Module 5

Global System for Mobile (GSM)

5.1 Gsm Network Architecture

GSM uses two 25-MHz frequency bands, that is, the 890-MHz to 915-MHz band is used for
mobile subscriber unit to base station transmissions (reverse-link transmissions), and the 935-MHz to
960-MHz frequency band is used for base station to mobile subscriber unit transmission (forward-link
transmissions). GSM uses Frequency-Division Duplexing (FDD) and a combination of TDMA and
FDMA techniques to provide simultaneous access to multiple mobile subscriber units.

The GSM network architecture consists of three major subsystems: – Mobile Station (MS) – Base
Station Subsystem (BSS) – Network and Switching Subsystem (NSS) The wireless link interface is
between the MS and the Base Transceiver Station (BTS), which is a part of BSS. Many BTSs

are controlled by a Base Station Controller (BSC). BSC is connected to the Mobile Switching Center
(MSC), which is a part of NSS. Figure 11.1 shows the key functional elements in the GSM network
architecture.

11.1.1 Mobile Station (MS)

A mobile station communicates across the air interface with a base station transceiver in the same
cell in which the mobile subscriber unit is located. The MS communicates the information with the user
and modifies it to the transmission protocols of the air-interface to communicate with the BSS. The user’s
voice information is interfaced with the MS through a microphone and speaker for the speech, keypad,
and display for short messaging, and the cable connection for other data terminals. The MS has two
elements. The Mobile Equipment (ME) refers to the physical device, which comprises of the transceiver,
digital signal processors, and the antenna.
The second element of the MS in the GSM is the Subscriber Identity Module (SIM) that is a
smart card issued at the subscription time identifying the specifications of a user such as a unique number
and the type of service. The SIM card is unique to the GSM system. It is about postage-stamp size with
32 k bytes of memory that can be plugged into any GSM mobile phone. From the user’s point of view,
one of the most remarkable features of GSM is the SIM card, which is a portable device in the form of a
smart card or plug-in module memory device that stores information such as the subscriber’s
identification number, privacy keys, the cellular networks and regions where the subscriber is authorised
to service, and other user-specific information.
The GSM subscriber units are totally generic until a SIM is inserted. Therefore, a subscriber need
only to carry a SIM card to use a wide variety of mobile equipments simply by inserting the SIM in the
device to be used. In fact, except for certain emergency communications, the subscriber units will not
work without a SIM inserted. Thus, the mobile equipment does not roam, it is the SIM which roams. The
calls in the GSM are directed to the SIM inserted in any mobile phone. Short messages are also stored in
the SIM card.
The SIM card allows a mobile subscriber to use any GSM mobile phone anywhere in the world
where GSM services are available. Alternatively, people visiting different GSM-enabled countries that
are not keen on making calls at their home number can always carry their own mobile phone and
purchase a SIM card in any other country. This way they avoid roaming charges and the expense of
having a different contact number. Several users can also share a mobile phone with different SIM cards.
Because SIM cards carry the private information for a user, a security mechanism is implemented
in the GSM that asks for a four-digit PIN number to make the information on the SIM card available to
the user. The SIM card also offers some protection against fraudulent use. A GSM mobile phone is
useless without a SIM.
For example, if the mobile subscriber removes the SIM card when leaving the mobile phone in a
vehicle, the mobile phone cannot be used unless another person has a valid SIM. Unfortunately, the SIM
cards can be stolen too. The SIM can be set up to require the user to enter a Personal Identification
Number (PIN) whenever the mobile phone is switched on to provide some security in case the card is lost
or stolen.
Once a mobile phone user has a valid SIM, buying a new GSM mobile phone is easy. No set-up
or programming is required. Similarly, a user can have a permanently vehicle-installed mobile phone and
a handheld mobile phone with the same phone number, provided that only one is used at a time. The
phone number of a mobile subscriber is usually of 10–15 digits. The first three digits are the country
code; the next two are the digits for the specific MSC, and the rest are the telephone number. The IMSI of
the same user is totally different from the ISDN telephone number. The first three digits of the IMSI
identify the country, and the next two digits, the service provider.
Besides the SIM card, the next most remarkable feature of GSM is the on-the-air privacy which is
provided by the system. Unlike analog FM cellular phone systems which can be readily monitored, it is
virtually impossible to eavesdrop on a GSM radio transmission. The privacy is made possible by
encrypting the digital bit stream sent by a GSM transmitter, according to a specific secret cryptographic
key which changes with time for each user that is known only to the service provider.
EXAMPLE 11.1 GSM air-interface standards
List the important GSM air-interface standard specifications.
Solution The GSM standard specifications are given in Table 11.1.
Table 11.1 GSM standard air-interface specifications
11.1.2 Base Station Subsystem (BSS)
A base station subsystem consists of a base station controller and one or more base transceiver
stations. Each Base Transceiver Station (BTS) defines a single cell. A cell can have a radius of between
100 m and 35 km, depending on the environment. A Base Station Controller (BSC) may be collocated
with a BTS. It may control multiple BTS units and hence multiple cells. The BSC reserves radio
frequencies, manages the hand-off of a mobile unit from one cell to another within the BSS, and controls
paging. The BSS manages the radio interface between the mobile stations and all other subsystems of
GSM such as MSC.
The BSS translates between the wireless-interface and fixed wired infrastructure protocols. The
needs for the wireless and wired media are different because the wireless medium is unreliable,
bandwidth limited, and needs to support mobility. As a result, protocols used in the wireless medium and
wired medium are different. The BSS provides for the translation among these protocols.
There are two main architectural elements in the BSS––the Base Transceiver Subsystem (BTS),
and the Base Station Controller (BSC). The BSS consists of many BSCs which connect to a single MSC,
and each BSC typically controls up to several hundred BTSs. Some of the BTSs may be co-located at the
BSC, and others may be remotely distributed and physically connected to the BSC by microwave links or
dedicated leased lines. The BTS is the counterpart of the MS for physical communication over the air-
interface. The BTS components include a transmitter, a receiver, and signaling equipment to operate over
the air-interface, and it is physically located in the centre of the cells where the BSS antenna is installed.
One BSS may have from one up to several hundred BTSs under its control. The hand-offs of calls
between two BTSs under the control of the same BSC are handled by the BSC, and not the MSC. This
greatly reduces the switching burden of the MSC.
The interface that connects a BTS to a BSC is called the A-bis interface. The A-bis interface
carries traffic and maintenance data. The main function of the BSC is to look over a certain number of
BTSs to ensure proper operation. The BSC is a small switch inside the BSS in charge of frequency
administration, maintains appropriate power levels of the signal and hand-off among the BTSs inside a
BSS. The hardware of the BSC in a single BTS site is located at the antenna and in the multi-BTS
systems, in a switching centre where other hardware elements of NSS are located. The interface between
a BSC and an MSC is called the A interface, which is standardised within GSM.
The user’s speech signal is converted into 13 kbps- digitised voice with a speech coder and
communicated over the air- interface to provide a bandwidth efficient air-interface. The backbone wired
network uses a 64 kbps PCM digitised voice in the PSTN hierarchy. Conversion from analog speech
signal to 13 kbps digitised voice signal takes place at the mobile station, and the change from 13 kbps to
64 kbps coding takes place at the BSS. The call is established through the exchange of a number of
packets.

11.1.3 Network and Switching Subsystem (NSS)

The NSS is responsible for the network operation. It provides the link between the cellular
network and the Public Switched Telecommunications Networks (PSTN or ISDN or Data Networks). The
NSS controls hand-offs between cells in different BSSs, authenticates users and validates their accounts,
and includes functions for enabling worldwide roaming of mobile subscribers. The NSS could be
interpreted as a wireless specific switch that communicates with other switches in the PSTN and at the
same time supports functionalities that are needed for a cellular mobile environment. The NSS
interconnects to the PSTN through ISDN protocols. The NSS provides communications with other wired
and wireless networks, as well as support for registration and maintenance of the connection with the MSs
via BSCs in the radio subsystem. The network and the switching subsystem together include the main
switching functions of GSM as well as the databases needed for subscriber data and mobility
management. In particular, the switching subsystem consists of
– Mobile Switch Centre (MSC)
– Home Location Register (HLR)
– Visitor Location Register (VLR)
– Authentication Centre (AuC)
– Equipment Identity Register (EIR)
– Interworking Function (IWF)
The NSS is the most elaborate element of the GSM network, and it has one hardware, Mobile
Switching Centre (MSC), and four software database elements: Home Location Register (HLR), Visitor
Location Register (VLR), Equipment Identification Register (EIR), and Authentication Centre (AuC). An
MSC is the hardware part of the wireless switch that can communicate with PSTN switches using the
signaling system-7 (SS-7) protocol, as well as other MSCs in the coverage area of a service provider. If
the MSC has an interface to the PSTN then it is called a Gateway MSC (GMSC). The MSC also provides
the network the specific information on the status of the mobile terminals. The MSC basically performs
the switching functions of the system by controlling calls to and from other telephone and data systems. It
also does functions such as network interfacing and common channel signaling.
Because the GSM represents an independent network, it must dispose of entities which provide
connection to other users. Therefore, the main component of the switching subsystem is the Mobile
Switching Centre, MSC. The main role of the MSC is to manage the communications between the GSM
users and other telecommunications network users. The basic switching function is performed by the
MSC, whose main function is to coordinate setting up calls to and from GSM users.
The MSC has interfaces with the BSS on one side (through which MSC VLR is in contact with
GSM users) and the external networks on the other side (ISDN/PSTN). An MSC is generally connected to
several BSSs, which provide radio coverage to the MSC area. The MSC is also connected to other GSM
Public Land Mobile Network (PLMN) entities such as other MSCs and HLR through a fixed network.
The MSC is the telephone switching office for mobile-originated or terminated traffic. The MSC controls
the call set-up and routing procedures in a manner similar to the functions of a land network end office.
The MSC provides call set-up, routing, and handover between BSCs in its own area and to/from other
MSCs; an interface to the fixed PSTN; and other functions such as billing. It also performs such functions
as toll ticketing, network interfacing, common channel signaling, and others.
The HLR is database software that handles the management of the mobile subscriber account. It
stores the subscriber’s address, service type, current location, forwarding address,
authentication/ciphering keys, and billing information. In addition to the ISDN telephone number for the
terminal, the SIM card is identified with an International Mobile Subscriber Identity (IMSI) number that
is totally different from the ISDN telephone number. The IMSI is used totally for internal networking
applications. Each HLR is identified by the HLR number which is sent to all the required VLRs. The
HLR is the reference database that permanently stores data related to subscribers, including a subscriber’s
service profile, location information, and activity status. When an individual user buys a subscription
from one of the GSM service providers, he is registered in the HLR of that service provider.
Various identification numbers and addresses as well as authentication parameters, services
subscribed, and special routing information are stored in the HLR. Current subscriber status, including a
subscriber’s temporary roaming number and associated VLR if the mobile is roaming, are maintained.
Location registration is performed by HLR. The HLR provides data needed to route calls to all MS-SIMs
home based in its MSC area, even when they are roaming out of area or in other GSM networks. The
HLR provides the current location data needed to support searching for and paging the MS-SIM for
incoming calls, wherever the MS-SIM may be. The HLR is responsible for storage and provision of SIM
authentication and encryption parameters needed by the MSC where the MS-SIM is operating. It obtains
these parameters from the AuC. The HLR maintains records of which supplementary services each user
has subscribed to and provides permission control in granting access to these services.
Based on described functions, different types of data are stored in the HLR. Some data are
permanent; that is, they are modified only for administrative reasons, while others are temporary and
modified automatically by other network entities depending on the movements and actions performed by
the subscriber. Some data are mandatory, other data are optional. Both the HLR and the VLR can be
implemented in the same equipment in an MSC (collocated). A PLMN may contain one or several HLRs.
 The VLR is a temporary database software similar to the HLR identifying the mobile subscribers
visiting inside the coverage area of an MSC. The VLR assigns a Temporary Mobile Subscriber Identity
(TMSI) that is used to avoid using IMSI on the air. The location of the mobile subscriber is determined by
the VLR into which the mobile subscriber is entered. The visitor location register maintains information
about mobile subscribers that are currently physically in the region covered by the switching centre. It
records whether or not the subscriber is active and other parameters associated with the subscriber. For a
call coming to the mobile subscriber, the system uses the mobile phone number associated to identify the
home switching centre of the mobile subscriber. The home switching centre can find in its HLR the
switching centre in which the mobile subscriber is presently located. For a call coming from the mobile
subscriber, the VLR is used to initiate the call. Even if the mobile subscriber is in the area covered by its
home switching centre, it is also represented in the switching centre’s VLR.
A VLR is linked to one or more MSCs. The function of the VLR is to memorise temporarily
information about the mobiles which are currently located in the geographical area controlled by the
linked MSC. The VLR is a database that contains temporary information about subscribers that is needed
by the MSC in order to service visiting subscribers. The VLR supports a mobile paging-and-tracking
subsystem in the local area where the mobile is presently roaming. The VLR is always integrated with the
MSC. A VLR may be in charge of one or several MSC LAs (Location Areas).
When a mobile subscriber roams from one LA to another, their current location is automatically
updated in their VLR. When a mobile station roams into a new MSC area, if the old and new LAs are
under the control of two different VLRs, the VLR connected to that MSC will request data about the
mobile station from the HLR. The entry on the old VLR is deleted and an entry is created in the new VLR
by copying the basic data from the HLR. Later, if the mobile station makes a call, the VLR will have the
information needed for call set-up without having to interrogate the HLR each time. The subscriber’s
current VLR address, stored at the HLR, is also updated. This provides the information necessary to
complete calls to roaming mobiles. These two databases, HLR and VLR, are used to keep track of the
current location of an MS in GSM. Maintenance of two databases at home and at the visiting location
allows a mechanism to support dialing and call routing in a roaming situation where the MS is visiting the
coverage area of a different MSC.
GSM transmission is encrypted. The AuC database holds different algorithms that are used for
authentication and encryption of the mobile subscribers that verify the mobile user’s identity and ensure
the confidentiality of each call. The AuC protects network cellular operators from different types of
frauds and spoofing found in today’s cellular world. AuC holds the authentication and encryption keys for
all the subscribers in both the home and visitor location registers. A stream cipher, A5, is used to encrypt
the transmission from subscriber to base transceiver. However, the conversation is in the clear in the
landline network. Another cipher, A3, is used for authentication. Different classes of SIM cards have their
own algorithms, and the AuC collects all of these algorithms to allow the NSS to operate with different
mobile terminals from different geographic areas.
The EIR is another database that keeps the information about the identity of mobile equipment
such as the International Mobile Equipment Identity (IMEI) that reveals the details about the
manufacturer, country of production, and device type. This information is used to prevent calls from
being misused, to prevent unauthorised or defective MSs, to report stolen mobile phones or check if the
mobile phone is operating according to the specification of its type.
 Each mobile equipment is identified by IMEI which is memorised by the manufacturer and
cannot be removed. By the registration mechanism the MS always sends the IMEI to the network, so that
the EIR can memorise and assign them to three different lists:
White List This list contains the IMEI of the phones who are allowed to enter in the network.
Black List This list on the contrary contains the IMEI of the phones who are not allowed to enter in the
network, for example because they are stolen. Those phones are not able to enter in all the GSM networks
which dispose of an EIR.
Grey List This list contains the IMEI of the phones momentarily not allowed to enter in the network, for
example because the software version is too old or because they are in repair. By the registration
mechanism, the MSC checks if the MS is contained in the black or grey list; if so, the mobile cannot enter
the network. One EIR per GSM network is enough. In the future there will be an interconnection between
all the EIRs to avoid the situation where a mobile stolen in one country can be used in a GSM network
from a different country. Both AuC and EIR can be implemented as individual stand-alone nodes or as a
combined AuC/EIR node. The implementation of the EIR is left optional to the service provider.
IWF-Interworking Function It is a subsystem in the PLMN that allows for non-speech communication
between the GSM and the other networks. The tasks of an IWF are particularly to adapt transmission
parameters and protocol conversion. The physical manifestation of an IWF may be through a modem
which is activated by the MSC dependent on the bearer service and the destination network. The SS
supports operation and maintenance of the system and allows engineers to monitor, diagnose, and
troubleshoot every aspect of the GSM network. The OSS supports one or several Operation Maintenance
Centres (OMC) that are used to monitor and maintain the performance of each MS, BS, BSC, and MSC
within a GSM system. The OSS has three main functions, which are to maintain all telecommunications
hardware and network operations with a particular service area, manage all mobile equipment in the
system, and manage all charging and billing procedures. Within each GSM system, an OMC is dedicated
to each of these tasks and has provisions for adjusting all base-station parameters and billing procedures,
as well as for providing system operators with the ability to determine the performance and integrity of
each unit of mobile subscriber equipment in the system.
11.2 GSM SIGNALING PROTOCOL ARCHITECTURE
 The interface between a BSC and a MSC is called the A’ interface, which is standardised within
GSM. The A’ interface uses an SS7 protocol called the Signaling Connection Control Part (SCCP) which
supports communication between the MSC and the BSS, as well as network messages between the
individual mobile subscribers and the MSC. The A’ interface allows a service provider to use base
stations and switching equipment made by different manufacturers.
A number of control messages are exchanged between the key entities of GSM network
architecture that deal with radio resources, mobility management, and connection management. The
protocol stack is divided into three layers: Layer 1 Physical Layer Layer 2 Data Link Layer (DLL) Layer
3 Networking or Messaging Layer
11.2.1 Layer I: Physical Layer The physical layer defined in the GSM specifications is for the Um air-
interface. The radio link carries higherlevel data inside the TDMA format between the mobile station and
the base transceiver station. This layer specifies how the information from different voice and data
services are formatted into packets and sent through the radio channel. It specifies the radio modem
details, the packaging of a variety of services into the bits of a packet, traffic structure and control
packets. This layer specifies modulation and coding techniques, power control methodology, and time
synchronisation approaches which enable establishment and maintenance of the channels. The physical
layer of the A and A-bis interfaces follow the ISDN standard with 64 kbps digital data per voice user.
11.2.2 Layer II: Data Link Layer The control and signaling data transfer may be through the same
physical channels or through separate physical channels. Signaling and control data are conveyed through
Layer II and Layer III messages. At the linklayer, a data link control protocol known as LAPDm is used
where m refers to the modified version of LAPD adapted to the mobile environment. In essence, LAPD is
designed to convert a potentially unreliable physical link into a reliable data link. It does this by using a
cyclic redundancy check to perform error detection and Automatic Repeat Request (ARQ) to retransmit
damaged frames. The LAPD protocol is used for the A-bis and A interfaces connecting the BTS to BSC
and BSC to MSC, respectively.
 The overall purpose of DLL is to check the flow of packets for Layer III and allow multiple
Service Access Points (SAP) with one physical layer. The remaining links use the normal LAPD protocol.
The DLL checks the address and sequence number for Layer III and manages acknowledgments for
transmission of the packets. In addition, the DLL allows two SAPs for signaling and Short Messages
(SMS). The SMS traffic channel in the GSM is not communicated through voice channels. In GSM, the
SMS is transmitted through a fake signaling packet that carries user information over signaling channels.
The DLL in GSM provides this mechanism for multiplexing the SMS data into signaling streams.
Signaling packets delivered to the physical layer are each 184 bits, same as that of the length of
the DLL packets in the LAPD protocol used in the ISDN networks. The length of the LAPDm packets,
shown in Fig. 11.3, is the same as LAPD, but the format is slightly adjusted to fit the mobile environment.

Since GSM has the time synchronisation and strong coding at the physical layer, the
synchronisation bits and CRC codes in LAPD are eliminated in the LAPDm. The address field is
optional, and it identifies the SAP, protocol revision type, and nature of the message. The control field is
also optional, and it holds the type of the frame (command or response) and the transmitted and received
sequence numbers.
The length indicator identifies the length of the information field. Fill-in bits are all 1s bits to
extend the length to the desired 184 bits. In peer-to-peer Layer II communications, such as DLL
acknowledgments, there is no Layer III payload and fill-in bits cover this field. The information field
carries the Layer III payload data.
The peer-to-peer Layer II messages are unnumbered acknowledgment, receiver ready, receiver
not ready, disconnect, and reject. These messages do not have Layer III information bits and are referred
to as Layer II messages. The information bits in Layer II packets specify Layer III operations
implemented on the logical signaling channels. These information bits are different for different
operations.
11.2.3 Layer III: Networking or Signaling Layer
The networking or signaling layer implements the protocols needed to support the mechanisms
required to establish, maintain, and terminate a mobile communication session. It is also responsible for
control functions for supplementary and SMS services. The traffic channels are carried by normal bursts
in different formats associated with different speech or data services. The signaling information uses other
bursts and more complicated DLL packaging. A signaling procedure such as the registration process is
composed of a sequence of communication events or messages between hardware elements of the
systems that are implemented on the logical channels encapsulated in the DLL frames.
Layer III defines the details of implementation of messages on the logical channels encapsulated
in DLL frames. Among all messages communicated between two elements of the network only a few,
such as DLL acknowledgment, do not carry Layer III information. Information bits of the Layer II
packets specify the operation of a Layer III message. As shown in Fig. 11.4, these bits are further divided
into several fields.
 The Transaction Identifier (TI) field is used to identify a procedure or protocol that consists of a
sequence of messages. This field allows multiple procedures to operate in parallel. The Protocol
Discriminator (PD) identifies the category of the operation (management, supplementary services, call
control, and test procedure). The Message Type (MT) identifies the type of message for a given PD.
Information Elements (IE) is an optional field for the time that an instruction carries some information
that is specified by an IE Identifier (IEI). The number of Layer III messages is much larger than the
number of Layer II messages.
To further simplify the description of the Layer III messages, GSM standard divides the messages
into three sublayers that provide specific functions: –
Radio Resource Management (RRM)
– Mobility Management (MM)
– Communication Management (CM)
The RRM sublayer of Layer III manages the frequency of operation and the quality of the radio
link. Radio resource management establishes and releases connections between MSs and an MSC and
maintains them despite subscriber movements. The RRM functions are mainly performed by the MS and
the BSC. The main responsibilities of the RRM are to assign the radio channel and hop to new channels
in implementation of the slow frequency-hopping option, to manage hand-off procedure and measurement
reports from MS for handoff decision, to implement power control procedure, and to adapt to timing
advance for synchronisation.
The major functions of Mobility Management (MM) sublayer are location update, registration
procedures, authentication procedure, TMSI handling, and attachment and detachment procedures for the
IMSI. This sublayer handles mobility issues that are not directly related to the radio, and include
management of security functions. Mobility management functions are handled by the MS/SIM, the
MSC/VLR, and the HLR/AuC.
The Communication Management (CM) sublayer is used to establish, maintain, and release the
circuitswitched connection between the calling and called subscribers of GSM network. Specific
procedures for the CM sublayer include mobile-originated and mobile-terminated call establishment,
change of transmission mode during the call, control of dialing using dual-tones, and call reestablishment.
In addition to call management, it includes supplementary services management and SMS management.
The Mobile Application Part (MAP) handles most of the signaling between different entities in
the fixed part of the network, such as between the HLR and VLR. It runs on top of two intermediate
protocols––Signal Connection Control Part (SCCP) and Message Transfer Part (MTP). SCCP and MTP
protocols are part of Signaling System Number 7, which is a set of protocols designed to provide control
signaling within digital circuit-switching networks.
11.2.4 SS7 Signaling Common Channel Signaling System No. 7 (SS7 or CC7) is a global standard that
defines the procedures and protocol by which network elements in PSTN exchange information over a
digital signaling network to effect wireless (cellular) and wireline call set-up, routing and control. The
SS7 signaling protocols are mainly used for basic call set-up, call management, wireless services such as
PCS, wireless roaming, mobile subscriber authentication, local number portability, toll-free and toll
wireline services, enhanced call features such as call forwarding, calling party name/number display, and
three-way calling, efficient and secure worldwide telecommunications.
The SS7 protocol provides both error correction and retransmission capabilities to allow
continued service in the event of signaling point or link failures. SS7 messages are exchanged between
network elements over 64 kbps bi-directional channels called signaling links. Signaling occurs out-of-
band on dedicated channels rather than in-band on voice channels. Compared to in-band signaling, out-of-
band signaling provides faster call set-up times, more efficient use of voice circuits, support for Intelligent
Network (IN) services which require signaling to network elements without voice trunks (for example,
database systems), and improved control over fraudulent network usage. There are three kinds of
signaling points in the SS7 network:
– Service Switching Point (SSP)
– Signal Transfer Point (STP)
– Service Control Point (SCP)
SSPs are switches that originate, terminate, or tandem calls. An SSP sends signaling messages to
other SSPs to set up, manage, and release voice circuits required to complete a call. An SSP may also
send a query message to a centralised database, an SCP, to determine how to route a call. An SCP sends a
response to the originating SSP containing the routing number(s) associated with the dialed number. An
alternate routing number may be used by the SSP if the primary number is busy or the call is unanswered
within a specified time. Actual call features vary from network to network and from service to service.
Network traffic between signaling points may be routed via a packet switch called STP. The STP
routes each incoming message to an outgoing signaling link based on routing information contained in the
SS7 message. Because it acts as a network hub, STP provides improved utilisation of the SS7 network by
eliminating the need for direct links between signaling points. The STP may perform global title
translation, a procedure by which the destination signaling point is determined from digits present in the
signaling message. The STP can also act as a firewall to screen SS7 messages exchanged with other
networks. Because the SS7 network is critical to call processing, SCPs and STPs are usually deployed in
pair configurations in separate physical locations to ensure network-wide service in the event of an
isolated failure.
11.2.5 Addressing and Routing
Within the GSM network, two types of routing can be described:
– SS7 addressing and message signaling routing
– Call control/number routing
The SS7 MTP layer 3 provides the routing function. This layer is used to route within a local
network using the Signaling Point Code addressing. To interconnect all the local networks on the national
SS7 networks, the SCCP Global Title Translation (GTT) functionality is used. Global Title Translation is
one of the strong routing capabilities of SS7 SCCP layer. This SCCP functionality allows a centralised
network to hold and maintain all the addresses and routing tables, centralising the routing function. For
MSC to send a message to a particular HLR, the MSC does not need to know each Mobile’s HLR point
code. Only the adjacent STP point code and the dialed digits (MSISDN) needs to be provided to the STP
in order to route the message to the HLR.
The STP will perform the translation of the dialed digits to physical point code (HLR or MSC).
The STP pair after checking the SCCP header information will determine if the message requires GTT
translation. It will then extract the IMSI of the subscriber from the calling number address field in the
SCCP header and from a database table determine the HLR point code where the
validation/authentication should be sent. This will eliminate book-keeping on every MSC and centralise
the routing/translation on the SS7 STP network.
A landline calling party dials the GSM mobile directory number (MS ISDN number). The PSTN
after performing the digits translation routes the call to the home PLMN GMSC. The GMSC contains
either the routing tables to relate the MSISDN number with the corresponding HLR, or if the GMSC is
connected to the SS7 network with the GTT functionality, the SS7 network will identify the HLR. Once
the GMSC interrogates the HLR with the MSISDN number, the HLR determines the IMSI from the
MSISDN number. The HLR stores the subscriber’s information based on IMSI, not MSISDN. The HLR
locates the visiting MSC/VLR point code and if the MSRN is available, it will return the information to
GMSC. If the HLR does not have the MSRN for the subscriber it will request one from the visiting
MSC/VLR. The latter can be done via GTT if an SS7 backbone with GTT (IMSI to point code)
functionality is available/supported. The GMSC once it receives the MSRN and the MSC/VLR point
code, will route the call to the VMSC/VLR. The MSC/VLR will then page the mobile subscriber.
The call-originating information including the dialed digits will be sent to the MSC/VLR. The
MSC/VLR with the subscriber’s profile information performs digits translation (if supported) and routes
the call either to the PSTN or to other MSCs. If the MSC cannot perform the digits translation it would
route the call to GMSC for translation and routing.
11.2.6 Location Update
A list of relevant functions of a mobile station includes provision of location updates. The
location-updating procedures, and subsequent call routing, use the MSC and two location registers: HLR
and VLR. When a mobile station is switched on in a new location area, or it moves to a new location area
or different operator’s PLMN, it must register with the network to indicate its current location. In the
normal case, a location update message is sent to the new MSC/VLR, which records the location area
information, and then sends the location information to the subscriber’s HLR. The information sent to the
HLR is normally the SS7 address of the new VLR, although it may be a routing number.
If the subscriber is entitled to service, the HLR sends a subset of the subscriber information,
needed for call control, to the new MSC/VLR, and sends a message to the old MSC/VLR to cancel the
old registration. For reliability reasons, the GSM also has a periodic location updating procedure. If an
HLR or MSC/VLR fails, to have each mobile register simultaneously to make the database up-to-date
would cause overloading. Therefore, the database is updated as location updating events occur. The
enabling of periodic updating, and the time period between periodic updates, is controlled by the operator,
and is a trade-off between signaling traffic and speed of recovery. If a mobile does not register after the
updating time period, it is de-registered.
A procedure related to location updating is the IMSI attach and detach. A detach permits the
network to know that the mobile station is unreachable, and avoids having to needlessly allocate channels
and send paging messages. An attach is similar to a location update, and informs the system that the
mobile is reachable again. The activation of IMSI attach/detach is up to the operator on an individual cell
basis. Location update is a typical example for the connection-oriented transactions in GSM. The local
operation code UpdatLocation is required directly after the location update for the new VLR to update the
location information in the HLR. Because this is a confirmed service, it requires all four variants: request,
indication, response and confirmation.
11.3 IDENTIFIERS USED IN GSM SYSTEM
Several identity numbers are associated with a GSM system, which are briefly described below.
 11.3.1 IMSI The International Mobile Subscriber Identity (IMSI) number is usually 15 digits or less.
When an MS attempts a call, it needs to contact a BS. The BS can offer its service only if it identifies the
MS as a valid subscriber. For this, the MS needs to store certain values uniquely defined for the MS, like
the country of subscription, network type, subscriber ID, and so on. These values are called the
International Mobile Subscriber Identity (IMSI). The structure of an IMSI is shown in Fig. 11.5. The first
three digits specify the country code, the next two specify the network provider code, and the rest are the
mobile subscriber identification code (the customer ID number). Another use of IMSI is to find
information about the subscriber’s home Public Land Mobile Network (PLMN). All such information is
placed on the SIM card.
11.3.2 Subscriber Identity Module (SIM) Every time the MS has to communicate with a BS, it must
correctly identify itself. An MS does this by storing the mobile phone number, personal identification
number for the mobile station, authentication parameters, and so on, in the SIM card. Smart SIM cards
also have a flash memory that can be used to store small messages sent to the unit. The main advantage of
SIM is that it supports roaming with or without a cellphone, also called SIM roaming. All a user needs to
do is to carry the SIM card alone, and insert it into any GSM mobile phone to make it work as per
customised MS. In other words, the SIM card is the heart of a GSM mobile phone, and the MS hardware
equipment is unusable without it.
11.3.3 Mobile System ISDN (MSISDN) MSISDN is the number that identifies a particular MS’s
subscriber, with the format shown in Fig. 11.6. The GSM actually does not identify a particular mobile
phone, but a particular HLR. It is the responsibility of the HLR to contact the mobile phone.
11.3.4 Location Area Identity (LAI) As shown in Fig. 11.7, the GSM service area is usually divided
into a hierarchical structure that facilitates the system to access any MS quickly.

Fig:Format of IMSI

Fig. 11.6 Format of MSISDN

 Each PLMN area is divided into many MSCs. Each MSC typically contains a VLR to inform the
system if a particular cellphone is roaming, and if it is roaming, the VLR of the MSC, in which the
cellphone is, reflects the fact. Each MSC is divided into many Location Areas (LAs). An LA is a cell or a
group of cells and is useful when the MS is roaming in a different cell but the same LA. Since any LA has
to be identified as a part of the hierarchical structure, the identifier should contain the country code, the
mobile network code, and the LA code.
11.3.5 IMSEI Each manufactured GSM mobile phone equipment is assigned a 15-bit long International
MS Equipment Identity (IMSEI) number to contain manufacturing information, as shown in Fig. 11.8.
Conceptually, when the mobile phone equipment passes the interoperability tests, it is assigned a type
approval code. Since a single mobile unit may not be manufactured at the same place, a field in IMSEI,
called the final assembly code, identifies the final assembly place of the mobile unit. To identify uniquely
a unit manufactured, a Serial Number (SN) is assigned. A spare digit is available to allow further
assignment depending on requirements.
11.3.6 MS Roaming Number (MSRN) When an MS roams into another MSC, that unit has to be
identified based on the numbering scheme format used in that MSC. Hence, the MS is given a temporary
roaming number called the MS Roaming Number (MSRN), with the format shown in Fig. 11.9. This
MSRN is stored by the HLR, and any calls coming to that MS are rerouted to the cell where the MS is
currently located.
11.3.7 TMSI As all transmission is sent through the air interface, there is a constant threat to the security
of information sent. A temporary identity Temporary Mobile Subscriber Identity (TMSI) is usually sent in
place of IMSEI.

11.4 GSM CHANNELS

 GSM-900 has been allocated an operational frequency from 890 MHz to 960 MHz. GSM uses the
frequency band 890 MHz–915 MHz for uplink (reverse) transmission, and for downlink (forward)
transmission, it uses the frequency band 935 MHz–960 MHz. The available 25-MHz spectrum for each
direction is divided into 124 Frequency Division Multiplexing (FDM) channels, each occupying 200 kHz
with 100 kHz guard band at two edges of the spectrum. This is shown in Fig. 11.10.

GSM uses FDD and a combination of TDMA and FDMA schemes to provide multiple access to
mobile subscribers. The available forward and reverse frequency bands are divided into 200-kHz wide
channels called ARFCNs (Absolute Radio Frequency Channel Numbers). The ARFCN denotes a forward
and reverse channel pair that is separated in frequency by 45 MHz and each channel is time shared
between as many as eight subscribers using TDMA.
The total number of available channels within a 25-MHz bandwidth is 125 (assuming no guard
band). Since each radio channel consists of eight time slots, there are thus a total of 1000 traffic channels
within a GSM. In practical implementations, a guard band of 100 kHz is provided at the upper and lower
end of the GSM spectrum, and only 124 channels are available for use.
Each carrier supports eight time slots for the TDMA operation. Each of the eight subscribers uses the
same ARFCN and occupies a unique Time Slot (TS) per frame. A guard frame of 8.25 bits is used in
between any two frames transmitted either by the BS or the MS. The data rate of each carrier is 270.833
kbps that is provided with a modulation scheme known as GMSK (Gaussian Minimum Shift Keying) that
is a variant of FSK having a frequency deviation of ± 67.71 kHz. The channel data rate of GSM is
270.833 kbps, which is exactly four times the RF frequency shift. This minimises the bandwidth occupied
by the modulation spectrum and hence improves channel capacity. The MSK modulated signal is passed
through a Gaussian filter to smooth the rapid frequency transitions that would otherwise spread energy
into adjacent channels. The bandwidth-time product (B × Tb) of GMSK is standardised at 0.3, a
normalised bandwidth expansion factor where 0.3 describes the 3 dB bandwidth of the Gaussian pulse
shaping filter with relation to the bit rate, which provides the best compromise between increased
bandwidth occupancy and resistance to cochannel interference. Ninety-nine per cent of the RF power of
GMSK signals so specified is confined to a bandwidth of 250 kHz, which means that, for all practical
purposes, the sidelobes of the GMSK signal are insignificant, and outside this frequency band.
EXAMPLE 11.2 GMSK signal bandwidth in GSM
Show that the 3-dB bandwidth for a Gaussian LPF used to produce B × Tb = 0.3 GMSK modulation in
GSM standard is 81.3 kHz. The channel data rate is 270.833 kbps.
Solution Channel data rate, Rb = 270.833 kbps (given) Baseband symbol duration, Tb = 1/Rb Baseband
symbol duration, Tb = 1/270.833 kbps = 3.69 μs
Product of 3-dB bandwidth and baseband symbol duration, B × Tb = 0.3 (given) Therefore, 3-dB
bandwidth, B = 0.3/Tbf Hence, 3-dB bandwidth, B = 0.3/3.69 μs = 81.3 kHz
Hence, the 3-dB bandwidth for a Gaussian LPF used to produce B × Tb = 0.3 GMSK modulation in GSM
standard is 81.3 kHz.
With the channel data rate of 270.833 kbps, the duration of each bit is 3.69 μs, and the effective channel
transmission rate per user is 33.854 kbps (270.833 kpbs/8 users). With overhead, user data is actually
transmitted at a maximum rate of 24.7 kbps. The user transmission packet burst is fixed at 577 μs, which
accommodates information bits and a time gap between the packets for duration equivalent to 156.25
channel bits times the bit duration of 3.69 μs.
EXAMPLE 11.3 Theoretical S/N in GSM
The channel data rate is 270.833 kbps in GSM standard that is 40% (say) of theoretical maximum data
rate that can be supported in a 200-kHz channel bandwidth. Calculate the corresponding theoretical S/N
required.
Solution Step 1. To calculate theoretical maximum data rate, C Channel data rate, Rb = 270.833 kbps
(given) Channel data rate, Rb is 40% of theoretical maximum data rate, C (given) Or, Channel data rate,
Rb = 0.4 × C Theoretical maximum data rate, C = Rb /0.4 Hence, theoretical maximum data rate, C =
270.833 kbps/0.4 = 677 kbps
Step 2. To calculate the corresponding theoretical S/N required
The channel bandwidth, B = 200 kHz (given)
The maximum possible theoretical data rate, C is given by Shannon’s channel capacity formula
C = B × log2 (1+ S/N) Or, log2 (1+ S/N) = C/B Or, log2 (1+ S/N) = 677 kbps/200 kHz Or,
log2 (1+ S/N) = 3.385 Or, S/N = 23.385 – 1 = 9.447 Or, S/N (dB) = 10 log10 (9.447) = 9.75 dB
Hence, the corresponding theoretical S required is 9.75 dB
EXAMPLE 11.4 Bandwidth efficiency in GSM
The GSM system uses the GMSK modulation scheme. Show that the bandwidth efficiency of the
standard GSM system is 1.35 bps/Hz.
Solution The channel bandwidth = 200 kHz (standard) The channel data rate = 270.833 kbps (standard)
Bandwidth efficiency = Channel data rate/Channel bandwidth
Therefore, bandwidth efficiency = 270.833 kbps /200 kHz
Hence, bandwidth efficiency = 270.833 kbps /200 kHz = 1.35 bps/Hz
GSM employs a moderately complicated, 13-kbps regular pulse-excited speech codec (coder/decoder)
with a long-term predictor. To provide error protection for the speech-encoded bits, concatenated
convolutional codes and multilayer interleaving are employed. An overall speech delay of 57.5 ms occurs
in the system.
11.4.1 GSM Logical Channels
The combination of a time slot number and an ARFCN constitutes a physical channel for both the
forward and reverse links. Each physical channel in a GSM system can be mapped into different logical
channels at different times. That is, each specific time slot or frame may be dedicated to either handling
traffic data (user data such as speech, facsimile, or teletext data), signaling data, or control channel data
(from the MSC, base station, or mobile subscriber).
Communication between the mobile subscriber and the base station is involved with both voice as
well as signaling and control. Voice and signaling packets are inserted in a hierarchy and mobile
subscribers use counters to identify the location of specific packet bursts in the overall structure of the
frames. The entire communication system can be thought of as a distributed real-time computer that uses
a number of instructions to transfer information packets from one location to another. Initial signaling is
needed for registration and call establishment, followed by maintaining the synchronisation among the
mobile subscribers, mobility management, and need to transfer the data traffic.
There is a need of a set of instructions and ports to instruct different elements of the cellular
network to perform their specified duties. In cellular communication systems, these ports are referred to
as logical channels. Logical channels use a physical TDMA slot or a portion of a physical slot to specify
an operation in the network in GSM. GSM uses a variety of multiplexing techniques to create a collection
of logical channels.
The GSM specification defines a wide variety of logical channels that can be used to link the
physical layer with the data link layer of the GSM network. These logical channels efficiently transmit
user data while simultaneously providing control of the network on each ARFCN. GSM provides explicit
assignments of time slots and frames for specific logical channels. The logical channels used by a GSM
system are shown in Table 11.2.

The logical channels in the GSM network are divided into two principal categories: Control Channels
(CCHs) and Traffic Channels (TCHs). Control channels carry signaling and synchronising commands
between the base station and the mobile station. Certain types of control channels are defined for just the
forward or reverse link. Traffic channels carry digitally encoded user speech or user data and have
identical functions and formats on both the forward and reverse link. GSM system uses a variety of
logical control channels to ensure uninterrupted communication between MSs and the BS.
11.4.2 GSM Control Channels There are three classes of control channels defined in GSM: Broadcast
Channels (BCH), Common Control Channels (CCCH), and Dedicated Control Channels (DCCH). Each
control channel consists of several logical channels that are distributed in time to provide the necessary
GSM control functions.
Specifically, the BCH and CCCH forward control channels are allocated only TS 0 and are broadcast only
during certain frames within a repetitive fifty-one frame sequence (called the control channel multiframe)
on those ARFCNs which are designated as broadcast channels. TS1 through TS7 carry regular TCH
traffic, so that ARFCNs that are designated as control channels are still able to carry full-rate users on
seven of the eight time slots.
The GSM specification defines thirty-four ARFCNs as standard broadcast channels. For each broadcast
channel, the frame number 51 does not contain any BCH/CCCH forward channel data and is considered
to be an idle frame. However, the reverse channel CCCH is able to receive subscriber transmissions
during TS 0 of any frame (even the idle frame). On the other hand, DCCH data may be sent during any
time slot and any frame, and entire frames are specifically dedicated to certain DCCH transmissions. The
BCH channels are broadcast from the BTS to MSs in the coverage area of the BTS, and thus are oneway
channels. The broadcast channel operates on the forward link of a specific ARFCN within each cell, and
transmits data only in the first time slot (TS 0) of certain GSM frames.
The BCH provides synchronisation for all mobiles within the cell and is occasionally monitored by
mobiles in neighbouring cells so that received power and MAHO decisions may be made by out-of-cell
users. Although BCH data is transmitted in TS 0, the other seven time slots in a GSM frame for that same
ARFCN are available for TCH data, DCCH data, or are filled with dummy bursts. Furthermore, all eight
time slots on all other ARFCNs within the cell are available for TCH or DCCH data. There are three
separate broadcast channels that are given access to TS 0 during various frames of the 51-frame sequence.
(a) The Broadcast Control Channel (BCCH) is used by BTS to broadcast system parameters such as the
frequency of operation in the cell, operator identifiers, cell ID, and available services to all the MSs. Once
the carrier, bit, and frame synchronisation between the BTS and MS are established, the BCCH informs
the MS about the environment parameters associated with the BTS covering that area such as current
control channel structure, channel availability, and congestion. The BCCH also broadcasts a list of
channels that are currently in use within the cell. Frames 2 through frame 5 in a control multiframe (4 out
of every 51 frames) contain BCCH data. The BCCH is physically implemented over the Normal Burst
(NB). The BCCH is also a continuously keyed channel, and it is used for signal strength measurements
for hand-off.
(b) The Frequency Correction Control Channel (FCCH) is used by the BTS to broadcast frequency
references and frequency correction burst of 148 bits length. An MS in the coverage area of a BTS uses
the broadcast FCCH signal to synchronise its carrier frequency and bit timing. The FCCH is a special data
burst that occupies TS 0 for the very first GSM frame (Frame 0) and is repeated every ten frames within a
control channel multiframe. The physical Frequency Correction Burst (FCB) is used to implement the
logical FCCH.
(c) The Synchronisation Channel (SCH) is used by the BTS to broadcast frame synchronisation signals
containing the synchronisation training sequences burst of 64 bits length to all MSs. Using SCH, MSs
will synchronise their counters to specify the location of arriving packets in the TDMA hierarchy. SCH is
broadcast in TS 0 of the frame immediately following the FCCH frame and is used to identify the serving
base station while allowing each mobile to frame-synchronise with the base station. The frame number,
which ranges from 0 to 2,715,647, is sent with the Base Station Identity Code (BSIC) during the SCH
burst. The BSIC is uniquely assigned to each BTS in a GSM system. Since a mobile may be as far as 30
km away from a serving base station, it is often necessary to adjust the timing of a particular mobile user
such that the received signal at the base station is synchronised with the base station clock. The BSC
issues coarse timing advancement commands to the mobile stations over the SCH, as well. The SCH is
transmitted once every ten frames within the control channel multiframe. The physical Synchronisation
Burst (SB) is used to implement SCH.
The Common Control Channels (CCCH) are also one-way channels used for establishing links between
the MS and the BS, as well as for any ongoing call management. CCCHs are the most commonly used
control channels and are used to page specific subscribers, assign signaling channels to specific users, and
receive mobile requests for service. On the broadcast channel ARFCN, the common control channels
occupy TS 0 of every GSM frame that is not otherwise used by the BCH or the Idle frame. There are
three CCCH logical channels:
(a) The Paging Channel (PCH) is a forward link channel and is used by the BTS to page or notify a
specific individual MS for an incoming call in the cell. The PCH transmits the IMSI of the target
subscriber, along with a request for acknowledgment from the mobile unit on the RACH. Alternatively,
the PCH may be used to provide cell broadcast ASCII text messages to all subscribers, as part of the SMS
feature of GSM. The PCH is implemented on a Normal Burst (NB).
(b) The Random Access Channel (RACH) is a reverse link channel and is used by the MS either to access
the BTS requesting the dedicated channel for call establishment or to acknowledge a page from the PCH.
The RACH is used with implementation of a slotted-ALOHA protocol, which is used by MSs to contend
for one of the available slots in the GSM traffic frames. The RACH is implemented on the short Random
Access Burst (RAB). All mobiles must request access or respond to a PCH alert within TS 0 of a GSM
frame. At the BTS, every frame (even the idle frame) will accept RACH transmissions from mobiles
during TS 0. In establishing service, the GSM base station must respond to the RACH transmission by
allocating a channel and assigning a Standalone Dedicated Control Channel (SDCCH) for signaling
during a call. This connection is confirmed by the base station over the AGCH.
(c) The Access Grant Channel (AGCH) is used by the base station to provide forward link
communication to the mobile for implementation of the acknowledgement from the BTS to the MS after a
successful attempt by MS using RACH in a previous CCCH frame. AGCH is also used by the BS to send
information about timing and synchronisation to the MS. The AGCH carries data that instructs the mobile
to operate in a particular physical channel (time slot and ARFCN) with a particular dedicated control
channel. The AGCH is the final CCCH message sent by the base station before a subscriber is moved off
the control channel. This channel is implemented on a Normal Burst (NB) and indicates the TCH for
access to the GSM network.
The Dedicated Control Channels (DCCH) are two-way channels having the same format and function on
both the forward and reverse links, supporting signaling and control for individual mobile subscribers,
and are used along with voice channels to serve for any control information transmission during actual
voice communication. DCCHs may exist in any time slot and on any ARFCN except TS 0 of the BCH
ARFCN. There are three DCCH logical channels:
(a) The Stand-alone Dedicated Control Channel (SDCCH) is a two-way channel allocated with SACCH
to each mobile terminal to transfer network control and signaling information for call establishment and
mobility management, just before a TCH assignment is issued by the base station. The SDCCH ensures
that the mobile station and the base station remain connected while the base station and MSC verify the
subscriber unit and allocate resources for the mobile. The SDCCH is used to send authentication and alert
messages (but not speech) as the mobile synchronises itself with the frame structure and waits for a TCH.
SDCCHs may be assigned their own physical channel or may occupy TS 0 of the BCH if there is low
demand for BCH or CCCH traffic. The physical channel for SDCCH occupies four slots in every 51
control-multiframes with an approximated gross data rate of 2 kbps per mobile terminal.
(b) The Slow Associated Control Channel (SACCH) is a two-way channel always associated with a TCH
or a SDCCH and maps onto the same physical channel. The SACCH is used to exchange the necessary
parameters between the BTS and the MS during the actual transmission to maintain the communication
link. Each ARFCN systematically carries SACCH data for all of its current users. The gross data rate of
the SACCH channel is half of that of the SDCCH. On the forward link, the SACCH is used to send slow
but regularly changing control information to the mobile subscriber, such as transmit power level
instructions and specific timing advance instructions for each user on the ARFCN. The reverse SACCH
carries information about the received signal strength and quality of the TCH, as well as BCH
measurement results from neighbouring cells. The SACCH is transmitted during the thirteenth frame (and
the twenty-sixth frame when half-rate traffic is used) of every speech/dedicated control channel
multiframe, and within this frame, the eight time slots are dedicated to providing SACCH data to each of
the eight full-rate (or sixteen half-rate) users on the ARFCN.
(c) The Fast Associated Control Channel (FACCH) is a two-way channel used to support fast transitions
such as a hand-off request in the channel when SACCH is not adequate. The FACCH is physically
multiplexed with the TCH or SDCCH to provide additional support to the SACCH. In fact, FACCH is not
a dedicated control channel but carries the same information as SDCCH. However, FACCH is a part of
the traffic channel, while SDCCH is a part of the control channel. To facilitate FACCH to steal certain
bursts from the TCH forward channel burst, there are 2 flag bits, called the stealing bits in the message. If
the stealing bits are set, the time slot is known to contain FACCH data, not a TCH, for that frame.
Control information in GSM is mainly on two logical channels––the Broadcast Channel (BCCH) and the
Paging Channel (PCH). As with TDMA, it is unnecessary to use a whole RF channel for this. Instead, one
of the eight time slots on one RF channel in each cell or sector is designated as a control channel. The
broadcast information is transmitted first, followed by paging information. Figure 11.11 shows the
structure of a GSM logical control channel.
The corresponding reverse channel to the forward channels BCCH and PCH is called the Random-Access
Channel (RACH). It is used by the mobile subscribers to communicate with the cell-site. Mobile
subscribers transmit on RACH channel whenever they have information. Transmissions are shorter than
the duration of the time slot to prevent interference caused by the propagation delay between the mobile
and cell-site. The mobile subscriber equipment has only one receiver. It cannot count on receiving the
broadcast channel during a call because both channels may use the same time slot. It is necessary to send
control information

on the voice channels. There are two control channels associated with the voice channel. The slow
associated control channel uses one of every 26 bursts on the voice channel. It is used to inform the
serving cell-site about the measurements of the signal strength of adjacent cells made by the mobile
subscriber. The fast associated control channel steals bits from the voice signal and is used for urgent
messages from the cell-site such as hand-off instructions.
11.4.3 GSM Traffic Channels
Voice channels are called Traffic Channels (TCH) in GSM. Traffic channels are two-way channels
carrying the voice and data traffic between the MS and BTS. In the GSM standard, TCH data may not be
sent in TS 0 within a TDMA frame on certain ARFCNs that serve as the broadcast station for each cell
(since TS 0 is reserved for control channel bursts in every frame). Traffic channels carry digitally encoded
user speech or user data and have identical functions and formats on both the forward and reverse link.
One RF channel is shared by eight voice transmissions using TDMA. In terms of spectral efficiency,
GSM works out to 25 kHz per voice channel, compared to about 30 kHz for AMPS and about 10 kHz for
TDMA-based IS-54 or IS-136 systems. This is an approximate comparison as it ignores differences in
control-channel overhead. As in TDMA-based systems, the mobile transmitter operates only during its
allotted time slot. Assuming other parameters similar, a GSM mobile phone has longer battery life than a
phone using either AMPS or IS-54/IS-136 because GSM mobile transmits in one-eighth of the time,
compared with one-third of the time in TDMA-based IS-54/IS-136 system.

Figure 11.12 illustrates how the TCH data is transmitted in consecutive frames.
Furthermore, frames of TCH data are broken up every thirteenth frame by either Slow Associated
Control Channel Data (SACCH) or idle frames. Each group of twenty-six consecutive TDMA frames is
called a multiframe (or speech multiframe, to distinguish it from the control channel multiframe described
later). For every twenty-six frames, the thirteenth and twenty-sixth frames consist of Slow Associated
Control Channel (SACCH) data, or the idle frame, respectively. The twenty-sixth frame contains idle bits
for the case when full-rate TCHs are used, and contains SACCH data when half-rate TCHs are used.
TCH logical channels are implemented over the normal burst. There are two types of TCH channels: The
full-rate traffic channel (TCH/F) uses a 13 kbps speech-coding scheme and 9,600 bps, 4,800 bps, and
2,400 bps data. After including signaling overhead, each full-rate traffic channel has a gross bit rate of
22.8 kbps for the network. When transmitted as full-rate, user data is contained within one time slot per
frame. The following full-rate speech and data channels are supported:
Full-Rate Traffic Data Channel (TCH/F) The full-rate speech channel carries user speech that is
digitised at a raw data rate of 13 kbps. With GSM channel coding added to the digitised speech, the full-
rate speech channel carries 22.8 kbps.
Full-Rate Data Channel at 9600 bps (TCH/F9.6) The full-rate traffic data channel carries raw user data
that is sent at 9600 bps. With additional forward-error-correction coding applied by the GSM standard,
the 9600 bps data is sent at 22.8 kbps.
Full-Rate Data Channel at 4800 bps (TCH/F4.8) The full-rate traffic data channel carries raw user data
that is sent at 4800 bps. With additional forward-error-correction coding applied by the GSM standard,
the 4800 bps is sent at 22.8 kbps.
Full-Rate Data Channel at 2400 bps (TCH/F2.4) The full-rate traffic data channel carries raw user data
that is sent at 2400 bps. With additional forward error correction coding applied by the GSM standard, the
2400 bps is sent at 22.8 kbps. The half-rate traffic channel (TCH/H) uses 16 time slots per frame that has
a gross bit rate of 11.4 kbps (half of gross bit rate of full-rate traffic channel). The half-rate TCH supports
4800 bps and 2400 bps data rate only. When transmitted as half-rate, user data is mapped onto the same
time slot, but is sent in alternate frames. That is, two half-rate channel users would share the same time
slot, but would alternately transmit during every other frame. The following half-rate speech and data
channels are supported:
Half-Rate Traffic Data Channel (TCH/H) The half-rate speech channel has been designed to carry
digitised speech which is sampled at a rate half that of the full-rate channel. GSM anticipates the
availability of speech coders that can digitise speech at about 6.5 kbps. With GSM channel coding added
to the digitised speech, the half-rate speech channel will carry 11.4 kbps.
Half-Rate Traffic Data Channel at 4800 bps (TCH/H4.8) The half-rate traffic data channel carries raw
user data that is sent at 4800 bps. With additional forward-error-correction coding applied by the GSM
standard, the 4800 bps data is sent at 11.4 kbps.
Half-Rate Traffic Data Channel at 2400 bps (TCH/H2.4) The half-rate traffic data channel carries raw
user data that is sent at 2400 bps. With additional forward-error-correction coding applied by the GSM
standard, the 2400 bps data is sent at 11.4 kbps.
The cell-site instructs the mobile subscriber to advance or retard the timing of its transmissions to
compensate for the changes in propagation delay as it moves about in the cell. In this way, the
transmission delay problem is avoided on the traffic channels.
11.5 FRAME STRUCTURE FOR GSM
Transmission in any TDMA-based wireless communication system is in the form of a repetitive sequence
of frames. Each TDMA frame is divided into a number of uniform time slots. Each time slot position
across the sequence of frames forms a separate logical channel. It is very critical to determine the length
and composition of the logical channel time slot that will provide effective speech and data transmission
with efficient use of the available frequency spectrum. In designing an appropriate frame structure in
TDMA, the following requirements are generally considered:
Frequency Band of Operation The most common spectrum allocated to cellular mobile communication
applications is around 900 MHz.
Number of Logical Channels or Number of Time Slots in TDMA Frame In order to justify the
additional costs of multiplexing, let the minimum number of time slots per TDMA frame be 8 so as to
serve eight simultaneous users.
Channel Bandwidth The current channel bandwidth being used for analog FM cellular systems in
Europe is 25 kHz. To serve 8 mobile subscribers using TDMA technique, the channel bandwidth should
not exceed 200 kHz.
Maximum Cell Radius (R) To provide radio service to high traffic in rural areas, let the maximum cell
radius be 35 km.
Maximum Vehicle Speed ( Vm ) To accommodate mobile subscriber units traveling on expressways or
highspeed trains, the maximum vehicle speed be 250 km/h.
Maximum Delay Spread (Δm ) Delay spread is the difference in propagation delay among different
multipath signals arriving at the same Rx antenna. Typical delay spread in mountainous regions is about
10 seconds.
Maximum Coding Delay To avoid unnecessary delays within the fixed wireless network, which may
involve satellite links, maximum coding delay be approximately 20 milliseconds. Figure 11.13 suggests
the general steps to be considered in designing the time slot in a TDMA frame.
 In the design of time slot of a TDMA frame, an appropriate data rate of the speech coder should be
decided first. It is desirable that the speech coder must provide satisfactory speech quality at minimum
data rate. The PCM speech coder has a data rate of 64 kbps, which is undesirably high for use with
wireless systems. A data rate of 12 kbps is reasonable for reproducing good-quality speech. Since the
coding delay is restricted to 20 milliseconds, the encoded speech can be formed into blocks of 20 ms
duration. This converts the speech samples of 12 kbps × 20 ms = 240 bits.
Error correction can then be applied to the 240-bit blocks. Using a convolutional error-correcting
technique with a code rate of , the number of bits in a block of 20-ms speech at 12 kbps rate increases
to (2 × 240 bits =) 480-bits. With a constraint length of 5, 4 bits per block of 240 bits are added to
account for the length of the shift register. This brings the speech block length to (480 + 2 × 8 =) 488 bits.
With these parameters, the minimum bit rate for an eight-channel TDMA system can be computed as
follows:
Number of bits in one channel = 488 bits
Number of channels or time sots = 8
Total number of bits in 8 time slots = 488 bits × 8 = 3904 bits
Duration of one speech block = 20 ms
Overall minimum channel bit rate =3904 bits/20 ms = 195.2 kbps
To take care of other design considerations, the gross channel bit rate will be slightly higher, and
let it be greater than 200 kbps in the available channel bandwidth of 200 kHz. In a mobile radio
environment, such data rates can be achieved with the use of adaptive equalisation. Adaptive
equalisation will require the inclusion of a new training sequence in each time slot when the mobile
subscriber moves a sufficient distance to potentially cause changes in the characteristics of transmission
path. Assume that the phase angle of the carrier signal changes by λc /20 of the maximum vehicle
speed. Thus, at 900 MHz (λc = 0.333m),
we have Maximum transmission duration (one-way) = (λc / 20)/Vm
Maximum transmission duration (one-way) = (0.333m/20)/250 km/h
Maximum transmission duration (one-way) = 0.24 ms Or,
Maximum transmission duration (two-way) = 2 × 0.24 = 0.48 ms
Hence, Duration for data transmission in a time slot, d = 0.48 ms
Assuming the number of taps on the adaptive equaliser to be equal to 6 times the number of bits
transmitted in the maximum dispersal time (Δm = 0.01 ms), the amount of time needed for the training
sequence in the time slot, t = 0.06 ms.
 To account for the differing amounts of delay between different mobile units and the base
station, a guard interval is needed at the end of each time slot. Because eight mobile subscriber units
share the same TDMA frame, it is necessary to adjust the timing of the transmissions of the mobile
subscriber units so that the transmission from one mobile subscriber does not interfere with adjacent
time slots. The guard time can be computed as follows.
Let the average duration of the voice call = 120 seconds
Maximum vehicle speed of the mobile = 250 km/h
Therefore, the radial distance a mobile moving toward or away from the base station located at the
centre of the cell = (250 km/h) × (120 s) = 8333 m
The change in propagation delay = 8333 m/(3 × 108 m/s) ≈ 0.03 ms Or,
Required duration for guard interval, g = 0.03 ms Figure 11.14 shows the tentative design of a time slot,
depicting time duration of two blocks of data before and after the training sequence and guard time.

So, Maximum time duration of a time slot, Ts = Td + Tts + Tg

Maximum time duration of a time slot, Ts = 0.48 ms + 0.06 ms + 0.03 ms
Maximum time duration of a time slot, Ts = 0.57 ms
Number of time sots in a TDMA frame = 8 Duration of a TDMA frame = 8 × 0.57 ms = 4.6 ms
This is quite close to actual design of a TDMA time slot and frame structure used in GSM.
Fundamentally, each 200-kHz frequency band is divided into 8 logical channels defined by the repetitive
occurrence of time slots. The GSM system uses the TDMA scheme shown in Fig. 11.15 with a 4.615 ms-
long frame, divided into eight time slots each of 557 μs. Each frame is 156.25 bits long, of which 8.25 bits
are guard bits.
At the lowest level is the time slot or a burst period, which has a duration of approximately 577
μs. With a bit rate of 270.833 kbps, each time slot has a length of 156.25 bits. The time slot includes the
following fields:
Tail Bits, T (3 Bits each at the Beginning and End of a Time Slot Excluding Guard Bits) It allows
synchronisation of transmissions from mobile units located at different distances from the base station.
Encrypted Data (114 Bits) Data is encrypted in blocks by conventional encryption of 114 plaintext bits
into 114 ciphertext bits; the encrypted bits are then placed in two 57-bit data fields in the time slot.
Explain the concept of GSM superframe, multiframe, TDMA frame and time slot in a GSM channel.
Give suitable illustration for GSM frame hierarchy.
Stealing Bit, S (1 Bit each at the End of Two 57-Bit Data Fields in the Time Slot) It is used to indicate
whether this block contains data or is stolen for urgent control signaling purpose during the call.
Training Data (26 Bits) It is used to adapt the parameters of the receiver to the current path-
propagation characteristics and to select the strongest signal in case of multipath propagation. The
training sequence is a known bit pattern that differs for different adjacent cells. It enables the mobile
subscriber units and base stations to determine that the received signal is from the desired base station
and not from a strong interfering base station. In addition, the training sequence is used for multipath
equalisation, which is used to extract the desired signal from unwanted reflections.
Guard Bits, G (8.25 Bits) It is used to avoid overlapping with other bursts due to different path delays.
The 148 bits of a data burst are used to transmit the information. Delimited by tail bits (consisting of 0s),
the frame contains 26 training bits sandwiched between two bursts of data bits. These training bits
allow the receiver to synchronise itself.
Moving up the frame format hierarchy, 8-time slots TDMA frames are typically organised into a
26-frame multiframe. One of the frames in the multiframe is used for control/signaling and another is
currently unused, leaving 24 frames for data traffic. Thus, each traffic channel receives one slot per
frame and 24 frames per 120-ms multiframe.
The gross channel data rate can be calculated as follows:
Number of data bits per time slot = 114 bits
Number of time slots per multiframe = 24
So, Number of bits per multiframe = 24 × 114 bits = 2736 bits
Time duration of one multiframe = 120 ms
So, Gross data rate = 2736 bits/120 ms = 22.8 kbps
GSM uses a complex hierarchy of TDMA frames to define logical channels, as shown in Fig. 11.16.
The GSM specification also allows half-rate traffic channels, with two traffic channels each
occupying one time slot in 12 of the 26 frames. With the use of half-rate speech coders, this effectively
doubles the capacity of the system. There is also a 51-frame multiframe used for control traffic. Thus,
many frames are combined to constitute multiframe, superframe, and hyperframes.
EXAMPLE 11.5 Frame duration in GSM
GSM uses a frame structure where each frame consists of 8 time slots, and each time slot contains
156.25 bits and data is transmitted over a channel at 270.833 kbps. Find time duration of a bit; time
duration of a time slot; time duration of a TDMA frame; and how long must a user wait when occupying
a single time slot between two successive transmissions.

Solution Step 1. To find time duration of a bit, Tb Channel data rate = 270.833 kbps (given)
 Time duration of a bit, Tb = 1/Data rate Hence, time duration of a bit, Tb = 1/270.833 kbps = 3.69 s
Step 2. To find time duration of a time slot, Tslot No. of bits per time slot = 156.25 bits (given)
Time duration of a time slot, Tslot = 156.25 bits × Tb Time duration of a time slot, Tslot = 156.25 bits ×
3.69 μs = 577 s
Step 3. To find time duration of a TDMA frame, Tf
No. of time slots per TDMA frame = 8 (given)
Time duration of a frame, Tf = No. of time slots × Tslot Time duration of a frame,
Tf = 8 × 577 μs = 4.616 ms
Step 4. To find time duration for a user occupying a single time slot between two successive
transmissions
A user occupying a single time slot between two successive transmissions has to wait for the time
duration of a frame. Hence, a user has to wait for 4.616 ms between two successive transmissions.
11.5.1 Physical Data Bursts in GSM
Each user transmits a burst of data during the time slot assigned to it. GSM supports five types
of packet data bursts used for control and traffic signaling.
The normal burst, shown in Fig. 11.17, is used for TCH and DCCH transmissions on both the
forward and reverse link.
The normal burst consists of three bits each at the beginning and at the end of the data burst,
8.25 bits of guard period, two sets of 58 bits encrypted bits (a total of 116 bits), and a 26-bits training
sequence.
The start bits are 000 providing a gap time for the digital radio circuitry to cover the uncertainty
period to ramp on and off for the radiated power and to initiate the convolutional decoding of the data.
The 26-bit training sequence is used to train the adaptive equaliser at the receiver. The training of the
equaliser is in the middle of the burst because the channel behaviour is constantly changing during the
transmission of the data burst. The 116 encrypted data bits include 114 bits of data and two flag bits at
the end of each part of the data that indicates whether data is user traffic or signaling and control
information during the call.
The Frequency-Correction (FCCH) burst is used in TS 0 of specific frames to broadcast the
frequency synchronisation control messages by the BTS on the forward link. MSs use it to synchronise
with the master clock in the system. The frame format of the FCCH data burst is shown in Fig. 11.18.
The FCCH burst has three bits at the start and the end of the data field. The rest of the data
burst contains all 0s that allows transmission of the unmodulated carrier frequency. Guard period
equivalent to 8.25-bits duration is used between two bursts.
The synchronisation (SCH) burst, as shown in Fig. 11.19, is very similar to the normal burst
except that the training sequence is longer and the coded data are used for the specific task of
identifying the network. The SCH burst is used in TS 0 of specific frames to broadcast the frequency and
time synchronisation control messages on the forward link
The BTS broadcasts the SCH burst, and the MSs use it for initial training of the equaliser, initial learning
of the network identity and to synchronise the time slots. The random access (RACH) burst, as shown in
Fig. 11.20, is used by the MS to access the BS as it registers to the network.
The overall structure of the RACH data burst is similar to the normal data burst except that a longer start
bits and synchronisation sequence is used to initiate the equaliser. A much longer guard period of 68.25
bits allows approximate estimation of the distance of the MS from its serving BTS. The distance can be
computed from the arrival time of the RACH burst. A guard period of 68.25 bits translates to 252 μs. The
signal transmitted from a MS should travel more than 75.5 km (at the signal speed of 300,000 km/sec)
before arriving at the BTS to exceed this guard period.

The Concept of Time Slot in GSM Channel A time slot consists of 156.25 bits that are transmitted at a
rate of 270.833 kbps. In one time slot, 114 bits are encrypted data bits transmitted as two times 57 data
bits each. The training sequence in the middle of the time slot consists of 26 bits. It allows the adaptive
equaliser in the receivers of the base station and mobile unit to analyse the characteristics of the
wireless channel before decoding the user data. On either side of the training sequence, there are
control bits called stealing flags. The bit value of these two flags distinguishes the time slot to contain
either the voice or control information during the call.
The Concept of TDMA Frames in GSM Channel During a frame, one time slot is used to transmit only
and another time slot is used to receive only. The remaining six time slots of a frame can be used to
measure received signal level from its serving base station as well as that from up to five adjacent base
stations.
The GSM radio-interface standard provides a variety of control channels and traffic channels defined in a
hierarchy built upon the basic eight-slot TDMA transmission format. The frame hierarchy, depicted in
Fig. 11.23, shows the TDMA hierarchy of the GSM network from a normal data burst of 577 μs interval
to a hyperframe of length of around three-and-half hours. The basic building block of the GSM frame
hierarchy is a 4.615-ms TDMA frame. Each frame comprises of eight data bursts or time slots. The time-
slot interval is equivalent to the transmission time for about 156.25 bits, comprising of 114 bits user
data and the remaining overhead bits. A TDMA frame contains 8 × 156.25 bits = 1250 bits. The frame
rate is 270.833 kbps/1250 bits/frame = 216.66 frames per second.
The Concept of Multiframes in GSM Channel Each of the normal speech frames are grouped into larger
structures called multiframes, superframes and hyperframes. The 13th or 26th frames are used for
control data only. Each 120-ms multiframe is composed of 26 frames––24 frames carry user
information, and two frames carry system control information related to individual users. The gross data
rate per user is 24 × 114 bits / 120 ms = 22.8 kbps. The speech coder has a net data rate of 13 kbps, and
the addition of error-correction coding results into gross transmission data rate up to 22.8 kbps per user.
The eight-slot TDMA frames may be also organised into control multiframes. Control multiframes are
used to establish several types of signaling and control channels used for system access, call set-up,
synchronisation, and other system control functions. The control multiframes span 51 TDMA frames.
The Concept of Superframes in GSM Channel Either traffic or control multiframes are grouped into
superframes, which are in turn grouped into hyperframes. One traffic multiframe contains 26 frames,
and one traffic superframe contains 51 traffic multiframes, or 1326 frames. A hyperframe contains 2048
superframes, or 2,715,648 frames. A complete hyperframe takes about every 3 hours, 28 minutes, and
54 seconds. The encryption algorithms rely on the particular frame number, and sufficient security can
only be obtained by using a large number of frames as provided by the hyperframe. Counters at the
mobile subscribers need to track the frame numbers at hyperframe, superframe, and multiframe levels
to communicate with the network.
11.8 GSM CALL PROCEDURES
There are three mechanisms of call establishment which are embedded in all voice-oriented
cellular communication networks that allow a mobile subscriber to establish and maintain a connection
with the network. These mechanisms are registration of the mobile subscriber, call establishment, and
hand-off procedures. Registration takes place as soon as the mobile subscriber unit is switched on. Call
establishment occurs when the mobile subscriber initiates or receives a call. Hand-off mechanism
enables the MS to change its connection link from one part of the network to another part.
11.8.1 Registration For an MS to operate in an MSC, it must be registered by accessing the BTS. The
MSC assigns a TMSI to the MS and updates the information in VLR and HLR. Whenever the MS is
switched on, there is a need to possibly establish a new registration with the cellular network.
Sometimes a mobile subscriber is required to connect to the cellular network at different locations
through a BS that may not be owned by its home service provider. Technically speaking, the MS
passively synchronises to the frequency, bit, and frame timings of the nearest BS to get ready for
information exchange.
The MS receives the cell identity, and system parameters determine its location in the cellular
network. If the present location is not the same as before, the MS initiates a registration procedure.
During a registration procedure, the system provides the MS with a control channel for preliminary
signaling. The MS provides its own identity, and finally the system authenticates the MS.
The MS registration process is described in Table 11.3 when a mobile subscriber is switched on
in a new MSC area.
Firstly, a radio communication link is established between the MS and BTS to process the
registration. It is followed by an authentication process by the system, and assignment of TMSI. Records
are updated in the VLR and HLR. After successful registration, the temporary radio communication link is
released.
 In the mobile communication environment, there are two separate call-establishment
procedures for mobile-to-network and network-to-mobile calls. Mobile-to-mobile calls are a
combination of these two. The detailed procedure for both types of call establishment in the GSM
network is described next.
11.8.2 Mobile-to-Network Call
The mobile subscriber monitors the BCH and gets synchronised to the nearest base station. By
receiving the BCCH, FCCH, and SCH messages, the mobile subscriber is locked on to the system. To
initiate a call, the mobile subscriber first dials the called subscriber number and presses the send button
on the GSM mobile phone. The mobile subscriber transmits a burst of RACH data on the same ARFCN as
the base station. The base station then responds with an AGCH message on the CCCH which assigns the
mobile subscriber to a new channel for SDCCH connection. The mobile subscriber, receives its ARFCN
and TS assignment from the AGCH on TS 0 of the BCH, and then immediately shifts to the new ARFCN
and TS. The step-by-step procedure for mobile-originated call establishment is described in Table 11.4.

The mobile subscriber first waits for the SACCH frame on the SDCCH, to inform the mobile subscriber of
any required timing advance and transmitter power command. The mobile subscriber is now able to
transmit normal burst messages as required for speech traffic. The SDCCH sends messages such as
authentication and user validation between the mobile subscriber and the base station. The PSTN
connects the called landline subscriber to the MSC. The MSC switches the voice connection to the
serving base station. The mobile subscriber receives a command by the base station via the SDCCH to
retune to a new ARFCN and TS for the TCH assignment. Speech data is transferred on both the forward
and reverse channels, and the SDCCH is released.
11.8.3 Network-to-Mobile Call To make a call from a landline telephone subscriber, the call-request
information is processed through the gateway MSC to the destination MSC after getting the information
from the home HLR of the called mobile subscriber. Then the called mobile subscriber is contacted
through the BSS. The base station broadcasts a PCH message on the BCH. The mobile subscriber locks on
to the same ARFCN, decodes its page and responds with an RACH message. The base station then uses
the AGCH on the CCCH to assign the mobile subscriber unit to a new channel for connection to the
SDCCH and SACCH while the network and the serving base station are connected. Once the subscriber
establishes timing advance and authentication on the SDCCH, the base station assigns the TCH. As
shown in Fig. 11.29, the PSTN directs the call initiated by the calling landline telephone subscriber to the
MSC identified by the dialed phone number of the called mobile subscriber.
The MSC requests routing information from the HLR. Since the mobile subscriber is roaming in
the area of a different MSC, the gateway MSC contacts the destination MSC. The VLR initiates a paging
procedure in all BSSs under the control of the MSC. After getting response from the MS, the VLR sends
the necessary system parameters to the MSC to establish the link to the MS.

EXAMPLE 11.8 GSM Layer III sublayer categories used for call establishment
Illustrate the step-by-step procedure for mobile-initiated call-establishment procedure, giving the type
of logical channel used along with sublayer categories of GSM Layer III.
Solution Table 11.5 shows the mobile-initiated call-establishment procedure. The second column
identifies the action taken or the message type. The third column identifies the logical channel that is
used to carry the message. The fourth column identifies the sublayer of the Layer III in which GSM
standard describes the message. Note that Layer III does not handle the traffic message, and therefore
there is no sublayer associated for that part of the procedure.
11.9 GSM HAND-OFF PROCEDURES
Hand-off is usually initiated because of signal strength deterioration at the edge of a cell
boundary. Hand-off in GSM is divided into four major categories:
(a) Intracell-Cum-Intra-BTS Hand-off This type of hand-off is necessary when high interference occurs
during the call. The channel for the connection is changed within the cell by moving to another
frequency of the same cell or to another time slot of the same frequency. The hand-off process is
initiated by the base station.
(b) Intercell-Cum-Intra-BSC Hand-off In this type of hand-off, the change is in the radio channel
between two cells that are served by the same BSC. Initially, the hand-off request is initiated by the
serving BSS to the MSC. The MSC transmits the hand-off request to the destination BSS. After receiving
acknowledgement, the MSC gives the hand-off command. The mobile subscriber transmits a hand-off
complete message to the new BSS, which relays it to the MSC for releasing the earlier occupied channel.
(c) Inter-BSC-Cum-Intra-MSC Hand-off A call connection is changed between two cells that are served
by different BSCs but operate in the same MSC. When the measured value of the received signal
strength at the mobile subscriber is lower than the threshold value, it informs the serving BSC which
initiates the hand-off command to the MSC of that area. The MSC relays the hand-off request to the
BSC, which sends a channel activation request to its BTS. It is then possible for the hand-off call to be
handled in the new MSC.
The BTS provides the MS with a list of available channels in neighbouring cells via the BCCH. The
mobile subscriber monitors the received signal strength from the BCCHs of these neighbouring cells and
reports these measured data to the MSC using the SACCH. This is called mobile-assisted hand-off. The
BTS also monitors the received signal strength from the mobile subscriber to make a hand-off decision.
The MSC negotiates a new channel with the new BSS and indicates to the mobile subscriber that a hand-
off should be made using a hand-off command. Upon completion of the hand-off, the mobile subscriber
confirms with a hand-off complete message to MSC. Figure 11.30 shows the hand-off procedure
between two BSSs that are controlled by one MSC.
(d) Inter-MSC Hand-off A connection is changed between two cells that are in different MSCs. This
situation occurs in case of roaming. This hand-off occurs wherein the home MSC is notified of the hand-
off condition through the PSTN, and the home MSC sends the necessary data to the new MSC through
the PSTN again.
11.10 GSM SERVICES AND FEATURES
GSM is an integrated voice-data service that provides a number of value-added services. A
telecommunication service supported by the GSM is defined as a group of communication capabilities
that the service provider offers to the mobile subscribers. As per ISDN guidelines, GSM services are
classified mainly into three categories: telephone services or teleservices, data or bearer services, and
supplementary ISDN services.
Teleservices provides the mobile subscribers with necessary capabilities which enable them to
communicate with other subscribers. Bearer services give the mobile subscribers the capacity required
to transmit appropriate signals between network access points. Supplement services supplement basic
teleservices and are offered together or in association with other services. Table 11.6 lists the GSM
services.
 Telephone services provide full-duplex voice communication applications between the calling
and called subscribers according to a standard protocol.
Data or bearer services provide capabilities to transmit information among user-network-
interfaces. Traditional bearer services include a variety of asynchronous and synchronous data access to
PSTN/ISDN and packet switched public data networks either in a transparent mode (where GSM
provides standard channel coding for the user data) or nontransparent mode (where GSM offers special
coding efficiencies based on the particular data interface).
Supplementary ISDN services are not standalone services but they are digital signaling services
that supplement telephone services or data services. Short Messaging Service (SMS) allows GSM
subscribers and base stations to transmit alphanumeric pages of limited length (160 7-bit ASCII
characters). SMS also provides cell broadcast, which allows GSM base stations to repetitively transmit
messages with as many as fifteen 93-character strings in a concatenated fashion. SMS may be used for
advertisement, safety, and advisory applications including broadcast of highway traffic conditions or
weather information to all GSM subscribers within reception range

11.10.1 Short Message Service (SMS) The Short Message Service (SMS) is the ability to send or receive a
text message to or from mobile subscriber phones. GSM system supports SMS messages using unused
available bandwidth and has several unique features. These features include automatic confirmation of
message delivery. SMS can be transmitted and received simultaneously with voice, data, or fax calls.
This is possible because voice/data/fax calls utilise dedicated voice channels for the duration of the call,
while short messages occupy the control channels.
SMS is basically a store and forward service. If the recipient mobile subscriber is not available,
the message can be stored with the system. Each mobile cellular network that supports SMS has one or
more messaging centres to handle and manage the short messages. This means that SMS message is not
sent directly from a sender to the receiver but always processed via an SMS centre at MSC.
A single SMS can be up to 160 characters of text in length. The characters may comprise of a
combination of words, numbers, or alphanumeric characters. Nontext-based SMSs (binary format) are
also supported. There are ways of sending multiple SMSs also. For example, SMSs concatenation and
SMS compression within single short message features are available.
Table 11.6 GSM services

11.10.2 GSM Service Quality Requirements

The GSM standards specify various requirements on the quality of service delivered to the
mobile users. Some of these service requirements are
– The time from switching to service ready of 4 seconds in the home service area
– The time from switching to service ready of 10 seconds in the visiting service area
– A connect time of 4 seconds to the called network
– A release time of 2 seconds to the called network
– The time to alert a called mobile subscriber of an incoming call of 4 seconds in the first
attempt and 15 seconds in the subsequent attempts
– A maximum time gap due to hand-off of 150 ms in intercell handover
– A maximum time gap due to hand-off of 100 ms in intracell handover
– A maximum one-way speech delay of 90 ms – An intelligibility of speech of 90%
– Probability of call release failure rate of less than 0.02%
 – Probability of misconnection, incorrect charging, no tone or similar failure of less than 0.01% –
Probability of losing HLR/VLR messages of less than 0.000001%
– Mean accumulated downtime for one cell-site of less than 30 minutes per year
On the average, a fault that causes more than 50% of the established calls to be disconnected
prematurely will occur less than once a year. The service availability of an MSC is expressed in terms of
the frequency or duration of loss of service. The loss of service to particular switching circuits, groups of
switching circuits, subsystems, or the complete MSC is determined by the nature of faults in the MSC.
The average cumulative duration of service denial due to faults affecting more than 50% of the switching
circuits will not exceed three minutes during the first year of operation and two minutes during each
subsequent year.
11.10.3 Power Classes in GSM Power management in the system helps the service provider to control
the interference among the mobile subscribers and minimise the power consumption at the mobile unit.
Therefore, power management has direct impact on quality of service and the battery life. There are
three major classes of mobile phones: vehicle mounted, portable, and handheld mobile phones. Vehicle-
mounted mobile phones use the car battery, portable mobile phones use larger rechargeable batteries,
and handheld mobile phones use low-capacity smaller rechargeable batteries. The antenna for the
vehicle-mounted mobile phones is mounted outside the car, which is away from the user’s body. The
antenna for the portable mobile phones is mounted along with the transceiver.
GSM cells have radii ranging from 300 m to 35 km. The size of the cell determines the required
transmitted power for the BTS and the MS. To allow manufacturers and service providers to
accommodate the diversified requirements for different BTS and MS, a number of radiated power
classes are identified by the GSM standard. There are five power classes for the mobile phones from +29
dBm (0.8 W) up to +44 dBm (20 W) with a 4-dB separation between consecutive mobile classes. There
are eight classes for the BTS radiated power ranging from +34 dBm (2.5 W) up to +55 dBm (320 W) in 3-
dB steps.
EXAMPLE 11.9 GSM transmitter powers
Tabulate the transmitter powers EIRP (watts) for all classes of GSM base stations and mobile stations.
Solution Table 11.7 shows EIRP levels for all eight classes of GSM base stations and five classes of GSM
mobile phone equipments.

The mobile subscriber Tx power is always controlled to its minimum required value to minimise the
interference and maximise the battery life. Power adjustments in both directions are made using
closedloop power control. The mobile subscriber is allowed to reduce its peak output power down to 20
mW in 2 dB steps. The BSS calculates the optimum Tx power level for individual mobile subscribers by
monitoring certain metrics of performance such as the received signal power level, received signal-to-
noise ratio, or received bit error rate, and sends this information through control signaling packets to
the mobile subscriber.
11.10.4 Frequency Hopping in GSM
In voice-oriented cellular networks, corrupted data packets are either discarded or retained with
incorrect value. In both these cases, distortion occurs in the voice signal at the receiver. If the frequency
channel coincides with a deep frequency selective fading or when the cochannel interference is
excessive, the distortion in the received voice signal will persist until the mobile subscriber moves to
some other location such that the frequency selective fading pattern is changed or the cochannel
interference is reduced.
One method to reduce the effect of the frequency selective fade or excessive cochannel
interference is to provide for a slow frequency-hopping pattern. This option is exercised in the GSM
system that supports an optional frequency-hopping pattern of 217.6 hops per second. When multipath
fading is a problem, the GSM system allows for frequency hopping. All GSM mobile phones are capable
of frequency hopping, but only those cells that are located in areas of severe fading are designated as
hopping cells. The system can hop only among the frequencies that are assigned to the cell, so there will
be only a few hopping possibilities. Thus GSM is not really a true spread-spectrum system, but rather a
TDMA/FDM system with some spreadspectrum capability added on.
EXAMPLE 11.10 Maximum frequency hopping in GSM
In Europe, GSM uses the frequency band of 890 to 915 MHz for uplink transmission, and the frequency
band of 935 to 960 MHz for downlink transmission. Determine the maximum frequency hop from one
frame to the next for uplink transmission and downlink transmission. Express it as a percentage of the
mean carrier frequency.
Solution Step 1. To find RF bandwidth for uplink transmission
Frequency band for uplink transmission = 890 MHz – 915 MHz (given)
RF Bandwidth for uplink transmission = 915 – 890 = 25 MHz
Step 2. To find RF bandwidth for downlink transmission
Frequency band for downlink transmission = 935 MHz – 960 MHz (given) RF Bandwidth for downlink
transmission = 960 – 930 = 25 MHz
Step 3. To find maximum frequency hop Therefore, in either case, the maximum frequency hop or
change from one frame to the next could be 25 MHz.
Step 4. To express maximum frequency hop in %age.
For uplink transmission,
Mean carrier frequency = 890 + (915 – 890)/2 = 902.5 MHz
Maximum frequency hopping = 25/902.5
Hence, maximum frequency hopping = 0.0277 or 2.77%
For downlink transmission, Mean carrier frequency = 935 + (960 – 935)/2 = 947.5 MHz
Maximum frequency hopping = 25/947.5
Hence, maximum frequency hopping = 0.0264 or 2.64%
The maximum RF spectrum bandwidth for uplink or downlink transmission is 25 MHz. Expressed as a
percentage of the mean carrier frequency of 900 MHz, the maximum frequency hopping for the
downlink is approximately 25/900 × 100 = 2.8%. With this percentage of maximum frequency hopping, it
turns out that the time spent by a rapidly moving mobile user in a deep fade is reduced to about 4.6 ms.
This incidentally matches with the frame duration. In the case of slowly moving mobile subscribers such
as pedestrians, the frequency-hopping algorithm produces substantial gains against fades. Each
successive frame in a given channel is carried on a different carrier frequency. Thus, the transmission
frequency is changed once every 4.615 ms.