GSM Overview

• GSM System Overview

• GSM Abis
• GSM A-Interface
• GSM Signalling Procedures

1
 GSM

Global System
for
Mobile Communication

(Groupe Spéciale Mobile)

2
 Definition and
History
BTS

3
 Basic concept - 1
GSM vs. fixed network Telephony

fixed
fixed location
Local medium Telephone
Exchange

SONOFON

M N

Diffuse
Medium
Variable
Mobile
Location
Switching
Centre Mobile
Station

4
 The evolution

UMTS / IMT-2000 (FPLMTS)

DCS 1800 PCS 1900 GSM

CDMA
DECT GSM at GSM at Digital
1800 MHz 1900 MHz 900 MHz
Satellite
(IRIDIUM)

GSM
GSM GSM
DAMPS
CT2 Digital
Digital Digital
(TDMA)
900 MHz
900 MHz 900 MHz Trunked
mobile radio
(TETRA)
C-NET NMT TACS/ETACS AMPS
CT0, CT1 Analog Analog Analog Analog
450 MHz 450/900 MHz 900 MHz 800 MHz
Other systems
Cordless Mobile

5
GSM Standards

• The GSM Standard is divided into phases (phase 1, phase 2

and phase 2+) all the phases has been finalized by ETSI.

• Many of the GSM networks in operation today are currently

using the phase 2. However many of the GSM network
operators are starting to implement phase 2+ (GPRS
support).

• The ETSI GSM standard specification is around 5500 pages,

and are divided into12 series.

6
GSM Status

• Specification start-up: 1980

• First network in operation: Jan. 1992 (Radiolinja, Finland)
• Forecast in 1995:
» At the ITU's Telecom '95 event, were stated that we will reach 100
million subscribers Worldwide before the year 2000.
• September 1997: ~55 million subscribers.
~1 new subscriber each second.
~250 networks in 110 countries.
• July 1998:
» More than15 months early then year 2000 the magic figure of 100
million subscribers was reached.
• Today : Over 200 million subscribers. 369 networks
in 137 countries.
7
 GSM Services.
BTS

8
Services
• Telephony
• Data services (up to 9600 b/s)
BTS • Fax group 3 (special modem)
• Short Message Service (SMS)
• Supplementary services, e.g.
» Call Forwarding
» Call Barring
» Call Waiting
» Three Party Service
» Advice of Charge

9
GSM Features
• Integrated voice/data (ISDN)
• Improved performance
BTS
• Improved security
» Digital encryption
» Authentication (IMSI)
» TMSI assignment
• All types of Mobile Stations
• Automatic roaming
• Sophisticated radio functions
» Discontinuous transmission - DTX
» Frequency hopping

10
Services, phase 2 and 2+

• Half-rate and enhanced full-rate speech

• New supplementary services:
BTS
» Display of called and calling user's number
» Multi-party conversations (up to 6 parties)
» Closed user groups / virtual private networks
» Call completion services (busy, no answer etc.)
» Intelligent network services (CAMEL)
» Roaming between GSM and DCS 1800 (PCS
1900)
• High speed data services:
» High Speed Circuit Switched Data (HSCSD)
» General Packet Radio Service (GPRS)

11
 System architecture.
BTS

12
 System Overview

Public Switched
ISUP / TUP Telephone Network ISUP / TUP Um

(PSTN)

Authen. Equip. Id
MAP BTS
Centre Register
AUC EIR
Base Mobile Station (MS)
Station Base
MAP MAP Subsystem Transceiver
Home Visitor MAP Base
Location Location (BSS) Station
Transceiver
Base
Register Register BTS
A-bis BaseStation
Transceiver
HLR VLR BTS
Station
Transceiver
Base
Mobile Mobile Base
Switching Base BTS
Transceiver
Station
Switching Station
Centre Centre Transceiver
Station
BTS
MAP Controller
MSC MSC A-Inter Station
BTS
BSC
BTS
ISUP / TUP

2 Mbit/s PCM
Air Interface

13
 System Building Blocks

Visitor
VLR Location
Register
SONOFON

M N

BTS
HLR MSC BSC

Home Mobile Base Base

Location Switching Station Transceiver
Register Centre Controller Station

14
HLR (Home Location register)

•“Home Base” of information regarding customers subscribing

to a particular operators GSM network
•Keeps track of subscriber profile, conditions and whereabouts

VLR

SONOFON

M N

BTS
HLR MSC BSC

15
HLR contains

• Subscriber information:
» IMSI (International Mobile Subscriber Identity)
BTS » MSISDN (International Mobile Station ISDN
Number)
» MS Category (e.g. payphone)
» Authentication vectors (RAND, SRES and Kc:
AUC and SIM)
» Allowed services (subscription data)

• Mobile location information:

» VLR number
» (MSRN - Mobile Station Roaming Number)

16
 VLR (Visitor Location register)
•Database with information about mobile users
present/active in the network segment served by the MSC
•Handles true visitors as well as subscribers of the operator
himself

VLR

SONOFON

M N

BTS
HLR MSC BSC

17
 VLR contains.

• Subscriber information:
» IMSI
» TMSI - Temporary Mobile Subscriber Identity
BTS
» MS category
» Authentication vectors
» Allowed services

• Mobile location information:

» MSRN - Mobile Station Roaming Number
» LAI - Location Area Identity

18
BTS (Base Transceiver Station)

•Contains the radio transmitters and receivers (transceivers)

covering a certain geographical area of the GSM network

VLR

SONOFON

M N

BTS
HLR MSC BSC

19
BSC (Base Station Controller)

•Controls a group of BTS’s in relation to power control and handover.

•The combination of a BSC and its BTS’s is called a Base Station
Subsystem (BSS).
•The interface between the BTS and the is called the A-bis interface.

VLR

SONOFON

M N

BTS
HLR MSC BSC

20
MSC (Mobile Switching Centre)
•Serves a number of BSS’s (Base Station Subsystem) via the A-interface.
•Responsible for call control (set-up, routing, control and termination of the
calls)
•Management of inter-MSC handover and supplementary services, and for
collecting charging/accounting information.
•Gateway to other to other GSM networks and public-switched networks)

VLR

SONOFON

M N

BTS
HLR MSC BSC

21
 AUC - Authentication Centre

• Contains the individual subscriber-identification

key (also contained in the SIM), and provides the
subscriber data to the HLR and VLR used for
BTS authentication and encryption of calls.

AUC

HLR

22
 EIR - Equipment Identity Registration.
• Stores information about mobile stations in use
and may block calls from a MS if the MS is
stolen, not type-approved or has faults which
may disturb the network.
BTS • Each MS is identified by a unique International
Mobile Station Equipment Identity (IMEI)

EIR

MSC

23
 (MS) Mobile Station

Power:
- Class 1: 20 W Vehicle/
- Class 2: 8W portable
- Class 3: 5W Hand-held
- Class 4: 2W Hand-held
- Class 5: 0.8 W Hand-held

24
 Functional model.
BTS

25
 System Overview

Public Switched
ISUP / TUP Telephone Network ISUP / TUP Um

(PSTN)

Authen. Equip. Id
MAP BTS
Centre Register
AUC EIR
Base Mobile Station (MS)
Station Base
MAP MAP Subsystem Transceiver
Home Visitor MAP Base
Location Location (BSS) Station
Transceiver
Base
Register Register BTS
A-bis BaseStation
Transceiver
HLR VLR BTS
Station
Transceiver
Base
Mobile Mobile Base
Switching Base BTS
Transceiver
Station
Switching Station
Centre Centre Transceiver
Station
BTS
MAP Controller
MSC MSC A-Inter Station
BTS
BSC
BTS
ISUP / TUP

2 Mbit/s PCM
Air Interface

26
A functional model

• Call Management (CM)

VLR
» Call Control (CC)
» SMS
» Non Call-related SS
• Mobility Management SONOFON

M N

MSC HLR
BSC
(MM) BTS

• Radio Resource
Management (RR) CM

MM

RR

27
 GSM Protocol Architecture
MS BTS BSC MSC

CM (CM) (CM) (CM) DTAP

CM
(MM) I
MM (MM) (MM) (CM+MM)
Layer 3 MM S
MAP
U
BTS (RR) (RR) TCAP P
BSSMAP BSSMAP
RR RR

RR' BTSM SCCP SCCP SCCP

BTSM
Sig. layer 2 Sig. layer 2 Sig. layer 2 Sig. layer 2
Layer 2
(LAPDm) (LAPDm) (LAPD) (LAPD)
MTP MTP MTP
Layer 1 Layer 1 (air) Sig. layer 1
Layer 1 (air) Sig. layer 1

Um Interface Abis Interface A Interface Inter-MSC

•SCCP - Signalling Connection Control Part

• DTAP - Direct Transfer Application Part •MAP - Mobile Application Part
• BSSMAP - BSS Management Application Part•TCAP - Transaction Capability Application Part
• CM - Call Management •ISUP - ISDN User Part
• MM - Mobile Management
•MTP - Message Transfer Part
• RR - Radio Resource Management
• BTSM - BTS Management

28
Layer 3 Network Layer

• The Network layer contains the signalling

procedures and is divided into:
BTS
» CM - Call Management.
» MM - Mobility Management.
» RR - Radio Resource Management.

29
Call Management (CM)

• Call Management takes care of the ordinary

BTS
call-control procedure:
» Establishment and release of calls, as well as
access to services and facilities.
• CM is divided into:
» Call Control (CC), short messages services
(SMS).
» Non-call-related supplementary services (SS).

30
 Mobility Management (MM)

• Mobility Management handles roaming and

BTS
authentication procedure.

31
 Radio Resource Management (RR)

• Radio Resource
BTS
Management comprise:
» Paging.
» Radio-channel access.
» Ciphering.
» Handover.
» Radio-signal control
» Radio-signal measurement

32
 Layer 2,
Data Link Protocol.

• The Data Link Protocol is used at the Um and A-bis

interface, the Data Link Protocol is based on LAPD
BTS
(ISDN D-channel layer 2 protocol).

• On the A-Interface MTP and SCCP are used as

signalling-transport function.

• On the inter-MSC interface, MTP is used for ISUP, TUP

and MTP + SCCP + TCAP is used for MAP.

33
 Layer 1
Physical Link

• Physical Link of the signalling is time slots

BTS
in the radio carriers (TS0-7) and digital
PCM (E1/T1)lines.

34
 Radio (Um) Interface
BTS

Um

BTS

35
 The System

Public Switched
ISUP / TUP Telephone Network ISUP / TUP Um

(PSTN)

Authen. Equip. Id
MAP BTS
Centre Register
AUC EIR
Base Mobile Station (MS)
Station Base
MAP MAP Subsystem Transceiver
Home Visitor MAP Base
Location Location (BSS) Station
Transceiver
Base
Register Register BTS
A-bis BaseStation
Transceiver
HLR VLR BTS
Station
Transceiver
Base
Mobile Mobile
Switching Base Base BTS
Transceiver
Station
Switching Station
Centre Centre Transceiver
Station
BTS
MAP Controller
MSC MSC A-Inter BSC Station
BTS
BTS
ISUP / TUP

2 Mbit/s PCM
Air Interface

36
Protocol Architecture
MS BTS BSC MSC

CM (CM) (CM) (CM) DTAP

CM
(MM) I
MM (MM) (MM) (CM+MM) MM S
MAP
U
BTS (RR) (RR) TCAP P
BSSMAP BSSMAP
RR RR

RR BTSM SCCP SCCP SCCP

BTSM
Sig. layer 2 Sig. layer 2 Sig. layer 2 Sig. layer 2
(LAPDm) (LAPDm) (LAPD) (LAPD)
MTP MTP MTP
Layer 1 (air) Layer 1 (air) Sig. layer 1 Sig. layer 1

Um Interface Abis Interface A Interface Inter-MSC

•SCCP - Signalling Connection Control Part

• DTAP - Direct Transfer Application Part •MAP - Mobile Application Part
• BSSMAP - BSS Management Application Part•TCAP - Transaction Capability Application Part
• CM - Call Management •ISUP - ISDN User Part
• MM - Mobile Management
•MTP - Message Transfer Part
• RR - Radio Resource Management
• BTSM - BTS Management

37
 GSM 900 Radio (Um) Interface
Physical Channels
• In GSM approx. 1000 radio channels has been
assigned in the 900 MHz band. More precisely:
» 890 - 915 MHz “Uplink”
» 935 - 960 MHz “Downlink”
ink 60
• A combination of frequency and time division isnused.
l
w Do 9 2 4
» 124 carriers Ch1

» Carrier spacing is 200 kHz

p link 124 915
» 8 timeslots per carrier 9 35 U Ch
Ch1
SONOFON

890
M N

Ch 1
BTS

38
 DCS-1800 Radio (Um) Interface
Physical Channels
• In GSM 1800 2992 radio channels has been assigned
in the 1800 MHz band. More precisely:
» 1710 - 1785 MHz “Uplink”
» 1805 - 1880 MHz “Downlink”
• A combination of frequency and time division is used.
k
w n lin
» 374 carriers Do 74 1
88 0
Ch 3
» Carrier spacing is 200 kHz
» 8 timeslots per carrier p link 74 1785
1 8 05 U Ch3
Ch1
SONOFON

M N

1 710
Ch1
BTS

39
 TDMA Frame Structure

13 kbit/s user data

4.615 msec

TDMA Frame 0 1 2 3 4 5 6 7

BTS 0.577 msec

3 57 1 26 1 57 3 8.25
Time Slot TB Coded Data C TS C Coded Data TB GP

Duration of 1 bit: 3.692 usec

TS : Tail bit
TS : Training Sequence (setting up the receiver equaliser)
GP : Guard Period
C : Control bit

40
Physical Channels

Traffic channels showing

three timeslot delays
between the down and up
TS7 TS3 links.
TS6 TS2
TS 5 TS 1
TS 4 TS 0
BTS TS 3
TS2
TS 7
TS6
TS TS
0 TS7 5 TS4
TS6 TS3
Control Channels TS 5 TS 2
TS 4 TS1
TS 3 TS 0
Control Channels TS2 TS7
TS TS
Traffic Channels 1 TS0 6 TS5
Downlink Uplink

Eight TS, or eight physical SON

M
OF
ON

channels compromise a FRAME

41
Radio (Um) Interface burst modulation structure
Tail Information Training Information Tail Guard

Normal 8.25
3 57+1 (TCH/FACCH) 26 57+ 1 (TCH/FACCH) 3
burst
Tail
Tail Training Information Guard
Access 68,25
7 41 36 3
burst

Tail Information Training Information Tail Guard

SCH 8.25
3 39 64 39 2
burst

Tail Information Tail Guard

FCCH 8.25
3 142 3
burst

Not illustrated is the “dummy” burst which has the same structure as the “Normal”
burst. The dummy burst is sent when no information is transmitted on a TCH

42
 Radio (Um) Interface Normal burst
Tail Information Training Information Tail Guard

Normal 8.25
3 57+1 (TCH/FACCH) 26 57+ 1 (TCH/FACCH) 3
burst

• For the “Normal” burst, one of the 58 information bits on

each side of the training sequence is a flag bit indicating
whether the burst is a TCH - traffic channel (0) or for a
FACCH - fast associated control channel (1).
• The burst is converted to FACCH when signalling is
required after a TCH has been allocated.
» Note: Each “Normal” burst (TDMA) time slot period consist of 156.25 bits (equal
to 33.9 kbit/s per time slot or 270.8 kbit/s per frame carrier), of which 144 (2*57)
bits are coded data including forward error correction. All information is
transferred in blocks of 456bits divided into four time slot periods (456 =
4*2*57). The maximum net bit rate is 13 kbit/s (Excluding the error correction)

43
 Radio (Um) Interface Access burst
Tail
Tail Training Information Guard
Access 68,25
7 41 36 3
burst

• The “access” burst is a shortened burst used by the

mobile station when it first access a cell.
• Its short length guarantees it will arrive within the
correct time slot at the BTS receiver if the mobile
station is no greater than 35km from the BTS.
» 68,25 bits * 3,s (1 bit) = 251s ~ (75Km / 2) = 37,5Km

44
 Time Division Multiple Access burst
• Downstream:
» A series of bits intended for different
users, who must select only the one
intended for him and filter out the rest
• Upstream:
» Individual bits from each of the users
arrive at the BTS
BTS
» Strict timing of when the MS should
Wrong Uplink Timing transmit is required to avoid collisions
at the BTS
SONOFON

M N

SONOFON

M N

SONOFON

M N

SONOFON

M N

45
Timing advance (Access burst)
1 Km 15 Km 30 Km

TS TS TS TS TS TS

BTS
SONOFON
SONOFON SONOFON
M N
M N M N

• The transmitted radio burst from BTS must travel whatever the distance is to the mobile station , and then transmitted burst from the mobile
station (three burst later) must travel back the same distance. By measuring the time between the last bit in the access burst and the last bit
in the TS the mobile then know the distance to the BTS and will adjust its Timing advance to compensate for the distance.

Access TS
burst Timing advance

46
Mobile Station
Timing advance Measurement Report
Message Type : 3Fh = Immediate assignment
--- Channel description ---
Time slot number : .....001
Channel type and TDMA offset : 01011... = SDCCH/8 + SACCH/C8 or CBCH (SACCH/8)
Training Sequence Code : 011.....
Hopping channel : ...0.... = Single RF channel
spare : ....00..
Absolute RF Channel Number : 720
--- Request reference --- Timing advance = 2
Random access information :4
T1 :7 The mobile station is 1km
T3 : 19
T2 :7
from the BTS.
--- Timing advance ---
Timing advance value : ..000010
Spare : 00......

47
 SCH burst
Tail Information Training Information Tail Guard
SCH 8.25
3 39 64 39 2
burst

• The SCH burst is the synchronization channel burst

which carries the the BSIC - Base Station Identity
Code and the FN - Frame Number.
• As this is the first burst decoded by the mobile
station it has an extended training sequence.

48
 FCCH burst
Tail Information Tail Guard
FCCH 8.25
3 142 3
burst

• The FCCH burst is the frequency correction

channel burst which is modulated with zero

49
 Radio (Um) Interface Logical Channels
• Traffic channels (TCH):
» Carrying Voice/data
» Bm: 13 kbit/s user data
BTS » Lm: Half rate (6,5 kbit/s)

• Common control channels (CCCH):

» Channels that all Mobile Stations can share

• Dedicated control channels (DCCH):

» Control channels for individual Mobile Stations

50
Radio (Um) Interface Common Control Channels

• Broadcast: BCCH
» Carry system info intended for everybody, e.g.
Location Area Identity
BTS
• Paging: PCH
» To request a specific Mobile User to react/reply, e.g.
when there is a call for him
• Random Access: RACH
» Used by the Mobile Station to initiate contact with the
network, e.g. when trying to start a call
• Access Granted: AGCH
» Used to respond to the RACH to inform that the
Mobile is now being allowed to access the network

51
Radio (Um) Interface Dedicated Control Channels

• Stand-alone Dedicated : SDCCH

» Used for settling practicalities such as roaming,
BTS
authentication, encryption and call control before
allocating the traffic channel
• Slow Associated: SACCH
» Associated to a TCH
» Used together with the Traffic Channel to deal with
control and measurement of radio signals
• Fast Associated: FACCH
» Large bandwidth version of the SACCH
» Used for sudden control action such as handovers
» Implemented a robbed bits in a TCH

52
 Hyper-, Super- and Multiframes
1 hyperframe = 2048 superframes (3h 28min 53s 760ms)
0 1 2 3 4 5 6 2042 2043 2044 2045 2046 2047

1 superframe = 26 (51-frames) or 51 (26-frames) multiframes (6.12s)

0 1 2 3 4 5 6 7 18 19 20 21 22 23 24 25

0 1 2 3 4 5 6 45 46 47 48 49 50

1 (26-frame) multiframe = 26 TDMA frames (120ms)

0 1 2 3 4 5 6 7 18 19 20 21 22 23 24 25

0 1 2 3 4 5 6 7

1 TDMA frame = 8 timeslots (4.615 ms) 1 (51-frame) multiframe = 51 TDMA frames (235.38 ms)
0 1 2 3 4 5 6 45 46 47 48 49 50

0 1 2 3 4 5 6 7

1 TDMA frame = 8 timeslots (4.615 ms)

53
 TDMA Frame with 1 combined CCH and 7
TCH
Downlink and Uplink Cyklus: 1 TCH multiframe = 26 TDMA frames = 120 ms

Bm Bm Bm Bm Bm Bm Bm Bm Bm Bm Bm Bm SA Bm Bm Bm Bm Bm Bm Bm Bm Bm Bm Bm Bm -

4.615 ms

TDMA Frame (8 timeslots) 0 1 2 3 4 5 6 7

Downlink:
Cyklus: 1 CCH multiframe = 51 TDMA frames = 235.38 ms

F S BCCH PCH/AGCH F S PCH/AGCH PCH/AGCH F S SDCCH/1 SDCCH/2 F S SDCCH/3 SDCCH/4 F S SACCH/1 SACCH/2 -
F S BCCH PCH/AGCH F S PCH/AGCH PCH/AGCH F S SDCCH/1 SDCCH/2 F S SDCCH/3 SDCCH/4 F S SACCH/3 SACCH/4 -

Uplink: F = Frequency correction burst S = Synchronisation burst

R R SACCH/1 SACCH/2 R R R R R R R R R R R R R R R R R R R R R R R SDCCH/1 SDCCH/2 R R SDCCH/3 SDCCH/4

R R SACCH/3 SACCH/4 R R R R R R R R R R R R R R R R R R R R R R R SDCCH/1 SDCCH/2 R R SDCCH/3 SDCCH/4
R = RACH

54
 Cell Structure
Omni-directional BTS
F1 F2
Safety distance
BTS BTS

R 5xR
F3 F4
F4
BTS

BTS To avoid interference between two cells using the same frequency,
F5 F6 a safety distance of about 5 times the cell radius is required.
A BTS may cover one cell (Omni-directional) or several cells
(typical three directional cells).
Each cell may be served by on or more TRXs depending on the
required capacity.

3-directional BTS Note: each TRX controls one carrier with eight TS.

55
 Radio (Um) Interface Neighbour Cells

• Mobile station in IDLE mode

» Besides listening to the BCCH and the PCH the
mobile station is measuring for neighbour cells.
• Mobile station in active mode
BTS
» In active mode the mobile station is using the
time between the down and uplink TS (three TS
2ms) to do neighbour cell measuring.
• The mobile station can measure up to 31
neighbour cells.
» In practice the mobile station measures up to 12
neighbour cells.
» Very often only three or four cells are measured.

56
Mobile Station
Neighbour Cells Measurement Report
--- MEAS REP ---
--- MEAS RES ---
NO NCELL M : 100b = 4 neighbour cell measurement result
RXL NCEL 1 : 36 = minimum received signal level = -75 dBm to -74 dBm
BCCH NCEL1 : 1
BSIC NCEL1 : 57
RXL NCEL 2 : 24 = minimum received signal level = -87 dBm to -86 dBm
BCCH NCEL2 : 12
BSIC NCEL2 : 63
RXL NCEL 3 : 23 = minimum received signal level = -88 dBm to -87 dBm
BCCH NCEL3 : 7
BSIC NCEL3 : 59
RXL NCEL 4 : 16 = minimum received signal level = -95 dBm to -94 dBm
BCCH NCEL4 : 2
BSIC NCEL4 : 56
RXL NCEL 5 : 0 = minimum received signal level less than -110 dBm
BCCH NCEL5 : 0
BSIC NCEL5 : 0
RXL NCEL 6 : 0 = minimum received signal level less than -110 dBm
BCCH NCEL6 : 0
BSIC NCEL6 : 0

57
 (MS) Mobile Station SIM Card
• IMSI
» - International Mobile subscriber Number
• MSISDN
» - Mobile Station ISDN Number
• Latest BCCH List
» The latest BCCH used last time the mobile station
was connected to the network.
• Preferred Network List.
• Forbidden Network List.
• KI
» The Key identifier refers to an authentication key for
the mobile subscriber.

58
 A-bis
BTS

59
 The System.
Public Switched
ISUP / TUP Telephone Network ISUP / TUP Um

(PSTN)

Authen. Equip. Id
MAP BTS
Centre Register
AUC EIR
Base Mobile Station (MS)
Station Base
MAP MAP Subsystem Transceiver
Home Visitor MAP Base
Location Location (BSS) Station
Transceiver
Base
Register Register BTS
A-bis BaseStation
Transceiver
HLR VLR BTS
Station
Transceiver
Base
Mobile Mobile Base
Switching Base BTS
Transceiver
Station
Switching Station
Centre Centre Transceiver
Station
BTS
MAP Controller
MSC MSC A-Inter Station
BTS
BSC
BTS
ISUP / TUP

2 Mbit/s PCM
Air Interface

60
 Protocol Architecture
MS BTS BSC MSC

CM (CM) (CM) (CM) DTAP

CM
(MM) I
MM (MM) (MM) (CM+MM) MM S
MAP
U
BTS (RR) (RR) TCAP P
BSSMAP BSSMAP
RR RR

RR' BTSM SCCP SCCP SCCP

BTSM
Sig. layer 2 Sig. layer 2 Sig. layer 2 Sig. layer 2
(LAPDm) (LAPDm) (LAPD) (LAPD)
MTP MTP MTP
Layer 1 (air) Layer 1 (air) Sig. layer 1 Sig. layer 1

Um Interface Abis Interface A Interface Inter-MSC

•SCCP - Signalling Connection Control Part

• DTAP - Direct Transfer Application Part •MAP - Mobile Application Part
• BSSMAP - BSS Management Application Part•TCAP - Transaction Capability Application Part
• CM - Call Management •ISUP - ISDN User Part
• MM - Mobile Management
•MTP - Message Transfer Part
• RR - Radio Resource Management
• BTSM - BTS Management

61
 A-bis (A) Layer 1 Structures
64 kbit/s signalling channels

TS 0 TS 1 TS 2 TS 3 TS 4 TS 5 ---- TS 31

TS = 64 kbit/s timeslot

BTS
16 kbit/s traffic channels

One 2Mbit/s line may cover several BTSs. This means that
normally several time slots in the same PCM frame are used
as signalling channels.
Three time slots divided into one 64Kbit/s signalling channel and eight 16Kbit/s
traffic channels are sufficient to cover one TRX, giving up to 10 TRXs and 10
signaling channels per 2 Mbit/s.
In practice , the configuration of the transmission lines depends on the actual
network structure and the GSM equipment used.

62
 A-bis Layer 2 Structure
Flag Address Control Information CRC Flag
01111110 16 Bits 8 or 16 Bits N - Bits 16 Bits 01111110

SAPI -Service Access Point Identifier

TEI - Terminal End Point Identifier
BTS SAPI C/R EA 0 C/R -Command / Response bit
TEI EA 1 EA -Address Extension bit
0 = Extend 1 = Final

SAPI value Related entity TEI value User type

0 Radio signalling 0-63 For fixed TRX addresses
1 Reserved for packet mode /Q.931 64-126 For additional TRX addresses
16 Reserved for packet mode /X.25
62 Operation and maintenance Not used in GSM
63 Layer 2 management
All others Reserved for future standardisation Vendor-specific

63
 A-bis Layer 2 Control Field

OCTET 1 OCTET 2 + 3 OCTET 4 ( + 5 ) OCTET N

Flag Address Control Information CRC Flag
01111110 16 Bits 8 or 16 Bits N - Bits 16 Bits 01111110

BTS
Control field bits Control field bits
8 7 6 5 4 3 2 1 8 7 6 5 4 3 2 1
( modulo 8 ) ( modulo 128 )
N(S) 0 OCTET 4
I format N(R) P N(S) 0 OCTET 4 I format 5
N(R) P
X X X X S S 0 1 OCTET 4
S format N(R) P/F S S 0 1 OCTET 4 S format
N(R) P/F 5

U format M M M P/F M M 1 1 OCTET 4 U format M M M P/F M M 1 1 OCTET 4

I forma - Information transfer format N(S) - Transmitter send sequence number

Used for information transfer between layer 3 N(R) - Transmitter receive sequence number
entities S -Supervisory function bit
S format - Supervisory format M -Modifier function bit
Used for control functions P/F - Poll bit when issued as a command Poll bit
U format - Unnumbered format when issued as a command Final bit when issued as
Used for additional control functions and a response
information transfer X - Reserved and set to 0

64
 A-bis Information Elements, part 1
- Channel number (Indicates channel on radio interface)
- Link identifier (Signalling link and SAPI used on radio interface)
- Activation type (Intra-cell, inter-cell or additional assignment CHAN ACTIV)
- BS power (BTS/TRX power level)
- Channel identification (Description of channels allocated to MS)
- Channel mode (Indicates discontinuous transmission and channel type, e.g. speech)
- Encryption information (Encryption algorithm and key)
- Frame number (On radio interface, modulo 42432)
- Handover reference (Identical to handover reference in RR information elements)
- L1 information (MS power level and timing advance)
- L3 information (Contains transparent RR, MM or CM message)
- MS identity (IMSI or TMSI)
- MS power (MS power level)
- Paging group (Identifies MS paging group)
- Paging load (Load on paging channel, PCH)
- Physical context (Not specified)
- Access delay (Delay of MS access burst at random access or handover)
- RACH load (Load of random access channel, RACH)
- Request reference (Random ref. in RR Channel Request message)

65
 A-bis Information Elements, part 2
- Release mode (Normal release or local end release)
- Resource information (Interference level for idle TRX channels)
- RLM cause (Indicates protocol error on radio link layer)
- Starting time (Expressed as Frame Number modulo 42432)
- Timing advance (To be used by MS in subsequent communications)
- Uplink measurements (Radio signal measurement results from TRX)
- Cause (Reason for event/failure)
- Measurement result num (For a radio channel; set to 0 at activation)
- Message identifier (In ERROR REPORT message: Message type of errored message)
- Message indicator (In ERROR REPORT message: Copy of errored message follows)
- System info type (Type of RR System Information message)
- MS power parameters (Limits set by BSC for BTS control of MS power)
- BS power parameters (Limits set by BSC for BTS control of TRX power)
- Preprocessing param. (For preproc. of radio measurement data in BTS)
- Preprocessed
measurements (Preprocessed radio measurement data)
- Immediate assign info (Conveys complete RR Immediate Assign msg.)
- SMSCB information (SMS-message to be broadcasted in a radio cell)

66
 A-Interface
BTS

67
 The System.
Public Switched
ISUP / TUP Telephone Network ISUP / TUP Um

(PSTN)

Authen. Equip. Id
MAP BTS
Centre Register
AUC EIR
Base Mobile Station (MS)
Station Base
MAP MAP Subsystem Transceiver
Home Visitor MAP Base
Location Location (BSS) Station
Transceiver
Base
Register Register BTS
A-bis BaseStation
Transceiver
HLR VLR BTS
Station
Transceiver
Base
Mobile Mobile Base
Switching Base BTS
Transceiver
Station
Switching Station
Centre Centre Transceiver
Station
BTS
MAP Controller
MSC MSC A-Inter Station
BTS
BSC
BTS
ISUP / TUP

2 Mbit/s PCM
Air Interface

68
 Protocol Architecture
MS BTS BSC MSC

CM (CM) (CM) (CM) DTAP

CM
(MM) I
MM (MM) (MM) (CM+MM) MM S
MAP
U
BTS (RR) (RR) TCAP P
BSSMAP BSSMAP
RR RR

RR' BTSM SCCP SCCP SCCP

BTSM
Sig. layer 2 Sig. layer 2 Sig. layer 2 Sig. layer 2
(LAPDm) (LAPDm) (LAPD) (LAPD)
MTP MTP MTP
Layer 1 (air) Layer 1 (air) Sig. layer 1 Sig. layer 1

Um Interface Abis Interface A Interface Inter-MSC

•SCCP - Signalling Connection Control Part

• DTAP - Direct Transfer Application Part •MAP - Mobile Application Part
• BSSMAP - BSS Management Application Part•TCAP - Transaction Capability Application Part
• CM - Call Management •ISUP - ISDN User Part
• MM - Mobile Management
•MTP - Message Transfer Part
• RR - Radio Resource Management
• BTSM - BTS Management

69
A-Interface

• Based on System7 MTP and SCCP

BTS • Uses Base Station Subsystem Application
Part (BSSAP)
» BSS Management Application Part (BSSMAP)
• Radio Resource (RR) and BSC management
• Uses SCCP connectionless service
» Direct Transfer Application Part (DTAP)
• Transfer of Call Control (CM) messages
• Transfer of Mobility Management (MM) messages
• Uses SCCP connection-oriented service

70
 Basic format of SCCP message
F B
F CK SIF Label SIO LI I FSN I BSN F
B B

Sub-service Service Indicator

Field 0011
Message Originating Destination
SCCP User Data type SLS
Point Code Point Code
N x 8 bits 8 bits 4 bits 14 bits 14 bits
Mandatory fixed part
Mandatory variable part
Optional part

71
 SCCP Message Types
Protocol class
Message type Code
0 1 2 3
X X CR Connection Request 0000 0001
X X CC Connection Confirm 0000 0010
X X CREF Connection Refused 0000 0011
X X RLSD Released 0000 0100
X X RLC Release Complete 0000 0101
X DT1 Data Form 1 0000 0110
X DT2 Data Form 2 0000 0111
X AK Data Acknowledgement 0000 1000
X X UDT Unitdata 0000 1001
X X UDTS Unitdata Service 0000 1010
X ED Expedited Data 0000 1011
X EA Expedited Data Acknowledgement 0000 1100
X RSR Reset Request 0000 1101
X RSC Reset Confirm 0000 1110
X X ERR Protocol Data Unit Error 0000 1111
X X IT Inactivity Test 0001 0000

72
SCCP Message Types, Class 0 and 2.

• UDT (Unitdata) Class 0

» Used by a SCCP wanting to send data in a
connectionless mode.
BTS

• DT1 (Data Form 1) Class 2

» A Data Form 1 message is sent by either end of a
signalling connection to pass transparently SCCP
user data between two SCCP nodes.

• Note: Only point to point signalling route is used in at the A-

inter phase, meaning that the MTP does not have to contain
the functions related to the signalling transfer point (STP) and
multiple signalling-route management.

73
 A-Interface
BSSAP
BTS

74
 Base Station Subsystem Application Part (BSSAP)

• ETSI has specified an SS7 Base Station

BTS Subsystem Application Part (BSSAP) as the
user of the SCCP/MTP transport service.
» SCCP subsystem number for BSSAP is FEh.

75
 BSSAP messages Structure
SIO F B
F CK SIF 83h LI I FSN I BSN F
B B
OCTET

Discriminator 1 1 Discriminator SCCP Header

00000000 00000001 SSN FEh: BSSAP

2 DLCI
DLCI Data Link Connection Identifier

Bit no.: 8 7 6 5 4 3 2 1
Length 3 2
Length C2 C1 0 0 0 S3 S2 S1
Indicator 1 Indicator 1
C2 C1 identifies signalling-radio channel
Layer 3 Layer 3 (00: SDCCH/FACCH, 01: SACCH)
Messages n n Um Interface S3-S1 is the SAPI on the radio interface
Octet Octet
BSSMAP DTAP

76
 A-Interface
BSSMAP
BTS

77
 BSSMAP Format

Information Element Identifier Disc. 0 = BSSMAP OCTET

BTS 1
Content of Information Elements
Length indicator OCTET
2

Fixed Length Info. Element Format BSSMAP message type

BSSMAP message OCTET

Information Element Identifier
n
Length of Information Elements

Content of Information Elements

Variable Length Info. Element Format

78
BSSMAP Messages, part 1

Code Message type

0000- - - - Assignment messages: (Setup of traffic channels)
0001 - Assignment request
0010 - Assignment complete
0011 - Assignment failure

0010- - - - Release messages:

0000 - Clear command (Release of traffic channels)
0001 - Clear complete
0010 - Clear request
0011 - SAPI "n" clear command (Control of layer 2 links with SAPI not equal
0100 - SAPI "n" clear complete to 0 on the radio interface)
0101 - SAPI "n" reject

79
 BSSMAP Messages, part 2
Code Message type
0001- - - - Handover messages:
0000 - Handover request (To BSC: Request for handover to that BSC)
0001 - Handover required (To MSC: Inter-BSC/MSC handover required)
0010 - Handover request ack (To MSC: Acknowledge of Handover request)
0011 - Handover command (To BSC: Contains the new radio channel/BTS
to which the MS should switch)
0100 - Handover complete (To MSC: Commanded handover complete)
0110 - Handover failure (To MSC: Commanded handover unsuccessful)
0111 - Handover performed (To MSC: BSC has performed intern. handover)
1000 - Handover candidate (To BSC: MSC requests list of MS that could
enquire be handed over to another cell)
1001 - Handover candidate (To MSC: Answer to Handover candidate
response enquire)
1010 - Handover required reject (To BSC: Required handover unsuccessful)
1011 - Handover detect (To MSC: Commanded handover successful)

80
 BSSMAP Messages, part 3
Code Message type
0011- - - - General messages:
0000 - Reset (Initialisation of BSS or MSC due to failure)
0001 - Reset Acknowledge
0010 - Overload (Processor or CCCH overload)
0011 - Trace invocation (Start production of trace record)
0100 - Reset Circuit (Initialisation of single circuit due to failure)
0101 - Reset Circuit
acknowledge

0100- - - - Terrestrial resource messages:

0000 - Block (Management of circuits/time slots
0001 - Blocking acknowledge between MSC and BTS)
0010 - Unblock
0011 - Unblocking acknowledge

81
 BSSMAP Messages, part 4
Code Message type
0101- - - - Radio resource messages:
0000 - Resource request (Available radio channels in the BSS cells)
0001 - Resource indication
0010 - Paging (Paging of MS)
0011 - Cipher mode command (Commands start of cyphering)
0100 - Classmark update (Change of MS power class)
0101 - Cipher mode complete (Ciphering is successfully initiated)
0110 - Queuing indication (Indicates delay in assignment of traffic
channel)
0111 - Complete layer 3 (Contains first message received from MS;
information sets up SCCP-connection at A-interface)

82
 A-Interface
DTAP
BTS

83
 Direct Transfer Application sub-Part (DTAP)

• The Direct Transfer Application sub-

BTS Part (DTAP) is used to transfer call
control and mobility management
messages to and from the MS;
» The layer-3 information in these messages
is not interpreted by the BSS.

84
 DTAP Format

Information Element Identifier Disc. 1 = DTAP OCTET

BTS 1
Content of Information Elements
Length indicator OCTET
2

Fixed Length Info. Element Format BSSMAP message type

BSSMAP message OCTET

Information Element Identifier
n
Length of Information Elements

Content of Information Elements

Variable Length Info. Element Format

85
 DTAP messages and elements

• Layer 3 of the DTAP messages has the

BTS same format as BSSMAP messages.

• The DTAP messages and information

elements are identical to the the
transparent MM and CM listed in the A-
bis section.

86
 BSC MSC

SCCP CR (BSSMAP Comp layer 3 info (CM Service Request [MM]))

SCCP CC (BSSMAP Cipher mode command)

SCCP DT1 (BSSMAP Cipher mode complete)

SCCP DT1 (DTAP (Setup [CM]))

SCCP DT1 (DTAP (Call Proceeding [CM]))

BTS
SCCP DT1 (BSSMAP Assignment request)

SCCP DT1 (BSSMAP Assignment complete)

A-Interface signalling SCCP DT1 (DTAP (Alerting [CM]))

example SCCP DT1 (DTAP (Connect [CM]))

. .
.
. Active call .
.
. .
SCCP DT1 (DTAP (Disconnect [CM]))

SCCP DT1 (DTAP (Release [CM]))

SCCP DT1 (DTAP (Release Complete [CM]))

SCCP DT1 (BSSMAP Clear command)

SCCP DT1 (BSSMAP Clear complete)

SCCP RLSD

SCCP RLC

87
 BTS Inter-MSC Signalling
MAP

88
 The System.
Public Switched
ISUP / TUP Telephone Network ISUP / TUP Um

(PSTN)

Authen. Equip. Id
MAP BTS
Centre Register
AUC EIR
Base Mobile Station (MS)
Station Base
MAP MAP Subsystem Transceiver
Home Visitor MAP Base
Location Location (BSS) Station
Transceiver
Base
Register Register BTS
A-bis BaseStation
Transceiver
HLR VLR BTS
Station
Transceiver
Base
Mobile Mobile Base
Switching Base BTS
Transceiver
Station
Switching Station
Centre Centre Transceiver
Station
BTS
MAP Controller
MSC MSC A-Inter Station
BTS
BSC
BTS
ISUP / TUP

2 Mbit/s PCM
Air Interface

89
 Protocol Architecture
MS BTS BSC MSC

CM (CM) (CM) (CM) DTAP

CM
I
MM (MM) (MM) (MM) (CM+MM) MM S
MAP
U
BTS (RR) (RR) TCAP P
BSSMAP BSSMAP
RR RR

RR' BTSM SCCP SCCP SCCP

BTSM
Sig. layer 2 Sig. layer 2 Sig. layer 2 Sig. layer 2
(LAPDm) (LAPDm) (LAPD) (LAPD)
MTP MTP MTP
Layer 1 (air) Layer 1 (air) Sig. layer 1 Sig. layer 1

Um Interface Abis Interface A Interface Inter-MSC

•SCCP - Signalling Connection Control Part

• DTAP - Direct Transfer Application Part •MAP - Mobile Application Part
• BSSMAP - BSS Management Application Part•TCAP - Transaction Capability Application Part
• CM - Call Management •ISUP - ISDN User Part
• MM - Mobile Management
•MTP - Message Transfer Part
• RR - Radio Resource Management
• BTSM - BTS Management

90
 Inter-MSC Signalling

• The inter-MSC interfaces are:

» The MSC-VLR interface.
BTS
» The MSC-HLR interface.
» The HLR-VLR interface.
» The MSC-MSC interface.
» The MSC-EIR interface.
» The VLR-VLR interface.
» The MSC-ISDN/telephone network
interface.

91
 MAP

• MAP = Mobile Application Part

BTS • Users: MSC, HLR, VLR, EIR

• Applications:
» Location updating/roaming
» Incoming call routing information (MSRN)
» Subscriber service information
» Non-call related supplementary services
» Short message service delivery
» MS equipment identity (IMEI)
» Charging information

92
 MAP Operations Part 1

Value Operation
1 Update location area
2 Update location
3 Cancel location
BTS 4 Provide roaming number
5 Detach IMSI
6 Attach IMSI
7 Insert subscriber data
8 Delete subscriber data
9 Send parameters
10 Register SS
11 Erase SS
12 Activate SS
13 Deactivate SS
14 Interrogate SS
15 Invoke SS
16 Forward SS notification
17 Register password
18 Get password
19 Process unstructured data

93
 MAP Operations Part 2

Value Operation
20 Send info for incoming call
21 Send info for outgoing call
22 Send routing information
BTS 23 Complete call
24 Connect to following address
25 Process call waiting
26 Page
27 Search for mobile subscriber
28 Perform handover
29 Send end signal
30 Perform subsequent handover
31 Allocate handover number
32 Send handover report
33 Process access signalling
34 Forward access signalling
35 Note internal handover
36 Register charging information
37 Reset
38 Forward check SS indication

94
 MAP Operations Part 3

Value Operation
39 Authenticate
40 Provide IMSI
41 Forward new TMSI
BTS 42 Set ciphering mode
43 Check IMEI
45 Send routing info for SM
46 Forward short message
47 Set message-waiting data
48 Note MS present
49 Alert service centre
50 Activate trace mode
51 Deactivate trace mode
52 Trace subscriber activity
53 Process access request
54 Begin subscriber activity

95
 Visited side Home side
BEGIN

INVOKE (Update Location)

BTS
CONTINUE

MAP - signalling INVOKE (Insert Subscriber Data)

Location Updating CONTINUE

example RETURN RESULT (Insert Subscriber Data)

END

RETURN RESULT (Update Location)

96
 TRAU
Transcoder Rate Adaptation Unit
BTS

97
TRAU

• TRAU - Transcoder / Rate Adaptation Unit

BTS
Functions:
» Conversion of speech from 64 kbit/s on PCM (A-
law) to 13/6.5 kbit/s on the GSM radio interface
» Intermediate rate adoption of data from V.110
frames to the special TRAU frames on the A-bis
interface

98
 Possible Locations of the TRAU.
T
R
BTS A BSC MSC
U

T
R
BTS BSC A MSC
U

T
R
BTS BSC A MSC
U

Um A-bis A-Interface

13Kbit/s speech channel

99
 GSM Speech Encoding

• Bandwidth: 13 kbit/s
• Encoding algorithm: Regular Pulse Excitation with
Long Term Prediction (RPE LTP):
BTS
» Speech is sampled 8000 times per second
» Each sample is converted into a 13 bit digital value
» Every 20 ms a 260 bit segment is generated (13 kbit/s)
» The segment is divided by importance into 182 class 1 bits
and 78 class 2 bits
» For protection, the 182 class 1 bits are mapped into 378 bits
» The resulting 456 bits (378 + 78) are divided into 8x57 bits
» The data are transmitted in 4 consecutive TDMA blocks
• Resulting overall delay is 57.5 msec.

100
Control of TRAU

• TRAU is controlled by BTS

BTS
• In-band signalling used, if TRAU not at
BTS

• Control functions:
» Shift between speech and data
» Shift between full rate and half rate channels
» Timing of speech frames (BSS - MS)
» Comfort noise (Discontinuous Transmission)

101
 GSM
Signalling
BTS
procedures

102
 Special signalling procedures for GSM

• Call Management
» Ordinary Call Control (as usual)
• Mobility Management
BTS
» Location Updating (Roaming)
» Authentication
• Radio Resource Management
» Paging
» Network Access
» Encryption
» Radio Signal Control
» Radio Signal Measurements
» Handover

103
 Location Updating (Roaming) VLR

•An MM procedure MSC

•Reasons for roaming: Area 1
» MS has detected that it has
entered into a new location
area (by listening to Broadcast
system info)
•Types of roaming:
» Inside same VLR area BTS BTS

• The HLR does not need to SONOFON

M N

know
» Another VLR area
• In this case the HLR is VLR
informed
BTS BTS MSC

Area 2

104
Handovers.
•A RR procedure
•The Handover process is the
situation where a Mobile Station
changes from being served by one
Antenna to another
•Handovers take place during a
BTS BTS call
•Handover are done automatically
•Crossing the boundary of two
adjacent cells is the typical
example of a Handover

105
 Handovers.
• Major types of handovers
» Intra BSC MSC - A Inter MSC
» Inter BSC
MSC - B
» Inter MSC
Inter BSC
• Purpose of handover
» Poor quality connection
• Avoid loosing contact
to the mobile station BSC BSC
Intra BSC
» Fault in the MS or BTS/BSC BSC
» Network management
SONOFON

M N

BTS

BTS SONOFON

M N

SONOFON

M N

BTS
BTS

106
Call Setup

• A CM procedure
BTS • Distinguish two types
» Mobile Terminating Call
• i.e. a call from the fixed network to a Mobile
Station
» Mobile Originating Call
• i.e. a call from a Mobile Station to the fixed
network

107
Mobile Terminating Call

• Problems and answers

» Where in the world is the Mobile Station
BTS
• Look it up in the HLR
• (The HLR may have to ask the VLR)
» How to Make the Mobile Station Aware that a call is waiting
• Page it in the cell where it is located
» What does the MS do when being paged ?
• Asks for a Radio channel
• Tells the system that it is ready

• Now the usual setup flow follows

108
 Incoming Call
MS BTS BSC MSC VLR HLR GMSC ISDN
IAM (MSISDN, service)
Send Routing Info (MSISDN)
Provide Roaming Number (IMSI)
Roaming Number (MSRN)
Routing Info (MSRN)
IAM (MSRN, service)
Send Info Incoming Call (MSRN, service)
Page (IMSI, TMSI, LAI)
Paging Request (TMSI) [RR]
Channel Request [RR]
Immediate Assign [RR]
Paging Response (TMSI) [RR]
Page Result
SETUP (service) [CM] Complete Call (service)
Call Confirm [CM]
Assign Command [RR] Assign Req [RR]
Assign Complete [RR]
Alerting [CM] ACM
Connect [CM]
ANM
Connect Ack [CM]
Complete Call Result
Um/A-bis/A signalling
MAP signalling
ISUP/TUP signalling

109
Mobile Originating Call

• Problems and Answers

BTS
» How the mobile gets in contact with the
network
• Switch the MS on
• Request a channel
• Tell the network what kind of service is wanted
» How does the network respond
• Verifies the Mobile identity (authentication)
• Assigns a traffic channel

• And then everything proceed as usual

110
 Outgoing Call from MS
MS BTS BSC MSC VLR ISDN
Channel Request/Required [RR]
Immediate Assign [RR]
CM Service Req (IMSI, transact) [MM] Process Access Request
CM copy [MM]
Authenticate (RAND)
Authentication Request (RAND) [MM]
Authentication Response (SRES) [MM] Authentication Response (SRES)
Set ciphering mode (key)
Ciphering Mode Command (key) [RR] Access Request Ack
Ciphering Mode Complete [RR]
SETUP (service, called number) [CM] Send info for o/g (service, called number)
Call Proceeding [CM] Complete call
Assign Command [RR] Assign Request [RR]
Assign Complete [RR]
IAM

Alerting [CM] ACM

Connect [CM] ANM

Connect Ack [CM]

Um/A-bis/A signalling
MAP signalling
ISUP/TUP signalling

111