Transmission

Simplex Duplex

on two-way
e-w
ay
 Single Cell System

Base station
Downlink (DL)

Uplink
(UL)

cell = supply area

 Cellular System

• Orange
Coverage
•
• • • Carpentras • •

•• •
• •
• Avignon • •
•
• • • • Cavaillon
• • • •
• Nimes • •
• • •
• Arles •
• Salon-de-Provence
• • •
• •
Aix-en-Provence
 Handover
Mobile phone is active,
e.g. a call takes place

Continued service
without interruption
 Location Areas and Paging
Location Area 3
Location Area 1

Location Area
=
registration
area of one
no Location Update Location Area 2 subscriber
Location Update
 1st Generation Limitations

1. No Roaming
2. Only Speech
3. Supplementary services not available
4. No security
5. Problems & limitations in radio interface
 Roaming
Example:
Roaming
GSM subscriber =
from Spain ability to use the
infrastructure of
different
operator‘s

Can use GSM network

in Australia, based on a
roaming agreement
between home operator
and visited operator
 GSM Radio Interface Organisation:
FDD and FDMA
UPLINK DOWNLINK

GSM900: 890 MHz - 915 MHz 935 MHz - 960 MHz

GSM1800: 1710 MHz - 1785 MHz 1805 MHz - 1880 MHz

123 ... 123 ...

200 kHz
Channel 1 - 124
guard band
1 - 374

Duplex frequency 45 MHz / 95 MHz

GSM Radio Interface
Organisation:
TDMA 5
4

e
tim
3
2
Physical channel, 1
e.g. allocated to one 0
subscriber with FR voice & 7
no frequency hopping 6
5
4
3
2 TDMA frame
1 = 8 timeslots
0
7 =8x.577ms
6
5 =4.615ms
4
3
2
TDMA frame
1
0
frequency
200 kHz
 GSM PLMN Organisation
Network Switching
Subsystem
• Switching
Air A • Mobility Management
• Connection Management
• Charging

MS BSS NSS
O&M

Base Station Subsystem

• Radio Resource
Management
NMS
Network Management
• Radio Link Management
System
• Fault Management
• Configuration Management
• Performance Management
Network Switching Subsystem

MSC Mobile services Switching Centre

GMSC Gateway MSC
VLR Visitor Location Register
AC HLR Home Location Register
EIR Equipment Identity Register
EIR HLR AC Authentication Centre

HLR

VLR

GMSC MSC
 Mobile services Switching Centre
(MSC)

MSC GMSC
• Call control • Call control
• Mobility management • Interrogation of HLR
• Initiation of paging • Collection of changing information
• Collection of changing information • Often used for interworking with
• Often associated with the VLR external networks
 Registers in the NSS

VLR HLR
• Identification numbers of subscribers • Subscriber Profile
• Security information • Routing Information
• Services that the subscriber can use

EIR AC
• Lists for Mobile Equipment (ME) Data for
checks • Authenticating (SIM) and
• Ciphering
 Base Station Subsystem
BSC
TC

BTS BSC

TC
BTS

BTS

Elements:
• Base Station Controller (BSC), Base Transceiver Station (BTS), and
Transcoder and Rate Adaptation Unit (TRAU, TC)
Functions:
• Radio path control, BTS and TC control, synchronisation with MSC
• Air and A interface signalling, connection establishment MS-NSS
• Mobility management, speech transcoding
• Collection of statistical data
 Base Station Controller (BSC)
BSC

• Connection establishment between the MS and the NSS

• Mobility management
• Statistical raw data collection
• Air- and A-interface signalling support
• BTS and TRAU Control
 Base Transceiver Station (BTS)

• Air interface signalling

• Ciphering
• Speech processing (channel coding, interleaving, and burst
formatting)
• Generation of alarms and statistics
• Baseband/Radio frequency transformation
 Speech Flow in BSS
Speech,
64 kbps 13kbit/s
compression Channel
Coding
MSC TRAU TRAU BTS = redundancy

22.8kbit/s

Interleaving
and ciphering

22.8kbit/s
Air
Interface 33.8kbit/s
GMSK TDMA burst
modulation formatting
Omnidirctional and Sectorised Cells
f1,f2, f3
BTS
BTS BTS

f1 f2

Omnidirectional BTS f1, f2

2 sectorised BTS

f5, f6 BTS

BTS
BTS

f3, f4

3 sectorised BTS
f = carrier frequency band
Network Management Subsystem
(NMS/2000)
N M S /2 0 0 0

BTS

D a ta C o m m u n ic a tio n s
N e tw o r k

DN2

BTS

BSC H LR
AC
E IR
MSC
VLR
BTS

BTS SMSC
 Functions of NMS (1)
Fault management
• Collects alarm reports from network elements.
• Provides one point for managing all fault
situations.
 Functions of NMS (2)
Configuration management
• Manages radio network configuration.
• Maintains up to date information on the network
element’s status.
 Functions of NMS (3)
Performance management
• Collects measurement data from network elements.
• Produces performance result from raw data.
 Interfaces
VLR
G
BSS NSS D
VLR HLR AC
EIR

B F C
Um
BSC
Abis
TC
BT Ater A
S

BT
S (G)MSC E

(G)MSC
 GSM network architecture
Base Station Subsystem Network Management Subsystem
Mobile Stations
Base Station
Controller Database Server Network
Planning
Data System
Communication Workstations
Network
Network Measurement
Base System
Transceiver Communications
Stations Server

Network Switching Subsystem

Home Location Register/
Authentication Centre/
Equipment Identity
Register TCP/IP

Data Communications
Digital Cross Server
Connect
PSTN/ISDN
Transcoder Mobile Switching Centre/
Submultiplexer Visitor Location Register
Voice
mail

Short Message IN Service Control Point

Service Centre
A-Interface Air Interface X.25 Interface Abis Interface
 Generic GSM architecture

BSS - Base Station

Subsystem
OMC
VLR
BTS BSC MSC HLR
IWF
BTS
EIR AC

BTS BSC NSS - Network

Subsystem
BTS PSTN
ISDN
PSPDN NMS - Network
BTS Management
SC
MS System
Air Abis A Transcoder
Turning on a mobile phone

BTS
 GSM databases (1)

Subscriber Identity Module (SIM)

Information in a SIM card:
• Security handling
information
• Subscriber identity
• Temporary network
information
• Access rights (Nat., Intl.)
• Preferred networks
• Prohibited networks
 GSM databases (2)
Home Location register (HLR)
• Permanent data HLR

• Regular update of
subscriber’s current VLR

Visitor Location register (VLR)

• Temporary data
VLR
• Kept as long as subscriber is
within its coverage area
• Updated from the HLR
MSC
• Always associated with a
Mobile Services Switching
Centre (MSC)
 Databases in a GSM network

GSM network

HLR

VLR
MSC

SIM
 Location update
• The Mobile Station monitors the information broadcast by
the network.

• The Mobile Station stores the current location area identity

in the SIM card.

• The Mobile Station continues to monitor the broadcast

information.

• If the location area identity being broadcast by the network

is other than the one stored in the SIM, the Mobile Station
starts the location update procedure.
Idle Mode Operation
 Idle
Mode
Operation Idle Mode Operation

Idle Mode Tasks

When?
• When the MS is switched ON? • PLMN selection
• Cell selection & re-selection
• When there is no dedicated connection? • Location updates

Why?
• To camp on the best suitable cell

Why to camp on a specific cell?

• For MS to receive system info from the NW on DL
• For MS to be able to initiate a call whenever needed
• For the NW to be able to locate the MS when there is a MT call/SMS
 Idle
Mode
Operation ID's and ID Codes

Parameter Value
LAI (locationAreaId)
• MCC (Mobile Country Code) 0 … 999
• MNC (Mobile Network Code) 0 … 99
• LAC (Location Area Code) 0 … 65535

BSIC (bsIdentityCode)
• NCC (Network Colour Code) 0…7
• BCC (BTS Colour Code) 0…7

CI (cell-ID) 0 … 65535

TSC (trainingSequenceCode) 0…7

CGI (Cell Global Identity) MCC + MNC + LAC + CI
 Idle
Mode
Operation Base Station Identity Code (BSIC)
• BSIC is a combination of NCC and BCC

• Reported in Measurement Results to BSC

• Can be listed in Hex or Decimal

NCC (0...7) BCC (0...7)

4 2 U 4 2 U
32 16 8 4 2 U Range
0 0 0 x x x 0-7
0 0 1 x x x 8 - 15
0 1 0 x x x 16 - 23
0 1 1 x x x 24 - 31
1 0 0 x x x 32 - 39
1 0 1 x x x 40 - 47
1 1 0 x x x 48 - 55
1 1 1 x x x 56 - 63
 Idle
Mode
Operation
PLMN Selection

• Two Modes
• Automatic - utilises a list of PLMNs in priority order. Highest priority
(available and allowable) PLMN is selected
• Manual - MS indicates to user which PLMNs are available
• Three Types of Lists
• Preferred
• Found
• Forbidden

Parameter Value

plmnpermitted 0 ... 7
NOTE This parameter is confusing. It’s not used for network selection. It’s used AFTER a network has been
selected so that measurements from only one PLMN are reported
 Idle
Mode
Operation Base Station Colour Code
f1 bcc = 2

f2
Location Area Code bcc = 1 f1
f3
MCC = Country e.g Finland
MNC = Operator f1
LAC 1 = Helsinki LAC 2
bcc = 3

LAC 3 LAC 4 BSC

Neighbour list of f3:
BTS BTS BTS f1
1 2 n f2
...
Location Updates
 Location Update Procedure
MS BSS MSC VLR HLR

LOCATION UPDATE REQUEST

REQUEST SUBSCRIBER ID

SEND SUBSCRIBER ID

REQUEST SUBSCRIBER INFO

SEND SUBSCRIBER INFO

AUTHENTICATION

AUTHENTICATION RESPONSE

ALL OK - HLR UPDATE

 Idle
Mode
Operation
Location Updates
• MS => MSC / VLR
• Mobile Station switched ON
• IMSI Attach / Detach
• Same Location Area => No Location Update
• Different Location Area => Location Update
• Change of the Location Area
• Location Area under the same MSC / VLR
• Location Area under another MSC / VLR => HLR will be updated
• Service is rejected (MS unknown in VLR)
• Time-Periodic LU (MS -> MSC/VLR)

Parameter Value

timerPeriodicUpdateMS 0.0 ... 25.5 hrs (PER)(BTS) see note in dictionary!

allowIMSIAttachDetach Yes/No (ATT)(BTS)
 Normal Cell Selection Idle
Mode
Search all the RF channels, take samples during Operation
3-5 s and calculate averages. And put them in
ascending order with respect to signal level.
Then tune to the strongest RF channel.

Search for the frequency correction burst in that Tune to the next highest
carrier in order to verify if it is a BCCH carrier RF channel which is not
tried before

Is it a BCCH No
carrier?
Yes
Try to synchronize to the carrier and read
the BCCH data

Is it a correct No
PLMN ?
Yes
Yes
Is the cell barred?

No
No
Is C1>0

Yes
Camp on the cell
Elements involved in a location update

HLR

VLR VLR
MSC
MSC (new)
(old)
Location
Update

Mobile moves SIM

Location update procedure - first time
MS BSS MSC VLR HLR
LOCATION UPDATE REQUEST

REQUEST SUBSCRIBER ID

SEND SUBSCRIBER ID

REQUEST AUTHENTICATION INFO

SEND AUTHENTICATION INFO

AUTHENTICATION

AUTHENTICATION RESPONSE
LOCATION UPDATE MESSAGE

ACKNOWLEDGEMENT, SUBSCRIBER INFORMATION

LOCATION UPDATE OK

ACKNOWLEDGEMENT
 Call set-up in a GSM network
PSTN originated call (1)

MSISDN PSTN

The dialled number is Mobile Subscriber International ISDN Number

(MSISDN)

MSISDN = CC + NDC + SN
CC: Country Code
NDC: National Destination Code
SN: Subscriber Number
358505527268
358 = Country Code (Finland)
50 = National Destination code (Radiolinja)
5527268 = Subscriber Number
 Call set-up in a GSM network (2)
• The PSTN routes the call to a
GSM network
HLR
• The MSC connected to the PSTN
is known as the Gateway MSC
GMSC (GMSC)
• The GMSC analyses the received
PSTN MSISDN VLR
MSISDN
• The only database that knows
where a GSM subscriber is at any
given moment is the HLR
GSM
Network • The GMSC requests the HLR for
some routing information to
know where to route the call
• This procedure is known as HLR
Enquiry
 Call set-up in a GSM network (3)

The HLR looks up its IMSI = MCC + MNC + MSIN

database. IMSI: International Mobile
HLR database contents: Subscriber Identity
MCC: Mobile Country Code (3 digits)
MSISDN: 358505527268 MNC: Mobile Network Code (2
digits)
IMSI: 244052200002345
MSIN: Mobile Subscriber Identity
VLR address: xyz
Number (max 10 digits)
Subscriber data: Services....

244052200002345
244: MCC of Finland
05: MNC of Radiolinja
2200002345: MSIN
Call set-up in a GSM network (4)

HLR

Gateway
MSC Target
MSC
PSTN VLR
VLR

GSM
Network

Elements involved in a call set-up inside the GSM network

 Call set-up in a GSM network (5)
• The HLR takes the VLR address
of the subscriber from its
database.
HLR
• The HLR sends a routing
information request message to
Routing
information the target MSC/VLR.
request
message • The target MSC/VLR allocates a
Gateway MSC
Mobile Subscriber Roaming
Number (MSRN) for this call.
VLR
MSRN = CC + NDC + SN
The format of the MSRN is the
VLR same as the MSISDN. The term
SN in the MSISDN points to a
database location in the HLR; in
case of MSRN it points a
Target MSC database location in the VLR.
The MSRN also has sufficient
information to enable the GMSC
to route the call to the target MSC.
 Call set-up in a GSM network (6)

• The target MSC forwards the

HLR MSRN to the HLR.
• The HLR forwards this to the
originating MSC.
358 50 456456 MSRN No.
to HLR • The originating MSC analyses the
Gateway MSC
MSRN.
• The “telephone number” type of
format enables the call to be
VLR
routed to the destination MSC,
wherever in the world it may be.
VLR

Target MSC
 Network Subsystem summary (part 1)
A ir A
M SC VL R

M SC VL R HLR

O & M

• Elements:
MSC, VLR, HLR
• Functions
– Call control
– Mobility management
– Signalling (towards BSS, other networks, other NSS
elements)
– Subscriber data handling
– Locating a subscriber for mobile terminated calls
 Location areas
• The MSC/VLR area is divided
into small areas called Location
Reception Restaurant Bar Pool areas.
• A subscriber can move within
this area without having to make
a generic location update
(explained later).
• The maximum size of an LA can
be one MSC area and the
minimum size is one cell.
LA 5 • Paging is done in all cells of the
LA where the subscriber is
LA 1 currently located.
LA 4
M SC VL R
• LAI = MCC + MNC + LAC
LAI = Location Area Identity
MCC = Mobile Country Code
LA 2 MNC = Mobile Network Code
LA 3
LAC = Location Area Code
 Base Station Subsystem
BSC
TC

BTS BSC

TC
BTS

BTS

Elements:
• Base Station Controller (BSC), Base Transceiver Station (BTS),
Transcoder (TC)
Functions:
• Radio path control, BTS and TC control, synchronisation with MSC
• Air and A interface signalling, connection establishment MS-NSS
• Mobility management, speech transcoding
• Collection of statistical data
MSC - BSC - BTS connections

BTS

BSC BTS

MSC
 Paging process

Location Area

Paging Paging

BTS BTS

Mobile responds
to paging Paging

BTS
 Simplified steps of a call set-up
in a GSM network
A- GMSC HLR MSC/VLR
PSTN
Subscriber

CALL SETUP (MSISDN)

ANALYSE NUMBER
CALL SETUP (MSISDN)

MSISDN

IMSI

MSRN
MSRN

CALL SETUP (MSRN)

PAGING
 Mobile originated call
• The Mobile Station user dials a number.
• The serving MSC analyses the calling subscriber
data. Depending on the subscriber data, the MSC
will:
–authorise or deny the use of the network
–activate the requested service
–route the call.
• If the dialled number is an MSISDN of another
Mobile Station belonging to the same network, an
HLR enquiry is performed to obtain the MSRN.
–The procedure is same as that of a PSTN originating
call.
• If the dialled number is any other number, the call
is routed out to the Public Switched Telephone
Network (PSTN) via the Gateway MSC.
 Call Phases

Overall Call Success Rate

Call Setup SuccessRate Call Completion Rate

SDCCH SDCCH TCH

Blocking Success Rate Blocking
(system) (system)

and and

SDCCH TCH Call

call Blocking
Blocking

establish establish
get get get call release
SDCCH TCH
service SDCCH TCH phase phase
connection connection
 Call Phase Types
PHASE PHASE_NAME
1 Paging
2 MM signalling
3 Basic assignment
4 Release
5 FACCH assignment
6 SMS establishment (TCH)
7 SMS establishment (SDCCH)
8 Ciphering
9 External handover (source)
10 Internal handover intra (source)
11 Internal handover inter (source)
12 External handover (target)
13 Internal handover Intra (target)
14 Internal handover inter (target)
15 Conversation (TCH)
 Call Phases for MTC

MS BTS BSC

CH. REQUEST (RACH)

Phase 1 : Paging, initial MS
IMMEDIATE ASSIGN(AGCH)

SERVICE REQUEST (SDCCH)

Phase 2 : MM signalling
AUTHENTICATION (SDCCH)
Phase 8 : Ciphering
CIPHERING MODE (SDCCH)

TMSI REALLOCATION (SDCCH)

Phase 2 : MM signalling
SETUP (SDCCH)
Phase 3 : Basic assignment
ASSIGNMENT (SDCCH-FACCH)
Phase 4 : Release
CH.RELEASE
Phase 2 : MM signalling
ALERTING & CONNECT (FACCH)
Phase 15 : Conversation
CONN. ACK. and MEASUREMENT

DISCONNECT & RELEASE (FACCH) Phase 4 : Release

Protocols Mobile Originating Call

MS NETWORK

CHAN REQ (RACH)

IMM ASSIGN (AGCH) Immediate assignment

CM SERV REQ (SDCCH)

Service Request

AUTH REQ (SDCCH)

AUTH RES (SDCCH) Authentication

CIPH MOD CMD (SDCCH)

CIPH MOD COM (SDCCH) Ciphering Mode Setting
Protocols Mobile Originating Call, cont.

MS NETWORK

SETUP (FACCH)
CALL PROC (SDCCH) Call Initiation

ASSIGN CMD (SDCCH)

ASSIGN COM (FACCH) Assignment of Traffic Channel

ALERT (FACCH)
Call Confirmation

CONNECT (FACCH)
CONNECT ACK (FACCH) Call Accepted
Protocols Mobile Originating Call, cont.
Protocols Mobile Terminating Call

MS NETWORK

PAG REQ (PCH)

CHAN REQ (RACH) Immediate assignment
IMM ASSIGN (AGCH)

PAG RES (SDCCH)

Service Request

AUTH REQ (SDCCH)

AUTH RES (SDCCH) Authentication

CIPH MOD CMD (SDCCH)

CIPH MOD COM (SDCCH) Ciphering Mode Setting
Protocols Mobile Terminating Call, cont.

MS NETWORK

SETUP (FACCH)
CALL CONF (SDCCH) Call Initiation

ASSIGN CMD (SDCCH)

ASSIGN COM (FACCH) Assignment of Traffic Channel

ALERT (FACCH)
Call Confirmation

CONNECT (FACCH)
CONNECT ACK (FACCH) Call Accepted
Protocols Location Update

MS NETWORK
CHAN REQ (RACH)
IMM ASSIGN (AGCH) Immediate assignment

LOC UPD REQ (SDCCH)

Service Request

AUTH REQ (SDCCH)

AUTH RES (SDCCH) Authentication

CIPH MOD CMD (SDCCH)

CIPH MOD COM (SDCCH) Ciphering Mode Setting

LOC UPD ACC (SDCCH)

TMSI REAL COM (SDCCH)

CHAN REL (SDCCH)

Channel Release
Protocols Disconnect - Network Initiated

MS NETWORK

DISCONNECT (FACCH)
REL (FACCH) Call Clearing
REL COM (FACCH)

CHAN REL
Release
Protocols Disconnect - MS Initiated
Disconnect, MS Initiated

MS NETWORK

DISCONNECT (FACCH)
REL (FACCH) Call Clearing
REL COM (FACCH)

CHAN REL
Release
Protocols Inter MSC Handover

New Cell / BTS

Air A

BSC TC
BTS
MSC VLR

BSC TC
BTS
MSC VLR

Old Cell / BTS

Protocols Handover Failure

MS NETWORK

ACTIVE CALL

HANDOVER CMD Old Channel, Old Cell

Timer T3124 expiry or New Channel, New Cell

Radio Link Failure

HANDOVER FAIL Old Channel, Old Cell

ACTIVE CALL
Simplified steps of a mobile originated
call
EXC GMSC HLR MSC VLR BSS MS

1. channel assignment

2. security procedures

3. call setup

4. check services etc.

5. all ok

6. call is proceeding

7. traffic channel allocated

8. set up the call

9. call set up complete

10. alert

11. B answers
 Types of location updates
Power On
• Also known as “IMSI Attach” and
“Location Registration”.
• Done every time a Mobile Station
is switched on.
Generic M SC VL R

• Done every time a Mobile Station LA 2

changes a location area. LA 1
Periodic
• Performed after a preset timer
expires, since the last transaction
with the network.
• Timer value is dependent on the
network operator.
The Mobile Station starts the
procedure.
Generic location update procedure
MS BSS MSC VLRnew VLRold HLR
1. channel assignment

2. location update request

3. request subscriber identity

4. send subscriber identity and security information

5. security procedures

6. update HLR

7. acknowledgement, subscriber information

8. cancel old location

9. location cancelling accepted

10. location update acknowledgement, new TMSI

11. TMSI acknowledgement

 Handovers
Handover due to traffic reasons
• When the capacity of a cell nears its maximum, mobile
stations in the periphery of the cell may be handed over to
neighbouring cell with lower traffic load.
• The MSC starts the procedure.

Handover due to signal quality and strength

• When a mobile subscriber is moving during a call, he may
travel from one cell to another.
• Frequency resources of previous cells can not be used any
more.
• The mobile station is handed over to the new cell.
• The BSC controlling the current cell makes the decision to
perform a handover.
• There are four types of these handovers.
Intra cell - Intra BSC handover

Air A

BSC TC
BTS

h an nel
O ld C

Ch annel
N ew
Inter cell - Intra BSC handover

Air A

BTS BSC TC

BTS

Old Cell / BTS New Cell / BTS

Inter cell - Inter BSC handover
New Cell / BTS
Air A

BSC TC
BTS

MSC VLR

BSC TC
BTS

Old Cell / BTS

Inter MSC handover (1)
New Cell / BTS
Air A

BSC TC
BTS
MSC VLR

BSC TC
BTS MSC VLR

Old Cell / BTS

 Inter MSC handover (2)
• The source MSC is known as the Anchor MSC.
• The call is routed from the source MSC to the target MSC.
• A routing number is needed to route a call from one MSC
to another MSC.
• The source MSC requests the target MSC for a Handover
Number (HON). The target MSC allocates one and gives it
to the source MSC.
• The format is the same as the MSRN.

HON = CC + NDC + SN
 Inter MSC handover (3)
MS BSSold MSCold MSCnew BSSnew MS (after HO)

1. measurement reports
2. handover required

3. request HON
4. request for radio resources

5. radio resources reserved

6. provide HON and target cell info

7. set up speech connection (HON)

8. handover command
9. handover complete

10. handover complete

11. connect

12. release old connections

 Security issues
• Authentication
–Verification of the subscriber.
• Ciphering
–Encryption of user speech in the Air Interface.
• IMEI checking
–Verification of the Mobile Equipment by
checking the validity of the International
Mobile Equipment Identity (IMEI).
• User confidentiality
–Avoidance of the broadcast of user’s IMSI in
the Air Interface.
 Authentication
• Each subscriber has an identity key, Ki, stored in
the Authentication Centre (AC) and the SIM card.
• Comparison of Ki without broadcasting it in the Air
Interface.
• Authentication always performed by the VLR
before call establishment and location update.
Air A
SIM
card AC

MSC
* I M SI VLR * I M SI

* Ki * Ki
 Security algorithms
• Need to check Ki without transmitting it in the air
–Use of one-way algorithm, A3, to produce a Signed Response
(SRES), by using a Random Number (RAND) and Ki as inputs.
–SRES is calculated in the AC and SIM, and compared in the VLR for
authentication.
• Need a cipherkey, Kc to encrypt user speech.
–Kc is generated using the algorithm A8.
• Actual encryption of user speech is done using Kc and
digitised speech as inputs to the encryption algorithm A5.
–Performed between the Base Transceiver Station (BTS) and the
Mobile Equipment (ME).
 Location of security algorithms

A ir A
AC
A3 A8

BSC TC
BTS MSC
VLR

M E + SIM A5

A5 A3 A8
 Authentication triplet
• Authentication verification is done in the VLR serving the
subscriber.
• The VLR can be external to the subscriber’s home
network (in case of roaming).
• Excessive signalling is required to transfer the SRES to
the VLR every time authentication is needed.
• The AC generates a number of SRESs, and transfers
them along with the corresponding RAND and cipher key
Kc to the serving VLR.
• The VLR uses the triplets to verify the subscriber.
• When the number of triplets reaches below a certain
threshold, new triplets are requested from the AC.
Authentication triplet generation
Random number Ki
generator

AC A3 A8

RAND SRES Kc

Authentication triplet

RAND SRES Kc
VLR
Authentication triplet
Authentication procedure
Authentication Triplet

SRES
VLR RAND Kc

Comparison

BSC

BTS Kc

MS

RAND

SIM
A3 SRES

Ki A8 Kc
Speech encryption
SPEECH/DATA

BTS A5

Kc

TDMA

A5

ENCRYPTED
SPEECH/DATA

A5

Kc

TDMA

A5

SPEECH/DATA
 IMEI checking
• The validity of a mobile equipment may be checked to
ensure its proper operation and as prevention against
stolen phones.
• The Equipment Identity Register (EIR), which is
implemented as part of the HLR, can store “black
listed” IMEI numbers.
• The mobile equipment sends its IMEI before a
transaction with the network
• The MSC can request the EIR to see if the received
IMEI is “black listed”
• If it is, the MSC can stop the call set-up
• An operator can set the MSC to check the IMEI of a
mobile equipment at times other than during call set-
up as well.
 User confidentiality
• IMSI is a confidential identity of the subscriber.
• After a successful first time location update, a mobile
subscriber is allocated a Temporary Mobile Subscriber
Identity (TMSI).
• The next time a transaction between the GSM network
and the MS is initiated, the subscriber is identified by the
use of TMSI.
• TMSI is reallocated after every successful authentication
verification.
• The format of TMSI is operator dependent. It is a 32 bit
binary number.
• Additionally, there is the provision of a Personal
Identification Number (PIN) code in the SIM card, which,
if enabled, must be entered before an MS can be used.
 Carrier frequency range
GSM 900 GSM 1800
Uplink: 890 - 915 Uplink: 1710 - 1785
Mhz Mhz
Downlink: 935 - 960 Mhz Downlink: 1805 - 1880 Mhz

Carrier pairs (in Mhz) Carrier pairs (in Mhz)

890.0 935.0 1710.0 1805.0
890.2 935.2 1710.2 1805.2
890.4 935.4 124 carriers 1710.4 1805.4
374 carriers
.... .... .... ....
.... .... .... ....
914.8 959.8 1784.8 1879.8
915.0 960.0 1785.0 1880.0
Duplex frequency = 45 Mhz Duplex frequency = 95 Mhz
Principle of Time Division Multiple Access
(TDMA)
TSL 7

TSL 6

TimeSLot 0
TSL 5
TSL 1
TSL 4
TSL 3 TSL 2 BTS
BTS
 GSM frequency bands
• GSM 450
UL: 450,4 – 457,6 MHz and DL: 460,4 – 467,6 MHz
• GSM 480
UL: 478,8 – 486 MHz and DL: 488,8 – 496 MHz
• GSM 700
UL: 747 – 762 MHz and DL: 777 – 792 MHz
• GSM 850
UL: 824 – 849 MHz and DL: 869 – 894 MHz
• GSM 900 (standard GSM, P-GSM, Primary GSM)
UL: 890 – 915 MHz and DL: 935 – 960 MHz
Extended GSM 900 (E-GSM; only in combination with GSM 900)
UL: 880 – 915 MHz and DL: 925 – 960 MHz
• Railway GSM 900 (R-GSM; in combination with GSM)
UL: 876 – 880 MHz and DL: 921 – 925 MHz
• GSM 1800 (DCS 1800)
UL: 1710 – 1785 MHz and DL: 1805 – 1880 MHz
• GSM 1900 (PCS 1900)
UL: 1850 – 1910MHz and DL: 1930 – 1990 MHz
 Modulation techniques

Digital signal 0 1 0

Frequency modulation

Amplitude modulation
 Phase modulation
Example: Binary Phase Shift Keying (BPSK)

Digital signal 1 1

00 phase shift
=> Interpretation

Phase modulation

1800 phase shift

=> Interpretation
duration of one bit duration of one bit

Digital signal 1 0
 Phase modulation

Digital signal 0 1 1 0

Phase modulation

3.69µs

-900 +900 +900 -900

 Channel
Configuration Burst Period

0 0

0 7 0
f s

TDMA frame = 4.615 ms

= BURST PERIOD
 Channel
Configuration Radio Timeslots & Frames

Hyperframe = 2048 Superframes

Superframe = 26x51 or 51x26 Multiframes

TCH 26 Multiframe = 120 ms 51 Multiframe = 235 ms SIGN.

0 1 2 24 25 0 1 2 49 50

0 7

TDMA frame = 4.615 ms

 Channel
Configuration
GSM Logical Channels
LOGICAL
LOGICAL
CHANNELS
CHANNELS

COMMON
COMMON DEDICATED
DEDICATED
CHANNELS
CHANNELS CHANNELS
CHANNELS

BROADCAST COMMON DEDICATED TRAFFIC

TRAFFIC
BROADCAST COMMON DEDICATED
CHANNELS CONTROL CONTROL CHANNELS
CHANNELS
CHANNELS CONTROL CONTROL
CHANNELS
CHANNELS CHANNELS
CHANNELS

FCCH
FCCH SCH
SCH BCCH
BCCH SDCCH
SDCCH SACCH
SACCH FACCH
FACCH

PCH
PCH RACH
RACH AGCH
AGCH TCH/F
TCH/F TCH/H
TCH/H TCH/EFR
TCH/EFR
 Channel
Configuration
Configuration of Signalling Channels

Combined Configuration

0 7

ts0=bcch + sdcch/4 + pch + agch

Non-combined Configuration

0 1 7

ts0=bcch + pch + agch ts1=sdcch/8

 GMSK – Gaussian Minimum Shift
Keying
• Phase changes of +/- 90 degrees for bit changes (new bit
values)
• The phase change is done gradually over a small time period,
meaning that:

The change is not as abrupt as in BPSK

The Mobile Station causes less inter-frequency interference

• In GSM, one bit duration is 3.69 µs (0.00000369 seconds).

 Logistical problem

8 seats in each vehicle

Number of channels required during
call set-up (1)
• Channel to transmit information to help the mobile
station to tune into the network.
• Channel to transmit synchronisation information.
• Channel to transmit information about the network to
help the mobile know about the frequencies being used
in its cell as well as in surrounding cells.

TDMA
TDMA Frame
Frame
BTS
Sync.
Sync.
Information
Information

BTS
Number of channels required during
call set-up (2)
• Channel to transmit mobile station’s request to initiate call
set-up.
• Channel to set up a call.
• Channel to transmit handover information.

TDMA
TDMA Frame
Frame

Channel
Channel
allocation
allocation
Request
Request
BTS

Traffic
Traffic
Number of channels required during
call set-up (3)
• Channel to page the called party.
• Channel to transmit measurements.
Conclusion: No channel left for conversation!
Solution: We must send more than one type of
information on a channel by sharing it.

TDMA
TDMA Frame
Frame

Answer
Answer

BTS BTS
BTS Traffic
Traffic
BTS
Paging
Paging
Logical channels in TDMA frames
... 0 1 2 3 4 5 6 7 ...
0 FCCH
1 SCH
2 BCCH
3 BCCH 0 TCH/F
4 BCCH 1 TCH/F
2 TCH/F
51-Frame Multiframe

26-Frame Multiframe
5 BCCH
3 TCH/F
...

...

...
PCH
...

AGCH 11 TCH/F
. . .

12 SACCH
...

FCCH 13 TCH/F

...

...
...

SCH
24 TCH/F
...

SDCCH 25 IDLE
...

SACCH
...

50 IDLE
 Broadcast channels
Frequency Correction Channel (FCCH)
• Pure sine wave.
• The MS searches for this channels to switch on.
• Downlink.

Synchronisation Channel (SCH)

• After locking to the frequency the MS synchronises with the
SCH.
• The SCH contains the BSIC of the BTS and the TDMA frame
number (used in encryption).

Broadcast Control Channel (BCCH)

• Common information about the BTS:
– Used frequencies
– Frequency hopping sequence
– Channel combination
– Paging groups
– Surrounding cell information
 Common control channels

Paging Channel (PCH)

• Used by BTS to page a mobile.
• A downlink channel only.
Random Access Channel (RACH)
• Used by the MS to request a dedicated control
channel.
• Used for e.g. mobile originated calls.
• An uplink channel only.
Access Grant Channel (AGCH)
• Used by the BTS to assign a dedicated control
channel.
• A downlink channel only.
 Dedicated channels
Stand Alone Dedicated Control Channel
(SDCCH)
• Bi-directional channel.
• Used for call set-up procedures, e.g. authentication.
• The traffic channel (TCH) is assigned by using SDCCH.
Slow Associated Control Channel (SACCH)
• Associated with SDCCH and TCH.
• Measurement reports.
• MS power control.
• Timing alignment.
Fast Associated Control Channel (FACCH)
• Associated with TCH.
• For quick control communication, e.g. handover.
• Physically replaces 20 ms of speech, “stealing mode”
 Traffic channels
Full Rate
• Bi-directional channel.
• Used for speech or data transmission.
• User data bit rate 13 kbit/s.
Half Rate
• Bi-directional channel.
• Used for speech or data transmission.
• User data bit rate 5.6 kbit/s.
Enhanced Full Rate (EFR)
• Bi-directional channel.
• Used for high quality speech
transmission.
• User data bit rate 12.2 kbit/s.
 Bursts and time slots in the Air
Interface
TDMA
TDMA Time
Time Slot
Slot

... TDMA
TDMA Frame
Frame
...
BTS
BTS

Bursts
Bursts from
from Mobile
Mobile Stations
Stations 2Mbit/s
2Mbit/s to
to BSC
BSC
 GSM burst types (1)
TDMA FRAME ~ 4.615 ms

576.9 µs

tail S training S tail guard

encrypted bits encrypted bits
bits B sequence B bits period
57 57 8,25 bits
3 1 26 1 3
NORMAL BURST

tail tail guard

fixed bits ("0")
bits bits period
142 8,25 bits
3 3
FREQUENCY CORRECTION BURST
 GSM burst types (2)

tail extended training tail guard

encrypted bits encrypted bits period
bits sequence bits 8,25
39 39
3 64 3 bits

SYNCHRONISATION BURST

tail tail guard

mixed bits
bits bits period
142 8,25 bits
3 3
DUMMY BURST

ext. tail synchronisation tail

encrypted bits extended guard period
bits sequence bits
8 36 68,25 bits
41 3
ACCESS BURST
 Channel
Combined CCCH + SDCCH/4
Configuration
Multiframe

Downlink 51 TDMA frames = 235 ms

f s b b b b c c c c f s cf c c c c c c c f s tf t t t t t t t f s tf t t t t t t t f s sf s s s s s s s i

1. 2. 3. 4.
Uplink

t t t t r r s s s s s s sf s r r r r r r r r rf r r r r r r r r r rf r r r r t t t t t tf t t r r t t t t

0 50

CHANNELS: f then s = FCCH then SCH b = BCCH r = RACH

ssss = SACCH c = CCCH t = SDCCH i=idle
 Channel
Configuration BCCH/CCCH Multiframe

Downlink
51 TDMA frames = 235 ms

f s b b b b c c c c f s cf c c c c c c c f s cf c c c c c c c f s cf c c c c c c c f s cf c c c c c c c i

Uplink

r r r r r r r r r r r r rf r r r r r r r r r rf r r r r r r r r r rf r r r r r r r r r rf r r r r r r r r

0 50

CHANNELS: f = FCCH b = BCCH r = RACH i=idle

s = SCH c = CCCH = PCH/AGCH
 Channel
Configuration SDCCH/8 Multiframe

Downlink 51 TDMA frames = 235 ms

t t t t t t t t t t t t tf t t t t t t t t t tf t t t t t t t t t sf s s s s s s s s s sf s s s s s i i i

1. 2. 3. 4. 5. 6. 7. 8.
Uplink

s s s s s s s s s s s s fi i i t t t t t t t tf t t t t t t t t t tf t t t t t t t t t tf t t t t t t t t

0 50

CHANNELS: t = SDCCH/8 s = SACCH/8 i=idle

 Channel
Configuration Full Rate Traffic Channel
(TCH) Multiframe

Downlink and Uplink

26 TDMA frames = 120 ms

t t t t t t t t t t t t sf t t t t t t t t t tf t t i

0 25

CHANNELS: t = TCH s = SACCH i=idle

 Channel
Configuration Half Rate Traffic Channel
(TCH) Multiframe

Downlink and Uplink

26 TDMA frames = 120 ms

t t t t t t st t t t t t i
t t t t t t t t t t t t

0 25

CHANNELS: t = TCH s = SACCH i=idle

 Channel
Configuration Paging Procedure
• Paging messages sent on PCH which MS continually listens to (TSL0 on BCCH
TRX)
• Limited to geographical sub-group of BSCs using LACs
• Paging sub-groups are used to save MS battery-life since MS only needs to listen to
its own sub-channel and not to the entire PCH
• MS can be paged using IMSI or TMSI (determines number of MSs that can be
paged per message (IMSI = 2 MSs : TMSI = 4 MSs)
• Split between PCH and AGCH determined by numberOfBlocksForAccessGrant
and the type of channel configuration used (i.e. combined or non-combined)
• PCH can be used for AGCH if
Non
Combined no paging messages are to be
Combined
sent, but AGCH can not be
Blocks for PCH & AGCH 3 9 used for PCH
No. Blocks Res AGCH 0-2 0-7 • Three types of paging
No. Blocks Res PCH 3-1 9-2
messages (type 1, 2 and 3)
depending on no. of MSs paged
 Channel
Configuration Paging Capacity
Combined BCCH / SDCCH (MBCCHC) Configuration

• One Block Reserved for AGCH => 2 Blocks for PCH BTS MS

• Paged MS per Paging_Request Message : From 2 to 4

(average 3) Paging_Request
• Average 2 Pages per MS
• 3 Pages/Blocks * 2 Blocks = 6 Pages every 51-frame
BTS 3MS
Multiframe ( 235 ms. )
• 2 Pages / Paged MS => 3 Paged MS every 235 ms.
• ( ( 3600 * 1000 ) / 235 ) * 3 = 45.957 Paged MS per Hour. 2 Paging_Request

• In the worst case all Transactions are Mobile Terminating

• All Cells in Location Area get the same PCH Load
• Capacity
• With one TRX 2,95 Erl.
• 25 mErl. / subs. => 120 subscribers

Capacity of PCH calculated for a Location Area

 Channel
Configuration
Non-Combined & Combined
Multiframes
BCCH + CCCH (Non-Combined)
51 TDMA frames = 235 ms

1 2 3 4 5 6 7 8 9

f s b b b b c c c c f s cf c c c c c c c f s cf c c c c c c c f s cf c c c c c c c f s cf c c c c c c c i

BCCH + SDCCH/4 (Combined)

1 2 3

f s b b b b c c c c f s cf c c c c c c c f s tf t t t t t t t f s tf t t t t t t t f s sf s s s s s s s i

CHANNELS: f then s = FCCH then SCH b = BCCH r = RACH

ssss = SACCH c = CCCH t = SDCCH i=idle
 Channel
Configuration Erlang B Table

Chs 1% 2% 3% 5 % Chs 1% 2% 3% 5%
1 0 .0 1 0 .0 2 0 .0 3 0 .0 5 21 1 2 .8 0 1 4 .0 0 1 4 .9 0 1 6 .2 0
2 0 .1 5 0 .2 2 0 .2 8 0 .3 8 22 1 3 .7 0 1 4 .9 0 1 5 .8 0 1 7 .1 0
3 0 .4 6 0 .6 0 0 .7 2 0 .9 0 23 1 4 .5 0 1 5 .8 0 1 6 .7 0 1 8 .1 0
SD 4 0 .8 7 1 .0 9 1 .2 6 1 .5 2 24 1 5 .3 0 1 6 .6 0 1 7 .6 0 1 9 .0 0
5 1 .3 6 1 .6 6 1 .8 8 2 .2 2 25 1 6 .1 0 1 7 .5 0 1 8 .5 0 2 0 .0 0
Channels
6 1 .9 1 2 .2 8 2 .5 4 2 .9 6 26 1 7 .0 0 1 8 .4 0 1 9 .4 0 2 0 .9 0
7 2 .5 0 2 .9 4 3 .2 5 3 .7 5 27 1 7 .8 0 1 9 .3 0 2 0 .3 0 2 1 .9 0
8 3 .1 3 3 .6 3 3 .9 9 4 .5 4 28 1 8 .6 0 2 0 .2 0 2 1 .2 0 2 2 .9 0
9 3 .7 8 4 .3 4 4 .7 5 5 .3 7 29 1 9 .5 0 2 1 .0 0 2 2 .1 0 2 3 .8 0
10 4 .4 6 5 .0 8 5 .5 3 6 .2 2 30 2 0 .3 0 2 1 .9 0 2 3 .1 0 2 4 .8 0
11 5 .1 6 5 .8 4 6 .3 3 7 .0 8 31 2 1 .2 0 2 2 .8 0 2 4 .0 0 2 5 .8 0
12 5 .8 8 6 .6 1 7 .1 4 7 .9 5 32 2 2 .0 0 2 3 .7 0 2 4 .9 0 2 6 .7 0
13 6 .6 1 7 .4 0 7 .9 7 8 .8 3 33 2 2 .9 0 2 4 .6 0 2 5 .8 0 2 7 .7 0
14 7 .3 5 8 .2 0 8 .8 0 9 .7 3 34 2 3 .8 0 2 5 .5 0 2 6 .8 0 2 8 .7 0
15 8 .1 1 9 .0 1 9 .6 5 1 0 .6 0 35 2 4 .6 0 2 6 .4 0 2 7 .7 0 2 9 .7 0
16 8 .8 8 9 .8 3 1 0 .5 0 1 1 .5 0 36 2 5 .5 0 2 7 .3 0 2 8 .6 0 3 0 .7 0
17 9 .6 5 1 0 .7 0 1 1 .4 0 1 2 .5 0 37 2 6 .4 0 2 8 .3 0 2 9 .6 0 3 1 .6 0
18 1 0 .4 0 1 1 .5 0 1 2 .2 0 1 3 .4 0 38 2 7 .3 0 2 9 .2 0 3 0 .5 0 3 2 .6 0
19 1 1 .2 0 1 2 .3 0 1 3 .1 0 1 4 .3 0 39 2 8 .1 0 3 0 .1 0 3 1 .5 0 3 3 .6 0
20 1 2 .0 0 1 3 .2 0 1 4 .0 0 1 5 .2 0 40 2 9 .0 0 3 1 .0 0 3 2 .4 0 3 4 .6 0
 Section 1 - Channel Dimensioning

Channel Dimensioning - Example

• In GSM channel dimensioning, the number of channels must be

related to the number of carriers (frequencies) available:
• 8 channels (timeslots) per carrier
• Some channels will be required for signalling

• Example - in a particular cell:

Mean call holding time = 90 seconds
Grade of Service = 1 %
Total number of available carriers = 4
3 timeslots allocated for signaling

How many subscribers can this cell support ?

 Section 1 - Channel Dimensioning

Channel Dimensioning - Solution

• Mean call holding time of 90 s implies the average traffic per
subscriber is 25 mE

• Number of channels available is given by:

(carriers x 8) - signalling channels
= 4 x 8 - 3 = 29 channels

• Using Erlang B tables for GoS = 0.01 and n = 29 channels,

gives traffic that can be offered as 19.487 E = 19487 mE

• Number of subscribers that can be supported is: 19487 / 25

= 779
 Section 1 - Channel Dimensioning

Trunking Efficiency
• Trunking efficiency or channel utilisation is given by:
carried traffic / number of channels
(where carried traffic = offered traffic modified by GoS)

• In the Erlang B model:

Trunking Efficiency = A (1- GoS) / n

where A = offered traffic (erlangs)

n = number of channels available

• Using the previous example:

A = 19.487 E, GoS = 0.01, n = 29

• Trunking Efficiency = 19.487 (1 - 0.01) / 29 = 0.665 = 66.5 %

 Section 1 - Channel Dimensioning

SDCCH Dimensioning
• A Standalone Dedicated Control Channel (SDCCH) block is allocated to
a user by the access grant channel (AGCH) in response to a random
access (RACH) request for a channel
• SDCCH carries signalling between
the MS and BTS while no traffic
channel (TCH) is active SDCCH Activity Mean Holding Time (s)

• The main activities on SDCCH Call Set-up 2.5

and the mean holding times for Location Updating (Automatic) 3.5
Location Updating (Periodic) 3.5
these are shown here: IMSI Attach 3.5
IMSI Detach 3.0
SMS Message 6.5
Supplementary Services 2.5
 Section 1 - Channel Dimensioning

SDCCH Grade of Service

• One of the main functions of SDCCH is to carry call setup signalling
• Since access to a TCH is via SDCCH, the grade of service for
SDCCH must be significantly better than for TCH - typically 2 to 4
times better - e.g. if TCH GoS = 2%, SDCCH GoS = 0.5% to 1%
Services using
Voice calls require
only SDCCH
SDCCH then TCH
e.g. SMS
TCH
requests
Carried traffic on
TCH
SDCCH
requests

Blocking Blocking
 Section 1 - Channel Dimensioning

SDCCH Example
• Question:
A cell is required to serve 500 subscribers
SDDCH grade of service is set at 0.5%
Typical SDCCH traffic in the busy hour is 5 mE

How many blocks are required for the SDCCH channel?

• Solution:
Total SDCCH traffic = 500 x 5 = 2500 mE = 2.5 E
From Erlang B tables, using GoS = 0.005, this requires 8 blocks

• How are the required SDCCH blocks to be allocated?

 Section 1 - Channel Dimensioning

SDCCH Allocation
• SDCCH blocks are allocated on the control channel multiframe
structure in a group of 4 (SDCCH/4) or 8 (SDCCH/8)
• Each SDCCH block comprises 4 timeslots and carries one
SDCCH message
• SDCCH/4 is combined with other control channels on timeslot 0:
SDCCH/4 allocation
Downlink
SDCCH SDCCH SDCCH SDCCH SACCH SACCH
F S BCCH CCCH F S CCCH CCCH F S 0 1 F S 2 3 F S 0 1 I

Uplink
SDCCH SACCH SACCH SDCCH SDCCH SDCCH
3 R R 0 1 RACH 0 1 R R 2

Note: SACCH 2 and 3 are

Combined multiframe structure carried on the next multiframe

• One SDCCH block may be replaced by CBCH if required

 Section 1 - Channel Dimensioning

Non- Combined Multiframe SDCCH

SDCCH/8 may be allocated on a non-combined

multiframe:
SDCCH/8 allocation
Downlink
SDCCH SDCCH SDCCH SDCCH SDCCH SDCCH SDCCH SDCCH SACCH SACCH SACCH SACCH
0 1 2 3 4 5 6 7 0 1 2 3 I I I

Uplink
SACCH SACCH SACCH SDCCH SDCCH SDCCH SDCCH SDCCH SDCCH SDCCH SDCCH SACCH
1 2 3 I I I 0 1 2 3 4 5 6 7 0

Non-combined multiframe structure

Other SACCH blocks are on the
next multiframe
 Section 1 - Channel Dimensioning

Practical SDCCH Dimensioning

• Certain locations make greater use of SDCCH and will require particular
allocation, e.g.
• Cells at the border between location areas where location updating
occurs frequently
Location area
boundary cells

• Airport:
Passengers disembark in large numbers and switch on their mobiles imposing a
lot of pressure on SDCCH for location updating
Location updating may be prolonged for international roaming subscribers
 Section 1 - Channel Dimensioning

CCCH Configuration
• On the downlink, CCCH consists of a number of blocks carrying paging
(PCH) and access grant (AGCH) messages
• A combined multiframe has only 3 CCCH blocks to allow for SDCCH and
SACCH:
SDCCH SDCCH SDCCH SDCCH SACCH SACCH
F S BCCH CCCH F S CCCH CCCH F S 0 1 F S 2 3 F S 0 1 I

• A non-combined multiframe has 9 CCCH blocks on timeslot 0:

F S BCCH CCCH F S CCCH CCCH F S CCCH CCCH F S CCCH CCCH F S CCCH CCCH I

• A complete paging or access grant message takes four bursts (timeslots),

i.e. one CCCH block
 Section 1 - Channel Dimensioning

CCCH Priority
• CCCH blocks are dynamically allocated to either PCH or AGCH
according to the following priority:

High
PCH
Priority

Immediate Assignment Message (AGCH)

Immediate Assignment Reject Message (AGCH)

Low

• During periods of heavy paging, PCH could dominate, leaving no blocks

for access grant messages
• To avoid this, some blocks can be reserved for AGCH
 Section 1 - Channel Dimensioning

Reserving AGCH Blocks on CCCH

• In a non combined multiframe, up to 7 of the 9 blocks may be
reserved for AGCH:

F S BCCH CCCH F S CCCH CCCH F S CCCH CCCH F S CCCH CCCH F S CCCH CCCH I

• In a combined multiframe, up to 2 of the 3 blocks may be reserved for

AGCH:

SDCCH SDCCH SDCCH SDCCH SACCH SACCH

F S BCCH CCCH F S CCCH CCCH F S 0 1 F S 2 3 F S 0 1 I

• Additional CCCH capacity can be provided on other timeslots (2,4 or

6) of the BCCH carrier if required
• The number of AGCH blocks reserved is specified in the system
information messages which the mobile reads on the BCCH
 Section 1 - Channel Dimensioning

Paging Capacity

• Paging capacity is the number of mobiles

that can be paged per second

• This depends on:

• CCCH configuration
• AGCH blocks reservation
• Type of paging message used

• Paging message takes 4 bursts (1 CCCH

block)

• This can page up to 4 mobiles depending on

the message type used
 Section 1 - Channel Dimensioning

Calculating Paging Capacity

XY
Paging Capacity = mobiles / second
0 .235

X = number of mobiles paged per paging message (1 to 4)

Y = number of possible paging messages per multiframe
Duration of control channel multiframe = 0.235 seconds (235 ms)

• X depends on paging message type

• Y depends on CCCH configuration in the multiframe (e.g. 3 or 9) and the
number of AGCH blocks reserved
 Section 1 - Channel Dimensioning

PCH Dimensioning
Paging channel requirement in blocks per multiframe is given by:

Calls x MT x PF x M
PMF x 3600 x 4.25

Calls = Number of calls predicted for the location area during busy
hour
MT = Fraction of calls which are mobile terminated
PF = Paging Factor = number of pages required per call
M = safety margin
PMF = Paging Message Factor = number of pages per message
Number of control channel multiframes per second = 4.25 (1 /
0.235)
 Section 1 - Channel Dimensioning

PCH Dimensioning - Example

• A particular location area contains 50 000 subscribers. It is predicted that
30% of these will receive a call during the busy hour. On average 2 pages
are needed per call and only type 3 paging messages (TMSI) are used.

This gives the following data:

Calls = 50 000
PCH Requirement = Calls x MT x PF x M
MT = 0.3
PF = 2 PMF x 3600 x 4.25
PMF = 4
A typical safety margin for peak variations in number of calls is 1.2

• PCH requirement 50000 x 0.3 x 2 x 1.2

= 0.6
= 4 x 3600 x 4.25

• 1 PCH block per multiframe will be adequate

 Section 1 - Channel Dimensioning

AGCH Dimensioning
• AGCH requirement is found by adding up the activities which need
an AGCH message during the busy hour
• The following equation gives the number of AGCH blocks per
multiframe:
(Calls + LU + SMS + IA + ID + SS) x M
AGCH required =
3600 x 2 x 4.25

The terms in brackets are the predicted numbers during the busy hour for:
Calls, Location Updates (LU), SMS, IMSI attaches (IA), IMSI detaches (ID),
Supplementary Services (SS)
M = safety margin (e.g. 1.2)
The PMF factor of 2 is because each AGCH block can carry 2 immediate
assignment
messages
 Section 1 - Channel Dimensioning

AGCH Dimensioning - Example

• A cell has 1000 calls during the busy hour
• Other AGCH activities are modelled as multiples of the calls figure.
A possible model is:
Activity Multiplier Total
LU 2 2000
SMS 0.1 100
SS 0.2 200
IMSI attach 0.2 200
IMSI detach 0.1 100

• This gives the total activity (including Calls) as 3600

3600 x 1.2
AGCH required = = 0.14 AGCH blocks per
3600 x 2 x 4.25 multiframe
 Burst types
• Frequency correction burst
Used to transmit the FCCH channel. No information.

• Synchronisation burst
Used to transmit synchronisation information.

• Access burst
Used to send RACH information.
RACH contains the first message from the MS to the BTS.
It has a long guard period to allow the BTS to calculate the MS distance
from the BTS and to provide timing advance information to the MS.

• Normal burst
Used to send all other logical channel information.

• Dummy burst
Used to fill up unused timeslots in the TRX, which transmits the BCCH
channel.
No real information.
Normal bursts and access bursts

Guard time
(8.25 Bits)

Normal
bursts 148 Bits 148 Bits 148 Bits

576.9 micro secs

(156.25 bit times)

Access
bursts 88 Bits 88 Bits 88 Bits

Guard time
(68.25 Bits)
 Multipath propagation

Approx.
17cm

RX sensitivity

BTS
BTS
Fading dips

Inter symbol interference Fading dips caused by

multipath propagation
 Frequency hopping

F1

F2

F3

F4

Time
 Radio
Resource
Management
Baseband (BB) Hopping

RTSL 0 1 2 3 4 5 6 7
TRX-1 B f1 B = BCCH timeslot. It does not hop.

TRX-2 f2 Time slots 1...7 of all TRXs

hop over (f1,f2,f3,f4).
TRX-3 f3

TRX-4 f4

Time slot 0 of TRX-2,-3,-4 hop over f2,f3,f4.

• TRXs are fixed-frequency - the switching is done at baseband in BBFH

• Number of frequencies = number of TRXs, highest hopping gain only in large

configurations
 Radio
Resource
Management
Parameters

General Parameters
btsIsHopping BB (BaseBand Hopping) CA = Cell Allocation
RF (Radio Frequency Hopping) MA = Mobile Allocation
N (No Hopping) MAIO = Mobile Allocation Index Offset
HSN = Hopping Sequence Number

Baseband Hopping
hoppingSequenceNumber1 (HSN1) (TS 0) 0 1 2 7 TS
0 ... 63 (0 = cyclic, 1 ... 63 = pseudorandom) TRX 1 B f1

TRX 2 f2

TRX 3 f3
hoppingSequenceNumber2 (HSN2) (TS 1 ... 7) TRX 4 f4
0 ... 63 (0 = cyclic, 1 ... 63 = pseudorandom)

HSN1 HSN2
 Radio
Resource
Management
Synthesised (RF) Hopping

TRX-1 B B = BCCH timeslot. TRX does not hop.

Non-BCCH TRXs are hopping over

f1, f1, the MA-list (f1,f2,f3,...,fn) attached to the cell.
f2, . . . . f2,
f3, f3,
fn fn
TRX-2

• TRXs (except BCCH) frequency hop

• Each TRX can hop over many frequencies - improved hopping gain
 Radio
Resource
Management
Parameters

RF (Synthesized Hopping) (from Talk-Family BTS onward)

mobileAllocationList (MA) (E)GSM: 1..124 and 975..1023
GSM 1800: 512..885
GSM 1900: 512..810
Note! Max. 63 Frequencies
0 1 2 7 TS

TRX 1 B f1

mobileAllocationId 512 … 885 TRX 2

usedMobileAllocation 512 … 885

MAL(f3,f4..fn)
hoppingSequenceNumber1 (HSN1) TRX 3
0 … 63 (0 = cyclic, 1 ... 63 = pseudorandom)
TRX 4

HSN1
 Radio
Resource
Parameters
Management RF Hopping (Site based MAIO allocation)
MAIO HSN MAIO
offset
TRX-1 BCCH - f1
(sector 1)
BTS-1

TRX-2 TCH 0
0 3
TRX-3 TCH 1
f4
TRX-4 TCH 2 f5
f6
TRX-5 BCCH - f2 f7
f8
TRX-6 TCH 3
(sector 2)

f9
BTS-2

3 3 f10
TRX-7 TCH 4
f11
5 f12
TRX-8 TCH

TRX-9 BCCH - f3
6
(sector 3)

TRX-10 TCH
BTS-3

6 3
TRX-11 TCH 7

TRX-12 TCH 8
 Radio
Resource
Management
Mobile Allocation Index Offset
Benefits of Flexible MAIO Management

• One MA list per site

• One MA list can contain a continuous band

• No risk of co-channel nor adjacent channel being used simultaneously within a site

• Single MA/HSN possible -> only BCCH frequency planning

• More/tighter reuse possible e.g. RF-FH (1/1) and thus more capacity can be
achieved
 Antenna receiver diversity
Approx. 6m (GSM-900)
Approx. 3m (GSM-1800)

Received signal

Antennas

RX RX

Signal
Processing
 Shadowing

BTS

Solution: Adaptive power control

 Propagation delay and TA

allocated time slot allocated time slot

BTS BTS

Effect due to propagation delay Solution using adaptive frame alignment

 Pulse Code Modulation (PCM)

300 - 3400 Hz A/D-

Converter 64000 bit / sec
Amplitude

o 8000 Hz x 8 Bit/s
o 64,000 Bit/s
o
o o o
o o

o
Time
1 o (8000 samples / second)
125 µs o o
8000
o
 PCM30

TS 0
used for synchronisation
32 time slots and alarms

TS 16
Exchange often used for common Exchange
1 channel signalling
2

125 µs time frame

 Partial Erlang table
( calls per hour ) × ( average conversation time )
x Erlangs =
3600 Seconds

Chs 1% 2% 3% 5%
... ..... .... .... .....
15 8.11 9.01 9.65 10.60
16 8.88 9.83 10.50 11.50
17 9.65 10.70 11.40 12.50
18 10.40 11.50 12.20 13.40
19 11.20 12.30 13.10 14.30
20 12.00 13.20 14.00 15.20
21 12.80 14.00 14.90 16.20
22 13.70 14.90 15.80 17.10
.... ...... ...... ..... .....
.... ...... ...... ..... .....
Frequency reuse exercise

• • • •

• • • •

• • • • •

• • •
Frequency reuse patterns (3x3)

6 6
7 8 7 8
3 • 1 • 2 3 • 1 • 2
4 5 6 4 5
9 7 8 9
• 3 • 1 • 2 •
6 4 5 6
7 8 9 7 8
3 • 1 • 2 • 3 • 1 • 2
4 5 6 4 5
9 7 8 9
• 3 • 1 • 2
4 5
9