1.

Explain GSM Network Architecture

GSM Network Architecture
The GSM (Global System for Mobile Communications) network architecture is structured to provide efficient
communication between mobile stations (MS) and other systems. It uses a combination of Frequency Division
Duplexing (FDD) and Time Division Multiple Access (TDMA) to handle multiple users simultaneously. The
network operates in two main frequency bands: 890-915 MHz for mobile-to-base station (reverse link) and
935-960 MHz for base station-to-mobile (forward link) transmissions.

The GSM network consists of three major subsystems: Mobile Station (MS), Base Station Subsystem (BSS),
and Network and Switching Subsystem (NSS). These subsystems work together to enable mobile
communication. Figure 11.1 shows the key functional elements in the GSM network architecture
Mobile Station (MS):
The Mobile Station includes two main components:
Mobile Equipment (ME):
• It is the physical device of the Mobile Station (MS). It includes the transceiver, which handles the transmission
and reception of signals, digital signal processors, and the antenna. The ME is responsible for the actual
communication over the air interface with the base station transceiver (BTS). It converts the user's voice and
data into the transmission protocols suitable for the wireless link, and it also interfaces with the user through
various input and output devices such as a microphone, speaker, keypad, and display.
• The ME itself is generic, and it does not function without the Subscriber Identity Module (SIM), which
is inserted into the device to enable personalized service.
Subscriber Identity Module (SIM):
• It is a small smart card in the Mobile Station (MS) that stores essential information about the subscriber. It
includes the International Mobile Subscriber Identity (IMSI), which uniquely identifies the user in the GSM
network. The SIM card also holds information about the type of services a user is authorized to access, such
as the subscriber's identification number, privacy keys, and network permissions.
• The SIM is essential for the mobile station to work, as it allows the device to communicate with the
GSM network. It is portable and can be moved between different mobile devices, making the user’s
identity and services available wherever the SIM is used. The SIM card is secured by a four-digit PIN
to protect the subscriber’s information from unauthorized access.
• Additionally, calls are directed to the SIM inserted in any mobile phone, and short messages are also
stored on the SIM. The SIM card allows for global roaming, enabling the user to use the same phone
number in different countries by simply inserting a local SIM card, avoiding roaming charges.
The MS communicates with the network via a Base Transceiver Station (BTS), which is part of the BSS.
Base Station Subsystem (BSS):
The BSS manages the radio interface between the MS and the rest of the GSM network. It includes:
• Base Transceiver Station (BTS): Responsible for the physical communication with the MS within a
cell. A cell can have a radius of 100 m to 35 km, depending on the environment. Multiple BTSs are
controlled by a Base Station Controller (BSC).
• Base Station Controller (BSC): Manages multiple BTSs, handles radio resources, and oversees tasks
such as hand-off (transferring a call from one cell to another) and frequency management. The BSC
communicates with the Mobile Switching Center (MSC) through an A Interface.
The A-bis interface connects the BTS and BSC, carrying both traffic and maintenance data. The BSC reduces
the burden on the MSC by managing call hand-offs within its area.
Network and Switching Subsystem (NSS):
The NSS is responsible for network operation, handling call routing, user authentication, and enabling global
roaming. It includes several key components:
• Mobile Switching Center (MSC): The central component that connects to the Public Switched
Telephone Network (PSTN), handles call setup, routing, and switching between mobile and fixed
networks. If it interfaces with the PSTN, it’s known as a Gateway MSC (GMSC).
• Home Location Register (HLR): A database storing subscriber details like address, service profile, and
current location.
• Visitor Location Register (VLR): A temporary database that stores information about subscribers
currently in the area of an MSC. It assigns a Temporary Mobile Subscriber Identity (TMSI) to avoid
transmitting IMSI over the air.
• Authentication Center (AuC): Protects users against fraud by verifying their identity and encrypting
communication.
• Equipment Identity Register (EIR): Maintains a list of mobile equipment (IMEI) to ensure only
authorized devices connect to the network.
• Interworking Function (IWF): Allows communication between GSM and non-GSM networks,
performing tasks like protocol conversion.
In the NSS, the HLR and VLR work together to track the location of mobile subscribers, enabling roaming
across different MSCs. The AuC and EIR ensure network security by authenticating users and preventing
fraudulent access.
2. Explain GSM signaling protocol architecture

The GSM signaling protocol architecture defines how the components of a GSM network communicate with
each other through a series of protocols and interfaces. The architecture ensures the effective exchange of
messages between the core network elements, enabling voice, data, and signaling traffic management.
Fig. 11.2 The GSM signaling protocol architecture

Um Interface: The air-interface between the Mobile Station (MS) and the Base Transceiver Station (BTS),
which defines wireless communication.
A-bis Interface: This connects the BTS to the Base Station Controller (BSC), supporting voice traffic (64
kbps) and signaling/data traffic (16 kbps).
A' Interface: This interface connects the BSC to the Mobile Switching Center (MSC), utilizing the SS7
protocol (SCCP) for communication between the Base Station Subsystem (BSS) and the MSC.
The GSM signaling architecture is divided into three layers:
Layer I: Physical Layer
The Physical Layer, defined for the Um interface, specifies the radio link between the MS and BTS. It ensures
the transport of data in the TDMA (Time Division Multiple Access) format. The main functions of the physical
layer are:
• Data Formatting and Packaging: It ensures the correct formatting of voice and data services into
packets.
• Modulation and Coding: The layer specifies the modulation and coding techniques for data
transmission.
• Power Control and Synchronization: It manages power control and synchronizes the radio transmission
to maintain the link between MS and BTS.
• Traffic Structure and Control: The physical layer defines the control and traffic channel structure. For
interfaces such as A and A-bis, 64 kbps of digital data is used per voice user.
Layer II: Data Link Layer
The Data Link Layer (DLL) ensures reliable data transfer between network elements. It uses the LAPDm
protocol (a modified version of LAPD) for GSM-specific communication.

Fig. 11.3 Frame format of the Layer II in LAPDm

• Error Detection and Correction: By using cyclic redundancy checks (CRC) and Automatic Repeat
Request (ARQ), LAPDm ensures that data is transmitted reliably.
• Multiplexing Signaling Channels: The DLL allows the multiplexing of SMS (Short Message Service)
and signaling data over the same channels, optimizing the usage of available resources.
• Flow Control: It manages the flow of data packets and handles acknowledgment of data reception.
• Message Structure: Each signaling packet delivered to the physical layer is 184 bits long, and contains
fields like address, control, and information bits.
In contrast to standard LAPD, LAPDm omits the need for CRC and synchronization bits due to the time
synchronization and coding at the physical layer. This optimization enhances the GSM network’s efficiency
in mobile environments.
Layer III: Networking or Signaling Layer
The Signaling Layer (Layer III) is responsible for managing the signaling required to establish, maintain, and
terminate mobile communication sessions. It also deals with supplementary services and SMS. This layer is
divided into several sublayers:
1. Radio Resource Management (RRM): This sublayer handles frequency allocation, channel
assignments, and quality of the radio link. It is primarily responsible for operations such as handoffs
and power control.
2. Mobility Management (MM): MM manages location updates, registration, authentication, and the
handling of TMSI (Temporary Mobile Subscriber Identity). It is concerned with mobility that is not
directly related to the radio but involves network-level services.
3. Communication Management (CM): This sublayer deals with establishing, maintaining, and releasing
circuit-switched connections. It also handles supplementary services like SMS and call management
features.

Fig. 11.4 Typical Layer III message format

Layer III messages include identifiers like the Transaction Identifier (TI), Protocol Discriminator (PD), and
Message Type (MT), helping the network differentiate and process various operations efficiently.
SS7 Signaling
The Signaling System No. 7 (SS7) protocol suite is essential for routing and controlling calls within the GSM
network. SS7 allows network elements to communicate through dedicated signaling links instead of using
voice channels. This out-of-band signaling enhances call setup times and overall network efficiency. SS7's
core components include:
• Service Switching Point (SSP): Initiates, terminates, or forwards calls.
• Signal Transfer Point (STP): Routes signaling messages between SSPs, providing improved
utilization.
• Service Control Point (SCP): Handles queries related to routing and features, often involving database
lookups.
SS7 provides critical functionalities like call routing, mobile subscriber authentication, roaming, and enhanced
call features like call forwarding and three-way calling.
Addressing and Routing
In GSM, two key routing types are defined:
SS7 Addressing and Message Signaling Routing: The SS7 MTP layer provides routing capabilities
based on Signaling Point Codes. SCCP enables global routing by translating the dialed number to the
correct signaling point code.
Call Control/Number Routing: This involves mapping the mobile subscriber's directory number
(MSISDN) to a specific MSC or HLR. This enables call routing to the appropriate destination based
on the subscriber's current location.
For example, a call from a landline to a mobile number involves querying the Home GSM Mobile Switching
Center (GMSC), which uses SS7 to locate the subscriber’s HLR and determine the correct routing.
Location Update
Location updates are vital for maintaining accurate subscriber records. When a mobile station moves to a new
location area or operator's PLMN, it performs a location update to inform the network of its new location. The
process includes:
• Location Update Request: The mobile sends this message to the MSC/VLR, which updates the HLR
with the new information.
• Periodic Location Updates: These updates ensure that the system remains up-to-date, even in case of
network failures.
The IMSI (International Mobile Subscriber Identity) attach/detach mechanism also plays a role in location
updates, indicating whether a mobile station is active or unreachable.
3. List the Identifiers used in GSM system and explain them.
Various identity numbers are associated with a GSM system. Below are descriptions of these identifiers.
IMSI
The International Mobile Subscriber Identity (IMSI) is typically 15 digits or less and is used to identify a
mobile subscriber. When the Mobile Station (MS) makes a call, it contacts a Base Station (BS), which can
only offer service if the MS is a valid subscriber. The IMSI helps with this identification and is stored on the
SIM card. The IMSI structure is shown in Fig. 11.5, where the first three digits represent the country code, the
next two are for the network provider, and the remaining digits represent the subscriber ID. IMSI also provides
information about the subscriber’s home Public Land Mobile Network (PLMN).

Fig. 11.5 Format of IMSI

Subscriber Identity Module (SIM)

It is a small smart card in the Mobile Station (MS) that stores essential information about the subscriber. It includes the
International Mobile Subscriber Identity (IMSI), which uniquely identifies the user in the GSM network. The SIM card
also holds information about the type of services a user is authorized to access, such as the subscriber's identification
number, privacy keys, and network permissions.

The SIM is essential for the mobile station to work, as it allows the device to communicate with the GSM
network. It is portable and can be moved between different mobile devices, making the user’s identity and
services available wherever the SIM is used. The SIM card is secured by a four-digit PIN to protect the
subscriber’s information from unauthorized access.

Additionally, calls are directed to the SIM inserted in any mobile phone, and short messages are also stored
on the SIM. The SIM card allows for global roaming, enabling the user to use the same phone number in
different countries by simply inserting a local SIM card, avoiding roaming charges.
Mobile System ISDN (MSISDN)
The MSISDN is the number that uniquely identifies a mobile subscriber, as shown in Fig. 11.6. Unlike
identifying a particular mobile phone, GSM systems identify a subscriber's Home Location Register (HLR).
The HLR is responsible for directing calls to the correct MS, ensuring the system can locate the subscriber
even if they are roaming.

Fig. 11.6 Format of MSISDN

Location Area Identity (LAI)

The Location Area Identity (LAI) is used to identify a specific location area within the GSM network, as
shown in Fig. 11.7. The GSM network divides its coverage area into multiple Mobile Switching Centers
(MSCs), each responsible for a group of cells called Location Areas (LAs). Each LA has a unique identifier,
including the country code, network code, and LA code. This structure helps the system locate a roaming MS
quickly and efficiently.

IMSEI
Each GSM mobile phone is assigned a 15-bit long International Mobile Subscriber Equipment Identity
(IMSEI) number, as shown in Fig. 11.8. This number contains details about the phone’s manufacturer,
including a type approval code, final assembly code, and serial number, which uniquely identify the
equipment. The IMSEI allows the system to track and manage the phone’s equipment and ensure
interoperability.

Fig. 11.8 Format of IMSEI

MS Roaming Number (MSRN)

When a mobile station roams into another Mobile Switching Center (MSC), it is assigned a temporary MS
Roaming Number (MSRN), shown in Fig. 11.9. This number is used for call routing and stored in the HLR.
It allows incoming calls to be rerouted to the current location of the MS, ensuring seamless communication
during roaming.
Fig. 11.9 Format of MSRN

TMSI
For security, Temporary Mobile Subscriber Identity (TMSI) is often used instead of the IMSI to protect the
subscriber's identity when transmitting over the air interface. This temporary identity helps prevent
interception of sensitive subscriber information.
4. Explain GSM Channels
GSM Channels
The GSM-900 system operates within the 890 MHz to 960 MHz frequency range, with the uplink (reverse)
using 890 MHz–915 MHz and the downlink (forward) using 935 MHz–960 MHz. Each direction has 25 MHz
of spectrum, divided into 124 FDM channels, each occupying 200 kHz, as shown in Fig. 11.10.

Fig. 11.10 Frequency channels in GSM-900

GSM uses FDD, TDMA, and FDMA. The available frequency bands are divided into ARFCNs (Absolute
Radio Frequency Channel Numbers), with 45 MHz separation between uplink and downlink channels. Each
ARFCN has eight time slots for eight subscribers.
The data rate for each carrier is 270.833 kbps, using GMSK (Gaussian Minimum Shift Keying) modulation.
The signal's bandwidth is confined to 250 kHz, minimizing co-channel interference.
GSM uses a combination of physical channels (defined by a time slot and ARFCN) mapped into logical
channels that handle various tasks such as user data, signaling, and control. These logical channels are grouped
into two main categories: Control Channels (CCHs) and Traffic Channels (TCHs) as shown in Table 11.2.
• The control channels (BCH and CCCH) are transmitted on the first time slot (TS 0) of every frame,
while the other time slots (TS 1-7) handle traffic channels (TCH) or control data.
• Traffic data is transmitted over 26-frame multiframes, with 13th and 26th frames dedicated to SACCH
or idle frames.
These logical channels ensure smooth communication and efficient network management in a GSM system.
Control Channels (CCHs)
Control channels handle signaling and synchronization between the mobile station (MS) and base station (BS).
They are categorized into:
Broadcast Channels (BCH)
• Broadcast Control Channel (BCCH): Provides system parameters like cell ID, available services,
and synchronization.
• Frequency Correction Control Channel (FCCH): Transmits frequency correction information for
synchronization.
• Synchronization Channel (SCH): Provides frame synchronization and base station identity.
Common Control Channels (CCCH)
These are used for establishing links and managing calls between the MS and BS. They include:
• Paging Channel (PCH): Notifies an MS about an incoming call.
• Random Access Channel (RACH): Used by the MS to request access to the network.
• Access Grant Channel (AGCH): Grants the MS access after a successful RACH request.
Dedicated Control Channels (DCCH)
These channels are used for signaling during actual voice communication and include:
• Stand-alone Dedicated Control Channel (SDCCH): Transfers network control and signaling
information during call establishment.
• Slow Associated Control Channel (SACCH): Carries control information like power levels and
timing adjustments.
• Fast Associated Control Channel (FACCH): Supports urgent control messages, like hand-offs,
using bits stolen from the TCH.
Traffic Channels (TCHs)
Traffic channels are used for actual voice and data transmission between the MS and BS. Two types of traffic
channels are defined:
Full-rate Traffic Channels (TCH/F)
These carry speech and data at rates of 13 kbps for voice and various data rates (9600 bps, 4800 bps,
2400 bps). The full-rate traffic channel provides 22.8 kbps including overhead.

Half-rate Traffic Channels (TCH/H)

These use 16 time slots per frame and carry speech at half the rate of full-rate channels (6.5 kbps for
voice) or data at lower rates (4800 bps or 2400 bps).

5. Explain GSM call procedure

The GSM system employs several key procedures to establish and maintain voice connections between
subscribers. The major components of these processes include registration, call establishment, and handoff
procedures. This section focuses on the call establishment procedures, specifically mobile-to-network and
network-to-mobile calls, as illustrated in Fig. 11.29.

Fig. 11.29 Network-to-mobile call scenario in a visiting network

1. Registration Procedure
When the mobile subscriber (MS) powers on, it must first register with the system before establishing a call.
Registration ensures that the MS is synchronized with the network and receives a Temporary Mobile
Subscriber Identity (TMSI). The registration process involves several steps:
1. Synchronization: The MS locks onto the nearest Base Transceiver Station (BTS) after receiving system
parameters (like cell identity).
2. Authentication: The MS provides its identity to the system for authentication.
3. Location Update: The system updates the Visitor Location Register (VLR) and Home Location
Register (HLR), and assigns the TMSI.
Once registration is successful, the MS is ready for call establishment.
2. Mobile-to-Network Call Procedure
This procedure describes how a mobile-originated call is set up, where the MS initiates the call to the network:
Step 1: The MS monitors the Broadcast Control Channel (BCH) for synchronization with the nearest BTS.
Step 2: The MS locks onto the system after receiving the BCCH, FCCH, and SCH messages.
Step 3: The MS dials the number of the called party and presses the send button.
Step 4: The MS transmits a Random Access Channel (RACH) burst on the same ARFCN as the BTS.
Step 5: The BTS responds with an Access Grant Channel (AGCH) message to assign the MS a new channel
for Stand-Alone Dedicated Control Channel (SDCCH).
Step 6: The MS switches to the new ARFCN and Timeslot (TS), as indicated by the AGCH.
Step 7: The MS waits for a Slow Associated Control Channel (SACCH) frame on the SDCCH for any
required timing or power adjustments.
Step 8: The MS is now ready to transmit voice data on the Traffic Channel (TCH).
Step 9: The Public Switched Telephone Network (PSTN) connects the called landline to the Mobile
Switching Center (MSC).
Step 10: The MSC establishes the voice connection to the base station.
Step 11: The MS receives a command from the base station to retune to a new ARFCN and TS for TCH
assignment.
Step 12: Voice communication is established, and the SDCCH is released.
This procedure ensures that a mobile-originated call is set up correctly, with authentication and voice setup.
3. Network-to-Mobile Call Procedure
For a network-originated call (e.g., a call from a landline to a mobile), the following steps are taken:
Step 1: The call request is routed from the PSTN to the Gateway MSC and then to the Destination MSC
after retrieving the mobile subscriber's information from the HLR.
Step 2: The destination MSC contacts the mobile subscriber through the BSS.
Step 3: The BTS broadcasts a Paging Channel (PCH) message on the BCH to locate the MS.
Step 4: The MS locks onto the ARFCN and decodes the page message.
Step 5: The MS responds with a RACH message.
Step 6: The BTS assigns a new channel for SDCCH and SACCH using the AGCH.
Step 7: The MS exchanges control information (timing advance, authentication) on the SDCCH.
Step 8: The Traffic Channel (TCH) is assigned once authentication and timing are complete.
Step 9: The PSTN connects the call to the MSC.
Step 10: The Gateway MSC contacts the destination MSC, and the VLR initiates paging across the BSS.
Step 11: Upon receiving a response from the MS, the VLR sends the necessary parameters to the MSC,
completing the call setup.
This ensures that the call from the landline is routed and properly connected to the mobile subscriber.
6. Explain GSM hand-off Procedures
GSM Hand-Off Procedures (As shown in Fig. 11.30)
The GSM hand-off procedure is a critical process that ensures an ongoing call is not dropped as a mobile
subscriber (MS) moves from one cell to another. Hand-off is typically initiated when the signal strength
deteriorates near the cell boundary. In GSM, hand-off is classified into four major categories, as described
below and illustrated in Fig. 11.30.

Fig. 11.30 Hand-off involving a single MSC and two BSSs

(a) Intracell-Cum-Intra-BTS Hand-Off

In this type of hand-off, the call remains within the same cell and BTS, but the channel for the connection is
changed. This hand-off is necessary when there is high interference during the call. The BTS initiates the
process by switching the call to another frequency within the same cell or to a different time slot on the same
frequency.
(b) Intercell-Cum-Intra-BSC Hand-Off
This hand-off occurs when the connection needs to change between two cells that are managed by the same
Base Station Controller (BSC). The process begins with the serving Base Station Subsystem (BSS) initiating
a hand-off request to the Mobile Switching Center (MSC). The MSC forwards this request to the destination
BSS. Once the new channel is activated, the MS sends a "hand-off complete" message to the new BSS, which
then informs the MSC to release the previously occupied channel.
(c) Inter-BSC-Cum-Intra-MSC Hand-Off
This type of hand-off involves a change between two cells managed by different BSCs, but both BSCs operate
under the same MSC. The hand-off is triggered when the signal strength received by the MS drops below a
threshold. The MS reports the signal strength of neighboring cells, a process called mobile-assisted hand-off.
The Broadcast Control Channel (BCCH) of the BTS provides a list of available channels in neighboring cells,
and the MS measures the signal strength from these channels. The MS reports the measurements via the Slow
Associated Control Channel (SACCH) to the MSC, which then makes the hand-off decision. Once the new
channel is established, the MS confirms the hand-off with a "hand-off complete" message.
(d) Inter-MSC Hand-Off
In this type of hand-off, the call is transferred between two different MSCs, typically during roaming. The
home MSC is notified of the hand-off condition through the Public Switched Telephone Network (PSTN).
The home MSC then sends the necessary data to the new MSC through the PSTN to complete the hand-off
process.
7. Explain GSM Services and features.
GSM provides a wide range of services to mobile subscribers, categorized into teleservices, data or bearer
services, and supplementary ISDN services. These services ensure seamless communication, both voice and
data, with additional features for better usability.
Teleservices
Teleservices enable voice communication between users. The most popular teleservice is Short Message
Service (SMS), which allows sending and receiving text messages of up to 160 characters. SMS supports
store-and-forward service via the SMS center (SMSC). It also allows cell broadcasts, such as traffic alerts or
weather updates, to be sent to multiple users simultaneously. SMS can be sent even during active calls as it
uses control channels instead of voice channels.
Data or Bearer Services
Bearer services allow data transmission between network access points. GSM supports both transparent mode
(where standard coding is used) and nontransparent mode (where special coding improves data efficiency).
These services provide connectivity to PSTN, ISDN, and packet-switched networks for applications like
internet access and file transfers.
Supplementary ISDN Services
These are enhanced services offered alongside teleservices or bearer services. They include features like caller
identification, call forwarding, and call waiting.
Service Quality Requirements
GSM ensures high service quality through specific performance metrics:
• Switch-On Time: 4 seconds in home network, 10 seconds in a visiting network.
• Call Connection Time: 4 seconds.
• Handoff Gap: Max 150 ms (intercell) and 100 ms (intracell).
• Speech Intelligibility: 90%.
• Call Release Failure Rate: Less than 0.02%.
The system is designed to have minimal downtime, ensuring high service availability. Faults that cause more
than 50% call disconnections are expected to occur less than once a year.
Power Classes in GSM
Power management helps reduce interference and improve battery life. Mobile phones are categorized into
vehicle-mounted, portable, and handheld devices. GSM defines five power classes for mobile phones, ranging
from +29 dBm (0.8 W) to +44 dBm (20 W). Power adjustments are made using closed-loop power control,
where the Base Station Subsystem (BSS) monitors signal strength and adjusts power accordingly.
Frequency Hopping in GSM
GSM uses frequency hopping to minimize the effects of signal fading and interference. It switches between
frequencies at a rate of 217.6 hops per second. This feature is especially useful in areas with severe fading or
co-channel interference, improving voice quality. While all GSM phones support frequency hopping, only
hopping cells in problem areas use it actively.