Unit-3: Second Generation Mobile System

Contents
From Mullet
 UNIT 3

GSM and TDMA Technology

• Objectives
– Discuss the basic services offered by GSM
cellular and the frequency bands of operation.

– Discuss the network components of a GSM

system and the basic functions of the mobile
station, base station system, and network
switching system.
– Explain the concept of GSM network interfaces
and protocols, and their relationship to the OSI
model.

– Explain the GSM channel concepts.

– Discuss the functions of the GSM logical channels.

– Explain the TDMA concept and how it is
implemented in GSM.

– Explain the mapping of logical channels on to

the GSM physical channels.

– Discuss the various GSM identities.

– Explain the GSM operations of call setup,
location updating, and handover.

– Discuss the GSM operations that occur

over the Um interface.
 Introduction to GSM and TDMA

What is GSM ?

Global System for Mobile (GSM) is a second

generation cellular standard developed to cater voice
services and data delivery using digital modulation
 GSM: History
•Developed by Group Special Mobile (founded 1982) which
was an initiative of CEPT ( Conference of European Post
and Telecommunication )
• Aim : to replace the incompatible analog system
• Presently the responsibility of GSM standardization resides
with special mobile group under ETSI ( European
telecommunication Standards Institute ) Full set of
specifications phase-I became available in 1990
• Under ETSI, GSM is named as “ Global System for Mobile
communication “
• Today many providers all over the world use GSM (more
than 135 countries in Asia, Africa, Europe, Australia,
America)
• More than 1300 million subscribers in world and 45 million
subscriber in India.
 GSM Services
•Tele-services
•Bearer or Data Services
•Supplementary services

Tele Services

Telecommunication services that enable voice

communication
via mobile phones
• Offered services
- Mobile telephony
- Emergency calling
 Bearer Services

•Include various data services for information transfer

between GSM and other networks like PSTN, ISDN
etc at rates from 300 to 9600 bps
•Short Message Service (SMS)
up to 160 character alphanumeric data
transmission to/from the mobile terminal
•Unified Messaging Services(UMS)
•Group 3 fax
•Voice mailbox
•Electronic mail
 Supplementary Services

Call related services :

Call Waiting- Notification of an incoming call while on the
handset
Call Hold- Put a caller on hold to take another call
Call Barring- All calls, outgoing calls, or incoming calls
Call Forwarding- Calls can be sent to various numbers
defined by the user
Multi Party Call Conferencing - Link multiple calls together
CLIP – Caller line identification presentation
CLIR – Caller line identification restriction
CUG – Closed user group
 GSM Specifications-1

RF Spectrum
GSM 900
Mobile to BTS (uplink): 890-915 Mhz
BTS to Mobile(downlink):935-960 Mhz
Bandwidth : 2* 25 Mhz

GSM 1800
Mobile to BTS (uplink): 1710-1785 Mhz
BTS to Mobile (downlink) 1805-1880
Mhz
Bandwidth : 2* 75 Mhz
 GSM Specification-II

Carrier Separation : 200 Khz

Duplex Distance : 45 Mhz
No. of RF carriers : 124
Access Method : TDMA/FDMA
Modulation Method : GMSK
Modulation data rate : 270.833
Kbps
 GSM timeslots

• Over head information is constantly transmitted between BTS and MS

 IAM: Initial Message; ACM: Address Complete Message; ANM: Answer Message

Messages exchanged: call delivery

1 GMSC 5 4
PSTN
2 HLR 3 VLR

6
Target
MSC

1. ISUP IAM Target

VLR MSC
GMSC HLR
Originating
Switch 2. MAP_SEND_ROUTING_INFO
3. MAP_PROVIDE_ROAMING_NUMBER

4. MAP_PROVIDE_ROAMING_NUMBER_ack

5.
MAP_SEND_ROUTING_INFO_ack
17
6. ISUP IAM
 Find operation in GSM
• ISDN switch recognizes from the MSISDN that the call
subscriber is a mobile subscriber. Therefore, forward the
call to the GMSC of the home PLMN (Public Land Mobile
Network)
• GMSC requests the current routing address (MSRN)
from the HLR using MAP
• By way of MSRN the call is forwarded to the local MSC
• Local MSC determines the TMSI of the MS (by querying
VLR) and initiates the paging procedure in the relevant
LA
• After MS responds to the page the connection can be
switched through.

18
 Call routing to a mobile station:
case when HLR returns MSRN
1
MSISDN

GMSC ISDN
LA 1 4 1
MSRN

2
3
MSISDN
BSC MSRN MSC
BTS MSC HLR
7
TMSI

5
7
MSRN
TMSI
LA 2
BSC
EIR
BTS
8 7
TMSI TMSI
VLR
AUC
6
MS BTS 19
TMSI
 GSM System Architecture

BSC
MS BTS
MSC
GMSC

BTS BSC
VLR
MS
BTS EIR
AUC
MS HLR
Mobile Station (MS)
Mobile Equipment (ME)
Subscriber Identity Module (SIM)
Base Station Subsystem (BSS)
Base Transceiver Station (BTS)
Base Station Controller (BSC)
Network Switching Subsystem(NSS)
Mobile Switching Center (MSC)
Home Location Register (HLR)
Visitor Location Register (VLR)
Authentication Center (AUC)
Equipment Identity Register (EIR)
 System Architecture
Mobile Station (MS)

The Mobile Station is made up of two entities:

1. Mobile Equipment (ME)

2. Subscriber Identity Module (SIM)
 System Architecture
Mobile Station (MS)

Mobile Equipment

• Portable,vehicle mounted, hand held device

• Uniquely identified by an IMEI (International Mobile
Equipment Identity)
• Voice and data transmission
• Monitoring power and signal quality of surrounding
cells for optimum handover
• Power level : 0.8W – 20 W
• 160 character long SMS.
 System Architecture
Mobile Station (MS) contd.

Subscriber Identity Module (SIM)

• Smart card contains the International Mobile

Subscriber Identity (IMSI)
• Allows user to send and receive calls and receive
other subscribed services
• Encoded network identification details
- Key Ki,Kc and A3,A5 and A8 algorithms
• Protected by a password or PIN
• Can be moved from phone to phone – contains key
information to activate the phone
 System Architecture
Base Station Subsystem (BSS)

Base Station Subsystem is composed of two parts that

communicate across the standardized Abis interface
allowing operation between components made by different
suppliers

1. Base Transceiver Station (BTS)

2. Base Station Controller (BSC)
 System Architecture
Base Station Subsystem (BSS)
Base Transceiver Station (BTS):

•Encodes,encrypts,multiplexes,modulates and feeds the RF

signals to the antenna.
•Frequency hopping
•Communicates with Mobile station and BSC
•Consists of Transceivers (TRX) units
 System Architecture
Base Station Subsystem (BSS)

Base Station Controller (BSC)

• Manages Radio resources for BTS

• Assigns Frequency and time slots for all MS’s in its area
• Handles call set up
• Transcoding and rate adaptation functionality
• Handover for each MS
• Radio Power control
• It communicates with MSC and BTS
 System Architecture
Network Switching Subsystem(NSS)

Mobile Switching Center (MSC)

• Heart of the network

• Manages communication between GSM and other networks
• Call setup function and basic switching
• Call routing
• Billing information and collection
• Mobility management
- Registration
- Location Updating
- Inter BSS and inter MSC call handoff
• MSC does gateway function while its customer roams to other
network by using HLR/VLR.
 System Architecture
Network Switching Subsystem
• Home Location Registers (HLR)

- permanent database about mobile subscribers in a large service

area(generally one per GSM network operator)
- database contains IMSI,MSISDN,prepaid/postpaid,roaming
restrictions,supplementary services.

• Visitor Location Registers (VLR)

- Temporary database which updates whenever new MS enters its

area, by HLR database
- Controls those mobiles roaming in its area
- Reduces number of queries to HLR
- Database contains IMSI,TMSI,MSISDN,MSRN,Location
Area,authentication key
 System Architecture
Network Switching Subsystem
• Authentication Center (AUC)
- Protects against intruders in air interface
- Maintains authentication keys and algorithms and
provides security triplets ( RAND,SRES,Kc)
- Generally associated with HLR

• Equipment Identity Register (EIR)

- Database that is used to track handsets using the
IMEI (International Mobile Equipment Identity)
- Made up of three sub-classes: The White List, The
Black List and the Gray List
- Only one EIR per PLMN
 GSM Operation
Speech Speech

Speech coding Speech decoding

13 Kbps
Channel Coding Channel decoding

22.8 Kbps
Interleaving De-interleaving
22.8 Kbps

Burst Formatting Burst Formatting

33.6 Kbps

Ciphering De-ciphering
33.6 Kbps
Radio Interface
Modulation
270.83 Kbps
Demodulation
GSM Network and System Architecture

Mobile station
Subscriber identity module
Base station system

Network switching system

SMS gateway
Flexible numbering register

Operation and support system and other

nodes

Administrative and control system

• The BSC communicates with the MSC through standard wireless
protocol called LAPD protocol.

• LAPD protocol is a data link protocol used in ISDN.

• TRC – Trans-coder controller- converts voice to PCM.

• NSS handles SMS service – the SMS-Interworking MSC, SMS-GMSC

with GPRS for high speed data transmission and reception.

• HLR data base contains – MSISDN and IMSI numbers of a subscriber

and types of services he wants.

• TMSI – Temporary Mobile Subscriber Number is assigned to visiting MS.

• AUC and EIR provides network security and facilitate roaming.

• The FNR-Flexible Numbering Register provides number portability to a

subscriber (Still maintains same MSISDN number can change GSM system
operator.)
GSM provides –

Digital Transmission
ISDN compatibility
Worldwide roaming in other GSM networks
Provides a model for 3G Cellular systems
(UMTS)
• 5.2 GSM Network and System
Architecture
– GSM network interfaces and protocols
• GSM interfaces
– Abis interface
– A interface
– Um interface
– Layered structure/OSI model
– See Figure 5-5
 GSM System Hieararchy
GSM Network

MSC Region MSC R.

.
Location Area .
BSC Location Area .
BSC .
.
..
.
.
.
Location Area
MSC R.
 Frequency Channels in GSM

• Uplink frequency band : 890 - 915 MHz

• Downlink frequency band : 935 - 960 MHz
• 124 channels (of 200 kHz each) in each band. ??
• Each channels has a TDMA structure with 8 timeslots.
( => upto 8 users per freq. channel )

960 Mhz
124
•
1 2 3 4 5 6 7 8
•
•
•
TDMA structure of
2
each channel
1
935 Mhz
1 2 3 4 5 6 7 8 Downlink

Delay

1 2 3 4 5 6 7 8 Uplink

So the MS does not have to Transmit and

Receive at the same time instance!
 Logical Channels

Traffic Channels (TCH)

Signaling Channels
• Broadcast Channel (BCH)
• Common Control Channel (CCH)
• Dedicated/Associated Control Channel (DCCH/ACCH)

Note:
Note:These
Theselogical
logicalchannels
channelsare
arethen
thenmapped
mappedonto
ontoPhysical
Physicalchannels.
channels.
AAGSM
GSMPhysical
Physicalchannel
channelcomprises
comprisesaaparticular
particulartimeslot
timesloton
onaagiven
givenfreq.
freq.Channel.
Channel.
Signalling channel contd. ....

BCH :
• Broadcast Control Channel (BCCH)
• Frequency Correction Channel (FCCH)
• Synchronization Channel (SCH)

CCH :
• Random Access Channel (RACH)
• Paging Channel (PCH)

D/ACCH
• Stand-alone Dedicated Control Channel (SDCCH)
• Slow Associated Control Channel (SACCH)
 Traffic channel structure for full rate
coding
TDMA
slots 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1

1 2 3 4 5 6 7 8 9 10 11 12 13 14 • • 26

TDMA Frames
on a given channel
Traffic

Signaling (S)

S-contains information about the signal strength in neighboring

cells
Traffic channel structure for half rate
coding

1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1

1 2 3 4 5 6 7 8 9 10 11 12 13 14 • • 26

Burst for one user

1 2 3 4 5 6 7 8 • • • • • • • • 26

Burst for another user

 Why 26 burst Traffic Channel?
• Mobile needs to send information about signal
strength from surrounding cells to the network.
• Capacity required to send measurement info is
1/24 the capacity required to send voice!

Signaling Channel – Control Channel

Associated Control Channel
Slow Associated Control Channel
 Timing Advance : How it works.
(Sent by BS on
down link)
1 2 3 4 5 6 78
| |
| | | | 1 2 3 4 5 6 7 8
| | | |
One way | | | | | (received by BS on
Propagation | | Two way propagation
| | delay up link)
delay |
| 1 2 3 4 5 (received by MS on
6 7 8
down link)
|
1 2 3 4 5 6
| 7 8

| (Sent by MS on up link)
Timeslot bursts

• Normal burst
• Frequency correction burst
• Synchronization burst
• Access burst
• Dummy burst
Normal Burst : Two groups of 57 encrypted bits are transmitted on the either side

Of a training sequence bits.

Training sequence : Consists of alternating 0’s and 1’s used to train the adaptive
Equalizer incorporated into the mobile GSM receiver.

Tail bits (3) : consists of three 0’s ( Un modulated carrier) that provide time for the
Digital circuitry to initialize it self.
Flag bits ( two separate) : Separate training sequence bits from encrypted
bit Groups.
The FLAG bits are also indicating whether the encrypted bits contain Traffic
or control information.

8.25 bit long Guard period – No transmission activity takes place.

When used as Traffic channel – 114 encrypted bits are delivered per time

slot.
. FCB - Used by mobile to obtain synchronization. Repetition of FCB by BTS within

the same GSM frame structure becomes FCCH.

. SB : Encrypted bit contain information about the Frame Number ( FN) and BSIC.

Repetition of this SB by BTS in GSM frame structure becomes SCH.

. AB : Used by mobile to facilitate Random access request and hand over operations.

Extension of guard time – Mobile becomes active by acquiring channel.

or just handed off does not knowing system timing
advance operation.

Maximum radius is 35 Km.

Used for RACH and FACCH during hand over.

Dummy Burst : Transmitted as C0.
The purpose is to ensure BS is always transmitting on the
frequency carrying information.

Power measurements on the strongest BTS in its location

Which BTS to attach to when MS first turned on.

MS also makes measurements of other BTSs providing

information during hand over.
Mapping of logical channels to physical channels

Multiplexing of GSM logical channels

Different schemes
Needed control signals
 Control Channel

Functions:
• To help the MS find the control channels. ??
• To provide information about
- voice and control channel repetition cycle.
- parameters in the cell.
- surrounding cells.
- paging.
• To allow random access attempts by the MS.
 GSM (MS Side)
Speech in GSM is digitally coded at a rate of 13 kbps

184 bits
( 20 ms) 260 bits every 20 ms

Convolutional Encoder

456 bits every 20 ms

8 57 bits block

GMSK
67
 The Downlink Control Channel

• 51 cycle burst (2x26 -1)

• Third burst on the control channel provides content
information.
• Basic structure of control channel :
FSxxx xxxxx FSxxx xxxxx FSxxx xxxx ....

F: Frequency Correction Channel

(occurs every 10th burst)
S: Synchronization Channel
 TDMA Bursts in GSM
FB 142
3 fixed bits 3 8.25

SB 39 64 bit 39
3 3 8.25
data Training seq data

Dummy 26 bit
Burst 3 3 8.25
Training seq

Acces 41 bit
8 36 data 3 68.25
s Training seq

Burst
 Normal Burst
Tail bit

57 26 bit 57 8.25
3 3
Data bits Training seq Data bits Bit GP

Stealing Flags

Fig.
 Frequency
F S B B B synchronization

Time
F S B B B
synchronization

F S B B B BCCH

Request
R R R R (Random access)

C C C C Grant

D D D
Physical Channel
GSM-Frame Structure
 GSM Channel Concept
Timeslots and TDMA frames
• TDMA frames
• TDMA multiframes
– See Figure
GSM Channel Concept
Hyperframes
Superframes
Multiframes
26 frame
51 frame
See Figure
GSM Channel Concept
– Time division multiple access
– Frames
– Multiframes
• See Figure 5-9
GSM Speech Transmission

78
GSM Normal Burst Formatting

79
GSM Frame Hierarchy

80
Physical Vs. Logical Channel

81
 GSM Protocol Architecture

Layer 3

Layer 2

Layer 1

TDMA/FDMA

82
 User Data and Control at Air
Interface
Two types of ISDN "channels" or
communication paths:

B-channel
The Bearer ("B") channel: a 64 kbps
channel used for voice, video, data, or
multimedia calls. D-channel
The Delta ("D") channel: a 16 kbps or
64 kbps channel used primarily for
communications (or "signaling")
between switching equipment in the
ISDN network and the ISDN
equipment

83
 User Data and Control at Air
Interface
In GSM:
• Bm channel for traffic / user data
• Dm channel for signaling

As in ISDN the Dm channel in GSM

can be used for user data if capacity is
available.

GSM’s Short Message Service (SMS)

uses this.

84
 Layer I:
Physical Layer
Radio transmission forms this Layer

85
 Layer I: Physical Layer
• Modulation Techniques – Gaussian Minimum Shift Keying (GMSK)
• Channel Coding
 Block Code
 Convolutional Code

• Interleaving
 To distribute burst error

• Power control methodology – to minimize the co-channel interference

• Time synchronization approaches

86
GSM Protocol Architecture for Speech – Air
IF

87
 Overview of Interfaces

• Um
 Radio interface between
MS and BTS
 each physical channel
supports a number of
logical channels
 Abis

between BTS and BSC

primary functions: traffic channel transmission, terrestrial
channel management, and radio channel management
 A

between BSC and MSC

primary functions: message transfer between different BSCs to
the MSC 88
The data link layer (layer 2)
over the radio link is based
on a modified LAPD (Link
Access Protocol for the D
channel) referred to as
LAPDm (m like mobile).

On the A-bis interface, the layer 2 protocol is based on the LAPD from
ISDN.

The Message Transfer Protocol (MTP) level 2 of the SS7 protocol is used
at the A interface.

89
 LAPDm

• The Link Access Procedure on the Dm channel (LAPDm) is

the protocol for use by the data link layer on the radio
interface.
• Functions
– organization of Layer 3 information into frames
– peer-to-peer transmission of signaling data
in defined frame formats
– recognition of frame formats
– establishment, maintenance, and
termination of one or more (parallel) data
links on signaling channels
90
 Frame format (LAPDm)

Address field: is used to carry the service access point identifier (SAPI),
protocol revision type, nature of the message
SAPI: When using command/control frames, the SAPI identifies the user
for which a command frame is intended, and the user transmitting a
response frame
Control field: is used to carry Sequence number and to specify the types of
the frame (command or response)
Length indicator: Identifies the length of the information field that is used to
distinguish the information carrying filed from fill-in bits
Information Field: Carries the Layer III payload
Fill-in bits: all “1” bits to extend the length to the desired 184 bits

91
 LAPD Vs. LAPDm
• LAPDm uses no cyclic redundancy check bits for error
detection
• WHY?

• Error correction and detection mechanism are provided

by a combination of block and convolutional coding used
(in conjunction with bit interleaving) in the physical layer

92