Sei sulla pagina 1di 39

1 Introduction

1.1 Development

By 1979, several mobile radio networks already existed worldwide. They


operated on different frequency bands and were based on different standards. A
mobile phone user in Britain could not use his mobile phone in Sweden, because
the British and the Swedish mobile radio networks were each based on their own
standards, with different signalling protocols, and were incompatible with each
other.

In view of the European unification process, it became clear that mobile


telephony, too, had to overcome national borders. A new European standard was
due! For this purpose, the "Conférence Européenne des Administrations des
Postes et des Télécommunications " established a workgroup, whose task was to
work out specifications for a standard Western European mobile system. This
was the Groupe Speciál Mobile, GSM, after which the new standard - the Global
System for Mobile Communications - was named

In 1988, the European Telecommunications Standards Institute (ETSI) was


founded. Its task was to work out the GSM standard for a digital radio telephone
network.

In the GSM 900 standard, a frequency range between 890 and 915 MHz was
assigned to the uplink, and a range between 935 and 960 MHz was assigned to
the downlink.

In GSM 1800, the frequency ranges 1710 - 1785 MHz were added in the uplink
and 1805 - 1880 MHz in the downlink.

In 1995, GSM 1900, with its own frequency range from 1850 to 1910 MHz in the
uplink and 1930 to 1990 MHz in the downlink, was implemented in America. At
the end of 1996, there were already 120 GSM networks in operation, and within
the year 2000 there were already 150 million GSM users all over the world.

The GSM specification had to consider the following: The system had to

• Function Europe-wide
• Provide a high speech quality
• Use the available frequencies as efficiently as possible
• Provide ISDN service characteristics
• Be compatible with other ways of data transmission and
• Meet high security requirements as far as the customers and the
transmitted information were concerned.

Many of these conditions have been turned into advantages for the users of
today:
• The available frequencies are used efficiently.
• The average speech quality is higher than in analog mobile networks.
• Speech encryption guarantees the security standards.
• A wider range of services is provided compared to analog cell networks,
like voice-, fax-, data- or Internet services.
• International roaming between all the GSM countries is possible.
• Furthermore, international competition reduces the prices.

1.2 GSM Today

Today, GSM is the first digital cellular mobile communication system to enable
international roaming and ISDN service characteristics.

GSM is an open standard for services, infrastructure and communication -


independent of the individual countries, network operators and producers, and
flexible to the requirements of the individual user.

All this has boosted the development of GSM:

• Now, over 300 network operators in 130 countries are offering GSM
services.
• Over 150 million customers use GSM.
• A considerable share of the world-wide telecommunication market goes to
GSM products and -services.

The cellular structure in GSM provides an almost complete radio coverage. The
system allows a maximum distance of 35 kilometers between the mobile station
and the base station. Therefore, the geographical area where GSM is used must
be subdivided into smaller areas, which are known as cells.

The cell size must be adjusted to the subscriber density and to the environment.
If a subscriber moves from one cell to another during a call, the connection is
handed over from the old radio station to the new radio station, without any
interruptions. This procedure is called "handover".

GSM distinguishes different channels on the basis of their frequency. Each cell is
assigned one or more frequencies, which it uses to serve active subscribers. An
uplink/downlink frequency pair can be used by up to 8 mobile stations practically
simultaneously. This is done with the help of the Time Division Multiple Access
(TDMA). Since there is only a limited amount of available traffic channels, high
subscriber numbers require that the frequencies be used several times. This is
not an insoluble problem, since several cells can use the same frequency,
provided that the distance between the cells is sufficient. But it sometimes makes
network planning a very complex task.
Thus GSM offers capacity for more subscribers than one would expect in view of
the very limited supply of frequency resources.

To guarantee flexibility, open interfaces are specified in GSM between particular


network elements. This way, network operators can be supplied by different
producers. Nevertheless, the interfaces' functionality is very well specified, to
guarantee a smooth data transmission.

In GSM, there are two truly open interfaces.

The first one is the air interface, located between the mobile and the base
station.

The other one is the A-interface between the Base Station Subsystem (BSS) and
the Network Subsystem (NSS). The GSM network structure is decentralized, and
consists of three separate subsystems communicating with each other over a
series of interfaces. Apart from the Network Subsystem for routing, and
subscriber localisation, and the Base Station Subsystem (BSS) for radio
coverage and radio resource management, there is also the Operation &
Maintenance Subsystem (OMS), which guarantees network management and
administration.

1.3 Evolution from GSM to the 3rd Generation

GSM has been designed, above all, for speech communication. Although the
standard also offers data services, their possibilities are limited by a data rate of
9.6 kbps. To meet the growing demands of increasingly complex data
applications, e.g. in the multimedia or Internet sector, higher data rates are
necessary. Therefore, the system's capacity is constantly being enhanced.

1.3.1 HSCSD

One extension of the GSM standard is High Speed Circuit Switched Data
(HSCSD). This innovation gives the bit rates an enormous boost. HSCSD is
circuit-switched and optimizes the existing transmission rates in two respects:

Firstly, a new channel coding method, available in GSM Phase 2+ in single


circuit-switched data, increases the data rate from 9.6 kbps to 14.4.

Secondly, the bundling of up to 4 timeslots can increase the user data rate to
57.6 kbps. This allows, for example,

• Faster e-mail transfer


• Faster file transfer, and
• Speedier and thus cheaper webbrowsing and data download from the
Internet.
As most of the services used require higher data rates in the downlink than in the
uplink, HSCSD really shows an asymmetrical implementation, e.g. 3 timeslots in
the downlink and 1 in the uplink. This also facilitates mobile station design and
avoids battery capacity problems.

1.3.2 GPRS

In contrast to HSCSD, the General Packet Radio Service GPRS is packet-


switched instead of circuit-switched. The radio network resources are only used if
data is actually being transmitted.

Thus, billing is no longer based on the duration of the call, but on the amount of
transmitted data. Additionally, the type of data service can be charged, for
example web browsing or WAP access.

By bundling up to 8 channels, a data rate of up to 171.2 kbps can be achieved,


with up to 8 subscribers per channel. The more subscribers transmit data within a
cell, the more the datarate available to each individual user is reduced. GPRS
requires some modifications to the existing GSM infrastructure. Together with
HSCSD, GPRS is a further step towards mobile multimedia.

1.3.3 EDGE

Enhanced Data Rates for Global Evolution (EDGE) is a technology concentrating


on the air interface between the mobile and the base station. Based on a new
modulation process, 8 Phase Shift Keying, or 8-PSK, EDGE achieves three times
the data rates of HSCSD and GPRS at the air interface. Furthermore, with
EDGE, the subscriber can use all 8 timeslots at the air interface. In contrast to
GSM, a digital data unit at the air interface, a symbol, is not just one bit, but three
bits.

This technology allows data rates of almost 474 kbps per user. On the other
hand, EDGE is very bit error sensitive and requires careful planning and a
sufficient number of base stations.

1.3.4 UMTS

The Universal Mobile Telecommunications System (UMTS), represents the 3rd


generation of mobile communication. It achieves bit rates of up to 2 Mbit/s if the
mobile is static and no other user is transferring any data. Realistic situations will
allow a maximum of 144 or 384 kbps. The introduction of UMTS won't make
GSM unnecessary. Simple services like speech will be dealt with by GSM in the
future, whereas high data rate multimedia services and mobile office applications
will be handled by UMTS. UMTS mainly affects the air interface, where a
broadband transmission method achieves high transmission speeds. This
requires considerable changes to the network architecture. Thus, especially at
the beginning, a close cooperation with the existing GSM network structure is
necessary to guarantee that services are supplied area-wide.

2 GSM Services
2.1 Classification

The GSM services subdivide into the Bearer Services and the Teleservices.
These base services are supplemented by the Supplementary Services. In
addition, we have the Value Added Services.

The Bearer Services are telecommunication services that guarantee the


transmission of signals between access points in telecommunication networks.
They are used exclusively for transport and define the services a network can
offer, for example data transmission between a corporate network and a mobile
notebook, or data download from the web.

The Teleservices are telecommunication services as well as functions that


enable communication between users, and are based on protocols agreed on by
the network operators. Teleservices affect the final link in the communication
process - the end user. They include telephone services, emergency calls, the
Short Message Service, E-mail and fax.

Supplementary Services modify or add to the basic telecommunication services.


They are only offered in combination with a Bearer Service or a Teleservice. The
same Supplementary Service can be applied to a range of Telecommunication
Services. Most of these services have been inherited directly from fixed
networks, with some concessions as regards their adjustment to the mobile radio
network. Supplementary Services include e.g. line identification and call
forwarding. Value-Added Services depend on the service provider or network
operator they are supplied by. They are not predefined in specifications, and
include e.g. reservation or information services.

Let's have a closer look at the services.

2.2 Bearer Services

GSM specifies a huge variety of Bearer Services for data transmission. Bit rates
between 300 and 9,600bps can be chosen according to data terminal equipment
and the interference situation of the air interface. With HSCSD, the data rate may
increase to 57.6 kbps.

All Bearer Services are handled as circuit-switched services between the mobile
data equipment and the NSS requiring a permanent link between the involved
components.
A converter, called Packet Assembler-Disassembler or PAD, is used to adapt
these signals to the packet-switched mode in public data networks, e.g. the
Internet. With GPRS, a total packet-switched transmission is provided between
all data terminal equipment at a maximum bit rate of 171.2 kbps.

2.3 Teleservices

Teleservices provide voice and non-voice services. Voice services include


normal speech telephony and emergency calls. Non-voice services include the
Short Message Service, for example, that is the sending, receipt and broadcast
of short messages.

Short messages can be received at any time, even during a call, and are
transmitted over signalling channels. Whereas normal short messages are stored
temporarily in the Short Message Service Center SMSC, with Cell Broadcast
they are stored in the Base Station Controller BSC.

The fax services, also referred to as Group 3 facsimile, provide automatic fax
service between a mobile fax and a fax machine within a PSTN, or between 2
mobile fax terminals, each with its own MSISDN at a maximum speed of 9.6
kbps.

2.4 Supplementary Services

Supplementary Services can be controlled by the subscriber as well as by the


network. There are two groups of services.

First, there are those services which are provided by the service provider and
made available to a customer.

Then there are the services which are invoked by a customer. The desired
service is, for example, activated by a customer pressing a particular key, as is
the case with line identification.

The supplementary services subdivide into several types.

2.4.1 Line Identification Services

The Line Identification Services include the Calling Line Identification


Presentation (CLIP), that is the display of the caller's number on the called
party's mobile station. The network transmits the call number at call set-up,
provided that both parties are ISDN or GSM customers.

Using Calling Line Identification Restriction (CLIR), the calling party can restrict
its call number, so it cannot be identified by the called party. An appropriate
instruction is sent from the caller's network to the network of the recipient. Some
networks allow particular user groups, such as the police, to identify a call
number even if the CLIR service is activated.

In accordance with CLIP and CLIR, there is the Connected Line Identification
Presentation, COLP, for identification of the called party by the caller, and
Connected Line Identification Restriction, COLR, if the called party does not want
to be identified by the caller. COLP and COLR come into play when the called
party has diverted its number to another number.

2.4.2 Call Offering Services

Call Offering Services are services which allow a customer to forward incoming
calls to other target numbers.

Call Forwarding Unconditional CFU ensures that all incoming calls are diverted to
a number specified by the customer, independent of the conditions of the call.

Call Forwarding on mobile Subscriber Busy CFB diverts calls only if the called
subscriber is making a call and the line is busy. Calls can also be diverted if the
called party can't be reached - because it currently has no network access,
because the phone is switched off, or because the call is not accepted.

Supported by the Optimal Routing Service SOR - a GSM Phase 2+ feature - calls
are routed directly to the subscriber's current location. This service is based on
the information provided by the called subscriber's home network. As an option,
the network may permit or deny SOR on a per call basis. SOR has not yet been
implemented.

2.4.3 Call Completion Services

Call Completion Services allow the customer to postpone incoming calls which
he is currently not able to accept, as well as to hold calls while simultaneously
making another call.

Call Waiting CW notifies the customer of an incoming call when no traffic channel
is available, and the customer is engaged in an active or held call. The customer
now has from half a minute to two minutes time to decide whether to accept,
reject or ignore the postponed call.

The Call Holding Service HOLD permits the customer to interrupt communication
on the active call for another call, without losing the connection to the first call.
This is because the traffic channel remains assigned to the customer even after
interruption of the active call, so he can resume the communication.

2.4.4 Multi Party Supplementary Services


Multi Party Services, also called conferencing services, allow the customer to
communicate with more than one party simultaneously. The Multi Party Service
can be initiated if a customer is in control of at least one active call and one call
on hold. After it has been initiated, parties an be added, disconnected or
separated. Thus the subscriber initiating the service can add more parties to the
Multiparty Call and exclude others from conversation. At the same time, he can
have a private conversation with another party, which the other participants
cannot hear. During all this, the participants of the Multiparty Call can still
communicate with each other.

2.4.5 Closed User Groups (CUG)

Closed User Group (CUG) gives a particular group of customers the opportunity
to communicate with each other in PLMN or ISDN networks. The members of a
Closed User Group can't communicate with subscribers outside the group. If
desired, one or more subscribers in this group can be authorised to call
subscribers outside, or to receive calls from them.

Emergency calls are not subject to the restrictions of this service.

2.4.6 Advice of Charge

The service Advice of Charge (AOC) is a supplementary service that allows a


mobile subscriber who uses services to receive service-related billing details.

With Reverse Charging, on the other hand, a called subscriber can be charged
for certain calls. For this purpose, each individual call is analyzed and evaluated.
Reverse Charging is activated at request by the calling subscriber, and must be
permitted by the called subscriber. At present, Reverse Charging is not
implemented in GSM networks.

2.4.7 Call Restriction Services

There are basically two categories of Call Restriction Services: one refers to
outgoing calls, and the other to incoming calls. The service offers several
possibilities, such as:

• Barring all outgoing and incoming calls


• Barring all outgoing international calls

or

• Barring all incoming calls except those coming from the country of the
home network.

The calls can be barred manually by the subscriber, or by network configuration.


2.5 Value Added Services

Value Added Services are supplied by the respective Service Provider or network
operator, and can be transmitted either via a normal telephone call or via SMS.
These services offer the supplier a further opportunity - apart from price - to
attract customers.

• Value Added Services are, for example:


• Information on cultural events or traffic announcements via Cell Broadcast
• Reservation of a hotel, a flight or a hire car
• Help in the event of a car breakdown
• Information services
• Medical advice
• Ticket reservation
• Sports news
• Delivery services, like sending flowers to a particular person and many
more.

3 Network Architecture
3.1 Network Elements and their Basic Functions

For the subscriber, a mobile telephone call is a simple process. In reality, though,
this call is only possible thanks to a complex network architecture consisting of
various different network elements. In this lesson, you' ll get to know the
individual elements of the GSM network and their basic functions.

3.1.1 Base Station Subsystem (BSS)

The Base Station Subsystem BSS provides the connection between the mobile
stations and the Network Subsystem NSS. The NSS forwards user signals to
other mobiles via the BSS or subscribers in the Public Switched Telephone
Network (PSTN), and provides necessary customer data. The Operation &
Maintenance Subsystem (OMS) monitors BSS and NSS performance, and
remotely debugs occurring faults in the network elements.

Additional components such as interface elements to data networks, the Short


Message Service Center or the Voice Mail System complete the GSM system
architecture.

The Base Station Subsystem ensures as complete a network coverage as


possible and includes a large number of structurally organised radio cells. It
consists of the following elements:

• The Base Transceiver Station


• The Base Station Controller
and

• The Transcoder.

The central element of one cell of this kind is a transmitting and receiving unit
known as a Base Transceiver Station (BTS). This makes the connection to the
mobile station via the air interface and controls the transceiver (TRX). The
transceiver, the central functional unit of the BTS, maintains calls to a maximum
of 8 mobile stations via one frequency pair each. The BTS is also responsible for
the monitoring of the signal quality and the encoding and modulation of useful
signals. Via the A-bis interface, it forwards calls, signals and control information
destined for the OMS and the NSS to the Base Station Controller (BSC).

Several BTSs are controlled by the Base Station Controller, or BSC.

This assigns free radio channels in the TRX for the link to the mobile station. It
controls the necessary output power for mobile station and TRX. It monitors the
existing radio link to and from the mobile station and controls handover between
neighboring radio cells if they are under its control. During an existing radio
connection, the BSC monitors its quality and controls disconnection of the radio
link when the call is over. The BSC communicates with the transcoder (TC) via
the A-ter interface.

The transcoder is the third element in the BSS and is needed to convert 64 kbps
original speech into a 16 kbps signal of speech description parameters to ensure
a spectrum-efficient modulation on the air interface. BTS, BSC and TC together
form the Base Station Subsystem (BSS).

3.1.2 Network Subsystem (NSS)

The Base Station Subsystem forwards the signals to the Network Subsystem
(NSS) where speech and circuit-switched data are controlled and forwarded to
other networks if necessary. The NSS provides data relevant to security and
mobility.

The speech signals processed by the transcoder reach the Mobile Services
Switching Center (MSC) via the A interface. The MSC serves as a digital
exchange for the forwarding of messages, connecting mobile subscribers with
each other or with subscribers in other networks such as the Public Switched
Telephone Network, the ISDN network, or data networks.

The MSC is responsible for the following functions:

It forwards incoming and outgoing calls.


It makes a connection to other MSCs in the same mobile radio network and
makes connections with other mobile radio networks and to fixed networks.

It monitors and controls the calls.

It is responsible for call data acquisition and the forwarding of signalling


information to connected registers or data bases.

In order to monitor, route and control mobile telephone calls in GSM networks,
several registers are connected to the MSC.

One of these registers is the Visitor Location Register (VLR), which is usually to
be found in the MSC, but is a functional unit in its own right. It is designed as a
dynamic subscriber file with dedicated geographical areas of responsibility, the
so-called Location Areas. The VLR acquires the data of all GSM customers in its
areas and is always well informed of their whereabouts. It assists the MSC in the
acquisition of charge-relevant data with subscriber information. The bills are
prepared from these data in the Billing Center. But where does the VLR get the
GSM customer data from?

For GSM customer data acquisition, there is a register, the so-called Home
Location Register (HLR), in which each network operator registers the customer
data necessary for dealing with traffic. The HLR supplies these data to all VLRs
in which the GSM customers involved are to be found at any given moment.
Inversely, the VLR in question informs the HLR of the location area of the
customer, and is thus able to give routing information when calls come in. The
HLR data contain information on access rights with regard to roaming, service
rights with regard to voice, fax and data services, and additional subscribed
services.

The Authentication Center (AuC) contains the customer data necessary to


protect connections against unauthorised access, and is mostly integral to the
HLR. The AUC checks the information stored in the Subscriber Identity Module,
that is the SIM card, for correspondence with its own register. If the data proves
to be identical, the authentication of the subscriber is successful, and he is given
permission to enter the network. If the SIM card is stolen, authorisation to access
the network is disabled very easily via the AUC. Additionally, the AUC provides
necessary information to cipher the air interface.

The Equipment Identity Register (EIR) can be implemented as an option by the


network operator. The EIR permits the detection of stolen terminal equipment
used in GSM networks by checking the IMEI (International Mobile Equipment
Identity) against the data stored in the EIR. This check is carried out
independently of the SIM card, and only applies to the mobile station in question.
All the components which control and forward the call, and are responsible for
security and mobility management, that is the MSC, HLR, VLR, AUC and EIR,
form the Network Subsystem (NSS).

3.1.3 Operation & Maintenance Subsystem (OMS)

The GSM network is monitored and controlled from a central point. This is the
Operation and Maintenance Center (OMC).

The OMC has the following tasks:

1. The Fault Management system analyses alarms from the BSS elements.
When faults occur, they are eliminated when necessary via software command or
in situ by technicians.

2. The Configuration Management function installs the software when new BSS
network elements are implemented, manages hardware inventory lists, and
changes operation parameters, for example for radio frequencies of a BTS.

3. The Software Management system feeds in new software or updates and


manages the software inventory lists.

The Network Management Center (NMC) assumes special functions in the


context of OMS which are not defined in the GSM standard but are based on
definitions of the International Standardisation Organisation (ISO), and on
recommendations of the International Telecommunication Union (ITU).

An NMC carries out functions of Performance Management

• Alarms and fault elimination times are evaluated statistically.


• Capacity bottlenecks in the network are detected.

and

• The service quality is monitored, for example the Dropped Call Rate in
percent. Depending on the network operator, the NMC functions are
carried out in a centralised or decentralised way in the geographical areas.

All NMC and OMC of a certain defined geographical area form the third
subsystem, the Operation and Maintenance Subsystem, or OMS.

The three subsystems BSS, NSS and OMS are vital for the operation of a GSM
network. The interfaces within and between the subsystems are mostly specified
by the ETSI.
3.1.4 Additional GSM Components

For dealing with customer support and supplying certain services, GSM includes
a number of additional components. The Administration & Billing Center ABC
transfers customer data to the appropriate registers of the NSS and into the AUC
and the HLR. The Administration Center is connected to the Personalization
Center for SIM Cards (PCS) via an interface. This makes it possible to disable
the SIM card if necessary and protect it from abuse. The so-called Call Detail
Records are used in the Billing Center for bill preparation.

The Voice Mail System (VMS) is a memory system for voice, data and fax
messages spread over the network, i.e. a large-scale answering machine. If a
subscriber has switched off his mobile station or can't be reached for other
reasons, the messages are not sent to his mobile station but are fed directly into
the VMS and stored there. The subscriber can either request them from the VMS
or he is notified via SMS. The VMS can have interfaces to several MSCs and to
the Short Message Service Center.

Via the Short Message Service Center (SMS-C), network operators, service
providers and private customers can send short messages directly onto the
mobile station of any subscriber. In the SMS-C, the short messages are stored
temporarily and forwarded to the recipient.

Point-to-point short messages are alphanumerical messages with a maximum


basic length of 160 characters, which are entered directly via the keyboard of the
mobile phone. Compression and concatenating techniques increase the number
of transmitted characters. The Cell Broadcast SMS, i.e. the service offering point-
to-multipoint short messages, is a "one-way" communication from the network to
all mobile phones in certain geographical areas. The messages with a basic
length of 93 alphanumerical characters are entered in the OMC, fed centrally into
the BSC, and transmitted to the mobile stations via all connected BTSs at regular
intervals.

In order that data can be fed into the GSM network from packet-switched
networks such as the Internet or company Intranets, a so-called Interworking
Function (IWF) is required. This is an external data server connected to the
different data networks. The IWF translates the unstructured incoming packet-
switched data into circuit-switched signals which can be understood by GSM. A
firewall upstream of the IWF protects the GSM network from unauthorised
access by hackers.

In GSM Phase 2, only circuit-switched data services are supported. The


Interworking Function (IWF), integral to the MSC, connects the circuit-switched
GSM data traffic to the existing packet-oriented networks, in other words, the
Internet, corporate networks, public data networks and WAP servers. It converts
protocols and adapts the data rate for the BSS.
3.2 GSM Network Topology

In GSM, the Public Land Mobile Network (PLMN) is a cellular network with a
hierarchical structure.

The smallest unit is the radio cell, which the BTS supplies with frequencies, or, in
other words, radio channels. It provides the network coverage. Several radio
cells are put together to form administrative areas controlled by a BSC. Various
areas controlled by one BSC each form a location area controlled by a VLR. It is
also possible for a Location Area to cover one BSC only, or even one cell, if
reasonable. If a mobile phone subscriber changes to a new Location Area, a
Location Update takes place automatically, so the location of the subscriber is
known to the network via a VLR linked to the MSC.

If a BTS is in the centre of exactly one cell, we speak of an omnidirectional radio


cell. The BTS transmits its frequencies with omnidirectional characteristics and a
high output.

Omnidirectional radio cells are used particularly in relatively sparsely populated


rural areas. In densely populated areas, though, the network must supply higher
capacities. One way of doing this is the sectorization of radio cells. With a
sectored radio cell, the BTS can supply up to three radio cells in 3 times 120
degrees with several frequencies each.

On motorways, Base Transceiver Stations are preferentially configured in 2


sectors. For example, the BTS transmits frequencies in two times 180 degrees.
The cell is aligned along the course of the road to be covered.

In densely populated cities, we often find a combination of omnidirectional cells


and sector cells. This is because there can often be zones of missing coverage
between sector cells. A superordinated omnidirectional umbrella cell takes over
the radio supply for scattered individual mobile stations located in these locally
occurring receptionless zones and for rapidly moving mobile stations used on
motorways and in high-speed trains. Rapidly moving mobile stations in particular
are supplied via the larger umbrella zones, in order to avoid as far as possible
handovers taking place in rapid succession.

In order to supply areas with a large number of mobile phone users, so-called
microcells are used.

Thus, for example, BTS with a low output are used in underground stations.
These take over the radio supply on the platform or, with special antennae, in the
subway tunnels.
4 BSS Interfaces
4.1 The BSS Interfaces

Within the BSS, the user- and signalling data is transported over a series of
interfaces. The A interface connects the Mobile Services Switching Center (MSC)
with the Transcoder TC.

The A-ter interface connects the Transcoder with the Base Station Controller
(BSC). The A-bis interface connects the BSC with the Base Transceiver Station
(BTS). Finally, the data is transmitted to the mobile station via the air interface
Um.

Let's consider the PCM30 configuration as an example for the frame structure of
data transmission between the MSC and the mobile station, to understand the
dataflow at the A interface, the A-ter, A-bis and Um interfaces.

We see that the 4 A-links are mapped onto one A-ter link. 4 A-channels of 64
kbps each are mapped onto an A-ter channel consisting of 4 subchannels of 16
kbps each. In total, the 128 channels of 4 A-links are reduced to the 32 channels
of one A-ter link, which are numbered consecutively from 0 to 31. The SS7
signalling, which in our example is to be found in timeslot No 16, is transmitted
from A to A-ter transparently, i.e. unchanged.

The frame structure consisting of 32 channels is also found at the A-bis interface.
Channel 0 is used for synchronization, the remaining 31 channels transmit
warning information for operation and maintenance of the BTS, known as O&M
alarms, as well as signalling and voice data. Finally, the information from A-bis is
transmitted to the air interface Um via the TRXs, the radio transceivers of the
BTS. Two A-bis channels of 4 subchannels each correspond exactly to the eight
timeslots of a TDMA frame, which carries the data to the mobile station. A TDMA
frame, which we will discuss in more detail later in the course, portions the
stream of physical channels or timeslots on a particular carrier frequency into
periods.

Its timeslots are numbered consecutively from 0 to 7, and can be assigned to one
TRX.

4.2 The A Interface

The A-interface transmits user and signalling data between the MSC and the
transcoder. It's the second completely standardized interface in GSM after the air
interface. As an open interface it is not tied to a specific producer.

The A-interface is an ISDN-S2M interface that has been adjusted to GSM with a
data rate of 64 kbps per timeslot. In the PCM30 configuration, the A interface
contains 30 traffic channels. Timeslot number 0 takes over synchronization tasks,
and timeslot number 16 contains signalling information in the No 7 signalling
system format, or SS7. Thus the air interface has an overall bit rate of 2048 kbps.

The PCM24 configuration, which is generally used in the USA, uses 24 traffic
channels. In both configurations, each frame has clearly defined channels for
signalling and synchronisation information.

4.3 The A-ter Interface

4 traffic channels of the A interface are bundled into four A-ter channels of 16
kbps each, which are subsequently transmittted to the BSC in a 64 kbps physical
A-ter timeslot.

Conversely, signals coming from the BSC are transcoded from 16 to 64 kbps,
which is the bit rate typically used in fixed networks. Signalling channels are not
transcoded. At the A-ter interface, 120 speech channels of 16 kbps each form a 2
Mbit/s multiplex connection. Four times as many A links as A-ter links are
necessary to transmit the same amount of voice data.

4.3.1 Fullrate Speech Codec

Now let's turn to a procedure which takes the original speech, and generates the
speech description parameters in the TC.

During the first phase of GSM, which lasted until 1995, a speech codec in the MS
and in the transcoder was specified as the Full-Rate Codec. The basic
characteristics of speech, that is the volume, the base frequency, and the tone,
are extracted in 20 ms segments from the 64 kbps signal so that descriptive
parameters in 16 kbps signals are generated. The prediction algorithms, that is to
say the calculability of speech, make the data less sensitive to the interference a
signal meets on its way from and to the mobile station at the air interface.

4.3.2 Discontinuous Transmission

In GSM, all voice signals are transmitted the same way and in a continuous data
stream. The channel is occupied even during silence intervals. This has two
fundamental disadvantages:

1. Since the mobile station must send for the whole duration of the call,
transmitting power is used even in silence intervals, i.e. when the
subscriber is only listening. This wastes the mobile station's battery power.
2. Other subscribers using the same frequency in distant cells could be
disturbed more than necessary.

Therefore it is logical to switch off the sender whenever the subscriber is not
actively transmitting information. Considering the pauses in the dialogue, and
also the pauses between and within the sentences, we will find that the average
occupation of the radio link is less than 40%.

Discontinuous Transmission (DTX) is a remedy to this problem.

In DTX, a function known as voice activity detection switches off the sender of a
mobile station whenever there is no data to be transmitted.

During speech pauses, a "stopgap" in the receiver, which in the uplink is the
corresponding transcoder element in the TC, must simulate a functioning channel
for the user. In GSM this is called "comfort noise". It is the background noise
analysed before the MS is switched off, re-generated by the TC. The comfort
noise is even updated during a speech pause, by the mobile station transmitting
relevant information to the TC.

4.4 The A-bis Interface

The A-bis interface connects the Base Transceiver Station (BTS) with the Base
Station Controller (BSC). In the PCM30 configuration, the data at this interface is
transmitted via cable or via microwave transmission at a bit rate of 2 Mbit/s. A
cable connection is more resistent to interference, but a network operator must
lease it from a fixed network operator.

The microwave links can be operated independently, and are easily configured
by the network operator, but they are more sensitive to interference. 4 types of
information can be transmitted over the A-bis interface: user information,
synchronisation data, signalling information, and data for the operation and
maintenance of the BTS, known as O&M alarms.

In the basic configuration, the channels of the A-bis interface are directly
connected to the timeslots of the radio transmission at the air interface. The
physical data rate is 64 kbps. In PCM30, timeslot 0 of the A-bis interface is used
for synchronization. The remaining 31 timeslots of the PCM30 configuration carry
data from and to the transceivers of the BTS, as well as signalling information
and O&M alarms.

In the uplink, 4 traffic channels of 16 kbps each are sub-multiplexed and


transmitted from the BTS to the BSC in a physical A-bis time slot. The same
happens in the downlink, only in the opposite direction, i.e. from the BSC to the
transceivers of the BTS.

Today's BSC - BTS connection can also be configured as a dynamic link with
variable signaling and traffic time slots, according to the current traffic situation.

Two PCM30 channels can be assigned to one TRX. These channels consist of 4
sub-timeslots each. Each PCM30-subtimeslot corresponds to a timeslot in the
TRX. Thus, by mapping 8 PCM30 sub-timeslots onto one TDMA frame consisting
of timeslots 0 to 7, the entire TDMA frame of the TRX would theoretically be
available for the transmission of payload data. But then there wouldn't be enough
space left for the necessary signalling traffic from and to the mobile stations.
According to a fixed, producer-, and configuration-specific pattern, the signalling
information is carried in specific A-bis timeslots of 64 kbps each, or in 16 kbps
sub-timeslots, to at least 1 TRX per cell, where it uses timeslot 0 to be
transmitted over the air interface.

Special timeslots carry the O&M alarm traffic between the OMC and the BTS
over the BSC. The information is, of course, not transmitted over the air interface.
As we could see at the A-ter interface, each 16 kbps of a traffic channel consist
of 13 kbps of payload and 3 of inband signalling between the BTS and the
transcoder.

Only the 13 kbps of payload data may be transmitted over the air interface.

Depending on the producer, and on the configuration, each A-bis connection in


the PCM30 configuration may transport user information, signalling information,
and O&M information from and to up to 15 transceivers.

In the PCM24 configuration, 24 channels achieve an overall bit rate of 1536 kbps
at the A-bis interface. Up to 10 transceivers can be assigned to a connection.

4.5 The Terrestrial Interfaces - Summary

Let's summarize what we have learned about the three terrestrial interfaces A, A-
ter and A-bis:

Each of these three interfaces transmits information for the synchronization of the
individual network elements point-to-point, at a data rate of 64 kbps, and using
timeslot 0.

The transcoder merely forwards the SS7 signalling between the MSC and the
BSC. This is done transparently, at a bit rate of 64 kbps, both over the A and
over the A-ter interface, for example in timeslot 16. The TRX-related signalling
between the BSC and the BTS is transmitted over the A-bis interface at 16, 32 or
64 kbps, depending on the producer. O&M alarms from the transcoder are
transmitted to the BSC over the A-ter interface at 16 kbps, or as inband signals
through a normal traffic channel. O&M alarms from the BTS are transmitted to
the BSC, which is also the O&M master for the entire BSS, over the A-bis
interface at 16 or at 64 kbps. If the BSC is unable to correct the errors that
caused the alarms, or if it detects an error within itself, it informs the OMC
directly, or forwards the alarms from the BTS or TC to it.
Let's consider the transmission of speech and user data, which is transmitted at a
data rate of 64 kbps over the A interface, at 16 kbps over the A-ter interface -
after being turned into transcoded speech or rate adapted data - and also at 16
kbps per subchannel over the A-bis interface. SMS messages are transmitted via
signalling channels. The number of physical timeslots that's available for the
transmission of signalling information over the air interface depends on the
configuration, and is up to the manufacturer or to the operator.

4.6 The Air Interface Um

Within mobile radio networks, data is transmitted over PCM lines at a bit rate of 2
Mbit/s. Air transmission is used between the mobile station and the BTS, and the
information transmitted over the air interface must be adjusted to the PCM lines
so it can pass through the rest of the network. The air interface, or Um, is the
weakest part of a radio link. In GSM, a lot is done to ensure high quality, security,
and reliability.

At the air interface, the frequencies are arranged in pairs. Each uplink frequency
has a downlink frequency permanently assigned to it. The uplink signal goes
from the mobile station to the base station, and the downlink signal goes in the
opposite direction - from the base station to the mobile. The arrangement in pairs
is what actually enables simultaneous communication. The difference between
the frequency pair is fixed and is called "duplex frequency". In GSM 900, the
duplex frequency is 45 MHz. Accordingly, the uplink frequency range 890 to 915
MHz, is assigned to a frequency range of 935 to 960 MHz in the downlink. In
GSM 1800, the duplex frequency is 95 MHz. The uplink frequency range lies
between 1710 and 1785 MHz, the downlink frequency range between 1805 and
1880 MHz. In GSM 1900, the duplex frequency is 80 MHz. The uplink frequency
lies between 1850 and 1910 MHz, and the downlink frequency between 1930
and 1990 MHz.

4.6.1 Basic Principles of Transmission

The BTS elements which send and receive radio signals in the downlink and
uplink channels, are known as transmitter & receivers, or transceivers (TRX) for
short. In GSM networks, the transmission over the air interface is digital. Digital
transmission in GSM is based on a combination of the FDMA- and the TDMA
methods, which already have been introduced. In Frequency Division Multiple
Access - or FDMA - different frequency channels are assigned to each BTS.
Mobile phones in neighbouring cells - or within the same cell - can be used
simultaneously, but occupy different frequencies. The FDMA method uses
different carrier frequencies - 124 in GSM 900, 374 in GSM 1800, and 299 in
GSM 1900.

Time Division Multiple Access, or TDMA, is a method where several subscribers


share one frequency - each subscriber is assigned its own time unit, which is
known as a timeslot. In analog mobile systems, on the other hand, a frequency is
occupied by one subscriber for the duration of the call. In TDMA systems, each
mobile station sends and receives information only on the timeslot it has been
assigned. These timeslots are either used to transmit voice data, or information
on signalling and synchronization.

To send digital information over the air interface, the analog radio signals must
be interpreted as bit signals. This process - the transmission of digital information
to the air interface - is called modulation. Modulation takes advantage of the
physical characteristics of analog signals, and changes them in a certain way,
depending whether the digital value to be transmitted is 1 or 0. Signals can be
modulated on the basis of their amplitude, their frequency, or their phase. GSM
uses a specific phase modulation known as the Gaussian Minimum Shift Keying,
or GMSK.

Time Division Multiple Access, or TDMA, splits a radio frequency into


consecutive periods known as TDMA frames. A TDMA frame, in turn, consists of
8 short time units, which are referred to as time slots. These time slots represent
the physical basis for data transmission. Therefore they are also called physical
channels. The radio signal between the mobile station and the BTS consists of a
continuous stream of time slots, organized in TDMA frames. Each connection is
always assigned one timeslot.

Thus, the physical channels provide the resources used to transmit specific types
of information. The types of information and the functions define the logical
channels. The logical channels differ according to the function they fulfil in data
transmission.

To organize the radio transmission, various frame types consisting of numbered


timeslots are specified in GSM. The numbered timeslots are continuously
numbered off by the mobile station.

A simple TDMA frame consists of eight physical channels, or timeslots. A


timeslot is 0.557 ms long. Thus a simple TDMA frame is 4.62 ms long. The
length of a timeslot is also referred to as the burst period. A burst is the content
of a physical channel.

Information is transmitted as bursts each TDMA frame period. Traffic channels,


i.e. time slots 0 to 7 in a basic TRX configuration, contain their information
organised in 26 TDMA periods of time known as a multi-frame. This is 26 x 4.62
ms = 120 ms long. Signaling information, normally provided in time slot 0, is
organised in 51 TDMA periods of 4.62 ms each, which makes 235 ms altogether.
26 of these "long" 51-multiframes, or 51 of the "short" 26-multiframes form a
superframe, which is 6.12 seconds.
The largest transmission unit defined is the hyperframe, which contains 2,048
superframes and is 3 hours, 28 minutes, 53 seconds, and 760 ms long. TDMA
frames, multiframes, superframes and the hyperframe can be considered as
counters to organize user and signalling information within the TRX, and to
support cyphering at the air interface.

4.6.2 The Physical Channels

The information which is physically transmitted over the air interface Um via the
physical channels must be converted into a 16 kbps signal within a 2 Mbit/s
Frame, which connects the BTS and the BSC as the A-bis interface. It is very
important that all mobile stations within a cell send their digital information at the
right moment, in order to avoid collisions at the timeslots of the air interface,
which would destroy the transmitted information. Therefore, each mobile station
sends its digital voice data at regular periodic intervals, using a different timeslot
to the other mobile stations within the same cell. The medium for this
transmission process is the timeslots, or physical channels. The content of such
a channel is also known as a burst. Bursts consist of different data blocks
containing payload- as well as security information, to guarantee high data
reliability and transmission quality.

4.6.3 The Logical Channels

In GSM, there are two types of logical channels: the dedicated channels, and the
common channels. Let's explain the difference between the two with a metaphor
from gardening. If we want to water a whole area, and not a particular plant in it,
we use a watering can.

This metaphor describes the common channels. These supply their data
according to the principle of "equal shares for all", and are not directed to a
specific target. They are used to broadcast information area-wide to all the
mobile stations within the service area of a BTS. This is general signaling
information, for example to log onto the network and cell-broadcast SMS.

If, on the other hand, we only want to water a specific plant and deliberately
leave out the neighbouring ones, we use a jet of water. This metaphor
corresponds to the Dedicated Channels. These are always directed to a
particular addressee. Various types of signalling channels, known as the
dedicated control channels, facilitate communication between the mobile station
and the mobile radio network. And, of course, traffic channels that carry user
speech and data also belong to this category. To understand the tasks of the
individual logical channels, we will now look at how a mobile station logs on to
the network.

After the subscriber has switched on his mobile station and typed in his PIN
code, the mobile station searches for a network. But how does it log on to the
network the subscriber is registered with? For this purpose, the BTS sends out
the Frequency Correction Channel (FCCH) at short regular intervals, to help the
mobile station find a frequency for downlink reception and adjust its frequency
oscillator for the uplink transmission. To do so, it picks out the strongest received
signal. The Synchronization Channel (SCH) then helps the mobile station to
synchronize itself to timeslot 0 sent out by the BTS. This means the mobile
station must adjust to the rhythm given by the BTS.

The SCH contains the TDMA frame number as well as the Base Station Identity
Code, containing basic information about the network operator that can be
compared with the info stored on the SIM card. After this step, the mobile is able
to decide whether it has chosen the proper network. If not, it starts the same
procedure again trying with the second strongest FCCH received.

While the mobile station uses the FCCH to adjust its frequency, and the SCH for
synchronization and network identification, the Broadcast Control Channel
(BCCH), which is also sent by the BTS, supplies the mobile station with
additional information about the selected cell, for example for ciphering. For
some Value Added Services, for example location-dependent services, additional
information has to be transmitted from the BTS to the mobile. The Cell Broadcast
Channel CBCH is used for this purpose to transmit geographical parameters, for
example Gauss-Krueger-Coordinates of the BTS, to the mobile. The FCCH,
SCH, BCCH and CBCH are Broadcast Channels, and exist only in the downlink.
They are the first logical channels belonging to the Common Channels.

The mobile station has now adjusted its frequency and synchronized its TDMAs,
and has picked out the best cell available. But before it can be reached by other
subscribers, and before it can initiate calls, a Location Update and authentication
procedure are necessary. Only after that is the mobile station logged on to the
network and has radio coverage. It can now be reached by other mobile stations,
or initiate a call. For this purpose, Common Control Channels are required.
Common Control Channels are "point-to-multipoint" channels, which exist either
only in the uplink, or only in the downlink.

When a subscriber is called, the Paging Channel (PCH) is broadcast in the


downlink by all base stations within a Location Area, so that the mobile station
concerned can react. To initiate a call, the mobile station sends out a Random
Access Channel (RACH), which carries its identification and request, for example
for registration, to the network. This channel only exists in the uplink. In return,
the network sends the Access Grant Channel (AGCH) in the downlink direction,
to assign resources to the mobile station, by granting it a Stand-Alone Dedicated
Control Channel, SDCCH. The PCH, RACH and AGCH form the group of the
Common Control Channels belonging also to the Common Channels.

A Stand-alone Dedicated Control Channel (SDCCH) has to be assigned to the


mobile station to exchange the requested signaling with the network, for example
authentication, ciphering or call set-up. Also, it assigns a traffic channel, and it
transmits short messages.

The SACCH is always linked with an SDCCH or a traffic channel. It sends


measurement reports to the network, and is used for power control and to handle
the exact temporal alignment of the channels, the so-called Timing Advance.

If the subscriber moves into the service area of another BTS, the handover
command needed is transmitted over the FACCH. This channel is also used for
every call release. During the call, FACCH data is transported over the Traffic
Channel assigned.

The Dedicated Control Channels are bidirectional point-to-point channels and


belong to the group of Dedicated Channels.

User speech and data are transmitted over the traffic channels we have already
spoken about. Traffic channels are bidirectional, and also belong to the group of
dedicated channels.

There are two different channel types supporting different gross bit rates. The
Traffic Channel Full rate (TCH/F) has a gross bit rate of 22.8 kbps. It is used for
speech encoded by a Full Rate or Enhanced Full Rate codec as well as for user
data encapsulating a net bit rate of 9.6 kbps for standard bearer services, 14.4
kbps per timeslot in the case of HSCSD, or up to 21.4 kbps with GPRS. The
Traffic Channel Half rate (TCH/H) supports 11.4 kbps and is only used for Half
Rate codec speech.

Let us sum up what we just learned about the classification of logical channels.
Common channels include FCCH, SCH, BCCH, PCH, RACH, AGCH and, finally,
CBCH. All contain point-to-multipoint signaling information.

Dedicated Channels contain point-to-point signalling, such as SDCCH, SACCH


and FACCH, or traffic, such as TCH/F and TCH/H.

4.7 Channel Coding

To be able to detect and correct bit errors at the air interface, GSM performs
channel coding. This procedure is organized in two consecutive processes: block
coding and convolutional coding.

In block coding, the parameters describing the speech data are first subdivided
into three classes, which define if the data is important, required or unimportant
for speech intelligibility. With convolutional coding, the information relevant to
speech intelligibility is doubled with an arithmetical operation. That means a copy
of the data is made so the data can be restored if necessary. This procedure
allows to fully compensate bit error rates of up to 12.5 % in the secured relevant
data. Channel coding increases the bit rate necessary at the air interface from 13
to 22.8 kbps.

5 NSS Interfaces
5.1 SS7 Signalling and NSS Interfaces

To enable GSM customers to use speech-, fax- and data services wherever they
are within the network, information and data must be exchanged within as well as
between different networks. This process is called signalling. To set up a call,
signalling takes place between subscriber interface points, that is between the
user and the network, as well as between different network elements. To make
sure that the individual elements through which the information travels can
understand each other, they must, as it were, agree on a common official
language. This language is specified by protocols. The protocol used in the
Network Subsystem NSS is called Signalling System No 7 - or SS7. SS7 is
based on the Open System Interconnection model, also called the OSI reference
model.

5.2 The OSI Reference Model

We will now illustrate in general terms the OSI reference model with an example
from business life. A car manufacturer B orders 1000 tyres from supplier A. This
deal is concluded and signed by two managers at the highest level. For the two
managers, only the outcome of this business deal is important. The process that
takes place in the lower hierarchy to get the tyres from the supplier to the car
manufacturer does not interest them. The managers rely on their purchasing-
and sales departments, which will deal with practical details. The car
manufacturer's purchasing department, however, only communicates with the
supplier's sales department. As soon as the financial transactions are concluded,
the goods can be delivered from A to B.

The purchasing and sales departments are not interested in the practical details
of delivery. At the supplier, the warehouse workers must pack the tyres and load
them on trucks, to get them ready for transport. As soon as the tyres arrive at the
manufacturer, the warehouse workers will unpack the tyres and store them. In
summary, we can say: It's always several levels of a company that collaborate in
a business transaction. The higher levels give the lower levels instructions,
without paying attention to the details of the processes. Communication between
the two companies takes place only between peer levels. With the OSI model, it's
similar.

OSI is a reference model consisting of 7 layers that are based on each other.
Each layer has its own tasks. The lower layer always provides support functions
for the layer above. For a layer, the data transported in the layers underneath is
irrelevant. Communication only takes place between the elements of the same
layer. This type of communication between elements belonging to the same layer
in different systems is known as peer-to-peer communication.

The layers take over the following tasks:

The lowest layer, layer No 1, is the Physical layer. It is responsible for


transmission, encoding, and modulation.

Layer 2 is the Data Link layer. It is responsible for the signalling link management
and data security.

Layer 3 is the Network layer. It contains the information needed for switching and
routing and handles call set-up, -supervision, and -clear down.

Layer 4 is the Transport layer. Here, the peer-to-peer connections' dataflow is


controlled.

Layer 5 is the Session layer. It handles the connections for application processes
as well as charging.

Layer 6 is the Presentation layer. It takes over the transfer of application-oriented


formats, as well as encryption and translation.

At the top resides layer No 7, the Application layer. It is responsible for the
application protocols and the user interfaces.

5.3 The SS7 System

The basic SS7 version consists of two parts:

• The Message Transfer Part (MTP), which is responsible for message


transfer

and

• The Telephone User Part (TUP) on the user's side, which receives, sends,
and acts on these messages.

Let's turn our attention to MTP first.

5.3.1 Message Transfer Part (MTP)

The Message Transfer Part (MTP), represents the basis for the entire SS7
system. It transmits messages between network elements. MTP is composed of
three layers. MTP layer 1 defines the physical and electrical characteristics of the
connection. MTP layer 2 supports the error free transmission of signalling
messages between neighboring network elements. MTP layer 3 is responsible
for taking the message from any element in a signalling network to any other
element within the same network.

5.3.2 Telephone User Part (TUP)

While MTP is responsible for message transfer, the Telephone User Part (TUP)
represents the protocol used for sending, receiving, and acting on these
messages from the user's point of view. TUP handles call set-up, call supervision
and clear down, and exists for normal public fixed networks, which are also
known as Public Switched Telephone Networks, or PSTN. With the introduction
of the more capable ISDN network, some extra sets of messages became
necessary. These features are contained in the ISUP which replaces the TUP.

5.3.3 Signalling Connection and Control Part (SCCP)

To guarantee virtual connections and connectionless signalling, that is signalling


which is not bound to a call, another protocol layer on top of MTP is required,
parallel to TUP. This is the Signalling Connection and Control Part, SCCP. TUP
and SCCP take over different tasks, but both make use of the services provided
by MTP. In contrast to MTP, SCCP uses sequence numbers to make sure that
messages arrive at the receiver in a determined order, so a virtual connection
can be guaranteed. SCCP also enables the routing of signalling messages
across multiple networks in the absence of a call.

This layer structure, consisting of MTP and TUP/ISUP, as well as SSCP,


represents the SS7 protocol, which is the protocol used for signalling within
Public Switched Telephone Networks and ISDN networks.

5.4 SS7 Applications in GSM Networks

In GSM networks, signalling is not as easy as in a fixed network. This is because,


due to the network architecture, a digital mobile radio network makes much
higher demands on signalling. GSM requires a considerably higher amount of
non-call-related signalling information. After all, it must be considered that the
GSM customer is mobile, in contrast to the user of a fixed network, who
telephones from a fixed device. Therefore, the mobile station must continuously
be provided with localization signals, to enable the Location Update. The
Location Update is an example of a non-call-related communication between the
phone and the network. To guarantee that the signalling demands in GSM
networks are met, additional standard sets of messages are required. The
following protocol layers are necessary:

• The Base Station Subsystem Application Part (BSSAP)


• The Transaction Capabilities Application Part (TCAP)
and

• The Mobile Application Part (MAP)

5.4.1 Base Station Subsystem Application Part (BSSAP)

The Base Station Subsystem Application Part (BSSAP) is a protocol layer


responsible for communication between the MSC and the BSC in GSM. BSSAP
is responsible for the entire management and control of the radio resources in
the BSS. It resides on top of the Signalling Connection and Control Part, SCCP.

5.4.2 Transaction Capabilities Application Part (TCAP)

The Transaction Capabilities Application Part (TCAP) is a protocol layer which


resides directly on top of SCCP.

TCAP is able, for example, to organize a complex dialogue between an MSC and
an HLR, including a sequence of successive requests and replies. TCAP
functions like a secretary's office, where many different requests are brought into
the correct sequence and distributed. TCAP handles the access to data bases
like the HLR or the VLR. It must exist so that a higher protocol - the Mobile
Application Part (MAP) - can be used.

5.4.3 Mobile Application Part (MAP)

The Mobile Application Part (MAP) is a GSM specific protocol for non-call-related
applications between elements in the NSS. MAP resides directly on top of TCAP,
which can be used as a "secretary's office" by the MAP, and which coordinates
and guarantees a smooth MAP communication.

A MAP-based communication takes place when data is exchanged between NSS


elements in the absence of a call.

This is the case for example with normal call set-up. To put a call through to the
subscriber, the Gateway MSC must request necessary routing data from the
HLR. Thus, there is no data exchange between the GMSC and the HLR, without
the actual call being routed to the HLR. In such cases, the network relies on
MAP, which is used for signalling communication between NSS elements. Please
note: in the MSC-MSC communication, MAP is only used for non-call-related
signalling. To forward a call from an MSC to another MSC, TUP or ISUP is used.

5.5 Protocols of the GSM Elements

Not every GSM element must be able to understand every language.


Consequently, only those protocol layers which the network element actually
requires for carrying out its task need to be implemented. A BSC, for example,
will never need the TUP protocol, because call supervision - which this layer
supports - is not its task. In the following lessons, the SS7 requirements of the
individual GSM elements will be introduced.

5.5.1 Protocol Structure in the MSC

As in all the other elements, MTP is the basis protocol in the MSC/VLR. Without
it, there would be no SS7-based signalling. Furthermore, the MSC needs
TUP/ISUP for call supervision. Since the MSC communicates with the BSC and
the HLR, it also requires BSSAP and MAP, which are both based on SCCP. The
use of MAP requires the presence of TCAP. Thus the MSC, as the key element
of the Network Subsystem NSS, must include the whole range of SS7 protocols.

5.5.2 Protocol Structure in the HLR and the BSC

The HLR is not responsible for call control, and therefore does not need
TUP/ISUP. Furthermore, since it does not have to communicate directly with the
Base Station Controller, BSSAP is not implemented in the HLR. Thus, only the
four protocols MTP, SCCP, TCAP and MAP must be present in the HLR.

Normally, the BSC would manage on BSSAP. But since, in modern networks,
BSSAP is based on the SCCP protocol, whose functionality in turn requires the
presence of MTP, the BSC contains MTP, SCCP and BSSAP.

5.5.3 Communication between Network Elements

Communication between network elements always takes place using the relevant
protocols, each protocol relying on the protocols of the layers below. For
example, the signalling from the MSC to a PSTN for call set-up is carried out by
TUP, which is based on MTP in both elements. Or, if an MSC wants to know the
current location of a subscriber, it communicates with the responsible HLR using
MAP. In this communication, TCAP, SCCP and MTP are required. The BSSAP
protocol, on the other hand, is only needed by the MSC when it wants to
communicate with the BSC.

5.5.4 Other GSM Signalling Protocols

Whereas the elements in the Network Subsystem use SS7, further protocol types
are needed in the Base Station Subsystem.

The BSC and BTS communicate using the Link Access Protocol for the ISDN "D"
channel, or LAP-D. This protocol is also used between the end user and the net
in ISDN networks.

A slightly modified version of the same protocol also exists between the BTS and
the mobile station. Due to the modifications imposed by the characteristics of the
air interface, the protocol is called LAP-Dm. The message structure within LAP-D
resembles that of SS7, but it's limited to the support of point-to-point connections.

5.6 Overview of the NSS Interfaces

Between the NSS elements, data is either exchanged over copper cable or
optical fiber, or via microwave.

All NSS interfaces offer data rates of at least 64 kbps. 2 Mbit/s connections are
the rule. The protocols are based on the SS7 standard.

Two kinds of information are transferred over the different interfaces. Signalling
information such as addressing and "mobility data", and user data, that means
speech, fax- and data messages.

Between the NSS elements we find the following interfaces. Note that the Mobile
Services Center (MSC) and the Visitor Location Register (VLR) form a spatial
unit.

Between the MSC and the VLR we find the B-interface. This interface is used to
transmit signalling data.

The C-interface is located between the MSC and the Home Location Register
(HLR). It is also used exclusively for signalling data.

The D interface provides the connection between the VLR and the HLR. Like the
interfaces B and C, it transmits signalling data.

The E interface is located between two MSCs. Apart from signalling data, user
data and speech can be transmitted as well.

The F interface is located between the MSC and the Equipment Identity Register
(EIR).

If an EIR exists, the interface is used exclusively for signalling data concerning
the IMEI control.

The MSCs which provide connections to another mobile radio network, that is a
Public Land Mobile Network (PLMN), or a Public Switched Telephone Network
(PSTN), and which are connected to the HLR, are also known as Gateway-
MSCs, or GMSCs. The interface between the visited network and a GMSC
transmits user- and signalling data.

As a rule, every MSC can function as a GMSC nowadays. From the network
operators' point of view, this is cost-efficient, because the more MSCs can
function as Gateways to other networks, the longer a call can be routed within
the own network before it is handed over to a different network.

6 Basic Procedures
6.1 Numbers-Identities-Codes

In GSM there is a range of numbers and identity codes which are required for the
provision of the basic procedures in a digital mobile network. The following
aspects must be considered:

• The identity of a subscriber


• The services required by the subscriber
• The national or international location of a subscriber
• The localization of the subscriber in relation to various base stations or
other network elements

and

• The mobile station used by the subscriber

There are several numerical identities for these aspects that will be introduced in
the course of this chapter.

6.1.1 Mobile Subscriber ISDN Number (MSISDN)

The international telephone number of a mobile GSM customer is his Mobile


Subscriber ISDN Number, or MSISDN. The number is only stored in the HLR of
the home network, and is never intended to be transmitted on the air interface.

How do you dial this number from a Public Switched Telephone Network, or
PSTN?

First, dial a prefix to distinguish between national and international calls. For
national calls, the prefix is usually zero. For international calls, it is 2 zeros, and
two or three digits, depending on the country. In GSM networks, it is sufficient
simply to enter a ''+'' sign instead of the double zero.

The second part of the MSISDN, the Mobile Country Code MCC, provides the
code for the relevant country. The MCC consists of two digits and does not have
to be entered when making national calls.

The third part of the number is the Network Destination Code NDC. It identifies
the appropriate national network operator. The Mobile Subscriber Identification
Number MSIN forms the fourth part of the MSISDN. The first three digits of this
number determine the logical HLR where the GSM customer is stored and which
is used to locate him/her. The remaining digits identify the individual subscriber,
with different services like speech, fax and data services requiring differing
MSINs.

6.1.2 International Mobile Subscriber Identity (IMSI)

To identify a GSM subscriber in a mobile network, each subscriber has his own
International Mobile Subscriber Identity (IMSI). The IMSI is of a standard length
of 15 digits and is composed of the following elements:

• A Mobile Country Code (MCC) with three digits,


• A Mobile Network Code (MNC) with two digits and
• A Mobile Subscriber Identification Number (MSIN) with 10 digits.

The IMSI is required for registration in a PLMN, because it is defined as an


individual number code with a uniform string length of digits. The MSISDN, by
comparison, has differing lengths of digits, depending on the country, and
therefore cannot be considered for a simple registration procedure. Furthermore,
a customer has different MSISDNs for every service, but only one IMSI that can
uniquely identify him internationally.

6.1.3 HLR Entries

MSISDN and IMSI are stored as permanent database entries in the Home
Location Register (HLR) of the customer's home network. The HLR also contains
information on the services for which the customer is registered. These are static
entries. In addition, a database field is reserved for the current VLR address. This
entry is dynamic, and is updated depending on the Location Area where the
subscriber is. In this way, the HLR always knows the current location of the
subscriber, and thus enables the routing of calls to the relevant MSC.

6.1.4 Mobile Station Roaming Number (MSRN)

The Mobile Station Roaming Number (MSRN) is a temporary number produced


for routing the call in case of a Mobile Terminated Call.

MSRN is generated within the serving MSC/VLR, that is where the mobile station
just happens to be at that moment. In order for a called subscriber to be
identifiable, the MSRN is linked to the International Mobile Subscriber Identity
(IMSI). In the event of an incoming call, the MSRN is transmitted via the HLR to
the Gateway MSC (GMSC) to inform it where the call has finally to be routed.

The MSRN has the same structure as the MSISDN. It consists of the Country
Code (CC), the National Destination Code (NDC), and a Subscriber Number
(SN) that is different to the SN in the MSISDN. While the MSISDN only
establishes a connection to the HLR, the MSRN is used to route the call to its
actual destination.

6.1.5 Handover Number (HON)

If a mobile subscriber, while making a call, moves from one MSC area to another
that is covered by a different VLR/MSC, an Inter-MSC-Handover is required, that
is the transfer of the call from a currently serving MSC, or the Anchor MSC, to the
new MSC, the Target MSC.

The Anchor MSC stays responsible for all call control activities, so it has to know
where to route the call. To support this, the Target MSC generates the Handover
Number HON, and sends it to the Anchor MSC. Using this number, it can now
create a connection to the Target MSC.

Like the Roaming Number, it is made up of the Country Code CC, the National
Destination Code NDC and a Subscriber Number SN (which is also different from
that of the MSISDN).

6.1.6 Temporary Mobile Subscriber Identity (TMSI) and Location Area


Identity (LAI)

The Temporary Mobile Subscriber Identity (TMSI) and the Location Area Identity
(LAI) are required for the Location Update of a mobile station. The TMSI is
generated in the VLR of the relevant hosting network after the first Location
Update, and then linked to the IMSI.

From then on, the IMSI is no longer transmitted for data security reasons.
Instead, the TMSI is transmitted via the air interface. This is the temporary
identity of the mobile radio user. It is assigned for the mobile's presence within
the Location Area.

The Location Area Identity (LAI) is a unique number worldwide. The net sends it
via the control channels of the air interface to the mobile station so the mobile
station recognizes its current position and can store it on the SIM card.

6.1.7 International Mobile Equipment Identity (IMEI)

The International Mobile Equipment Identity (IMEI) is stored on the hardware of


the mobile station, and is used to check the validity of the relevant terminal used.

In the Equipment Identity Register (EIR), the same number is stored to check
number compliance. This equipment check is optional in GSM, and not every
network operator offers this service. The IMEI contains a check code (the Type
Approval Code), a terminal number (the Final Assembly Code), and the serial
number of the mobile station.
6.1.8 Cell Global Identity (CGI)

The Cell Global Identity (CGI) is a number code used to identify each cell within a
Location Area of a GSM network.

The CGI consists of the relevant Mobile Country Code (MCC) of a country, the
Mobile Network Code (MNC) for a relevant network, the Location Area Code
(LAC) of a Location Area, and the Cell Identity (CI), which indicates the relevant
cell within this Location Area. Using this code, the traffic data relevant to a cell,
for example, can be evaluated statistically in the Network Management Center
(NMC).

6.1.9 Base Station Identity Code (BSIC)

If a mobile subscriber is at a certain location, his mobile phone usually receives


frequencies from different network operators. In order for his mobile phone to
synchronize to the frequency of its own network operator, each base station must
be able to identify itself.

This identity is the Base Station Identity Code (BSIC). It is broadcast by every
BTS, and compared with the appropriate entry on the SIM card of the subscriber.
Only after verification that the broadcast BSIC is identical with the entry on the
SIM card can a mobile station be registered on the network.

Furthermore, the BSIC has to make a distinction between the serving cell and
those other cells that use the same frequency as the serving cell. It consists of
the Network Color Code (NCC) and the Base Station Color Code (BCC).

6.2 Procedures
6.2.1 Registration of the Mobile Station on the Network

In order for a user to be able to use a mobile station, it must be registered on the
network. After a subscriber has switched on his mobile phone, he first enters his
PIN. The PIN is stored on the SIM card. This step will not access the network.

The mobile station only begins communications with the network after successful
PIN query. "Network search" appears on the display of the mobile station. To
select the radio cell, the mobile station measures all Broadcast Control Channels
that have been sent on all frequencies from all network operators.

Then, a suitable network PLMN that is authorized for the subscriber is selected.
In the home country, this at first is only the network of a subscriber's own network
operator, then the network of a contract partner. Now the mobile can select a
suitable cell from several possible cells. After a successful Location Update, the
mobile station is in Idle Mode. Let's have a closer look at the Location Update
procedure.
6.2.2 Location Update and Authentication

Irrespective of where a mobile subscriber happens to be, a caller must always be


able to contact him/her.

This means the mobile network must always know the subscriber's current
location so it can put through calls. By ''subscriber's current location'' we
understand in this context the appropriate Location Area, that is the area
controlled by a certain VLR. A VLR controls at least one Location Area.

However, in order to define as accurately as possible a subscriber's current


location, the VLR area usually consists of several logical Location Areas. The
process that keeps the network up to date as regards this current location is
called Location Update.

A Location Update is carried out:

• When a mobile customer switches on his/her mobile station


• When a mobile customer changes his/her Location Area

and

• At regular intervals after a mobile customer has not moved his/her mobile
station for some time.

What information is exchanged between which network elements during Location


Update?

The mobile station sends, via the BSS and the appropriate serving MSC, a
Location Update Request to the controlling VLR.

This then requests the subscriber ID stored on the SIM card of the mobile station,
which is sent immediately to the VLR. Now the VLR can request the
authentication data, also called the authentication triplet, from the subscriber's
HLR/AUC. After receiving the reply from the HLR, the VLR sends the
authentication data to the mobile station.

After successful authentication, the Location Update, in the form of the VLR
address, can be sent to the HLR of the subscriber as the current location.

Let's have a closer look at the authentication process. A new serving VLR
requests authentication from the SIM card used. This request is forwarded to the
Authentication Center (AUC) of the home network, which will provide the VLR
with an "Authentication Triplet".
The triplet consists of a random number (RAND), a Signed Response (SRES),
and a key (Kc). SRES is the calculation result of the algorithm A3 combining the
individual key Ki stored in the AUC and the random number RAND. Kc is
generated in the same way by the algorithm A8 using RAND. Several of these
triplets produced this way are transmitted to the enquiring VLR.

The VLR first stores both parameters from the triplet Kc and SRES for later use,
and only transmits the random number RAND to the mobile station. Using this
number and the information stored on the SIM card - that is the algorithms A3
and A8, and the key Ki, the mobile station can produce the same parameters as
the AUC, namely SRES and Kc. For authentication, the mobile station sends the
SRES it has produced back to the VLR. The key Kc is used later for channel
encoding.

Now the VLR can compare both SRES numbers: one from the mobile station,
and one produced by the AUC. If both parameters tally, authentication was
successful. Finally, the TMSI is transmitted in encoded form.

6.2.3 Mobile Terminated Call (MTC) and Encoding

We refer to a Mobile Terminated Call (MTC) when a mobile subscriber is being


called. Let us look at the MTC using a call from a PSTN as an example:

1. A PSTN customer dials the number of a mobile phone. The number dialed
is the MSISDN.
2. The exchange of the Public Switched Telephone Network (PSTN)
analyses this number and contacts the Gateway Mobile Services
Switching Center (GMSC), that is the link between the PSTN and the
mobile network.
3. The GMSC does not know the current location of the called subscriber,
and therefore starts an appropriate inquiry to the HLR of the called
subscriber.
4. The HLR checks its database entries to find the current location or the
currently serving MSC/VLR of the called subscriber.
5. Now the HLR asks the serving MSC/VLR for the routing information
necessary for the call connection.
6. The serving VLR now generates the temporary Mobile Subscriber
Roaming Number (MSRN) and sends it via the HLR to the GMSC.
7. The GMSC now has the routing information it needs, and transmits the
call onwards to the serving MSC.
8. The VLR makes the LAI available to the called subscriber
9. To locate the called subscriber, the MSC initiates a Paging Process within
the Location Area.

Let's have a closer look at this process.


The MSC initiates the paging in the entire Location Area using the Temporary
Mobile Subscriber Identity (TMSI). This is made available by the VLR and is also
known to the called mobile station. It's been allocated to a subscriber after the
first Location Update of his mobile station, and is used instead of the IMSI for
data security reasons.

Within the relevant Location Area, the TMSI of the called mobile station is
broadcast on the air interface via the Paging Channel (PCH). However, as the
TMSI is clearly allocated within the VLR area, and thus also within the Location
Area, only the called mobile station can identify the Paging Channel, and react
accordingly.

The called mobile station reacts to the Paging Channel with a request to the
network for a free channel. This request is sent via the Random Access Channel
(RACH) in an uplink to the BSS. This allocates, through the Access Grant
Channel (AGCH), a Stand-alone Dedicated Control Channel (SDCCH) to the
mobile station.

This communicates with the BSS via the SDCCH, which exists both in the uplink
and the downlink, until a traffic channel is allocated to the mobile station.
Parameters for authentication and encoding, as well as the new TMSI, are
transmitted via the SDCCH to the mobile station.

If this is concluded successfully, the actual call set-up is initiated. For this
purpose, a voice link is established between the mobile station and the BSS, by
allocating a traffic channel on the air interface. Let's have a more detailed look at
the various steps of call set-up.

1. First, the mobile station is informed that an incoming call requires a call set-up.
This set-up message is sent to the mobile station via the SDCCH

2. The mobile station confirms this set-up inquiry in the uplink via the same
channel.

3. Now the MSC selects a terrestrial channel of the A interface, also called a
trunk, for the transmission to the BSS. It sends a message, an Assignment
Request Message, to the BSS, asking it to allocate a free resource on the air
interface. This message contains information on the trunk used, so later on the
data stream functions perfectly.

4. After receiving the Assignment Request Message, the BSS allocates a


suitable traffic channel, and transmits this allocation via the SDCCH to the mobile
station. This must now prepare itself for a configuration of its air channel.

5. The mobile now takes over the allocated traffic channel and transmits the
confirmation of the allocation to the BSS via the FACCH. Now, the
subscriber is informed for the first time by the Man Machine Interface
(MMI) of the incoming call, in other words: the telephone rings. The BSS
transmits a final confirmation message to the MSC, about the successful
allocation of the air and terrestrial resources.

If the channel allocation is unsuccessful, the BSS sends an appropriate error


message to the MSC about the reason for the failure. Possible reasons for a
failure are that either air or terrestrial resources were reserved previously, and
are thus unavailable.

Speech and signalling data are not transmitted in their original state on the air
interface, but are encoded. Only after successful authentication can the BTS and
the mobile station start the encoding process.

The 114-bit key used for encoding and decoding at both ends of the air
transmission is produced at the BTS and at the mobile station using the encoding
algorithm A5. For this purpose, A5 uses the 64-bit key Kc that was generated
during the authentication process, and a 22-bit TDMA frame number in order to
encode and decode speech and signalling data.

6.2.4 Mobile Originated Call (MOC) and IMEI Checking

We refer to a Mobile Originated Call, or MOC, when a mobile telephone


subscriber calls a subscriber on the Public Switched Telephone Network (PSTN)
or on a Public Land Mobile Network (PLMN). The mobile caller dials a number.
This means he starts a call service inquiry in the net where he is currently a
visitor. Then the net analyses the caller's subscriber data to do three things:

• To authorise or refuse the use of the network


• To activate the requested service

and

• To route the call

If the call is addressed to the same mobile network, the MSC turns to the
relevant HLR via the dialed MSISDN to send the call to its destination. If the call
is to the PSTN or to a different PLMN, it is routed there via the Gateway MSC
(GMSC) and sent on to the target subscriber.

If a call is made to a PSTN, the following communication procedures take place


between the network elements. First, the BSS and the mobile station agree on
channel allocation. When this is done, necessary safety checks relating to the
subscriber are carried out between the mobile station and the serving MSC/VLR.
The mobile check is optional, depending on the network operator. The IMEI,
which is transmitted in encoded form through the air by the mobile station, is sent
to the Equipment Identity Register (EIR) that checks the authorization of the
terminal used. Only after the security checks have been carried out can the
mobile station start the call set-up via the MSC.

This now checks in the connected VLR whether the subscriber is authorized for
the desired service. If the VLR sends back a positive reply, the call set-up can be
carried out, and a traffic channel can be allocated to the connection. The serving
MSC sends the call via the relevant GMSC to the exchange of the PSTN. If a
confirmation of successful call set-up is sent from there, the caller is informed by
his MSC, and he hears the calling signal on his telephone. The conversation can
start.

6.2.5 Handover

We know already that the GSM network is of a cellular design. If a subscriber


moves from one cell to a neighboring cell, the current connection must be
maintained without any interruption. To ensure this, there is the Handover - that
is the neighboring cell takes over the coverage tasks in a sort of "substitution
without stopping", and the connection to the original cell is interrupted.
Handovers occur in the following cases:

1. A handover due to transmission measuring results occurs when the signal


strength or its quality is too low, or the distance from the mobile station to the
BTS is too great. The call is then transferred to a neighboring cell.

2. A handover due to high traffic volume within the cell occurs when the capacity
of the cell is exhausted and the call is transferred into a neighboring cell which is
less busy.

3. When necessary, a handover can be forced by the OMC - due to maintenance


work in the cell, for example.

A distinction is made between various handover types. We'll look at them in more
detail in the following lessons.

6.2.6 Intra Cell - Intra BSC Handover

The smallest of all handover types is the handover within a cell, the Intra cell -
Intra BSC handover. In this case, a subscriber is diverted to a different traffic
channel within the same cell. Generally, this channel is generated with a different
frequency or time slot. The decision about the handover is made by the BSC that
controls the cell.
6.2.7 Inter Cell - Intra BSC Handover

The Inter cell - Intra BSC handover takes place when a mobile user moves from
one cell into a neighboring cell, both controlled by the same BSC. The traffic
connection to the old cell is discontinued as soon as the connection set-up to the
new cell is successfully completed. This process is controlled by the BSC.

6.2.8 Inter Cell - Inter BSC Handover

We refer to an Inter Cell - Inter BSC handover when a mobile user moves from
one cell to a neighboring cell that is controlled by a different BSC, with both
BSCs being supervised by the same MSC.

This type of handover is carried out by the operating MSC, but the decision about
the handover is made by the old BSC. The connection to the old BSC area is
only interrupted when the new connection has been successfully established.

6.2.9 Inter MSC Handover

If a mobile phone user changes over to a new cell operated by a different MSC,
we refer to an inter MSC handover. This is a bit more complicated: Based on the
signal measuring results supplied by the mobile station, the old BSS can detect
the need for a handover to a neighboring cell.

The old BSS informs the MSC that is still serving of the required handover. This
MSC is also called the Anchor MSC. Next, the Anchor MSC requests the
Handover Number (HON), from the new MSC, or Target MSC. After receiving
this request, the Target MSC asks the new BSS to provide free resources at the
air interface.

When terrestrial and air resources have been re-allocated, the Target MSC can
make the required HON available to the Anchor MSC. With this number, the
Anchor MSC can establish a connection to the Target MSC.

The Anchor MSC now sends the handover command to the mobile station via the
old BSS. When the handover is successful, the mobile station sends an
appropriate success message to the new BSS, which passes the message on to
the Target MSC.

The Target MSC informs the Anchor MSC via the current connection that the old
connection to the mobile station can now be interrupted. The Anchor MSC re-
releases the channel allocation by notifying the old BSS.

Potrebbero piacerti anche