Introduction

The Global System for Mobile Communications (GSM) is a set of recommendations

and specifications for a digital cellular telephone network (known as a Public Land
Mobile Network, or PLMN).
These recommendations ensure the compatibility of equipment from different GSM
manufacturers, and interconnectivity between different administrations, including
operation across international boundaries.
GSM networks are digital and can cater for high system capacities.
They are consistent with the world-wide digitization of the telephone network, and are
an extension of the Integrated Services Digital Network (ISDN), using a digital radio
interface between the cellular network and the mobile subscriber equipment.

GSM FREQUENCIES

GSM systems use radio frequencies between 890-915 MHz for receive and between
935-960 MHz for transmit.
RF carriers are spaced every 200 kHz, allowing a total of 124 carriers for use.
An RF carrier is a pair of radio frequencies, one used in each direction.
Transmit and receive frequencies are always separated by 45 MHz.

-1-
Extended GSM (EGSM)

EGSM has 10MHz of bandwidth on both transmit and receive.

Receive bandwidth is from 880 MHz to 890 MHz.
Transmit bandwidth is from 925 MHz to 935 MHz.
Total RF carriers in EGSM is 50.

DCS1800 FREQUENCIES

DCS1800 systems use radio frequencies between 1710-1785 MHz for receive and
between 1805-1880 MHz for transmit.
RF carriers are spaced every 200 kHz, allowing a total of 373 carriers.
There is a 100 kHz guard band between 1710.0 MHz and 1710.1 MHz and between
1784.9 MHz and 1785.0 MHz for receive, and between 1805.0 MHz and 1805.1 MHz
and between 1879.9 MHz and 1880.0 MHz for transmit.
Transmit and receive frequencies are always separated by 95 MHz.

-2-
-3-
-4-
-5-
Base Station Subsystem (BSS)

To understand the paging process, we must analyse the functions of the BSS.
The Base Station Subsystem consists of the following elements:
 BSC Base Station Controller
 BTS Base Transceiver Station
 TC Transcoder
The Base Station Controller (BSC) is the central network element of the BSS and it
controls the radio network. This means that the main responsibilities of the BSC are:
Connection establishment between MS and NSS, Mobility management, Statistical raw
data collection, Air and A interface signalling support.
The Base Transceiver Station (BTS) is a network element maintaining the Air
interface. It takes care of Air interface signalling, Air interface ciphering and speech
processing. In this context, speech processing refers to all the functions the BTS
performs in order to guarantee an error-free connection between the MS and the BTS.

The TransCoder (TC) is a BSS element taking care of speech transcoding, i.e. it is
capable of converting speech from one digital coding format to another and vice versa.
We will describe more about the transcoder functions later.

Figure 2.18 The Base Station Subsystem (BSS)

BSC
TC

BTS BSC
TC
BTS

BTS

The BTS, BSC and TC together form the Base Station Subsystem (BSS) which is a
part of the GSM network taking care of the following major functions:

-6-
Radio Path Control
In the GSM network, the Base Station Subsystem (BSS) is the part of the network
taking care of Radio Resources, i.e. radio channel allocation and quality of the radio
connection. For this purpose, the GSM Technical Specifications define about 120
different parameters for each BTS. These parameters define exactly what kind of BTS is
in question and how MSs may "see" the network when moving in this BTS area. The
BTS parameters handle the following major items: what kind of handovers (when and
why), paging organisation, radio power level control and BTS identification.
BTS and TC Control
Inside the BSS, all the BTSs and TCs are connected to the BSC(s). The BSC maintains
the BTSs. In other words, the BSC is capable of separating (barring) a BTS from the
network and collecting alarm information. Transcoders are also maintained by the BSC,
i.e. the BSC collects alarms related to the Transcoders.
Synchronisation
The BSS uses hierarchical synchronisation which means that the MSC synchronises
the BSC and the BSC further synchronises the BTSs associated with that particular
BSC. Inside the BSS, synchronisation is controlled by the BSC. Synchronisation is a
critical issue in the GSM network due to the nature of the information transferred. If the
synchronisation chain is not working correctly, calls may be cut or the call quality may
not be the best possible. Ultimately, it may even be impossible to establish a call.
Air & A Interface Signalling:
In order to establish a call, the MS must have a connection through the BSS. This
connection requires several signalling protocols that are explained in the Signalling
Chapter.
Connection Establishment between MS and NSS
The BSS is located between two interfaces, the Air and the A interface. From the call
establishment point of view, the MS must have a connection through these two
interfaces before a call can be established. Generally speaking, this connection may be
either a signalling type of connection or a traffic (speech, data) type of connection.
Mobility Management and speech transcoding
BSS Mobility Management mainly covers the different cases of handovers. These
handovers and speech transcoding are explained in later sections

-7-
Collection of Statistical Data
The BSS collects a lot of short-term statistical data that is further sent to the NMS for
post processing purposes. By using the tools located in the NMS the operator is able to
create statistical "views" and thus observe the network quality.
A Base Station Subsystem is controlled by an MSC. Typically, one MSC contains
several BSSs. A BSS itself may cover a considerably large geographical area consisting
of many cells. (A cell refers to an area covered by one or more frequency resources).
Each cell is identified by an identification number called Cell Global Identity (CGI)
which comprises the following elements:

CGI = MCC + MNC + LAC + CI

 MCC Mobile Country Code

 MNC Mobile Network Code
 LAC Location Area Code
 CI Cell Identity

There is one 2Mbit/s PCM line reserved for each BTS to provide the connection to NSS.
But as you can see, the BTS’s are used at different times and on different days. Why
not use the same line for both of the two BTSs? It can be done, but in this case there
has to be a concentrator between MSC and BTS. The BSC acts as a concentrator
(in addition to being the radio network controller). One BSC is capable of serving
several BTSs.

Note: That there is no relation between a BSC area and Location Area and the serves
as a concentrator in addition to its major role of radio network control. The purpose of
the location area is to facilitate the paging process (searching for the subscriber),
whereas a BSC area is related to traffic connections and radio resources.

-8-
A Mobile Terminated Call and Paging

Let us go back to our professor. We know that he is within the hotel area. Thanks to the
registration system of the hotel, we also know that he went to the restaurant and
registered his presence there. Somebody calls him and the receptionist answers. The
receptionist checks the registration system of the hotel and discovers that the professor
is in the restaurant. A message about an incoming call is sent to the restaurant and one
of the waiters starts looking for the professor. If the waiter does not know the right table,
he uses the public address system and "pages" the professor as follows: “There is a
telephone call for Mr. So and So. Could you please come forward?” Once the professor
raises his hand, the search is complete and the call is set up.

Figure 2.22 The paging process

Location Area

Paging Paging

BTS BTS

Mobile responds
to paging Paging

BTS

Again, a similar process is used in the cellular network. Paging is a signal that is
transmitted by all the cells in the Location Area (LA). It contains the identification of the
subscriber. All the mobile stations in the LA receive the paging signal, but only one of
them recognises the identification and answers to it. As a consequence of this answer,
a point to point connection is established. Now the two subscribers are connected, and
traffic can be carried through the network. Let’s sum up the entire process:

-9-
 A- GMSC HLR MSC/VLR
PSTN
Subscriber

CALL SETUP (MSISDN)

ANALYSE NUMBER
CALL SETUP (MSISDN)

MSISDN

IMSI

MSRN
MSRN

CALL SETUP (MSRN)

PAGING

Figure 2.23 Simplified steps in setting up a call

1. A subscriber in a fixed network dials a number of a mobile phone. The dialled

number is the MSISDN.
2. The Public Switched Telephone Network (PSTN) exchange analyses the number
and contacts the Gateway Mobile Services Switching Centre (GMSC).
3. The Gateway MSC analyses the MSISDN and sends a message to the Home
Location Register (HLR).
4. The HLR checks its database to determine the current location of the called
subscriber.
5. The HLR interrogates the MSC/VLR (Visitor Location Register) that is currently
serving the called subscriber.
6. The serving MSC/VLR generates a temporary MSRN (Mobile Subscriber
Roaming Number).
7. MSC/VLR sends MSRN to HLR and the HLR forwards the MSRN to the GMSC.
8. The GMSC identifies the serving MSC/VLR as the destination for routing the call.
9. Destination MSC/VLR receives MSRN. It identifies the number that is called and
traces the called subscriber.
10. The destination MSC/VLR initiates a paging process in the Location Area to
locate the called subscriber. The mobile phone of the called subscriber
recognises the paging signal and answers it.

-10-
Mobile Originated Call

We have studied the phases of a PSTN originated call and traced the movements of the
subscriber. We have examined the functions and architecture of the network elements.
Now it’s time to investigate another case: how is a connection established when the call
is initiated by a mobile subscriber instead of a fixed one?
The mobile subscriber dials a number. In other words, the subscriber issues a service
request to the network in which he is currently registered as a visitor. After receiving the
request, the network analyses the data of the calling subscriber in order to do three
things:
 Authorise or deny the use of the network.
 Activate the requested service.
 Route the call.
The call may have two types of destinations: a mobile station or a telephone in a fixed
network. If the call is addressed to a telephone in a fixed telephone network, it is routed
to the PSTN, which in turn routes it to the destination. If the called number is another
mobile station in the same network, the MSC starts the HLR Enquiry procedure which is
processed in the same way as in the example of a PSTN originated call.

-11-
 Figure 2.24 Mobile Originated Call procedure.

EXC GMSC HLR MSC VLR BSS MS

1. channel assignment

2. security procedures

3. call setup

4. check services etc.

5. all ok

6. call is proceeding

7. traffic channel allocated

8. set up the call

9. call set up complete

10. alert

11. B answers

Identifying and locating the called subscriber are the two key preconditions of setting up
a point to point connection. The MSISDN fulfils the purpose of identification, but locating
requires a quick and comprehensive system for keeping track of the subscriber. If the
network does not have up-to-date information about the subscriber’s current location,
setting up a call would mean paging large network areas in order to find the subscriber
and that would be a complex and time-consuming task. To avoid this, the GSM network
monitors and records the movements of the subscribers all the time. This process is
called Location Update. We have already discussed it briefly, but now we will analyse
it in detail.

-12-
Location Update

Types of Location Update

In practice, there are three types of location updates:

1. Location Registration (power on)

2. Generic
3. Periodic

Location registration takes place when a mobile station is turned on. This is also
known as IMSI Attach because as soon as the mobile station is switched on it informs
the Visitor Location Register (VLR) that it is now back in service and is able to receive
calls. As a result of a successful registration, the network sends the mobile station two
numbers that are stored in the SIM (Subscriber Identity Module) card of the mobile
station.

These two numbers are the Location Area Identity (LAI) and the Temporary Mobile
Subscriber Identity (TMSI). The network, via the control channels of the air interface,
sends the LAI. The TMSI is used for security purposes, so that the IMSI of a subscriber
does not have to be transmitted over the air interface. The TMSI is a temporary identity,
which regularly gets changed.

A Location Area Identity (LAI) is a globally unique number.

A Location Area Code (LAC) is only unique in a particular network.

-13-
 Every time the mobile receives data through
M
SC the control channels, it reads the LAI and
compares it with the LAI stored in its SIM
V
LR card. A generic location update is
performed if they are different. The mobile
L
A2starts a Location Update process by
L
A1 accessing the MSC/VLR that sent the
location data.

A channel request message is sent that

contains the subscriber identity (i.e.
IMSI/TMSI) and the LAI stored in the SIM
card. When the target MSC/VLR receives
the request, it reads the old LAI which identifies the MSC/VLR that has served the
mobile phone up to this point. A signalling connection is established between the two
MSC/VLRs and the subscriber’s IMSI is transferred from the old MSC to the new MSC.
Using this IMSI, the new MSC requests the subscriber data from the HLR and then
updates the VLR and HLR after successful authentication.

Air A
MSC VLR

MSC VLR

O&M

Figure 2.25 Network Elements involved in location update

-14-
Periodic location update is carried out when the network does not receive any location
update request from the mobile in a specified time. Such a situation is created when a
mobile is switched on but no traffic is carried, in which case the mobile is only reading
and measuring the information sent by the network. If the subscriber is moving within a

9
9
99 0
0
00L
o
ca
t
i
onU
p
d
a
te
R
eq
u
es
t

B
T
S
B
T
S

single location area, there is no need to send a location update request.

Figure 2.26 Example of Periodic Location Update

A timer controls the periodic updates and the operator of the VLR sets the timer value.
The network broadcasts this timer value so that a mobile station knows the periodic
location update timer values. Therefore, when the set time is up, the mobile station
initiates a registration process by sending a location update request signal. The VLR
receives the request and confirms the registration of the mobile in the same location
area. If the mobile station does not follow this procedure, it could be that the batteries of
the mobile are exhausted or the subscriber is in an area where there is no network
coverage. In such a case, the VLR changes the location data of the mobile station to
“unknown”.

-15-
Procedures

MS BSS MSC VLRnew VLRold HLR

1. channel assignment

2. location update request

3. request subscriber identity

4. request subscriber identity

5. request subscriber data

6. request subscriber data

7. security procedures

8. update location

9. update HLR

10. update acknowledgement

11. cancel old location

12. location cancelling accepted

Figure 2.27 Location Update procedures

-16-
Handover
In a mobile communications network, the subscriber can move around. How can we
maintain the connection in such cases? To understand this, we must study the process
of handing over the calls.
Maintaining the traffic connection with a moving subscriber is made possible with the
help of the handover function. The basic concept is simple: when the subscriber moves
from the coverage area of one cell to another, a new connection with the target cell has
to be set up and the connection with the old cell has to be released. There are two
reasons for performing a handover:
1. Handover due to measurements occurs when the quality or the strength of the
radio signal falls below certain parameters specified in the BSC. The
deterioration of the signal is detected by the constant signal measurements
carried out by both the mobile station and the BTS. As a consequence, the
connection is handed over to a cell with a stronger signal.
2. Handover due to traffic reasons occurs when the traffic capacity of a cell has
reached its maximum or is approaching it. In such a case, the mobile stations
near the edges of the cell may be handed over to neighbouring cells with less
traffic load.
The decision to perform a handover is always made by the BSC that is currently serving
the subscriber, except for the handover for traffic reasons. In the latter case the MSC
makes the decision. There are four different types of handover and the best way to
analyse them is to follow the subscriber as he moves:
Intra cell - Intra BSC handover
The smallest of the handovers is the intra cell handover where the subscriber is handed
over to another traffic channel (generally in another frequency) within the same cell. In
this case the BSC controlling the cell makes the decision to perform handover.
Air A

BSC TC
BTS

-17-
Figure 2.28 Intra Cell - Intra BSC Handover

-18-
Inter cell - Intra BSC handover
The subscriber moves from cell 1 to cell 2. In this case the handover process is
controlled by BSC. The traffic connection with cell 1 is released when the connection
with cell 2 is set up successfully.

A ir A

BTS B SC T C

B TS

O ld C e ll / B T S N e w C e ll / B T S

Figure 2.29 Inter Cell - Intra BSC handover

Inter cell - Inter BSC handover

The subscriber moves from cell 2 to cell 3, which is served by another BSC. In this case
the handover process is carried out by the MSC, but, the decision to make the handover
is still done by the first BSC. The connection with the first BSC (and BTS) is released
when the connection with the new BSC (and BTS) is set up successfully.

-19-
 N e w C e ll / B T S
A ir A

B SC T C
BTS

M SC VL R

B SC T C
B TS

O ld C e ll / B T S

Figure2.30:-InterCell-InterBSCHandover

-20-
Inter MSC handover

The subscriber moves from a cell controlled by one MSC/VLR to a cell in the domain of
another MSC/VLR. This case is a bit more complicated. Considering that the first
MSC/VLR is connected to the GMSC via a link that passes through PSTN lines, it is
evident that the second MSC/VLR can not take over the first one just like that.
The MSC/VLR currently serving the subscriber (also known as the anchor MSC),
contacts the target MSC/VLR and the traffic connection is transferred to the target
MSC/VLR. As both MSCs are part of the same network, the connection is established
smoothly. It is important to notice, however, that the target MSC and the source MSC
are two telephone exchanges. The call can be transferred between two exchanges only
if there is a telephone number identifying the target MSC.

N e w C e ll / B T S
A ir A

BSC T C
BTS
M SC VLR

B SC T C
B TS
M SC VLR

O ld C e ll / B T S

Figure 2.31Inter Cell - Inter MSC Handover

Such a situation makes it necessary to generate a new number, the Handover Number
(HON). The generation and function of the HON are explained in the following text.
The anchor MSC/VLR receives the handover information from the BSS. It recognises
that the destination is within the domain of another MSC and sends a Handover
Request to the target MSC via the signalling network. The target MSC answers by
generating a HON and sends it to the anchor MSC/VLR, which performs a digit analysis
in order to obtain the necessary routing information. This information allows the serving
MSC/VLR to connect the target MSC/VLR. When the two MSCs are connected, the call
is transferred to a new route.

-21-
In practice, the handover number is similar to the roaming number. Moreover, the roaming
number and the handover number have a similar purpose, that is connecting two MSCs. The
structure of the handover number is shown below:

HON = CC + NDC + SN

 CC= Country Code

 NDC= National Destination Code (of the serving network)
 SN= Subscriber Number
The call will not last forever and the connection has to be released sooner or later. To
understand the process of releasing the connection, we must consider a few things
such as: Who pays for the call, which exchange takes care of the charging operation
and where is the subscriber data stored. This will be discussed in the next section but
before that, let us sum up the stages of Inter MSC handover.

MS BSSold MSCold MSCnew BSSnew MS (after HO)

1. measurement reports
2. handover required

3. request HON
4. request for radio resources

5. radio resources reserved

6. provide HON and target cell info

7. set up speech connection (HON)

8. handover command
9. handover complete

10. handover complete

11. connect

12. release old connections

Figure 2.32 Inter MSC handover procedure

-22-