M900/M1800 GSM SYSTEM

BSC Training Document

OMA0000 GSM Fundamentals

Huawei Technologies CO., Ltd.

Training Center

Contents

1 GSM FUNDAMENTALS............................................................................................................................1

1.1 BASIC CONCEPTS OF CELLULAR MOBILE SYSTEM.................................................................................2

1.2 GSM NETWORK COMPONENTS..............................................................................................................7

1.3 TERRESTRIAL INTERFACE.....................................................................................................................28

1.4 SERVICE AREA AND NUMBER PLANNING.............................................................................................38

1.5 CHANNELS ON THE AIR INTERFACE.....................................................................................................52

1.6 RADIO TECHNOLOGIES.........................................................................................................................69

1.7 THE FUTURE DEVELOPMENT................................................................................................................79

1 GSM Fundamentals

1

1.1 Basic Concepts of Cellular Mobile System

2

Each cell in the Cellular Network requires a RF carrier. A RF carrier is a pair of

radio frequencies. One is used in each direction (including transmitting and

receiving) so that information may be passed in both directions simultaneously.

The frequency spectrum allocated for cellular system is only a narrow bandwidth.

The bandwidth for the GSM system is 25MHz. The transmitting and receiving

frequencies in GSM are separated by 45MHz to avoid interference. The frequency

bandwidth used for the downlink (from base station to MS) is 935-960MHz. The

frequency bandwidth for the uplink (from MS to base station) is 890-915MHz. The

channel bandwidth is 200 KHz.

Considering the interference to other systems, the very first carrier is not used.

Thus, there are only 124 RF carriers in the GSM frequency band.

3

The Frequency SpectrumThe Frequency Spectrum

Separation: 95MHz

Channel Bandwidth: 200KHz

Base Station Receive

1710 1785 1805 1880MHz

Base Station Transmit

DCS 1800DCS 1800

The bandwidth for the DCS1800 system is 75MHz. The transmitting and receiving

frequencies in DCS1800 are separated by 95MHz to avoid interference.

The frequency bandwidth used for the downlink (from base station to MS) is 1805-

1880MHz. The frequency bandwidth for the uplink (from MS to base station) is

1710-1785MHz.

The channel bandwidth is 200 KHz just the same as GSM. Due to interference to

other systems, the very first carrier is still not used. Thus, there are 374 RF

carriers in the DCS1800 frequency band.

Thus, DCS 1800 has three times the frequency allocation of GSM 900. So you will

understand that DCS1800 can meet the requirements of high traffic in the large

densely populated area, while GSM 900 can meet the requirements of large

coverage.

4

The hexagonal regions in this diagram are known as cells and represent the

geographic area covered by one RF carrier. Sure it is really like the shape of bee’s

cell. Now you will understand that why it is called as cellular system.

Cellular system involves dividing a large service area into regions called "cells".

Each cell has the equipment to switch, transmit and receive calls from any

subscriber located within its' radio coverage area.

Cells are conventionally regarded as being hexagonal, but in reality they are

irregularly shaped. The cell shape is determined by the nature of the surrounding

area such as hills, tall buildings etc.

In Omni -Directional Cells, all the cells have their own Cell Site this is known as an

Omni cell. When traffic density is very high, cells can be reduced into many smaller

size called as “sectoring ".

In 120 Degree Sectors, the original cell is divided into three smaller cells. These

cells share the same cell site but each has its own allocation of radio carriers.

5

Because the frequency spectrum allocated for cellular system is only a narrow

bandwidth, it is very clear that there are not enough frequencies available for every

cell to have a different RF carrier. Therefore the frequencies must be reused. It

means that the same RF carrier can be used in other several different cells at the

same time. By reusing frequencies, many more phone calls may be made.

The radio frequencies available are allocated according to a regular pattern. In this

way, each carrier used repeatedly throughout the coverage area according to a

frequency re-use pattern.

This diagram illustrates 4*3 Re- Use Pattern. It means that 4 sites share the same

group frequencies and each site has 3 cells. These group frequencies can be

reused in another 4 sites.

Care must be taken to make the cells which are using the same frequencies far

enough apart from one another to prevent interference.

6

1.2 GSM Network Components

7

This diagram shows a simplified GSM network. The main components of a GSM

System are: BSS, NSS and OMC

The Mobile Station (MS) is the only direct part of the network that the subscriber

can see.

BSS means Base Station Subsystem. BSS is responsible for the system functions

related to radio and transmission of the GSM system. BSS includes BSC and BTS.

BSC means base station controller. BTS means base transceiver station.

NSS means Network Subsystem. NSS is composed of MSC/VLR, HLR/AuC/EIR.

NSS is the control and switching part of the whole GSM system.

MSC means Mobile Switching Center. HLR means home location register. AuC

means authentication center. EIR means equipment identification register. MSC

provides the interface between GSM network and the Public Switched Telephone

Network (PSTN).

OMC means operation and maintenance center. It is used to configure and

maintain the network from a central location. OMC is connected to BSS and NSS

through LAN or WAN.

8

The Mobile Station consists of two parts, the Mobile Equipment (ME) and an

electronic “smart card” called a Subscriber identity module (SIM card).

The Mobile Equipment is the hardware used by the subscriber to access the

network. This may be a telephone, fax machine etc. The hardware has an identity

number which is unique for that particular device and permanently stored in it. This

enables stolen mobile equipment to be detected by GSM system. This identity

number is called an International Mobile Equipment Identity (IMEI).

The SIM is a card which plug into the Mobile Equipment. This card identifies the

mobile subscriber and also provides other information regarding the service. The

subscriber is identified by an identity number called the International Mobile

Subscriber Identity (IMSI).

Mobile Equipment may be purchased from any store but the SIM card must be

obtained from the GSM network operator. When SIM card is not inserted into the

mobile equipment, only the emergency calls can be made.

9

The SIM card as mentioned previously is a "smart card" which plugs into the

mobile equipment and contains information about the mobile subscriber. The SIM

card contains the following information:

International Mobile Subscriber Identity (IMSI) - This number identifies the mobile

subscriber. It is only transmitted over the air interface during initialization.

Temporary Mobile Subscriber Identity (TMSI) - This number identifies the

subscriber, it is periodically changed by the system in order to protect the

subscriber from being identified by someone monitoring the radio interface.

Location Area Identity (LAI) identifies the current location of the subscriber.

Subscriber Authentication Key (Ki) - This is used to authenticate the SIM card.

Mobile Station International ISDN Number (MSISDN) - This is the telephone

number of the mobile. It is comprised of a country code, a national code and a

subscriber number.

Most of the data contained within the SIM is permanent (such as Ki and IMSI).

Some of the parameters (such as LAI) will be continuously updated to reflect the

current location of the subscriber.

The SIM card has high security and provides protection for the subscriber's

information to be difficult to duplicate. The SIM can be also protected by use of

Personal Identity Number (PIN) password. PIN is similar to credit card password

10

and it is used to prevent unauthorized use of the card. The SIM card also executes

the Authentication Algorithm in which Ki is used.

11

The BSS provides the connection between the mobile equipment and the Mobile

Switching Center. The BSS consists of two major hardware components:

The BSC provides the control for the BSS and communicates directly with the

MSC. The BSC may control one or more BTS.

The BTS comprises of a combination of RF equipment that provides the air

interface for a particular cell. This is the part of the GSM network that

communicates with the mobile station. The antenna is included as part of the BTS.

The Transcoder is used to compress the signals so that they can be more

efficiently sent over the terrestrial interfaces. In fact it will convert data between

64kbps and 16kbps.

Sub-Multiplexer is used to combine the data in order to save the transmission cost

between MSC and BTS. Although the Transcoder is considered to be part of the

BSS, but it is very often located closer to the MSC in order to optimize the

transmission between MSC and BTS.

Maybe you are wondering how TC and SM can save the transmission line. Ok, the

detailed reason will be described in the next slide.

12

It is known that the 64Kbps Pulse Code Modulation (PCM) circuits are adopted in

PSTN. So if 64kbps from the MSC transmitted on the air interface without

modification, it would occupy an excessive amount of radio bandwidth. This would

use the available radio spectrum inefficiently.

Then the Transcoder is required to convert the speech or data output from the

MSC into the data rate specified by GSM standard. For example, 64kbps/PCM is

converted to 13kbps speech or 3.6/6/12kbps data over the interface between BSS

and MS. The required bandwidth is therefore reduced.

Transcoder may be located with the MSC or BSC. If it is located at the MSC, the

13kbps channels are transmitted to the BSS by inserting additional synchronization

data to 16kbps and then combining four of them into each 64kbps terrestrial circuit.

Thus each 30 channel 2Mbps PCM link can carry 120 GSM- specified voice

channels. It obviously costs savings for the system operator.

Therefore, Transcoder is commonly arranged to be located with the MSC side and

it will reduce the number of 2 Mbps link required.

13

The Network Switching System includes the main switching functions of the GSM

Network. It also contains the databases required for subscriber data and mobility

Management. Its main function is to manage communications between the GSM

Network and other networks.

The components of the Network Switching System are listed below:

1. Mobile Switching Center - MSC

2. Home Location Register - HLR

3. Visitor Location Register - VLR

4. Equipment Identity Register - EIR

5. Authentication Center - AUC

6. Inter-Working Function -IWF

7. Echo Canceller -EC

In addition to mobile switching center, NSS has Location Register network entities.

These entities are the Home Location Register (HLR), Visitor Location Register

(VLR), Equipment Identity Register (EIR). Normally, HLR, AuC and EIR are

located in the same physical entity, and MSC/VLR can also be co-located in one

physical entity. All the database registers are used to manage subscriber data and

keep track of a mobile subscriber’s location as it roams around the network.

14

Functionally, the Inter working Function and the Echo Canceller may be

considered as parts of the MSC since their activities are linked with the switch.

Echo Canceller is used between PSTN and MSC. Inter working Function is used

between MSC and other network.

15

The main function of MSC is for call- switching in GSM system. Its overall purpose

is the same as that of any telephone exchanger.

The MSC will carry out several different functions depending upon its position in

the network. When the MSC provides the interface to PSTN, it will be known as a

Gateway MSC (GMSC). In this position it will provide the switching required for all

mobile originated or terminated traffic.

The GSM network typically contains more than one MSC, each MSC provides

service to mobiles located within a defined geographic coverage area. The

functions carried out by the MSC are listed below:

1. Call Processing function - Includes of data/ voice call setup, inter - BSS and

Inter - MSC Handover and control of mobility management.

2. Operation and Maintenance Supporting function - Includes database

management, traffic measurement and a man machine interface.

3. Inter-network & Inter-working function - Manages the interface between the

GSM network and the PSTN

4. Billing function- Collects call billing data and transit the bills to the centralized

billing center.

16

The HLR is the database for subscriber parameters. Various identification numbers

and addresses are stored as well as authentication parameters. This information is

entered into the database by the network operator when a new subscriber is added

to the system.

The parameters stored in the HLR are listed below:

1. Subscriber ID (IMSI and MSISDN)

2. Current subscriber VLR (Current location)

3. Supplementary service information (e.g. Current forwarding number )

4. Subscriber status (registered / de-registered )

5. Authentication key and AUC functionality

6. Temporary Mobile Subscriber Identity (TMSI)

7. Mobile Subscriber Roaming Number (MSRN)

The HLR database contains the master database of all the subscribers in GSM

system. It’s data can be remotely accessed by all the MSCs and VLRs in the

network.

17

Although the network may contain more than one HLR, there is only one database

record per subscriber - each HLR is therefore handling a portion of the total

subscriber database.

The subscriber data may be accessed by either the IMSI or the MSISDN number.

The data can also be accessed by an MSC or a VLR in a different network and

allow inter-network calling and inter-country roaming.

18

The VLR contains a copy of most of the data stored at the HLR. However, It is a

temporary data that exists for only as long as the subscriber is "active" within the

VLR coverage.

So, the VLR provides a temporary local database for the subscriber. This function

reduces the need for excessive and time-consuming references to the "home" HLR

database.

The additional data stored in the VLR is listed below:

1. Mobile status (busy /free/no answer etc.)

2. Location Area Identity (LAI)

3. Temporary Mobile Subscriber Identity (TMSI)

4. Mobile Station Roaming Number(MSRN)

19

The EIR contains a centralized database for validating the International Mobile

Equipment Identity (IMEI).

This database is concerned solely with MS equipment and not with the subscriber.

The EIR database consists of lists of IMEIs organized as follows:

1. WHITE LIST contains those IMEIs that have been assigned to valid mobile

Equipment.

2. BLACK LIST Contains IMEIs of mobiles which have been reported stolen or

which are have forbidden service for some other reason.

3. GREY LIST Contains IMEIs of mobiles that have problems (e.g. faulty software).

These are not sufficiently significant to enter into a "black list".

20

The AUC is a processor system. It performs the "authentication " function. It will

normally be co -located with the HLR. The authentication process will usually take

place each time the subscriber "initializes "on the system.

In the authentication process, secure data stored on the SIM card is calculated and

compared with the data held in the HLR database. The Authentication Process is

as follows:

A random number is sent to the Mobile from the AUC.

This number is calculated together with Authentication Key (Ki) stored in the SIM

card by authentication algorithms, which is held in the SIM card.

The calculation of the random number and Ki will get two results. One is a

response called as SRES, which are returned to the AUC. Another is an

Encryption Key called as Kc which is stored in the SIM card. The Encryption key is

used to encrypt data that is sent over the air interface in order to make the

interface more secure.

1. While the mobile is carrying out these calculations, the AUC carries out exactly

the same calculations using the random number and ki stored in the HLR. Then

AUC also gets a response.

21

2. The AUC compares it with the response from the subscriber. If the responses

produced by the AUC and the subscriber are the same, the subscriber is permitted

to access the network.

3. The Encryption Key produced by the AUC is stored and sent to the BTS to

enable ciphering to take place.

The first time a subscriber attempts to make a call, the full authentication process

takes place. However, for subsequent calls, authentication may not be necessary.

22

The IWF provides the function to enable the GSM system to connect with the

various forms of data networks.

The basic features of the IWF are listed below:

1. Rate Conversion function

2. Protocol Adaptation function

GSM system may require IWF capability or not. This depends upon the network to

which it is being connected.

23

An Echo Canceller is used between PSTN and MSC for all voice circuits. Echo

control is required at the MSC because the GSM system delay can cause an

unacceptable echo condition even on a short distance with PSTN.

The GSM system delay may be caused by call processing, speech encoding and

decoding etc. The total round trip delay is approximately 180ms.

This would not be apparent to the call between MS. But this case will be very

different for the call between MS and land subscriber.

It is well known that, in the PSTN a 2- wire to 4- wire hybrid transformer is required

in the circuit because the standard telephone connection is 2- wire. This

transformer causes the echo, which does not affect the land subscriber. During a

normal PSTN land to land call, no echo is apparent because the delay is too short

and the user is unable to distinguish.

However, with the GSM round trip delay added and without the EC, the effect

would be very irritating to the MS subscriber and disrupting speech. Thus, Echo

controller is required between PSTN and MSC.

24

The operation and maintenance sub- system provides a capability to manage the

GSM network remotely.

Operation and Maintenance Center is a centralized facility that supports daily

management for the whole GSM system including MSC, HLR, BSC and BTS.

The OMC provides a central point from which to control and monitor the whole

network entities as well as monitor the quality of service provided by the network.

Because GSM does not specified the OMC specification and it is left to the

network operator to decide what capabilities they wish it to have. Thus, at present,

GSM manufacturers have their own OMCs, which are not compatible with those of

other manufacturers.

Generally, an OMC only manages a certain area of GSM network. Another

equipment Network Management Center-NMC should be mentioned here. NMC

has a view of the entire PLMN and is responsible for the management of the

network as a whole. The NMC locates at the top of the hierarchy and provides

global network management.

25

There are two types of OMC as below:

1. OMC (R) - It is assigned specifically to the Base Station System.

2. OMC (S) – It is assigned specifically to the Network Switching System.

These two parts can be located together or work independently according to the

practical requirements.

26

The OMC Functional Architecture is illustrated in this diagram:

The OMC should support the following functions as recommendations:

1. Event/Alarm Management

2. Fault Management

3. Performance Management

4. Configuration Management

5. Security Management

27

1.3 Terrestrial Interface

28

Each GSM component is designed to communicate over an interface specified by

the GSM standards. This provides flexibility and enables a system operator to

adopt system components from different manufacturers. For example Motorola

BSS equipment may be coupled with a Huawei NSS.

Each interface within the GSM system has a specified name associated with it.

This table illustrates the names of all the interfaces specified by GSM.

Name Interface

Um

Abis

A

B

C

D

E

F

G

H

MS BTS

BTS BSC

BSC MSC

MSCVLR

MSCHLR

VLR HLR

MSCMSC

MSCEIR

VLR VLR

HLR AUC

This section will introduce the terrestrial interfaces. It comprise all the connections

between the GSM system entities, while the Um, or air – interface is not included

since it belongs to radio interface and will be introduce in the next section.

29

The GSM interfaces conform to ITU specifications, which widely used throughout

the world.

This diagram shows the GSM system with the 2Mbps interfaces, which are

highlighted. These interfaces carry traffic from the PSTN to the MSC, between

MSCs, from an MSC to a BSC and from a BSC to remotely sited BTSs. These

links are also used between the MSC and IWF.

30

This diagram illustrates the structure of 2Mbps.

Each is a 2.048 Mbps link provides 30*64Kbps channels available to carry speech,

or data and two channels for control information.

The speech or data channels may contain CCS7 LAPD or X.25 formatted

information.

Therefore, these 2Mbps links commonly act as the physical bearer for all the

interfaces used between the GSM system entities.

31

This diagram shows the interface in GSM system with the X.25 packet data

connections or TCP/IP with highlight.

The X.25 or TCP/IP provide the OMC with communications to all the entities, such

as between OMC and MSC, between OMC and BSC, etc.

32

This diagram illustrates the use of CCS7 in the GSM system, carrying signaling

and control information between most major entities and to and from the PSTN.

The following message protocols, which are part of CCS7, are used to

communicate between the different GSM network entities.

The structure of CCS7 conforms to OSI structure. The left side is OSI 7 layer. The

right side is the CCS7 used in GSM system.

The first level is physical layer with 2Mbps trunk, also called as MTP level 1.

The second level is link layer with MTP level 2

The third level is network layer with MTP level 3 and SCCP.

The layers from layer 4 to layer 6 are not used in GSM CCS7 structure.

The seventh level is application layer, such as TUP, ISUP, MAP, TCAP and

BSSAP.

33

This slide lists the abbreviation of CCS7.

MTP Message Transfer Part

TCAP Transaction Capabilities Application Part

SCCP Signaling Connection Control Part

TUP Telephone User Part

ISUP ISDN User Part

MAP Mobile Application Part

BSSAP Base Station System Application Part

BSSMAP BSS Management Application Part

DTAP Direct Transfer Application Part

As for the detailed description, please refers to the course of CCS7

34

This slide introduces the CCS7 protocols used on the GSM interfaces.

Inter - facing the PSTN, the MSC performs call signaling functions using the

Telephone User Part (TUP) while inter - facing the ISDN, the ISDN User Part

(ISUP) will be used.

Between the MSC and the BSC, the Base Station System Management

Application Part (BSSMAP) is used. The Direct Transfer Application Part (DTAP) is

used to send messages between the MSC and the mobile station (MS). MAP is

used between the MSC and the VLR, EIR, and HLR.

35

Abis is the interface between BSC and BTS. Because the GSM specifications for

this interface are not very specific, therefore Abis interface is not an open and

standard interface. Thus, the Abis interface of different manufacturers is varied.

This means that one manufacturer's BTS will not work with another manufacturer's

BSC. That is to say, BSC and BTS must come from the same manufacture.

Through Abis interface, a different type of protocol is required. GSM has specified

the use of LAPD protocol in Abis interface.

36

The LAPD protocol uses the standard frame structure shown in this slide.

The first and last bit are flag bits. Between them, there are frame check sequence,

information, control and address.

37

1.4 Service Area and Number Planning

38

MS service area is subdivided into following six levels: System area, PLMN service

area, MSC service area, Location area, Base station area, and radio cell

1. The System area comprises one or more international PLMN service area. In

this area, the other users from PLMN、PSTN and ISDN can connect with the

MS without knowing where it is.

2. PLMN service area is served by one operator. The PLMN service area is

served by one or more HLR. There are the same numbering plan and the

routing plan in PLMN service area. PLMN service area comprises one or more

MSC service area.

3. MSC service area is served by one MSC. It may be a part of a city or an entire

country area. MSC service area comprises one or more Location area.

4. Location area is determined by the operator to fulfill the requirements imposed

by traffic and flow, population density and subscriber mobility. Location area

comprises one or more Base station area.

5. Base station area is served by one or more BTS. It consists of one cell if the

antenna is omni-directional, or more than one cell if the antenna is directional.

Base station area comprises one or more radio cell.

39

6. Radio cell is served by a directional or omni-directional antenna. It is the

smallest service area in GSM system. In radio cell, specific radio channel

devices are used for each radio connection.

40

In the GSM system, For identification purpose, We defined the number for GSM

system equipment, mobile subscriber, mobile equipment and cell.

MSC/VLR number is used to identify MSC/VLR. The format is CC+NDC+LSP

CC means Country Code. For example: The CC of China is "86".

NDC means National Destination Code. For example: The NDC of China Mobile is

139、138、137、136、135.

LSP means Locally Significant Part. It is defined by Telecom operator.

For example, a MSC/VLR number is 86-139-00311

Since the MSC and the VLR are usually co-located together, so the MSC-Number

and the VLR-Number are the same in most case.

41

HLR number is used to identify HLR.

The format is：CC+NDC+H0 H1 H2 H3 0000.

CC： Country Code. For example: The CC of China is "86".

NDC： National Destination Code. For example: The NDC of China Mobile is

139、138、137、136、135.

H0H1H2H3 is defined by Telecom operator.

For example: 86-139-0666-0000

42

The IMSI is the unique international code for the mobile subscriber within the GSM

system area. But it is not known to the mobile subscriber. IMSI is stored in SIM

card and is assigned to the MSISDN in the HLR. It is also stored in HLR and VLR.

The structure of IMSI is shown in this diagram

MCC：Mobile Country Code， it consists of 3 digits. For example: The MCC of

China is "460".

MNC：Mobile Network Code， it consists of 2 digits. For example: The MNC of

China Mobile is "00".

MSIN：Mobile Subscriber Identification Number. Its format is H1H2H3 S ABCDEF.

The first 3 digits H1H2H3 of the MSIN identify the HLR Identification.

NMSI：National Mobile Subscriber Identification，MNC and MSIN form NMSI

together.

For example of IMSI: 460-00 –666-9777001

Note that IMSI should be not more than 15 digits.

43

MSISDN is used in the following cases:

1. By the caller to set up a connection to this mobile subscriber

2. By the MSC/Gateway MSC to address the HLR when inquiring the visitor

location of the mobile subscriber.

MSISDN is stored as semi-permanent data in the database of HLR and VLR. It is

transferred on MAP interface.

The structure of MSISDN is shown in this diagram.

CC： Country Code. For example: The CC of China is "86".

NDC：National Destination Code. For example: The NDC of China Telecom is

139, 138, 137, 136, 135.

SN： Subscriber Number. It’s format: H0 H1 H2 H3 ABCD

For an Example of MSISDN: 86-139-0666-1234

44

IMEI means International Mobile Station Equipment Identification. It is the unique

number for mobile equipment. Please note the difference between IMSI and IMEI.

IMSI is the identification for mobile subscriber, IMEI is the identification for mobile

equipment.

The structure of IMEI is shown as follows.

TAC---Type approval code. It is administered by the type approval center.

FAC----Final assembly code. It is administered by the manufacturer.

SNR----Serial number. It is issued by the manufacturer of the MS.

SP-------Not used.

45

TMSI means Temporary Mobile Subscriber Identification.

1. The TMSI is assigned only after successful subscriber authentication.

2. The VLR controls the allocation of new TMSI numbers and notifies them to the

HLR.

3. TMSI is used to ensure that the identity of the mobile subscriber on the air

interface is kept secret. The TMSI will be updated frequently; this makes it

very difficult for the call to be traced and therefore provides a high degree of

security for the subscriber.

4. The TMSI consists of 4 bytes (8 HEX numbers) and determined by the

telecom operator.

46

MSRN means Mobile Subscriber Roaming Number

HON means Hand-over Number

The MSRN is not a direct subscriber number. At the request of HLR the VLR

allocates a MSRN. Then the MSRN is transferred to the HLR. The HLR passes the

MSRN on to the original MSC from which a call is then set up.. The MSRN is then

used to route the call to the MSC which MS is currently located. At the end of call

setup this MSRN is released again for further call setup processes. So, MSRN is a

temporary number.

During handover process, For example, when the MS is moving from MSC-A to

MSC-B, the MSC-B will request a HON from it's VLR and transfers it to the MSC-A.

The HON is used by the MSC-A to set up a connection to the MSC-B.

Usually, MSRN and HON share the same numbering plan.

The format of MSRN/HON is CC+NDC+individual number. CC and NDC is the

same as that of MSISDN. The individual number is taken from a pool of numbers

specially reserved for MSRN/HON. In fact, the format of MSRN/HON is based on

MSC number and another several digits are added

47

LAI means location area identification. The LAI is the international code for a

location area.

Each VLR controls several LALs and as a subscriber moves from one LAI to

another, the LAI is updated in the VLR. As the subscriber moves from one VLR to

another, the VLR address is updated at the HLR.

The format of LAI is shown in this slide.

MCC：Mobile Country Code，it consists of 3 digits.

For example: The MCC of China is "460"

MNC：Mobile Network Code，It consists of 2 digits.

For example: The MNC of China Mobile is "00"

LAC： Location Area Code，It is a two bytes BCD code (hex).

The value 0000 and FFFF is invalid.

For example of LAI: 460-00-0011

48

CGI means cell global identification. The CGI is a unique international identification

for a cell.

The format is LAI+CI

LAI：Location Area Identification

CI：Cell Identity. This code uses two bytes BCD code (hex) to identify the radio

cells within a LAI.

For example of CGI: 460-00-0011-0001

49

RSZI means Regional Subscription Zone Identity. It is used by the operators to

determine MS roaming permission or restriction.

This diagram shows the structure of RSZI

CC、NDC: Same as that of MSISDN

ZC (Zone Code): is designed by telecom operator and stored in the VLR.

50

BSIC means Base Station Identification Color Code

The structure of BSIC shows in this diagram.

NCC----PLMN network color code. It comprises 3 bits. It allows various

neighboring PLMNs to be distinguished.

BCC----BTS color code. It comprises 3 bits. It allows distinction

Between different radio frequency channels using the same frequency in

neighboring cells.

51

1.5 Channels on The Air Interface

52

The channels used in the air interface are divided into two types: physical channel

and logical channel.

The physical channel is the medium over which the information is carried, in the

case of a terrestrial interface this would be a cable. The logical channels consist of

the information carried over the physical channel.

First physical channels will be introduced.

A single GSM RF carrier can support up to eight mobile subscribers

simultaneously. This diagram shows how this is accomplished. Each channel

occupies the carrier for one eighth of the time. This is a technique called Time

Division Multiple Access (TDMA).

Time is divided into discrete periods called "time slot". The time slots are arranged

in sequence and are conventionally numbered 0 to 7. Each repetition of this

sequence is called a "TDMA frame".

Each mobile telephone call occupies one time slot (0-7) within the frame until the

call is terminated, or a handover occurs. The TDMA frames are then built into

further frame structures according to the type of channel. We later shall introduce

how the information builds into frames and multi – frames.

The information carried in one time slot is called a "burst". Each data burst

occupies its allocated time slot and provides a single GSM physical channel.

53

There are two main groups of logical channels, traffic channels and control

channels.

The traffic channel carries speech or data information.

A full rate TCH/F carries information at a gross rate of 22.8kbps. The raw data rate

for each TCH is 13kbps and 9.6kbps, 4.8kbps and 2.4kbps for data

A half rate TCH/H carries information at half of the full rate channel or at the gross

rate of 11.4kbps. The data rate associated with the half rate TCH are 4.8kbps and

2.4kbps.

The different types of traffic channel are listed below:

TCH/FS Full rate speech channel

TCH/HS Half rate speech channel

TCH/F9.6 9.6Kbps full rate data channel

TCH/F4.8 4.8Kbps full rate data channel

TCH/F2.4 2.4Kbps full rate data channel

TCH/H4.8 4.8Kbps half rate data channel

TCH/H2.4 2.4Kbps half rate data channel

54

There are four main groups of control channel that are listed below:

1. Broadcast Control Channel - BCCH

2. Transmitted at all times convey information about cell timing and

configuration.

3. Common Control Channel - CCCH

4. Used by BSS and MS when trying to initiate a connection over the air.

5. Dedicated Control Channel DCCH

6. This dedicated channel is used to convey signaling information during call set

- up.

7. Associated Control Channel - ACCH

The associated channels are used to transmit signaling information when a call is

in progress.

55

The Broadcast Control Channel is transmitted by the BTS at all times. The RF

carrier used to transmit the BCCH is called as the BCCH carrier. The information

carried on the BCCH is monitored by the mobile periodically (at least every 30s)

when it is switched on and not in a call.

Broadcast Control Channel (BCCH) - Carries the following information (this is only

a partial list):

1. Location Area identity (LAI)

2. List of neighboring cells that should be monitored by the mobile

3. List of frequencies used in the cell

4. Cell identity

5. Power Control indicator

6. DTX permitted

7. Access Control (e.g. Emergency calls, call barring)

8. CBCH description

The BCCH is transmitted at constant power at all times and its signal strength is

measured by all mobiles which may seek to use it.

56

Frequency Correction Channel (FCCH) is transmitted frequently and is more easily

detected by the mobile than SCH. When the FCCH is detected, the mobile corrects

the frequency. It is then able to detect the SCH which contains the precise

synchronization information.

Synchronization Channel (SCH) carries the information to enable the mobile to

synchronize to the TDMA frame structure. The following parameters as also

carried.

1. Frame Number

2. Base Site Identity Code (BSIC)

The mobile will monitor BCCH information from surrounding cells and store the

information from the best six cells. The SCH information on these cells is also

stored so that the mobile may quickly re-synchronize when it enters a new cell.

57

The common control channel (CCCH) is responsible for transferring control

information between all mobiles and the BTS. This is necessary for the

implementation of "call origination" and "call paging" functions.

It consists of the following types:

Random Access Control Channel (RACH) - Transmitted by the mobile when it

wishes to access to the system. This occurs when the mobile initiates a call or

responds to a page.

Paging Channel (PCH) - Transmitted by the BTS when it wishes to contact a

mobile.

Access Grant Control Channel (AGCH) - Transmitted by the BTS. The AGCH is

used to assign dedicated resources to an MS such as a Standalone Dedicated

Control Channel (SDCCH).

Cell Broadcast Channel (CBCH) - This channel is used to transmit messages to be

broadcast to all mobiles within a cell e.g. traffic info. The CBCH will steal time from

an SDCCH.

Active mobiles must frequently monitor both BCCH and CCCH. The CCCH will be

transmitted on the RF carrier with the BCCH.

58

Dedicated control channels (DCCH) are assigned to a single mobile connection for

call setup or for measurement and hand over purposes:

Standalone Dedicated Control Channel (SDCCH) - This supports the transfer of

data to and from the mobile during call setup. It also carries information for call

forwarding and transmission of short messages.

Associated Control Channels – ACCH

These channels can be associated with either an SDCCH or a TCH. They are

used for carrying information associated with the process being carried out on

either the SDCCH or the TCH.

Slow Associated Control Channel (SACCH) - Conveys power control and timing

information in the downlink direction (towards the MS) and Receive Signal

Strength Indicator (RSSI) and link quality reports in the uplink direction.

Fast Associated Control Channel (FACCH) - the FACCH is transmitted instead of a

TCH. The FACCH "steals" the TCH burst and inserts its own information. The

FACCH is used to carry out user authentication and handover.

59

The different logical channel types mentioned previously are grouped into what are

called channel combinations. The four most common channel combinations are

listed below:

1. Full Rate Traffic Channel Combination - TCH8/FACCH + SACCH

2. Broadcast Channel Combination - BCCH + CCCH

3. Dedicated Channel Combination - SDCCH8 + SACCH8

4. Combined Channel Combination - BCCH + CCCH + SDCCH4 + SACCH4

As for the half rate channel combination will not introduce here because it will be

provided in the future.

60

Now the relation between Channel Combinations and Time slots will be

introduced.

The channel combinations are sent over the air interface in a selected time slot.

Some channel combinations may be sent on any time slot but others must be sent

specific time slots. Below is a table mapping the channels combination to their

respective time slots.

Channel Combination Time slots

Traffic Any time slot

Broadcast 0,2,4,6(0 must be used first)

Dedicated Any time slot

Combined 0 only

This diagram gives an example.

In the low capacity cell, ts0 is used as combined channel, while other time slots

used for traffic channels.

In the higher capacity cell, ts0 is used as broadcast channel, ts1 is used as

dedicated channel, while other time slots used for traffic channels.

61

This diagram illustrates how these different channel combinations may be mapped

onto the TDMA structure.

Several logical channels share one time slot. The individual channels are

sequenced so that each receives the amount of time it requires. This sequencing is

carried out by the use of multi-frames, each channel combination has a different

multi-frame configuration.

This diagram shows the time relationship between time slot, TDMA frame, and

multi-frame for traffic channels. Traffic channels occupy a 26 - frame multi-frame

structure.

62

This multi-frame structure for control channels is different from traffic channel.

The diagram shows the time relationship between time slot, TDMA frame, and

multi-frame for control channels. Control channels occupy a 51 - frame multi-frame

structure.

63

This diagram illustrates a 26 frame multi-frame structure, this is used to transmit a

Traffic Channel Combination (TCH / SACCH / FACCH). Note the FACCH is not

shown in the diagram as it does not receive its own time allocation. The FACCH

steals a time period from the TCH when it is required.

The 13th frame is used by the SACCH (Slow Associated Control Channel) which

carries link control information to and from the mobile and BTS. Also note that the

26th frame is idle which will be used when half rate speech channel is a reality.

64

The 51 - frame structure used for control channels is considerably more complex

than the 26 frame structure used for the traffic channels.

The 51 – frame multi-frame structure occurs in several forms, depending on the

type of control channel and the system operator's requirements.

This diagram gives an example.

In the downlink direction (from BSS to MS), the time slot is shared by several

logical channel types. Some of the channels are repeated frequently e.g. SCH and

FCCH while others less frequently e.g. BCCH.

In the uplink direction (from MS to BSS), all time slots are allocated to RACH. This

is because RACH is the only control channel in the BCCH/CCCH group, which

operates in the uplink direction.

65

This diagram shows the 51 - frame structure used to accommodate 8 SDCCHs

although, as it takes two repetitions of the multi-frame to complete the entire

sequence, it may be more logical to think of it as a 102 - frame structure! This

structure may be transmitted on any time slot.

Note that the 8 SACCHs (shaded) are associated with the 8 SDCCHs. It is

important to remember that each SDCCH has an SACCH just like a traffic channel.

66

This diagram illustrates the 51 - frame Control Channel combined Multi-frame.

In this configuration the BCCH and SDCCH share a common time slot, this means

that each logical channel has less time than it would if one of the other

configurations were used. Because each channel has less time, fewer subscribers

can be supported. Therefore the combined channel combination is used in areas

where traffic density is low.

Like the SDCCH multi-frame, it takes two repetitions of the 51 - frame multi-frame

to complete the sequence, this is really a 102 - frame structure.

67

By the end of this section, Super frames and hyper frames will be introduced.

From the previous slide, we have known that the control channel multi-frame is

not a direct multiple of the traffic channel multi-frame. This case is not by accident.

From the diagram, it can be seen that any given frame number will only occur

simultaneously in both multi-frames every 1326 TDMA frames (26×51). This

number of TDMA frames is called a "super frame" and it takes 6.12s to transmit.

This arrangement means that the timing of the traffic channel multi-frame is always

moving in relation to that of the control channel multi-frame. This enables a mobile

to receive and decode BCCH information from surrounding cells.

If the two multi-frames were exact multiples of each other, then control channel

time slots would be permanently 'masked' by traffic channel time slot activity. This

changing relationship between the two multi-frames is particularly important.

The "hyper frame" consists of 2048 super frames, this is used in connection with

ciphering and frequency hopping, the hyper frame lasts for over three hours, after

this time the ciphering and frequency hopping algorithms are restarted.

68

1.6 Radio Technologies

69

It is well known that there are three methods of modulating a signal so that it may

be transmitted over the air:

1、Amplitude Modulation (AM)

2、Frequency Modulation (FM)

3、Phase Modulation (PM)

The modulator causes the frequency, amplitude or phase of an RF carrier to be

varied in proportion to the signal it is going to carry.

GSM uses a digital air interface. It means that digital signals are transmitted on the

radio channel.

Digital signals can use any of the modulation methods but phase modulation

provides the best noise tolerance. Since phase modulation can be implemented

easily for digital signals, this is the method, which is used for the GSM air interface.

Phase Modulation is known as Phase Shift Keying when applied to digital signals.

70

Phase Modulation provides a high degree of noise tolerance, however there is a

problem with this modulation. When the signal changes phase abruptly, high

frequency components are produced, thus, a wide bandwidth would be required for

transmission.

We have mentioned previously that GSM has a narrow bandwidth and to be as

efficient as possible with the available bandwidth. Therefore, a more efficient

development of phase modulation called as Gaussian Shift Keying(GMSK) is

actually used by the GSM air interface.

With GMSK the phase change does not occur instantaneously. Instead it occurs

over a period of time and therefore the addition of high frequency components to

the spectrum is reduced.

With GMSK, first the digital signal is filtered through a Gaussian filter. This filter

causes distortion to the signal, the corners are rounded off. This distorted signal is

then used to phase shift the carrier signal. The phase change therefore is no

longer instantaneous but spread out.

71

In GSM system, one of the main factors which restrict reducing the size of a mobile

station is the battery.

A battery must be large enough to maintain a telephone call for an acceptable

amount of time without needing to be recharged. Since there is demand for

mobiles to become smaller and lighter the battery must also become smaller and

lighter.

Four features which enable the life of a GSM mobile battery to be extended.

1. Power Control

2. Voice Activity Detection - VAD

3. Discontinuous Transmission - DTX

4. Discontinuous Reception - DRX

72

POWER CONTROL is a feature of the GSM air interface which allows the operator

to not only compensate for the distance from mobile to BTS as regards timing, but

can also cause the BTS and mobile to adjust their power output. This feature

saves radio battery power at the mobile, and helps to reduce co -channel and

adjacent channel interference.

Both Uplink and Downlink power settings can be controlled independently and

individually.

Initial power setting for the MS is set by the information provided on Broadcast

Control Channel (BCCH) for a particular cell.

The BSS controls the transmit power of both the mobile and the BTS .The received

mobile power is monitored by the BSS and the receive BTS power is monitored by

the mobile and then reported to the BSS. Using these measurements the power of

both mobile and BTS can be adjusted accordingly

73

VOICE ACTIVITY DETECTION - VAD is a mechanism whereby the source

transmitter equipment identifies the presence or absence of speech.

VAD implementation is effected in speech mode by encoding the speech pattern

silences at a rate of 500 bit/s rather than the full 13 Kbit/s. This results in a data

transmission rate for background noise, which is regenerated in the receiver,

known as "comfort" noise.

Comfort noise is necessary. Because without "comfort" noise the total silence

between the speech would be considered to be disturbing by the listener.

DISCONTINUOUS TRANSMISSION - DTX increases the efficiency of the system

through a decrease in the possible radio transmission interference level. It does

this by ensuring that the Mobile Station does not transmit unnecessary message

data. DTX can be implemented, as necessary on a call, its' effects will be most

noticeable in communications between two Mobile Stations.

When implemented at the mobile station DTX also result in considerable power

saving. If the mobile does not transmit during 'silences' there is a reduction in the

overall power output requirement.

The function of DTX may be selected by the system operator and there are

different specifications applied for different types of channels.

74

DISCONTINUOUS RECEPTION – DRX allows the mobile station to effectively

"switch -off" during times when reception is deemed unnecessary.

After initially locking on to a BCCH, MS will monitor BCCH, FCCH and SCH. The

Mobile is aware of the Frame Number and repetition format for frame

synchronization. Therefore, it can determine when next relevant information is to

be transmitted. This allows the mobile to 'go to sleep and listen -in only ‘. This is

called DRX. It also effectively saves in power usage.

VAD, DTX and DRX result in battery use time being considerably extended and

can reduce the effective battery size needed.

75

Multi path Fading results from a signal traveling from a transmitter to a receiver by

a variety of routes. This is caused by the signal being reflected from objects, or

being influenced by atmospheric effects as it passes, for example, through layers

of air of varying temperatures and humidity.

The received signals will therefore arrive at different times and not be in phase with

each other, they will have experienced time dispersion. When the receive antenna

is moving, the exact phase of each path changes and consequently the combined

signal-strength is also continually changing.

GSM offers many techniques, which combat multi-path fading effects. In the

following, Diversity and Frequency Hopping will be introduced.

76

Signals arrive at the receive antenna from multiple paths. The signals are therefore

received by the antenna at different phases, some at a peak and some at trough.

This means that some signals will add together to form a strong signal while others

will subtract causing a weak signal

When diversity is implemented, two antennas are situated at the receiver. These

antennas are placed several wavelengths apart to ensure minimum correlation

between the two receive paths .The two signals are then combined, this ensures

that a low signal strength is less likely to occur.

77

.

Frequency hopping means each time the BTS or mobile transmits a burst on a

different RF carrier frequency. In one way, Frequency hopping brings the security

benefit to GSM system. The other main reason is to reduce multi path fading

effects

The hopping must use a predetermined sequence so that both transmitter and

receiver must hop in synchronization. This sequence is stored in a 'frequency

hopping table'.

Care should be taken to that BCCH is not frequency hopped and it is always

transmitted at the same frequency. This is because the BCCH in any cell must be

transmitted on a dedicated RF carrier ,otherwise mobiles would be unable to find

and decode it.

There are two methods of frequency hopping, Synthesizer Hopping and Baseband

Hopping. Both are slow frequency hopping techniques. This means that the

frequency of the transmission only changes once every time a burst is transmitted.

In Synthesizer Hopping, each time slot on a given transceiver can transmit at a

different frequency. The transceiver retunes between time slots. This is an efficient

method for small sites with few transceivers.

In Baseband Hopping, each transceiver stays at the same frequency and data is

switched to the appropriate .The numbers of hopping frequencies is limited to the

number of transceivers.

78

1.7 The Future Development

79

Nowadays, The mobile communication market has experienced rapid growth.

GSM system wins widely market applications. However, it represents a large and

continuously increasing percentage of all new mobile subscribers in the world.

All professional Market Forecasts say GSM will stay in the Lead in the recent

several years.

From this diagram, you can know about the average growth of GSM mobile

subscribes in the world. Last year, the number of mobile subscribers reaches more

than 200millions. In 2001, it will reach about 300 millions.

80

It is obvious that the development of technologies is driven by market forces. In old

days, voice service represents the traditional service and can meet demands of

most customers. Nowadays, the customers have diversity demands for services.

For example, the demand for data communication is growing fast. Surfing on the

Internet is not a new thing, it has becoming the people’s daily necessary and

change the people’s life style. From this diagram, you can know about the

development trends of service required by the customers.

81

The growing demands for data communication not only occurs in the fixed

telephone subscriber. It also occurs in the mobile subscriber. The demands of

surfing on the Internet through MS also are required by more and more customers.

Although it’s growth is slower than the telephone subscriber. But it will represent

the future development of mobile communication. How to meet these requirements

is a severe challenge for both the mobile manufactures and the telecommunication

operators.

82

Driven by the market force, cellular system experienced three generations. GSM

and DCS 1800 belong to Second Generation cellular technologies

In recent years second generation technologies have been developed to GPRS

called 2.5G to support high-speed data packet services. Its maximum rate can

reach 115kbps.

A third generation system is being developed. It aims at integrating and merging a

range of communication services and providing high-speed and wide-band

services.

GSM will become the basis for the Third Generation (3G) system will evolve

from GSM. The maximum rate of Mobile multimedia services can reach 2Mbps.

83

Summary:

The contents of this course are mainly divided into seven sections:

Section 1 deal with principles of the Cellular Telecommunication, where we

discuss the concepts of cell and frequency spectrum used in cellular system.

Section 2 provides a detailed discussion of GSM Network Components and their

functions.

Section 3 describes service Area and Number Planning

Section 4 is devoted to Terrestrial Interface in GSM system.

Section 5 provides a detailed discussion of Channels on the Air Interface

Section 6 deals with radio interfaces, where we discuss the basic concepts of radio

technologies.

Section 7 briefly introduces the Future Development of mobile communication

So much for the courses for GSM fundamentals. Thank you.

84