GLOBAL SYSTEM

for
MOBILE COMMUNICATIONS
 Agenda
• The Cellular Concept
• GSM Network Architecture
• Radio Channel Structure in GSM
• GSM Protocols
• AT & T commands
• GSM enabled Technologies
 The Cellular Concept
• Cellular mobile Communication is based on the
concept of frequency reuse.
• Limited Spectrum is partitioned into N non-
overlapping channel sets, which are then assigned in a
regular repeated pattern.
 Digital Cellular Systems

• Digital cellular systems are

– wireless - can be used everywhere.
– digital - give good quality.
– cellular - achieves high capacity.
– standardized - competition makes them cheap.
 Representation of Cells

Fictitious cells Ideal cells

 Cell Characteristics
• The Basic Union In The System
– defined as the area where radio coverage is given by
one base station.
• Addressed by Cell Global Identity (CGI).
• A cell has one or several frequencies, depending on
traffic load
– Frequencies are reused, but not used in neighboring
cells due to interference.
 Cell Structure
• Implements Space Division Multiplex – Base Station (BS)
covers a certain transmission area (cell).
• Mobile Station (MS) communicate via the BS.
• Advantages
– Higher capacity, Higher number of users.
– Less transmission power needed.
– More robust, decentralized.
– BS deals with interference, transmission area etc locally.
• Problems
– Fixed networks needed for BS’s.
– Handover.
– Interference with other cells.
• Cell sizes from 100m in cities to 35km on the country side.
 Cell Size
• Cell size determines number of cells available to
cover geographic area and (with frequency reuse) the
total capacity available to all users.
• The size is usually based in the local traffic
distribution and demand.
• Each network operator has to size cells to handle
expected traffic demand.
• The more the concentration of traffic demand in the
area, the smaller the cell has to be sized.
 Capacity of a Cellular System
Capacity within cell limited by available bandwidth and
operational requirements.

• Frequency Re-Use Distance.

The need
•Optimum Spectrum • The K factor or the cluster
Usage size.
•More Capacity
•High Quality of • Cellular coverage or Signal to
Service interference ratio.
•Low Cost
• Sectoring.
 The K factor and Frequency Re-Use Distance
7
K = i2 + ij + j2 6 2
K = 22 + 2*1 + 12 1
5 3
K=4+2+1
j
K=7 7 R
6 2
1 i
5 D
3 D = 3K * R
4 D = 4.58R

• Frequency re-use distance is based on the cluster size K.

• The cluster size is specified in terms of the offset of the
center of a cluster from the center of the adjacent cluster
 Cell Structure for K = 4
1

2 1
4
1 4 2
3
4 2 1 3

3 4 2 1

1 3 4 2

4 2 1 3

3 4 2

3
 Increasing cellular system capacity

• Cell sectoring
– Directional antennas subdivide cell into 3 or 6
sectors.
– Might also increase cell capacity by factor of 3 or 6.
• Cell splitting
– Decrease transmission power in base and mobile.
– Results in more and smaller cells.
– Reuse frequencies in non-contiguous cell groups.
– Example: ½ cell radius leads 4 fold capacity
increase.
Tri – Sector antenna for a cell
 Cell Distribution in a Network

Rural
Highway

Suburb Town
 GSM
• GSM is globally accepted standard for Digital Cellular
Communications today.

• GSM provides
– Anybody – 700 million users
– Anywhere – 194 countries
– Any media – voice, messaging, data, multimedia

• GSM is the stepping-stone to 3G networks.

 GSM Specifications and Characteristics
• Frequency band – 1850 to 1990 MHz.
• Duplex Distance – 80 MHz.
• Channel Separation – 200kHz.
• Modulation – Gaussian Minimum Shift Keying (GMSK).
• Transmission rate – 270 kbps over the air.
• Access method – Time Division Multiple Access
(TDMA).
• Speech coder – Linear Predictive Coding (LPC).
 GSM Network Architecture
:Access Network :Core Network
Base Station Subsystem GSM CS network

HLR VLR EIR AuC

BSC
BTS SS7
Mobile
Station MSC
PSTN

BTS

Um Abis A
 GSM Interfaces
• Um Interface
– Mobile Station and Base Station Subsystem
communicate across Um interface, also known as
air interface or radio link.
• Abis interface
– Base Transceiver Station (BTS) and Base Station
Controller (BSC) communicate across Abis
interface.
• A interface
– Base Station Subsystem communicates with
Mobile service Switching Center (MSC) across A
interface.
 GSM Functional Entities
• MS Mobile Station
– SIM – Subscriber Identity Module
• BSS Base Station Subsystem
– BTS – Base Transceiving Station
– BSC – Base Station Controller
• NSS Network and Switching Subsystem
– MSC – Mobile Switching Center
– Registers
• O&M: Operations and Maintenance Center
 GSM Functional Entities
• Registers
– HLR – Home Location Register
– VLR – Visitor Location Register
– AUC – Authentication Centre
– EIR – Equipment Identification Register
 Mobile Station (MS)
• Provides access to GSM network.
• Consists of
– Mobile Equipment (ME)
– Subscriber Identity Module (SIM)
• While subscriber roams or is stationary, the MS
transmits a radio signal to one of the many BTS using a
radio-link protocol via the Um interface.
 Mobile Equipment (ME)
• Physical Mobile Device
• Identifiers
– International Mobile Equipment Identity (IMEI)

– Press *#06#
 Subscriber Identity Module (SIM)
• A SIM is a logical single application running on a
UICC (Universal Integrated Circuit Card) smartcard.
• Contains Administrative data, Security data,
Subscriber data, and Roaming Data.
• Identifiers
– Ki – Subscriber Authentication Key.
– International Mobile Subscriber Identity (IMSI).
– Temporary Mobile Subscriber Identity (TMSI).
– Mobile Station International Service Digital
Network (MSISDN).
– Personal Identity Number protecting a SIM (PIN).
– Location Area Identity (LAI).
SIM Anatomy
 Base Station Subsystem (BSS)

• The BSS is composed of two

parts
– Base Transceiver Station
(BTS)
– Base Station Controller
(BSC)
 Base Transceiver Station (BTS)
• BTS houses radio transceivers that define a cell.
• Handles the radio link protocols with MS.
• BTS separates the speech and control signaling
associated with a MS and sends them to the BSC on
separate channels.
• Requirements
– Ruggedness
– reliability
– Portability
– Minimum cost
 Base Station Controller (BSC)
• BSC manages radio resources for one or more BTS.
• Handles (through the Abis Interface)
– Radio Channel Setup
– Frequency Hopping
– Handovers
• BSC also connects MS to MSC using A interface.
 Network and Switching Subsystem (NSS)
• NSS is the main component of the public mobile
network GSM.
• Provides
– Switching.
– mobility management.
– Interconnection to other networks.
– System control.
• Components
– Mobile Services Switching Center (MSC).
– Databases/Registers.
 Mobile Services Switching Centre (MSC)
• The central component of the
network subsystem.
• Interface between radio system
and fixed networks (PSTN and
ISDN).

• It acts like a normal switching

node
of the PSTN or ISDN.

• Connected to BSS through

A interface; usually an E-1,
either wireline or microwave.
 Mobile Services Switching Centre (MSC)
• Also performs signaling between MSC and other
functional entities using SS7
– Registration
– Authentication
– Location updating
– Handovers
– Call routing to a roaming subscriber
 Registers/Databases
• GSM defines a number of network databases that are
used in performing the functions of mobility
management and call control.
– HLR – Home Location Register
– VLR – Visitor Location Register
– AUC – Authentication Centre
– EIR – Equipment Identification Register
• Requirements
– Scalability
– High Capacity
– Low Latency
 Home Location Register (HLR)
• Central database for all subscribers
– Identity of the subscriber
– Services accessible to the subscriber
– Current location of the subscriber
• Given a Mobile Subscriber ISDN number
(MS-ISDN), call is routed to IMSI number-VLR
• Each subscriber appears only once in database
• HLR might be physically distributed in several sites
(e.g., using first two digits to identify physical HLR)
 Visitor Location Register (VLR)
• Database with information on MS within area served
by MSC
– MS Roaming number
– TMSI if applicable
– Location area in which was last registered
– Supplementary services
• Used by an MSC to retrieve information for various
purposes
– Handling of calls to or from a roaming mobile
station currently located in its area
• Typically part of MSC
 Call Routing

Fixed PSTN/ISDN Gateway Home Location PSTN/ISDN MSC/VLR Mobile

Subscriber exchange MSC Register exchange Station

MSISDN
MSISDN IMSI
MSISDN
MSRN
MSRN

MSRN
MSRN
TMSI

Indicates a switching Node

 Authentication Centre (AuC)
• Entity associated to HLR for authentication
– allows International Mobile Subscriber Identity (IMSI)
to be authenticated
• Allows ciphering of communication over radio path
between mobile station and network ciphered
• Transmits data needed for authentication and ciphering
via HLR to VLR, MSC and SGSN which need to
authenticate a mobile station (SIM validation)
 Equipment Identity Register (EIR)
• Logical entity responsible for storing IMEIs in network
used in GSM system.
• Equipment classified as "white listed", "grey listed” and
"black listed”.
• Ensures that MEs being used are valid and authorized to
function on the Public Land Mobile Network (PLMN) .
 Public Land Mobile Network (PLMN)
• Functionally may
be regarded as
BTS BTS BTS BTS BTS BTS

BTS BTS BTS BTS

independent BTS BTS BTS BTS

telecommunications
entities BSC BSC BSC BSC

• A collection of
MSC’s areas within MSC MSC

a common
numbering plan PSTN
 GSM Radio Transmission
• Combination of FDMA and
TDMA to send information A
IRIN
TER
FACE
• Frequencies: 800, 900, 1800, 1900 BA
SETR
ANSCEIVE
RSTA
TION

MHz
For example, GSM 900:
M
OBILE

– Uplink = 890-915 MHz

– Downlink = 935-960 MHz
• Each 25 MHz bandwidth is
divided into 124 carrier
frequencies spaced 200 KHz with
one or more frequencies allocated
to each base station
 GSM uses paired radio channels

PLINK
U

LINK
W N
DO

890MHz 915MHz 935MHz 960MHz

0 124 0 124
 Frequency Multiplex

k1 k2 k3 k4 k5 k6

t
 Time Multiplex

k1 k2 k3 k4 k5 k6

t
 Time and Frequency Multiplex
• Combination of both methods
• A Channel gets a certain
frequency band for a k 1 k2 k3 k4 k5 k6

certain amount of
c
time.
f

t
 GSM - TDMA/FDMA
935-960 MHz
124 channels (200 kHz)
downlink
yc
en
qu

890-915 MHz
fre

124 channels (200 kHz)

uplink
higher GSM frame structures
time

GSM TDMA frame

1 2 3 4 5 6 7 8
4.615 ms

GSM time-slot (normal burst)

guard guard
space tail user data S Training S user data tail space
3 bits 57 bits 1 26 bits 1 57 bits 3
546.5 µs
577 µs
 GSM delays uplink TDMA frames
The start of the uplink
TDMA is delayed of TDMA frame (4.615 ms)
three time slots

Downlink TDMA R1 R2 R3 R4 R5 R6 R7 R8
F1MHz
Uplink TDMA
T1 T2 T3 T4 T5 T6 T7 T8 Frame
F1 + 45MHz

R T

R T

Fixed transmit
Delay of three time-slots
 Logical Channels

TRAFFIC SIGNALLING

FULL RATE HALF RATE

Bm 22.8 Kb/S Lm 11.4 Kb/S
BROADCAST COMMON CONTROL DEDICATED CONTROL

FCCH SCH BCCH RACH

PCH AGCH
FCCH -- FREQUENCY CORRECTION CHANNEL
SCH -- SYNCHRONISATION CHANNEL
BCCH -- BROADCAST CONTROL CHANNEL
PCH -- PAGING CHANNEL SDCCH SACCH FACCH
RACH -- RANDOM ACCESS CHANNEL
AGCH -- ACCESS GRANTED CHANNEL DOWN LINK ONLY
SDCCH -- STAND ALONE DEDICATED CONTROL CHANNEL BOTH UP &
SACCH -- SLOW ASSOCIATED CONTROL CHANNEL UPLINK ONLY DOWNLINKS
FACCH -- FAST ASSOCIATED CONTROL CHANNEL
 Traffic Channels (TCH)

• Used to carry speech and data

• Types of TCH
– Full-rate (TCH/F)
– Half-rate (TCH/H)
• double capacity, but half the quality
– Eighth-rate or Stand-alone Dedicated Control
Channels (SDCCH)
• 26 TDMA frames
– 24 traffic channels
– 1 slow associated control channel
– 1 unused channel
 Control Channels
• Accessed by:
– Idle mode mobiles to exchange signaling information
required to change to dedicated mode
– Dedicated mode mobiles to monitor surrounding
base stations for handover and other information
• 51 TDMA frame format
• Broadcast Control Channel (BCCH)
– Broadcasts on the downlink information such as base
station identity, frequency allocation, frequency-
hopping sequences
 Control Channels
• Frequency Correction Channel (FCCH) and
Synchronization Channel (SCH)
– Synchronize mobile to time slot structure of cell
• Random Access Channel (RACH)
– Used by mobile to request access to GSM network
• Paging Channel (PCH)
– Alerts mobile to incoming call
• Access Grant Channel (AGCH)
– Allocates an SDCCH to mobile for signaling
following a request on the RACH
 Control Channels
• Stand-alone Dedicated Control Channel (SDCCH)
– exchange of location update information and call
set up information
• Slow associated control channel (SACCH)
– exchanging control information between base and
a mobile during the progress of a call set up
procedure
• Fast associated control channel (FACCH)
– exchange of time critical information between
mobile and base station during the progress of a
call
– FACCH steals capacity from the associated TCH
 HIERARCHY OF FRAMES
1 HYPER FRAME = 2048 SUPERFRAMES = 2 715 648 TDMA FRAMES ( 3 H 28 MIN 53 S 760 MS )

0 1 2 3 4 5 6 2043 2044 2045 2046 2047

TRAFFIC CHANNELS 1 SUPER FRAME = 1326 TDMA FRAMES ( 6.12 S )

LEFT (OR) RIGHT
1 SUPER FRAME = 51 MULTI FRAMES

0 1 2 3 4 48 49 50 SIGNALLING CHANNELS

1 SUPER FRAME = 26 MULTI FRAMES

0 1 2 24 25
1 MULTIFRAME = 26 TDMA FRAMES ( 120 ms )

0 1 2 3 24 25
1 MULTI FRAME = 51 TDMA FRAMES (235 .4 ms )
0 1 2 3 4 48 49 50

0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0
(4.615ms) TDMA FRAME NO.
0 1
1 TIME SLOT = 156.25 BITS
( 0.577 ms) 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0
(4.615 ms)
1 2 3 4 155 156 0 1
1 bit =36.9 micro sec
 Handover
• Four types of handovers:
– Channels (time slots) in same cell
– Between cells within same BSC
– Between BSCs, within same MSC
– Between MSCs
BTS BTS BTS BTS BTS BTS

BTS BTS BTS BTS

BTS BTS BTS BTS

BSC BSC BSC BSC

MSC MSC

PSTN
GSM Protocol Suite
GSM Protocol Architecture
 GSM Signaling Protocols
• The signaling protocol in GSM is structured in three layers
– Physical Layer
• Uses many channel structures
– Link Layer
• Uses LAPDm across Um interface
• Uses lower parts of SS7 across A interface
– Layer 3 also called Message Layer
• Made up of 3 sublayers
– Resource Management (RR) implemented over the
link between the MS and BSS.
– Mobility Management (MM) and
– Connection Management (CM) provide
communication between MS and MSC.
 SS
HLR

MM + CM
MSC
VLR

RR
BSC

BTS

Radio interface
 Physical Layer
• TDMA frame across
Um interface.
• The signaling channels
are basically logically
multiplexed on an
aggregate of the TDM
slots.
• PCM transmission
across A-bis interface.
 Link Layer
• Across Um interface LAPDm is used
– No Flag.
– No Error retransmission mechanism due to
realtime constraints.
– On radio interface two independent flows (one for
signaling, and one for SMS) can exist
simultaneously.
– These two flows are distinguished by a link
identifier called the Service Access Point Identifier
(SAPI).
• SAPI=0 for radio signaling, SAPI=62 for OAM
and SAPI=63 for layer 2 management on the
Abis interface.
 Link Layer

• Across A-bis interface LAPD is used.

• Across A interface, Message Transport Part (MTP)
level 2 is used
 Layer 3
• Radio Resources Management (RR)
– Establishment, maintenance, and termination of
radio channels that allow point-to-point dialogue
between network and mobile stations; including
cell selection and handover procedures
• Mobility Management (MM)
– Manages location updating, registration, security
and authentication procedures
• Connection Management (CM)
– Handles general call control, similar to CCITT
Recommendation Q.931, and provides
supplementary services & Short Message Services
(SMS)
 Layer 3 – MM Sublayer
• The MM sublayer is terminated at the MSC and the
related messages from or to the MS are relayed
transparently in the BSS using the Direct Transfer
Application Part (DTAP) process.
• The MM sublayer provides functions that can be
classified into three types of procedures
– MM specific procedures
• Location updating, IMSI attach.
– MM common procedures
• IMSI detach, TMSI reallocation, and
Authentication/Identification.
– MM connection-related procedures
• Used to establish, maintain, and release a MM
connection
 BSS Application Part (BSSAP)
• BSS performs radio resource management, and
internetworking functions between the data link
protocols used on the radio and the BSS - MSC side
for transporting signaling related messages.
• These functions are provided by the BSS
Management Application Part (BSSMAP) and the
DTAP.
• The BSSMAP is the process with BSS that controls
radio resources in response to instructions from MSC
• The DTAP is used for the transparent transfer of
MM/CM signaling messages between the MS and
MSC.
 GSM and Enabled Services

• Short Message Service (SMS)

• Multimedia Messaging Service (MMS)
• General Packet Radio Service (GPRS)
• Enhanced Data Rates for GSM Evolution (EDGE)
 Short Message Service (SMS)
• SMS provides a mechanism for transmitting short
messages to and from wireless devices.
• The service makes use of an SMSC, which acts as a store-
and-forward system for short messages.
• The wireless network provides the mechanisms required
to find the destination station(s) and transports short
messages between the SMSCs and mobile stations.
• The service elements are designed to provide guaranteed
delivery of text messages to the destination.
 Characteristics
• Guaranteed delivery of text messages to the destination
• Supports several input mechanisms that allow
interconnection with different message sources and
destinations
• An active mobile handset is able to receive or submit a
short message at any time, independent of whether a
voice or data call is in progress
 Applications
• Initial applications of SMS focused on transmission of
alphanumeric messages
• As technology and networks evolved, a variety of
services have been introduced, including e-mail, fax, and
paging integration, interactive banking, information
services such as stock quotes, and integration with
Internet-based applications.
• Wireless data applications include downloading of
subscriber identity module (SIM) cards for activation,
debit, profile-editing purposes, wireless points of sale
(POSs), and other field-service applications such as
automatic meter reading, remote sensing, and location-
based services.
 Network Elements and Architecture

Short Message Service Centre Signal Transfer Point

 Network Elements and Architecture
• SMSC
– Combination of hardware and software responsible
for the relaying and storing and forwarding of a short
message between an SME and mobile device.
– The SMSC must have high reliability, subscriber
capacity, and message throughput.
– The system should be easily scalable to accommodate
growing demand for SMS in the network.
• STP
– The STP is a network element normally available on
IN deployments that allows interconnections over
signaling system 7 (SS7) links with multiple network
elements.
Mobile Terminated Short Message
Mobile Terminated Short Message
Multimedia Messaging Service (MMS)
 General Packet Radio Service (GPRS)
• GPRS is an overlay network on the GSM network.
• Provides TCP/IP packet data connectivity from a GPRS
enabled mobile phone.
• Additional Nodes
– Gateway GPRS Support Node (GGSN)
• Takes packets out onto Internet or to Corporate LAN
– Serving GPRS Support Node (SGSN)
• Takes packet data from base station onto data network
 Features
• Data rate
– Maximum of 171.2 kbps (theoretical)
– 14 kbps uplink and 28 to 64 kbps downlink
• Classes
– Indicates the mobile phone capabilities
• Class A
– Connected to both GSM and GPRS simultaneously
• Class B
– Automatically switch between GSM/GPRS services
• Class C
– Manually switch between GSM/GPRS services
General Packet Radio Service (GPRS)
Routing
 IP allocation
• Fixed
– IP addresses stored in the HLR
• Dynamic
– A set of IP addresses are allocated to the GGSN
domain
– IP address can be allocated by external RADIUS.
Enhanced Data rates for GSM Evolution (EDGE)
• Provides further enhancements to GSM networks
• EDGE can be introduced in two ways
– Packet switched enhancement for GPRS, known as
Enhanced GPRS or EGPRS
– Circuit switched data enhancement called Enhanced
circuit-switched data or ECSD
• Provides up to three times the data capacity of GPRS,
upto 474kbps.
 Implementation
• One EDGE transceiver unit (EDGE TRU) will need to be
added to each cell.
• EDGE capable terminals will also be needed
 Technology

GPRS EDGE
Modulation GMSK 8-PSK/GMSK
Symbol Rate 270ksym/s 270ksym/s
Modulation Bit Rate 270kb/s 810kb/s
Radio data rate per time slot 22.8kb/s 69.2kb/s
User data rate pertimeslot 20kb/s 59.2kb/s
User data rate (8 time slots) 160kb/s 473kb/s
(182.4kb/s) 553.6kb/s
 AT & T Commands
• These are the commands that cause the modem to
perform certain functions.
• They begin with the command AT.
• Types
– Call Control Commands
– Network Services Commands
– Security Commands
– Phonebook Commands
– Short Messages Commands
– Supplementary Services Commands
– Data Commands
– Fax Commands
 Examples
• AT + CGSN – *#06# – Get IMEI
• AT + CIMI – Get IMSI
• A/ - Repeat Last Command
• AT + CPOF – Power Off
• ATD<nb> - Set a voice call with nb as destination
• ATH –Hang up
• ATA – Answer a call
SS7
Telephone User Part

Transaction Capabilities
User Part
ISDN User Part
Signaling Connection
Control Part

Message Transfer Part