CGI = LAI + Cell ID

Cell ID 2 Octet
LAI = MCC + MNC + LAC
LAC 2 Octet or 4 digit HEX or 16 bit
MSISDN = MCC + NDC + SN 15 digit (3+2+10) NDC + SN = NSN
MSRN = MCC + NDC + SN
Assigned by present VLR, stored in HLR, used by GMSC
IMSI = MCC + MNC + MSIN 15 digit (3+2+10); Stored at SIM, HLR, VLR and AUC; MNC + MSIN = NMSI
TMSI 32 bit Assigned by VLR after authentication; changes on Loc updation, not passed to the HLR
LMSI 32 bit used in VLR for easy sub identification, will passed to the HLR
ICCIC 19 digit starting with 89
IMEI = TAC + FAC + SN + SP 19 Digit (6+6+6+1); Never sent in cipher mode by MS
SIM --- p + 256B RAM + 16KB ROM + 8KB EPROM
Ki + RAND --A3-SRES (32 bit)
Kc & RAND 128 bit
Ki + RAND --A8-Kc (64 bit)
Kc + TDMA Frame No 22 --A5-ciphering stream (CS)
CS XOR 114 information bit Ciphered bit
Authentication triplets - RAND (128 bits), SRES (32 bits) & Kc (64 bits)
GSM 900
GSM 1800 (DCS)
UP LINK 890 to 915 MHz
UP LINK 1710 to 1785 MHz
DOWN LINK 935 to 960 MHz
DOWN LINK 1805 to 1880 MHz
Spectrum Bandwidth - 25 MHz
Spectrum Bandwidth - 75 MHz
Carrier Bandwidth 200 KHz
Carrier Bandwidth 200 KHz
st
No of channels 125 (1 channel willnt use)
No of channels 375
Duplex Distance - 45 MHz
Duplex Distance - 95 MHz
Access Method - TDMA/FDMA
Modulation Method - GMSK
Transmission/Carrier bit Rate - 270.833 Kbps
Speech Coding RPE-LTP
Full rate 13 Kbps; Half rate 6.5 Kbps
Interference/frequency reuse Ratio = D/R = 3N = q
Frequency reuse factor/cell pattern 4, 7, 12, 21
Cell capacity and cluster size (frequency reuse factors) are inversely proportional
No of Neighbors keeping 6;
Only hard handoff
Duration of a bit = 3.9s
A block of 20 ms is encoded in one set of 260 bits
It is channel coded to 456 bits (22.8 kbps)
These 456 bits for every 20 ms of speech are interleaved forming eight blocks of 57 bits each.
In one burst one block of 57 bits from one sample and another block from another sample are
sent together.
136 bits training sequence added to 456 bits basic speech/data to form 592 bits data
Spectral efficiency = 1.354 bps/Hz Actual spectral efficiency = 1.354/frequency reuse factor
Timing Advance 0 to 63 bit, Max 35 Km
Discontinuous TXM VAD comfort noise extend battery life
MS BTS
Um
BTS BSC
A bis
BSC MSC
A
MSC VLR
B
MSC HLR
C
HLR VLR
D
MSC EIR
F
VLR VLR
G
HLR AUC
H
MSC PSTN ISDN, SMSC, GMSC, MMSC, VMSC
E interface
BSC Transcoder
A ter
Transcoder (TRAU) 13kbps to 64kbps conversion

Traffic Channel (TCH) Full Rate 13 kbps, enhanced full rate 12.2 kbps, half rate 5.6 kbps
HSCSD (data) Full rate 9.6/4.8/2.6 kbps, half rate 7/4.2/2.4
Control Channels

BCH BCCH, FCCH, SCH, CBCH

CCCH PCH, RACH, AGCH
DCCH SDCCH, SACCH, FACCH
BCCH Cell ID, LAI. Act as beacon (900MHz 30 BCCH max will be searched; 1800MHz 10 BCCH)
SCH Time slot sync; contain base station identity code BSIC & TFN BSIC = NCC + BCC
CBCH cell specific info (Optional)
PCH Paging when i/c call comes; Discontinuous reception
RACH to request allocation of a specific SDCCH; Uplink channel
SDCCH location registration, updation, authentication, ciphering, SMS, call setup info flow
SACCH Radio link supervision, measurement, Power control, TA; 13th frame (frame no 12) of TCHMF
FACCH Urgent procedure like handover; Will use time slot of TCH by setting stealing bit/flag
FCCH, SCH, BCCH are not frequency hopped
Each TS/burst of TDMA frame = 0.577ms (156.25 bits = 148 bits + 8.25 bits time is empty
Guard Period)
FCCH Burst:
3
142
3
8.25
Tail
Fixed
Tail Guard
bits
bits
bits
bit
Normal Burst:
3
57
1
26
1
57
3
8.25
Tail
Data
Stealing Training Stealing
Data
Tail Guard
bits
bits
bit
sequence
bit
bits
bits
bit
One TDMA frame = 0.577 * 8 = 4.615 ms
Traffic Channel Multiframe = 26 TDMA Frame = 120 ms. Frame 12 is SACCH, 25 is idle
Control Channel Multiframe = 51 TDMA Frame = 235.365 ms
0 FCCH
1 SCH
2 5 BCCH
6 9 CCCH
BCCH + FCCH +SCH + PCH
BCCH + FCCH +SCH + PCH + SDCCH/4 + SDCCH/4
SDCCH/8 + SDCCH/8

50 Idle

Superframe 6.12s 26 CCHMF + 51 TCHMF All logical channels will be cycled once.
Hyperframe 2048 superframe
3 Hrs 28 min 53 sec 760 msec
Complete cycle of frequency hopping;
TDMA frame number will reset
BTS Radio link management
BSC Radio resources management, inter cell handover, power control, TA, frequency reallocation
MSC switching, paging, resource allocation, location registration, encryption
Echo canceller used on PSTN side

1. The MS will send a Channel Request message to the BSS on the RACH.
2. The BSS responds on the AGCH with an Immediate Assignment message and assigns an
SDCCH to the MS.
3. The MS immediately switches to the assigned SDCCH and sends a Location Update Request
to the BSS. The MS will send either an IMSI or a TMSI to the BSS.
4. The BSS will acknowledge the message. This acknowledgement only tells the MS that the
BTS has received the message, it does not indicate the location update has been processed.
5. The BSS forwards the Location Update Request to the MSC/VLR.
6. The MSC/VLR forwards the IMSI to the HLR and requests verification of the IMSI as well as
Authentication Triplets.
7. The HLR will forward the IMSI to the Authentication Center (AuC) and request
authentication triplets.
8. The AuC generates the triplets and sends them along with the IMSI, back to the HLR.
9. The HLR validates the IMSI by ensuring it is allowed on the network and is allowed
subscriber services. It then forwards the IMSI and Triplets to the MSC/VLR.
10. The MSC/VLR stores the SRES and the Kc and forwards the RAND to the BSS and orders
the BSS to authenticate the MS.
11. The BSS sends the MS an Authentication Request message. The only parameter sent in
the message is the RAND.
12. The MS uses the RAND to calculate the SRES and sends the SRES back to the BSS on the
SDCCH in an Authentication Response. The BSS forwards the SRES up to the MSC/VLR.
13. The MSC/VLR compares the SRES generated by the AuC with the SRES generated by the
MS. If they match, then authentication is completed successfully.
14. The MSC/VLR forwards the Kc for the MS to the BSS. The Kc is NOT sent across the Air
Interface to the MS. The BSS stores the Kc and forwards the Set Cipher Mode command to the
MS. The CIPH_MOD_CMD only tells the MS which encryption to use (A5/X), no other
information is included.
15. The MS immediately switches to cipher mode using the A5 encryption algorithm. All
transmissions are now enciphered. It sends a Ciphering Mode Complete message to the BSS.
16. The MSC/VLR sends a Location Updating Accept message to the BSS. It also generates a
new TMSI for the MS. TMSI assignment is a function of the VLR. The BSS will either send the
TMSI in the LOC_UPD_ACC message or it will send a separate TMSI Reallocation Command
message. In both cases, since the Air Interface is now in cipher mode, the TMSI is not
compromised.
17. The MS sends a TMSI Reallocation Complete message up to the MSC/VLR.
18. The BSS instructs the MS to go into idle mode by sending it a Channel Release message.
The BSS then deassigns the SDCCH.
19. The MSC/VLR sends an Update Location message to the HLR. The HLR records which
MSC/VLR the MS is currently in, so it knows which MSC to point to when it is queried for the
location of the MS