GSM TRAINING ENGINEER

1

prepared by: Engr. Aris Condino 2

ObjectivesObjectivesName the three subsystems of GSM.Explain the mobility concept ( handover, location update, paging ).Describe how mobile originated and mobile terminated calls are handled in GSM.Explain the concept of security.


MobileStation

Air Interface

BaseTransceiverStation

A‐bisInterface

A Interface

Mobile Switching Center

Base StationController

Home LocationRegister

Gateway MSCVisitorLocationRegister

NetworkManagement Subsystem

Base Station Subsystem

Network Switching Subsystem

ShortMessageService Center


GSM subsystemsGSM subsystems

BSC

MSCVLR

GMSCHLR

NMS

MS

BSS

NSS

Air

A

O&M

A-bis

NSS Functions:1. Mobility Management2. Subscriber Data Handling3. Signalling ( towards other network elements )4. Call Control5. Charging6. Locating a subs for mobile terminated calls.


BSC

MSCVLR

GMSCHLR

NMS

MS

BSS

NSS

Air

A

O&M

A-bis

BSS Functions:1. Radio Path Control, BTS and TC control, Sync with MSC.2. Air and A interface signalling, Connection establishment.3. Mobility management, Speech Transcoding4. Collection of Statistical data



BSC

MSCVLR

GMSCHLR

NMS

MS

BSS

NSS

Air

A

O&M

A-bis

NMS Functions:1. Fault Management2. Configuration Management3. Performance Management



Mobile StationWhat is a mobile station?

A device able to access services in a GSM network via the Air interface.

+ =

MobileEquipment

SubscriberIdentityModule Mobile

StationGSM

Network

AirInterface


Mobile EquipmentIMEI (International Mobile Equipment Identification)


Subscriber Identification ModuleIMSI

International Mobile Subscriber IdentityICCID

International Compact Card Identification Unique SIM manufacturing number


MSISDN = CC +NDC +SN

CC = Country CodeNDC = National Destination CodeSN = Subscriber #

IMSI = MCC + MNC + MSIN ( fixed 15 digits )

MCC = Mobile Country CodeMNC = Mobile Network CodeMSIN = Mobile Subscriber Identification #

LAI = MCC + MNC + LAC

MCC = Mobile Country Code (of visiting country)MNC = Mobile Network Code(of serving PLMN)LAC = Location Area Code

11

BTS1BSC

1

MSC

VLR1

MSCVLR2

LAI 1

MSB

Loc Up

First time Location Update (1)

HLR

IMSI RequestIMSI

HLR DBMSISDN IMSI VLR Address Sub. Data62+898+8983725 310+02+1234567890 vlr2 services

Loc Up + TMSI

Authen


MS BSS MSC VLR HLR

LOCATION UPDATE REQUEST

REQUEST SUBS ID

SEND SUBS IDREQUEST SUBS INFO

SEND SUBS INFO

AUTHENTICATION

AUTHENTICATION RESPONSE

HLR UPDATE

13

PSTN BTS1BSC

1

MSC

VLR1

MSCVLR2

HLRHLR Enquiry


VLR DBIMSI MSRN LAI DATA310+02+1234567890 1 services

LAI 1

MSRNPOOL

MSB

IMSI

A

B

Call Establishment (PSTNO‐MT)

MSISDN

MSISDN (B)CC+ NDC + SN63 918 9499247

IMSI = MCC+MNC+MSIN

MSRN = CC+NDC+SN

MSISDN

14

PSTN BTS1BSC

1

MSC

VLR1

MSCVLR2

LAI 1

MS

A

B

MSISDN

Call Establishment (MO‐PSTNT)

MSISDN (A)CC+ NDC + SN63 2 5113580HLR

15

VLR DBIMSI MSRN LAI Services

2 Speech

BTS1

BTS2BSC

2

BSC1

MSC

VLR1

MSCVLR2

HLR

HLR Enquiry

LAI 1

LAI2

MSRNMS

MSB

IMSIB

C

MSISDN

Call Establishment (MO‐MT)

MSISDN (C)CC+ NDC + SN63 918 9499247

IMSI = MCC+MNC+MSIN

MSRN = CC+NDC+SN

MSISDN


16

BTS1BSC

1

MSC

VLR1MSC

VLR2

LAI 1

MSB

Generic Location Update

TMSI + LAIHLR

Loc Up + new TMSI

TMSI

IMSISecurity Info

Subscriber Info

UpdateDel olddata

Authentication


Handover (1)

MSC/VLR 1 MSC/VLR 2

BSC1 BSC2 BSC3

BTS4BTS3BTS2BTS1

PSTN

HLR

A

BMeasurement Report


Handover (2)

MSC/VLR 1 MSC/VLR 2

BSC1 BSC2 BSC3

BTS4BTS3BTS2BTS1

PSTN

HLR

BI am OK

A


Handover (3)

MSC/VLR 1 MSC/VLR 2

BSC1 BSC2 BSC3

BTS4BTS3BTS2BTS1

PSTN

HLR

B

A

Measurement Report


Handover (4)

MSC/VLR 1 MSC/VLR 2

BSC1 BSC2 BSC3

BTS4BTS3BTS2BTS1

PSTN

HLR

BI am OK

A


Handover (5)

MSC/VLR 1 MSC/VLR 2

BSC1 BSC2 BSC3

BTS4BTS3BTS2BTS1

PSTN

HLR

B

A

Measurement Report


Handover (6)

MSC/VLR 1 MSC/VLR 2

BSC1 BSC2 BSC3

BTS4BTS3BTS2BTS1

PSTN

HLR

BI am OK

A


Handover (7)

MSC/VLR 1 MSC/VLR 2

BSC1 BSC2 BSC3

BTS4BTS3BTS2BTS1

PSTN

HLR

B

A

24

AC VLR BTS Air Interface ME SIM

A3

A8A8 A5 A5

A3Authentication

EIR MEIMEI Checking

Ciphering

COMPARINGKi SRES SRES

RAND

KiA3A3

A8Kc Kc

Traffic Traffic

TDMA FN TDMA FN

A8A5 A5

Request of IMEI

Provide IMEI

Encrypted DataEncrypted Data


ObjectivesObjectivesDifferentiate between physical and logical channels.List and describe the twelve different types of logical channels and their functions.Describe how air interface properties affect the transmission of speech between MS and network and explain GSM solutions to these problems.List 3 BSC/BTS connections.


FRAME STRUCTURE1 TDMA Frame = 8 TDMA Time Slots

0 1 2 3 4 5 6 7

4.615 ms

Tail Data F Training DataF TailOr Speech

Flag

3000

57 1 26 1 57 3

Burst 148 bits

156.25 bits 0.577 ms

Basic TDMA frame, timeslot and burst structure


LOGICAL CHANNELSOn every physical channel, a number oflogical channels are mapped. Each logical channel is used for a specific purpose.

11 Logical Channels in the GSM system:

2 are used for Traffic9 are used for Control Signaling


LOGICAL CHANNELSTRAFFIC CHANNELS (TCH)

Full Rate ChannelHalf Rate Channel

CONTROL CHANNELS (with horrible abbreviations!)Broadcast Channels (BCH)

Frequency Correction Channel (FCCH)Synchronization Channel (SCH)Broadcast Control Channel (BCCH)

Common Control Channels (CCCH)Paging Channel (PCH)Random Access Channel (RACH)Access Grant Channel (AGCH)

Dedicated Control Channels (DCCH)Stand alone Dedicated Control Channel (SDCCH)Slow Associated Control Channel (SACCH)Fast Associated Control Channel (FACCH)


CHANNEL CONFIGURATION :

0 7

0 1 2 24 25 0 1 2 49 50

Time Slots and Frames:

Hyperframe = 2048 Superframes

Superframe=26X51 or 51X26 Multiframes

26 Multiframe =120 ms 51 Multiframe =235 ms

TDMA frame = 4.615 ms


Logical Channels, DOWNLINK

COMMON CHANNELS

FCCHSCHBCCH

PCHAGCH

BCH

CCCH

SDCCHSACCHFACCH

TCHTCH

DCCH

TCH

DEDICATED CHANNELS



Logical Channels, UPLINK

COMMON CHANNELS

RACH CCCH

SDCCHSACCHFACCH

TCHTCH

DCCH

TCH

DEDICATED CHANNELS



Hey! Don’t shoutat me, lower your

power...

BROADCAST CHANNELSall downlink!

FCCH

SCH TDMA#…BSIC...

BCCH

Hey. I’m aGSM xmitter!

GSM?

GSM!!!

LA…neigbors…cell info…max power...

Ok…ok


COMMON CONTROL CHANNELS

PCH downlink only

Hello! You have a call.

RACH uplink only

Hello! I have to setup a call.

I need SDCCH.

AGCH downlink only

Ok. Use SDCCH.


DEDICATED CONTROL CHANNELSuplink and downlink

SDCCH

SACCHtiming advanceMS power

FACCH

handover

On SDCCH:-call set up signaling-location updating-periodic registration-IMSI attach/detach-SMS-facsimileetc…..

On SACCH-mobile transmits signalstrength on ncell quality

“Don’t shout at me”“I can’t hear you “

35

F D T T T T T TS D T T T T T TB D T T T T T TB D T T T T T TB D T T T T T TB D T T T T T TC D T T T T T TC D T T T T T TC D T T T T T TC D T T T T T TF D T T T T T TS D T T T T T TC D A T A T A TC D T T T T T TC D T T T T T TC D T T T T T T

TS0 TS1 TS2 TS3 TS4 TS5 TS6 TS74.615 ms

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

1 Frame (Downlink ‐ BTS transmit)

1 carrier = 200 kHz

F = FCCHS = SCHB = BCCHC = PCH or

AGCHD = SDCCHA = SACCHT = TCH

R D T T T T T TR D T T T T T TR D T T T T T TR D T T T T T TR D T T T T T TR D T T T T T TR D T T T T T TR D T T T T T TR D T T T T T TR D T T T T T TR D T T T T T TR D T T T T T TR D A I A I A IR D T T T T T TR D T T T T T TR D T T T T T T

TS0 TS1 TS2 TS3 TS4 TS5 TS6 TS74.615 ms

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

.

1 Frame(Uplink ‐Mobile transmit)

1 carrier = 200 kHz

R = RACHA = SACCHT = TCH


0 1 2 3 4 5 6 7

.577 ms

200 KHz

4.615 ms

FCCHSCHBCCHPCHRACHAGCH

SDCCHSACCHCBCH

TCHSACCHFACCH

TCHSACCHFACCH

TCHSACCHFACCH

TCHSACCHFACCH

TCHSACCHFACCH

TCHSACCHFACCH



Configuration of Signaling Channels:

0 7

Combined Configuration

RTSL 0 = BCCH, SDCCH/4, PCH, AGCH

0 7

Separated Configuration

RTSL 0 = BCCH, PCH, AGCH

RTSL 1 = SDCCH/8




f s b b bb f s c c c c c c c c f s t t t t t t t t f s t t t t t t t t f s s s s s s s s sc c c c i

t

0

Downlink

Combined CCCH/SDCCH/4 Multiframe:

t t t rr s s s s r r r r r r r r r r r r r r r r r r r r r r r t t t t t t t t r r t t ts s s s t

50

Uplink

51 TDMA Frame = 235 ms

Channels:

f = FCCH b = BCCH r = RACH i = idles = SCH/SACCH c = CCCH ( either PCH or AGCH )



0

BCCH/CCCH Multiframe:

f s b b bb f s c c c c c c c c f s c c c c c c c c f s c c c c c c c c f s c c c c c c c cc c c c i

r r r r rr r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r rr r r r r

50

Downlink

Uplink


Channels:

f = FCCH b = BCCH r = RACH i = idles = SCH c = CCCH ( either PCH or AGCH )


0 50

Downlink

SDCCH/8 Multiframe:


t t t t s s s s s s s s s s s s s s s s i it t t t tt t t t t t t t t t t t t t t t t t tt t t t i

1 2 3 4 5 6 7 8

tt tti i is s s s s s s s s s s t t t t tt t t t t t t t t t t t t t t t t t tt t t ts t t t t

Uplink

Channels:

t = SDCCH s = SACCH i = idle




Full Rate Traffic Channel ( TCH ) Multiframe:

t t tt t t t t s t t t t t t t t t t t t it t t tt


Downlink and Uplink

t = TCH s = SACCH i = idle

Channels:

42


Idle Mode Task

• PLMN selection

• Cell selection

• Cell reselection

• Location updating.


IDLE MODE


Automatic Mode

• PLMN selection

• Cell selection

• Cell reselection

• Location updating.


Normal Cell Reselection

Cell is consider Suitable if:

• It belong to the same selected PLMN

• Cell is not barred

• It does not belong to location area included in the list of forbidden LA for roaming


Search All RF Channels

Tune to the carrier w/ highest signal strength

Get info (BSIC, BCCH) ‐> ex. BA List

Cell Selection

Cell Selection

3‐5 sec to get the list


Continuous Make Measurement(Neighboring BCCH)

Cell Reselection

BSIC BCCH data

Serving cell ‐ at least every 30 s

Six neighbours at least every 30 s at least every 5 min

Reselect to the best Cell

49

Technology

GSM TRAINING ENGINEER