Training GSM System Overview

Version 1.020th Oct 2005

GSM System Architecture

GSM System Architecture

The Network Switching System Mobile Switching Center (MSC)

Setting up, routing and supervising calls to and from the mobile subscriberCollecting the charging dataService provisioning

Gateway Mobile Switching Center (GMSC) The GMSC is an MSC serving as an interface between the mobile network and other networks such as the PSTN and ISDN. GMSC has functions for rerouting a call to the MS according to the location information provided by the HLR

Home Location Register (HLR)The HLR database stores and manages all mobile subscriptions belonging to a specific operator.

Subscriber identity– International Mobile Subscriber Identity– Mobile station ISDN number

Subscriber supplementary servicesLocation information

– Visitor Location Register Address Subscriber authentication information

HLR can be implemented with the MSC or as a stand-alone database

The Network Switching System (2)Visitor Location Register (VLR)

The VLR contains information from a subscriber's HLR The VLR temporarily stores information about the MS currently visiting its service area.

Status of MS (attached or not)Current Location Area of MS

– The VLR will then have enough information in order to assure the subscribed services without needing to ask the HLR each time a communication is established.

Each MSC has own VLRAuthentication Centre (AUC)

Used to protect operators against fraudSubscriber authentication Ciphering transferred information in radio interface

Equipment Identity Register (EIR)Used to detect stolen and unauthorised mobile

GSM Interworking Unit (GIWU) The GIWU corresponds to an interface to various networks for data communications

Base Station Subsystem

TRanscoder Controller (TRC)TRC is to multiplex network traffic channels from multiple BSCs onto one 64 Kbit/s PCM channel, which reduces network transmission costs. The TRC can be combined with the BSC or exist as a stand-alone node.

Base Station Controller (BSC)The BSC controls a group of BTS and manages their radio resources. A BSC is principally in charge of handovers, radio channel assignment, frequency hopping, exchange functions and control of the radio frequency power levels of the BTSs.

Radio Base Station (RBS)The RBS controls the radio interface to the MS. The RBS comprises the radio equipment such as transceivers and antennas, which are needed to serve each cell in the network

Operation and Maintenance Center

Network Management Center (NMC)Centralized control of a network is done at a Network Management Center Only one NMC is required for a network and thiscontrols the OMCs.

Operation and Maintenance Center (OMC)An OMC is a computerized monitoring center, which is connected to other network components such as MSCs and BSCs via X.25 data network links. In the OMC, the staff is presented with information about the status of the network and can monitor and control a variety of system parameters.

Operation and Support System (OSS)Operation and Support System (OSS) is Ericsson’s product to support the activities performed in an OMC and/or NMC. The network operator monitors and controls the network through OSS, which offers support for centralized, regional and local operations and maintenance activities.

Identity Numbers

Identity numbers allow communications to take place Globally. They relate to:

Mobile Station (SIM Card and Mobile equipment)Network Location

Mobile Station Identity NumbersMSISDN: Mobile Station ISDN (Number dialed to reach a mobile station)

MSISDN= CC + NDC + SNCC = Country codeNDC = National Destination NumberSN = Subscriber Number

Number is in national or international format:012 3776434+ 60 12 3776434

IMSI: International Mobile Subscriber Identity (Number that identifies a subscriber)

IMSI = MCC + MNC + MSINMCC = Mobile Country Code (three digits)MNC = Mobile Network Code (two digits)MSIN = Mobile Subscriber Identification Number (ten digits)

IMEI: International Mobile Station Equipment Identity (Verifies MS is type approved and not stolen)MSRN: Mobile Station Roaming Number (Used to route a call to the serving MSC/VLR service area)

CC = of the currently visited network NDC = of the visited network SN = in the current mobile network

TMSI: Temporary Mobile Subscriber Identity (Keeps the subscriber’s IMSI confidential)

Location Identity NumbersThree types of Location Numbers are used by some of the nodes to perform different actions:

BSIC: Base Station Identity CodeIn order to distinguish neighboring base stations, a unique BSIC is used which consists two components:

– Network Color Code (NCC): color code within a PLMN (3 bits)

– Base Station Color Code (BCC): BS color code (3 bits) The BSIC is broadcast periodically by the BTS on the SCH.

LAI: Location Area IdentityEach location area of a PLMN has its own identifier. The LAI is also structured hierarchically and internationally unique:

– Country Code (CC): 3 decimal digits – Mobile Network Code (MNC): 2 decimal digits – Location Area Code (LAC) maximum 5 decimal digits, or maximum twice 8

bits, coded in hex

CGI: Cell Global IdentityCells are uniquely identified with a Cell IdentifierTogether with the LAI, cells are internationally defined in a unique way

Subscriber Data in GSM Identity Numbers and Network Elements

Radio InterfaceFrequencies:

GSM900GSM1800

F_RX = 1710.2 + (n-512) * 0.2 in MHZ , n =512 to 885.F_TX = F_RX + 95 MHZ

Modulation: GSM uses GMSK (Gaussian Minimum Shift Keying) for modulation on the radio channel

Transmission on the Radio Channels A GSM frequency channel subdivided into 8 different time slots numbered from 0 to 7. The length of a TS is 0.577ms Each of the 8 time slots is assigned to an individual user TDMA frame = 8 time slots. The length is 4.615 ms

Bursts and Frames

BurstsNormal Burst (NB)

used to transmit information on traffic and control channels

Frequency Correction Burst (FB)used for the frequency synchronization of an MS

Synchronization Burst (SB) used to transmit information which allows the MS to synchronize time-wise with the BTS.

Dummy Burst (DB) This ensures that BCCH transmits a burst in each time slot which enables the MS to perform signal power measurements of the BCCH

Access Burst (AB) used by BTS to make a preliminary rough estimate on timing advance setting

Logical ChannelsA logical channel carries signaling data or a user’s dataClassification of logical channels in GSM

Broadcast Channels

Bi-directional TCHUnidirectional, downlink BCH

Full-rate channel TCH/FS, or Bm

Broadcast Control Channel BCCH

Half-rate channel TCF/HS, or Lm

Synchronization Channel SCH Frequency Correction Channel FCCH

Traffic Channels

Random Access Channel RACH

Access Grant Channel AGCH

Paging Channel PCH

Standalone Dedicated Control Channel SDCCH

Slow Associated Control Channel SACCH

Fast Associated Control Channel FACCH

Signaling Channels

Unidirectional, Down-or Uplink CCCH Bidirectional DCCH

Common Control Chs Dedicated Control Chs

Frame Structures

26 TDMA frames multiframe

used mainly for payload - speech

and data(TCH, SACCH,

FACCH)

51 TDMA frames

multiframe mainly used for

signaling (BCCH, CCCH,

SDCCH, SACCH, FCCH,SCH)

A superframe consists of 1326 consecutive TDMA frames

hyperframe is divided into 2048 superframes

Beginning of Digital Communication

The analog speech signal at the transmitter is sampled at a rate of 8000 samples per second

Quantization

The 8000 samples per second, are quantized with a resolution of 13 bits. This corresponds to a bit rate of 104 Kbps for the speech signal. At the input to the speech codec, a speech frame containing 160 samples of 13 bits arrives every 20ms

Speech & Channel CodingSpeech Coding

The speech signal is divided into blocks of 20 ms. The speech codec compresses this speech signal into a source-coded speech signal of 260-bit blocks at a bit rate of 13 Kbps. Thus the GSM speech coder achieves a compression ratio of 1 to 8.

Channel Codingadds redundancy bits to the original information in order to detect and correct, if possible, errors occurred during the transmission The BER of the mobile radio channel is often very high, in the order of 10^-3 to 10^-1 Suitable error correction procedures are therefore necessary to reduce the bit error probability into an acceptable range of about 10^-5 to 10^-6. An output block of 456 bits is finally obtained by the convolutional code and is then passed to the interleaver

Channel Coding Example: GPRS Throughput Calculations

Coding Scheme N (number of bytes) RLC Payload data block sizeCS-1 23 20CS-2 33 30CS-3 39 36CS-4 53 50

Table 2. The size of the Radio Block for each Coding Scheme

Coding Radio Spare Bids USF RadioBlock size Precoded BCS Tail RadioBlock TotalScheme Block Size Added excl. USF USF number of bits

CS-1 23*8 0 3 23*8+0-3=181 3 40 4 181+3+40+4=228CS-2 33*8 7 3 33*8+7-3=268 6 16 4 268+6+16+4=294CS-3 39*8 3 3 39*8+3-3=312 6 16 4 312+6+16+4=338CS-4 53*8 7 3 53*8+7-3=428 12 16 0 428+12+16=456

Table 3. Structure of Radio Block prior to Channel Coding

Coding RadioBlock Total Total no of bits Punctured No of bits toScheme number of bits after coding bits Send

CS-1 228 228*2=456 0 456-0=456CS-2 294 294*2=588 132 588-132=456CS-3 338 338*2=676 220 676-220=456CS-4 456 456*1=456 0 456-0=456

Table 4. Channel Coding Radio Blocks, each 456 bits in length

CS-1,-2,-3 use the same channel coder as GSM signaling (BCCH, SACCH, FACCH etc.CS-4 Leaves Uncoded

Equivalent to

speech

InterleavingInterleaving is the processes of rearranging the bits.It allows the error correction algorithms to correct more of the errors that could have occurred during transmission. By interleaving the code, there is less possibility that a whole chuck of code can be lost.

Interleaving ExampleWe need to transmit 20 bits. Furthermore, 10 bits can be transmitted in one transmission burst, and the error correcting mechanism can correct 3 errors per 10 bits. We need to transmit 20 bits. Furthermore, 10 bits can be transmitted in one transmission burst, and the error correcting mechanism can correct 3 errors per 10 bits. Take a look at the following two scenarios:With interleaving the receiver is able to get all 20 bits correctly but without interleaving we lose 1 complete burst.

Interleaving (II)In GSM the interleaving is much more complicated The 456 bits outputed by the convolutional encoder are divided into 57 bit blocks Selects:

the 0th, 8th, 16th through 448th bits in the first block, the 1st, 9th 17th through 449th bits in the 2nd block and so on to have 8 blocks

Then the bits in the first 4 blocks are placed in the even bit positions for the total block of 456 bits, and the bits in the second set of 4 blocks are placed in the odd positions

One Disadvantage for speech and data communication code words are spread across several bursts. For a complete reconstruction of a code word, one has to wait for the complete transmission of several bursts. This forces a transmission delay, which is a function of the interleaving depth. In GSM, with a maximal interleaving depth of 19, this can lead to delays of up to 360 ms.

Interleaving (III)

GSM protocol architecture for signaling

Um

Abis

AB

C

MS to BTS UmBTS to BSC AbisBSC to MSC AMSC to VLR BMSC to HLR CMSC to MSC EMSC to EIR FVLR to VLR GVLR to HLR D

Interfaces

A and Abis InterfacesThe A interface: between MSC and the BSS.

The signaling is done according to the BSSAP protocol. BSSAP uses the Message Transfer Part (MTP) and the Signaling Connection Control Part (SCCP). The BSSAP messages can be divided into two categories, transparent messages sent to the MS and non transparent sent to the BSC. For more information see 3GPP Technical Specification 48.008

The Abis interface: between the BSC and BTS The protocol LAPD is used on layer 2. At layer 3 some messages pass the BTS transparently. However, some Radio Resource management (RR) messages are not handled transparently by the BTS, e.g. ciphering and channel activation. For more information 3GPP Technical Specification 48.058

.

Um InterfaceThe Um interface: between the BTS and MS.

Layer 2 protocol on Um is called LAPDm and is a modified LAPD protocol. Layer 3 is divided into three sub layers,

Radio Resource management (RR), Mobility Management (MM) Connection Management (CM).

CM and MM messages are sent transparently between the MSC and the MS.

(RR) Layer 3 Messages (I)RR: Radio Resources Management

The role of the RR function is to establish, maintain and release communication links between MS and the MSC Some of the main RR procedures that assure its responsibilities are:

Channel assignment, change and release. Handover, (4Types)

– Handover of channels in the same cell. – Handover of cells controlled by the same BSC. – Handover of cells belonging to the same MSC but controlled by

different BSCs. – Handover of cells controlled by different MSCs.

» Handovers are mainly controlled by the MSC. However in order to avoid unnecessary signaling information, the first two types of handovers are managed by the concerned BSC (in this case, the MSC is only notified of the handover).

Frequency hopping. Power-level control. Discontinuous transmission and reception. Timing advance.

(RR) Layer 3 Messages (II)RR: Radio Resources Management

Some of the remaining RR procedures that assure its responsibilities are:

Monitoring of BCCH and PCH (readout of system information and paging messages) RACH administration: MS send their requests for connections and replies to paging announcements to the BSS Requests for and assignments of data and signaling channels Periodic measurement of channel quality (quality monitoring) Transmitter power control and synchronization of the MS Handover, always initiated by the network Synchronization of encryption and decryption on the data channel

(MM) Layer 3 MessagesMM: Mobility Management (MM).

The MM function is in charge of all the aspects related with the mobility of the user

Location management – Location Updates, message sent to new MSC/VLR

» IMSI Attach» New Location Area» Periodic» IMSI Detach (tell the network that it is no longer connected )

Authentication and security The authentication procedure involves the SIM card and the Authentication Center

The mobile station and the AuC compute a SRES using the secret key, the algorithm A3 If the two computed SRES are the same, the subscriber is authenticated The different services to which the subscriber has access are also checked

(CM) Layer 3 MessagesCM: Communication Management (CM). The CM function is responsible for:

Call control. The CC is responsible for: Establishment of normal calls (MS-originating and MS-terminating) Establishment of emergency calls (only MS-originating) Termination of calls Dual-Tone Multifrequency (DTMF) signaling Call routing functions, to reach a mobile subscriber, MSISDN

Supplementary Services management. The mobile station and the HLR are the only components involved with this function:

– Call Forwarding, Call Barring, Call hold, Call Waiting, Advice of Charge, Multiparty service, Closed User Group, Calling Line Identification Presentation, etc..

Short Message Services management.In order to support these services, a GSM network is in contact with a Short Message Service Center through the two following interfaces:

– The SMS-GMSC for Mobile Terminating Short Messages (SMS-MT/PP). It has the same role as the GMSC.

– The SMS-IWMSC for Mobile Originating Short Messages (SMS-MO/PP).

Layer 3 Messages, Summary

RR messages are mainly exchanged between MS and BSS.

CM and MM functions are handled exclusively between MS and MSC.

RR messages have to be transported over the Um and Abis interfaces,

CM and MM messages need additional transport mechanisms across the A interface.

Summary of Layer 3 Messages

Call Process Flow Charts

RR connection establishment

Paging Request

Paging CommandPaging

Channel RequestChannel Required

Channel Activation

Ch ActAcknowledge

Imm AssCommand

ImmediateAssignment

MS BTS BSC MSC

RR (PCH)

RR (RACH)

RR (AGCH)

MS Originated Call

Establishment

MS Call Termination

Setup

Location Updating, flow chartHLRMSC/VLRBSCMS

SCCP-CR(LOC UPD REQ)

(BSSMAP)

AUT REQ(DTAP)

(DTAP)AUT RES

CHAN REQ.

IMM ASSIGN

LOC UPD REQ

SCCP-CC

CIPH MODE CMD

(BSSMAP)

CIPH MODE COM

(BSSMAP)TMSI REALLOCATION CMD

(DTAP)TMSI REALLOCATION COM

(DTAP)

(DTAP)

CIPH MODE CMD

CIPH MODE COM

LOCATION UPDATING ACCEPTED

INSERT SUB DATA

UPDATE LOCATION

INSERT SUB DATA

UPDATE LOCATION

CLEAR CMD

(BSSMAP)

CLEAR COM

(BSSMAP)

CHAN RELEASE

SCCP RLC

SCCP RLSD

(MAP)

(MAP)

(MAP)

(MAP)

(MAP)

(MAP)

INFORMATIONSEND AUTH.

INFORMATIONSEND AUTH.

Location Updating, flow chartHLRMSC/VLRBSCMS

SCCP-CR(LOC UPD REQ)

SCCP-CR(LOC UPD REQ)

(BSSMAP)

AUT REQ(DTAP)

(DTAP)AUT RES

CHAN REQ.

IMM ASSIGN

LOC UPD REQ

SCCP-CC

CIPH MODE CMD

(BSSMAP)

CIPH MODE COM

(BSSMAP)TMSI REALLOCATION CMDTMSI REALLOCATION CMD

(DTAP)TMSI REALLOCATION COMTMSI REALLOCATION COM

(DTAP)

(DTAP)

CIPH MODE CMD

CIPH MODE COM

LOCATION UPDATING ACCEPTEDLOCATION UPDATING ACCEPTED

INSERT SUB DATA

UPDATE LOCATION

INSERT SUB DATA

UPDATE LOCATION

CLEAR CMD

(BSSMAP)

CLEAR COM

(BSSMAP)

CHAN RELEASE

SCCP RLC

SCCP RLSD

(MAP)

(MAP)

(MAP)

(MAP)

(MAP)

(MAP)

INFORMATIONSEND AUTH.INFORMATIONSEND AUTH.

INFORMATIONSEND AUTH.

INFORMATIONSEND AUTH.

Location Updating

Intra BSS Handover

Inter BSS Handover

GPRSMS

Originated Packet

Transfer

GPRSMS

Terminated Packet

Transfer

GSM & UMTS

System Nodes &

Interfaces