Mfgsgshsbhddhdhdhdhdhdbdbdbddbdbdbbdbdbdbdbdhdhfhfd

Mttgsgs

1. Module-5 Global System for Mobile (GSM )

2. Introduction to GSM and TDMA Global System for Mobile Communications (GSM) services are a standard collection of applications and features available to mobile phone subscribers all over the world. The GSM standards are defined by the 3GPP collaboration and implemented in hardware and software by equipment manufacturers and mobile phone operators The common standard makes it possible to use the same phones with different companies' services, or even roam into different countries. GSM is the world's most dominant mobile phone standard.

3. GSM Network and System Architecture

4. Cont …, The Major subsystem of GSM Network and System Architecture are Network Switching Subsystem (NSS), Base Station Subsystem (BSS) and Mobile Station (MS). The Mobile Station (MS) is the device provides the radio link between the GSM subscriber and the wireless mobile network. Base Station Subsystem (BSS) Base Transceiver Station (BTS) Base Station Controller (BSC) Network Switching Subsystem(NSS) Mobile Switching Center (MSC) Home Location Register (HLR) Visitor Location Register (VLR) Authentication Center (AUC) Equipment Identity Register (EIR)

5. Cont …, Mobile Station (MS) Mobile Equipment (ME) Subscriber Identity Module (SIM) • MS provides subscribers the means to control their access to the PSTN and PDN Base Station Subsystem (BSS) The BSS communicate with MS over air interface using protocols • BSC and BTS communicate using LAPD protocol • LAPD is the data link protocol used ISDN

6. Cont …, Base Transceiver Station (BTS) Encodes, encrypts, multiplexes, modulates and feeds the RF signals to the antenna. • Communicates with Mobile station and BSC . Consists of Transceivers (TRX) units • It is also called as Radio base station or RBS . RBS is the interface corresponds to the subscribers MS. • Provides radio link the MS over the air interface Base Station Controller (BSC) Manages Radio resources for BTS • Assigns Frequency and time slots for all MS’s in its area • Handles call set up • Handover for each MS. It communicates with MSC and BTS. • Its also contains Transcoder controller (TRC). Urban and suburban area traffic are handled by BSC/TRC

7. Cont …, Network Switching Subsystem(NSS) Mobile Switching Centre (MSC) Heart of the network Manages communication between GSM and other networks Billing information and collection Mobility management - Registration - Location Updating - Inter BSS and inter MSC call handoff - SS7 Protocol

8. Cont …, Home Location Registers (HLR) Stores information about each subscriber that belongs to it MSC in permanent and temporary fashion. As soon as mobile subscriber leaves its current local area, the information in the HLR is updated. Database contains IMSI, MSISDN , prepaid/postpaid , roaming restrictions , supplementary services. Visitor Location Registers (VLR) Temporary database which updates whenever new MS enters its area, by HLR database. Assigns a TMSI (Temporary Mobile Subscriber Identity) to each MS entering the VLR area which keeps on changing Controls those mobiles roaming in its area. Database contains IMSI, MSISDN, Location Area , authentication key

9. Cont …, Authentication Centre (AUC) Contains the algorithms for authentication as well as the keys for encryption. Protects network operators from fraud . Equipment Identity Register (EIR) Stores all devices identifications registered for this network. Database that is used to track handsets using the IMEI (International Mobile Equipment Identity) Short message services the wireless Switching System we need to have an SMS gateway MSC(SMS-GMSC) and an SMS interworking MSC(SMS-IWMSC). The implementation of GPRS for high-speed data transmission and reception requires the use of two additional switching elements A serving GPRS support node (SGSN) A Gateway GPRS support node (GGSN)

10. GSM network interfaces and protocols

11. Cont …, The GSM standard defines interfaces between all architectural elements. The air-interface 'Um' handles wireless communication between the MS and BTS . The A- bis interface connects the BTS and BSC , supporting 64 kbps voice traffic and 16 kbps data/signaling traffic, both carried over the LAPD protocol used in ISDN. The interface between a BSC and a MSC is called the A’ interface , which is standardised within GSM. The A’ interface uses an SS7 protocol called the Signaling Connection Control Part (SCCP) which supports communication between the MSC and the BSS, as well as network messages between the individual mobile subscribers and the MSC . The protocol stack is divided into three layers: Layer 1 Physical Layer Layer 2 Data Link Layer (DLL) Layer 3 Networking or Messaging Layer

12. Cont …, The physical layer in GSM specifications defines the Um air-interface, facilitating communication between the mobile station and the base transceiver station by formatting higher-level data into TDMA packets for transmission over the radio channel. It specifies key aspects such as modulation, coding techniques, power control, synchronization, and structuring of traffic and control packets to ensure efficient channel establishment and maintenance. Additionally , the physical layer of the A and A- bis interfaces adheres to the ISDN standard, supporting 64 kbps digital data per voice user. Control and signaling data in GSM can be transmitted through the same or separate physical channels using Layer II (DLL) and Layer III messages . The LAPDm protocol, a mobile-adapted version of LAPD, ensures reliable data transfer by performing error detection (CRC) and retransmitting damaged frames (ARQ ). LAPD is used for A- bis (BTS-BSC) and A (BSC-MSC) interfaces, while other links use standard LAPD . The Data Link Layer (DLL) manages packet flow for Layer III, handles multiple Service Access Points (SAPs), and provides acknowledgments for packet transmissions. It supports signaling and SMS, with SMS transmitted as fake signaling packets on signaling channels. DLL ensures efficient multiplexing of SMS data into signaling streams.

13. FRAME FORMAT OF THE LAYER II LAPDm Signaling packets in GSM are 184 bits long, matching the LAPD protocol used in ISDN networks, but LAPDm modifies the format for mobile environments. Synchronization bits and CRC codes are removed due to GSM's strong physical layer coding. Optional fields include: Address Field : Identifies SAP, protocol type, and message nature. Control Field : Indicates frame type, sequence numbers, and responses. Length Indicator : Specifies information field length. Fill-in bits (all 1s) are used when there’s no payload, while the information field carries Layer III data . Peer-to-peer Layer II messages (e.g., acknowledgment, ready/not ready, disconnect) lack Layer III payload and support operations on logical signaling channels with operation-specific information bits.

14. Cont …, Layer III: Networking or Signaling Layer manages protocols for establishing, maintaining, and terminating mobile communication sessions. It also controls supplementary and SMS services . Traffic channels use normal bursts for speech and data, while signaling relies on specialized bursts and DLL packaging. Processes like registration involve sequences of messages exchanged over logical channels encapsulated in DLL frames. 184 fixed Address Feild Control Feild Length indicator Information feild fill-in bits cover this field Information Bits Transaction Identifier The Protocol Discriminator Message Type Information Elements Information Elements Identifier

15. Cont …, The Transaction Identifier (TI) field is used to identify a procedure or protocol that consists of a sequence of messages . This field allows multiple procedures to operate in parallel. The Protocol Discriminator (PD) identifies the category of the operation (management, supplementary services, call control, and test proce d ure ). The Message Type (MT) identifies the type of message for a given PD. Elements (IE) is an optional field for the time that an instruction carries some information that is specified by an IE Identifier (IEI ). To further simplify the description of the Layer III messages, GSM standard divides the messages into three sublayers that provide specific functions: – Radio Resource Management (RRM) :-Handles radio link quality, channel allocation, hand-offs, and synchronization

16. Cont …, – Mobility Management (MM):- Manages location updates, registration, authentication, TMSI handling, and security. – Communication Management (CM): -Establishes, maintains, and releases circuit-switched connections, manages calls, SMS, and supplementary services.

17. SS7 Signaling SS7 is a global standard for digital signaling in PSTN, supporting call setup, routing, and control in wireless and wireline networks . Used for call management, roaming, authentication, number portability, toll-free services, call forwarding, caller ID, and secure communications . Provides error correction and retransmission for reliability during failures . Messages exchanged over 64 kbps bi-directional channels (signaling links ). Operates out-of-band, offering faster call setup, efficient voice circuit use, and fraud prevention . Signaling Points : Service Switching Point (SSP) : Handles call setup, termination, and database queries for routing . Signal Transfer Point (STP) : Routes messages between points, eliminates direct links, performs global title translation, and acts as a firewall.

18. Cont …, Service Control Point (SCP) : Responds to SSP queries with routing numbers and manages alternate routing if needed . Advantages of Out-of-Band Signaling :Supports Intelligent Network (IN) services requiring signaling without voice trunks . Improves efficiency and control It provides realibility service by SCPs and STPs are deployed in pairs at separate locations to ensure service continuity during failures.

19. IDENTIFIERS USED IN GSM SYSTEM IMSI The International Mobile Subscriber Identity (IMSI) is a unique identifier, up to 15 digits, stored in the Mobile Station (MS) to confirm valid subscription when connecting to a Base Station (BS). It includes details like country, network type, and subscriber ID . Subscriber Identity Module (SIM): -The SIM card stores the mobile number, PIN, authentication parameters, and can hold small messages . It enables SIM roaming, allowing users to insert it into any GSM phone for customized functionality, making it essential for GSM phones, as the hardware is unusable without it. 15 DIGITS OR LESS 3 digits 2 digits 10 digits Mobile country code Mobile network type code Mobile subscriber identity code

20. Cont …, MSISDN(Mobile station ISDN):-It is unique identification number for mobile telephone subscription in the PSTN numbering plan Location area identity (LAI):- Is used for MS paging and location updating LAI = MCC + MNC + LAC Mobile Country Code (MCC) Mobile Network Code (MNC) Location Area Code (LAC ) IMSEI Each manufactured GSM mobile phone equipment is assigned a 15-bit long International MS Equipment Identity (IMSEI) number to contain manufacturing information 15 DIGITS OR LESS 3 or 1 digits Mobile country code National Destination Code Subscriber Number

21. Cont …, MS Roaming Number (MSRN ):- When an MS roams into another MSC, that unit has to be identified based on the numbering scheme format used in that MSC. Hence , the MS is given a temporary roaming number called the MS Roaming Number (MSRN), This MSRN is stored by the HLR, and any calls coming to that MS are rerouted to the cell where the MS is currently located . TMSI:- As all transmission is sent through the air interface, there is a constant threat to the security of information sent . A temporary identity Temporary Mobile Subscriber Identity (TMSI) is usually sent in place of IMSEI

22. GSM Channel Concept The cellular telephone network use various control and traffic channels. The GSM cellular system is based on the use of TDMA technique to provide additional user capacity over a limited amount of radio frequency spectrum. The GSM system divides the radio link connection time into eight equal and repeating time slots known as FRAMEs for both uplink and downlink transmissions. The timeslots are arranged in sequence and are conventionally numbered 0 to 7 Each time slot is considered as logical channel .

23. Cont …, Figure 2.9 TDMA time frame structure Logical Channels. Broadcast channels Broadcast control channels. Frequency Correction channel Synchronization channels

24. Cont …, Logical Channels  Carry either subscriber traffic or signaling and control information to facilitate subscriber mobility The signaling and control channels consist of three channel sub categories: Broadcast Channels, Common Control Channels, And Dedicated Control Channels.

25. Cont …., Broadcast channels The GSM cellular system uses broadcast channels (BCHS) provide information to the mobile station about various system parameters and also information about the location area identity (LAI). three types BCHs Broadcast control channel Frequency correction channel Synchronization channel Broadcast control channel It contains information that needed by MS concerning the cell that it is attached to in order for the MS to be able to start making or receiving calls , or to start roaming

26. Cont …, Frequency correction channel: It transmits bursts of zeros (this is an un-modulated carrier signal) to the MS.  This signaling is done for two reasons: i ). the MS can use this signal to synchronize itself to the correct frequency and ii). the MS can verify that this is the BCCH carrier Synchronization channel: It transmit the required information for the MS to synchronize itself with the timing within a particular cell . Common Control Channels  The common control channels (CCCHS) provide paging messages the MS and a means which the mobile can request signaling channel that it can use to contact the network. Paging channel Random access channel Access Grant channel

27. Cont …, Paging channel: It is used by the system to send paging messages to mobiles attached to cell. The mobile will paged whenever the network has an incoming call ready for mobile or some type of message (e.g., short message, multimedia message ) to deliver to the mobile Random access channel: It is used by the mobile to respond a paging message . If the mobile receives page on the PCH , it will reply on the RACH (Random Access Channel) with request for signaling channel. Access Grant channel It is used by the network to assign a signaling channel to the MS.

28. Cont …, Dedicated Control Channels These dedicated channels are used for specific call setup , handover , measurement , and short message delivery functions. The four DCCHs are Standalone dedicated control channel Slow associated control channel. Fast associated control channel Cell Broadcast channel Standalone dedicated control channel : used for call setup procedure

29. Cont …, Slow associated control channel: It is used to transmit information about measurements made by the MS or instructions from the BTS about the mobile's parameters of operation . Fast associated control channel It is used to facilitate the handover operation in a GSM system. If handover is required, the necessary handover signaling information is transmitted instead of a 20-ms segment of speech over the TCH.This operation is known as " stealing mode“ Cell Broadcast channel : It is used to deliver short message service in the downlink direction.

30. Traffic channels Traffic channels carry digitally encoded user speech or user data and have identical functions and formats on both the forward and reverse link. One RF channel is shared by eight voice transmissions using TDMA . In terms of spectral efficiency, GSM works out to 25 kHz per voice channel, compared to about 30 kHz for AMPS and about 10 kHz for TDMA-based IS-54 or IS-136 systems . The full-rate traffic channel (TCH/F or Bm ) Half-rate traffic channel (TCH/H or Lm) Enhanced full-rate (EFR) traffic Full-rate traffic channel (TCH/F or Bm )  The full-rate traffic channel (TCH/F or Bm ) carries one conversation by using one timeslot. The transmitted voice signal is encoded at a 13-kbps rate , but it is sent with additional overhead bits.

31. Cont …, Full-Rate Data Channel at 9600 bps (TCH/F9.6) The full-rate traffic data channel carries raw user data that is sent at 9600 bps. With additional forward-error-correction coding applied by the GSM standard, the 9600 bps data is sent at 22.8 kbps Full-Rate Data Channel at 2400 bps (TCH/F2.4) The full-rate traffic data channel carries raw user data that is sent at 2400 bps. With additional forward error correction coding applied by the GSM standard, the 2400 bps is sent at 22.8 kbps. Half-rate traffic channel (TCH/H or Lm) The half-rate traffic channel (TCH/H or Lm) carries voice encoded at 6.5 kbps or data at rates of 4.8 or 2.4 kbps With additional overhead bits, the total data rate for TCH/H becomes 11.4 kbps. Therefore, two conversations or a conversation and a data transfer or two data transfers may be transmitted over one channel at the same time . Half-Rate Traffic Data Channel at 4800 bps (TCH/H4.8) The half-rate traffic data channel carries raw user data that is sent at 4800 bps. With additional forward-error-correction coding applied by the GSM standard, the 4800 bps data is sent at 11.4 kbps. Half-Rate Traffic Data Channel at 2400 bps (TCH/H2.4) The half-rate traffic data channel carries raw user data that is sent at 2400 bps. With additional forward-error-correction coding applied by the GSM standard, the 2400 bps data is sent at 11.4 kbps Enhanced full-rate (EFR) traffic channel Enhanced full-rate (EFR) traffic encodes voice at a 12.2-kbps rate and like TCH/F adds overhead bits to yield a 22.8 kbps channel data rate

32. Design TDMA time slots in GSM In TDMA-based wireless communication, transmission occurs in repetitive frames, each divided into uniform time slots. Each time slot across frames forms a logical channel . Optimizing the time slot length and composition ensures efficient speech and data transmission while maximizing spectrum use . In designing an appropriate frame structure in TDMA, the following requirements are generally considered : Frequency Band of Operation The most common spectrum allocated to cellular mobile communication applications is around 900 MHz . Number of Logical Channels:-let the minimum number of time slots per TDMA frame be 8 so as to serve eight simultaneous users . Channel Bandwidth:-the channel bandwidth should not exceed 200 kHz. Maximum Cell Radius (R):-the maximum cell radius be 35 km the maximum vehicle speed be 250 km/h . Maximum Delay Spread ( Δm ) Delay spread is the difference in propagation delay among different multipath signals arriving at the same Rx antenna maximum coding delay be approximately 20 milliseconds.

33. Cont.,, T he minimum bit rate for an eight-channel TDMA system can be computed as follows: Speech coding Speech coding Speech FRAME STUCTURE Maximum speech field frame Training sequence Final time slots Channel design The PCM speech coder has a data rate of 64 kbps A data rate of 12 kbps is reasonable for reproducing good-quality speech Since the coding delay is restricted to 20 milliseconds, the encoded speech can be formed into blocks of 20 ms duration. This converts the speech samples of 12 kbps × 20 ms = 240 bits . Error correction can then be applied to the 240-bit blocks

34. Cont …, Figure 11.14 shows the tentative design of a time slot, depicting time duration of two blocks of data before and after the training sequence and guard time. Ts 0.06ms T ts Ts Tg

35. FRAME STRUCTURE FOR GSM The GSM system uses the TDMA scheme shown in Fig. 11.15 with a 4.615 ms -long frame, divided into eight time slots each of 557 μs . Each frame is 156.25 bits long, of which 8.25 bits are guard bits . Tail Bits, T (3 Bits each at the Beginning and End of a Time Slot Excluding Guard Bits) It allows synchronisation of transmissions from mobile units located at different distances from the base station. Encrypted Data (114 Bits) Data is encrypted in blocks by conventional encryption of 114 plaintext bits into 114 ciphertext bits; the encrypted bits are then placed in two 57-bit data fields in the time slot

36. Cont …, Training Data (26 Bits) It is used to adapt the parameters of the receiver to the current path-propagation characteristics and to select the strongest signal in case of multipath propagation It enables the mobile subscriber units and base stations to determine that the received signal is from the desired base station and not from a strong interfering base station. Guard Bits, G (8.25 Bits) It is used to avoid overlapping with other bursts due to different path delays. The 148 bits of a data burst are used to transmit the information . Delimited by tail bits (consisting of 0s), the frame contains 26 training bits sandwiched between two bursts of data bits . These training bits allow the receiver to synchronise itself.

37. TDMA Hyper Frame structure TDMA Hyperframe structure Hyperframe is a multi frame sequence that is composed of 2048 superframes and is largest time interval in the GSM system ( 3 hours, 28 minutes, 53 seconds ) Eight of these burst periods are grouped into what is known as a TDMA frame

38. Cont …, GSM Super frame Multi frames are then constructed into superframes taking 6.12 seconds. These consist of 51 traffic multiframes or 26 control multiframes . GSM Hyperframe Above this 2048 superframes (i.e. 2 to the power 11) are grouped to form one hyperframe which repeats every 3 hours 28 minutes 53.76 seconds . It is the largest time interval within the GSM frame structure. Frequency hopping : Frequency hopping is a feature that is optional within the GSM system. It can help reduce interference and fading issues Encryption: The encryption process is synchronized over the GSM hyperframe

39. GSM Traffic and control signal bursts GSM Traffic and control signal bursts

40. Cont.., The normal burst consists of 3 start bits, 8.25 guard bits, 116 encrypted bits (114 data + 2 flag bits), and a 26-bit training sequence . The start bits handle power ramping and decoding, while the training sequence, centered in the burst, trains the receiver's equalizer. The FCCH burst in TS 0 broadcasts frequency synchronization messages for MSs to align with the system's master clock.

41. GSM speech processing In the mobile, speech is digitized and broken up into 20 ms segments . This process produces 8000 samples of 13 bits per sample per second or 160 samples of 13 bits per 20 ms . The speech coder is 260 bits per 20 seconds are the 3 kbps whereas the channel coding yields 456 bits per 20 ms or a 22.8 kbps data rate . Interleaving, ciphering, and burst formatting is yields 156.25 bits per time slot. This yields an overall data transfer rate of 270.8 kbps over a GSM channel. Channel model is created in the Equalizer where and estimated bit sequence is calculated for a receiver signal.

42. Registration For an MS to operate, it registers with the BTS. The MSC assigns a TMSI and updates the VLR and HLR. Upon switching on, the MS may register with the network, potentially through a non-home BS . It passively synchronizes to the nearest BS's frequency, bit, and frame timings for communication.

43. Mobile-to-Network Call The mobile subscriber monitors the BCH, synchronizes with the nearest base station, and locks onto the system via BCCH, FCCH, and SCH messages . To initiate a call, it sends RACH data on the base station's ARFCN . The base station responds with an AGCH message on the CCCH, assigning an ARFCN and TS for SDCCH connection. The subscriber then switches to the assigned channel and time slot.

44. Network-to-Mobile Call To connect a landline call to a mobile subscriber, the gateway MSC processes the request, retrieves routing information from the HLR, and contacts the destination MSC . The destination MSC initiates paging via BSS, and the mobile responds with an RACH message . The base station assigns channels (AGCH, SDCCH, SACCH) for authentication and timing advance, after which the TCH is allocated, completing the connection. PSTN GMSC MSC HLR VLR BSS Mobile subscriber

45. Intra-BSC handover During the call, MS will measure the strength and quality of the signal on the TCH and the signal strength from the neighboring cell The BTS will send the results of measurements on the TCH to the BSC In the BSC, the function is activated when the placement is required to handover to another cell MS choose a new frequency handover and access to the appropriate time slot. MS send a " HO complete message ."

46. Cont …,

47. Inter BSC handover

48. Inter-MSC handover

49. GSM Services: GSM Tele-services GSM Bearer or Data Services Supplementary services Tele services : Voice communication between two users Teleservices provide standard voice communications between end users and additional communications between two end user applications according to some standard protocol. • Offered services - Mobile telephony - Emergency calling

50. Cont …, Bearer services : Provide the user with ability to transfer data between user network interfaces. Bearer services provide user with the ability to transmit data between user network interfaces. Include various data services for information transfer between GSM and other networks like PSTN, ISDN etc at rates from 300 to 9600 bps Short Message Service (SMS) - up to 160 character alphanumeric data transmission to/from the mobile terminal Voice mailbox

51. Cont.., Supplementary services : Supplementary services are services that enhance or support a teleservice provided by the network. Call related services: • Call Waiting- Notification of an incoming call while on the handset • Call Hold- Put a caller on hold to take another call • Call Barring- All calls, outgoing calls, or incoming calls • Call Forwarding- Calls can be sent to various numbers defined by the user • Multi Party Call Conferencing - Link multiple calls together

52. Features of GSM Key Features of GSM (Global System for Mobile Communications): Digital Technology : GSM uses digital communication for improved voice quality and capacity. Frequency Bands : Operates in 900 MHz, 1800 MHz, and 1900 MHz bands. Multiple Access Method : Utilizes TDMA (Time Division Multiple Access) for efficient bandwidth sharing. International Roaming : Provides seamless cross-border connectivity through agreements between operators. SIM-Based Architecture : Subscriber information is stored in a removable SIM card, offering flexibility and security. Encryption : Ensures secure communication with robust encryption algorithms. Low Power Consumption : Optimized for mobile devices to extend battery life. Short Message Service (SMS) : Supports text messaging between devices. Support for Data Services : Includes circuit-switched data, HSCSD, GPRS, and EDGE for internet and multimedia. Call Features : Offers call forwarding, waiting, barring, and conference calls. Cell Broadcast : Delivers information to multiple users within a geographical area. Handoff : Ensures continuity of calls when moving between cells.

53. Thank you