Filtre 1/(1-a0z-1-a1z-2)

Filtre 1/(1-a0z-1-a1z-2- a2z-3-a3z-4- -..a7z-8)

Fréquence (Hz)

0 1000 2000
In GSM: 8th order polynom for short term prediction
5. Voice Compression
Long term prediction: accounts for the variations of F0

N on 7 bits
Filter 1/(1-bz-N) b on 2 bits

F0

Updated 4 times in the 20ms period (4x9=36 bits)

5. Voice Compression
Encryption
260 bits

50 b 132 b 132 b
• filter coefs • RPE pointers • 2nd RPE pulses
• block amplitude • RPE pulses • 2nd filter params
• LTP params • 2nd LTP params

50 b 3 132 b 4 132 b
convolution
114 b 114 b 114 b 114 b
5. Voice Compression
Is HR a real high resolution?

• Still 13 bits
• Still 300-3200Hz
filtering
• Still 8000Hz sampling

but…
• Enhanced full rate
• Specific hardware at
base station to improve
error recovery
 Speech Encoder

Conversion
Voice
LPC Analysis LPF Decimation
to bits

Status
C algorithm compiled using MS Visual C

References
http://www.eas.asu.edu/~spanias/index.html
http://www.kt.tu-cottbus.de/speech-analysis/
http://www.ddj.com/documents/s=1012/ddj9412b/
 Interleaving

T=Output Burst number {1-4}

t=the bit number in T’th burst {1-114}
b=((57.(T mod 4)+t.32+196.(t mod 2)) mod 456) B= tx_encoded number {1-2}
B=((T-(b mod 8) div 4)
b= the bit number in B’th tx_encoded {1-456}

tx_encoded tx_encoded

tx_data tx_data tx_data tx_data

encoded data encoded data

Interleaver 4 times tx_data

*Principles & Applications of GSM, Vijay K. Garg, Prentice Hall Communications Engineering and
Emerging Tech. Series
 Channel Encoding in GSM
Input : 260 bits Output: 456 bits
Class I Class II
182 bits 78 bits

Class Ia Class Ib
Convolutional
50 132 378 78
encoder

Parity
encoder
50 3 + 132 + {0000}

Parity check bits Tail Bits

Parity Encoder Generator Polynomial: G(x)=x3+x+1  G={1 0 1 1}

Convolution Encoder : Rate=1/2 Constrained length=5

C2k=bk  bk-3  bk-4

C2k+1=bkbk-1 bk-3  bk-4

 =Mod 2 addition
k {0,1,2,3,…..189} and bk=0 for k<0
Thank You