‫بسم هللا الرحمن الرحيم‬

Global System for Mobile

communication (GSM)
Course
 Course Outlines
.Chapter 1: Introduction to GSM
.Chapter 2: GSM Radio planning
.Chapter 3: GSM Radio Transmission
.Chapter 4: GSM Network Elements
Chapter 5: Air Interface.
Chapter 6: Traffic Cases.

GSM 2
 Chapter 1
Introduction to GSM
.Mobile Communications Evolution
Telegraphy: Morse perfects his 1866–1838 •
system; Stein hill finds that the earth can be
.used for a current path
Maxwell’s equations predict 1864 •
.electromagnetic radiation
: Wireless telegraphy 1907–1887 •
.Heinrich Hertz verifies Maxwell’s theory–
Marconi patents complete wireless telegraph–
. system (1897)
GSM 4
Television: Mechanical image- 1938–1923 •
formation system demonstrated, DuMont and
others perfect vacuum cathode-ray tubes; field
.tests and experimental broadcasting begin
Armstrong’s paper states the case of 1936 •
.frequency modulation (FM) radio
Alec Reeves conceives pulse code 1937 •
.modulation (PCM)
Radar and microwave systems 1945–1938 •
developed during World War II, FM used
.extensively for military communications
GSM 5
Digitalization of telephone network 1969–1968 •
.begins
High-capacity optical systems developed; 1985–1975 •
the breakthrough of optical technology and fully
.integrated switching systems
The first generation(1G) of modern 1985–1980 •
cellular mobile networks put into service. But it was
:all based on analog system
NMT-450 (Nordisk MobilTelefoni ) in Northern 1981 –
. Europe
AMPS (Advanced Mobile Phone System) in 1983 –
. the United States
TACS (Total Access Communication System) in 1985 –
. Europe and China
GSM 6
Standardization for second generation(2G) 1985 •
. digital cellular systems is initialized
.GSM900 in World Wide 1992 •
.GSM1800 in Europe 1993 •
.GSM1900 was firstly commercial 1994 •
Global System for Mobile (GSM) is a second- •
. generation digital cellular telephone system
GSM became the world's leading and fastest
growing mobile standard, spanning over 174
countries, serving more than one in ten of the
.world's population
GSM providing data rates of 9.6 kbps which is too
. slow
GSM 7
General Packet Radio Service (GPRS) 1999 •
reuses the existing GSM infrastructure to
. provide higher data rate
It was lunched to increase the data rate to
. 171.2kbit/s
Evolved Data rate for GSM Evolution 2001 •
(EDGE) offers data rate of 384 kbps by
.using new modulation scheme(8psk)

GSM 8
Code Division Multiple Access (CDMA) 1993 •
is a second-generation digital cellular
.telephone system that was first deployed

Universal Mobile Telecommunication Service •

(UMTS) is the marketing name for the 3G
:has two standardization bodies
.3GPP which uses the W-CDMA technology -1
2- 3GPP2 which uses the CDMA2000
technology.

GSM 9
Development of Mobile
Communication

GSM 10
Mobile Telephony
► Mobile telecommunication is one of the fastest
growing and most demanding of all
telecommunication technologies.
► Currently, it represents an increasingly high
percentage of all new telephone subscriptions
worldwide. In many cases, cellular solutions
successfully compete with traditional wire line
networks and cordless telephones.
► In the future, cellular systems employing
digital technology will become the universal
method of telecommunication.
GSM 11
 Development of GSM
► Global System for Mobile communication(GSM) is the
European digital cellular telecommunications standard.
GSM is the current digital mobile telephony standard
specified by the European Telecommunication
Standards Institute (ETSI) .
► And provides a common standard that means
cellular subscribers can use their mobile
telephones all over Europe and increasingly
throughout the world.
► GSM provides a common standard, cellular subscribers
can use their telephones over the entire GSM service
area.
► GSM provides user services such as high-speed
data communication,and a Short Message
Service (SMS).
GSM 12
GSM Specifications
► GSM was designed to be platform independent.
The GSM specifications do not specify the
actual hardware requirements, but instead
specify the network functions and interfaces in
detail.

► Thisallows hardware designers to be creative

in how they provide the functionality. At the
same time it is possible for operators to buy
equipment from different suppliers.
GSM 13
The GSM recommendations consist of twelve
.series

GSM 14
 Chapter 2
GSM Radio planning
Cell Geometry
► The simplest shape of a cell is to be circular
with its transceiver at the center. But it is
obvious from the following figure that there
will be dead spots between the adjacent cells,
which will have no any coverage. To solve this
problem, the cells might be square, triangular,
or hexagonal shaped.

GSM 16
► Differentiation between these three shapes will be in order
to optimize the number of cells required to cover a given
service area against the cell transceiver power, where both
parameters are functions of the variable “R”. By some
calculations, you will find that using hexagonal shaped
cells achieves the optimum.

GSM 17
► The radiation of the
transceiver antenna cannot
take a hexagonal shape.
► The circular shape is the
nearest one, so the cells will
take the form of
Overlapping circles in order
to overcome the problem of
dead spots. Usually a
coverage area contains
obstacles, like large
buildings, which deform the
radiation of a cell.
► Hence the actual shape of a
cell will be random.
GSM 18
Transceiver Antenna
There are two types of antennas that are used:
► Omni-directional antenna: transmits equally in
all directions (360 degrees).
► Directional or sectorial antenna: with the main
lobe of radiation directed to specific area. When
using the second type of antennas, there will be
three 120 degree sectorial antennae for each site,
each sector is then called a “cell”. Hence a site
consists of three cells at most.

GSM 19
GSM 20
► The border between the coverage areas of two
cells is the set of points at which the signal
strength from both antennas is the same. In reality,
the environment will determine this line, but for
simplicity, it is represented as a straight line.
► The carrier-to-reflection (C/R) ratio is defined as
the ratio between the direct signal (C) and the
reflected signal (R). Also, due to the problem of
time alignment the maximum distance an MS can
be from a BTS is 35 km. This is the maximum
radius of a GSM cell.

GSM 21
Frequency Re–use
► Modern cellular networks are planned using
the technique of frequency [Link] a
cellular network, the number of calls that the
network can support is limited by the amount
of radio frequencies allocated to that network.
► If the GSM900 system has 124 Absolute
Radio Frequency Traffic Channels, and if we
are using only in our network 60 of them,
then we can only serve 8 x 60 = 480 Calls if
we only use the frequency once. However, a
cellular network overcome this constraint and
maximizes the number of subscribers that it
can service by using frequency re-use.
GSM 22
► Frequency re-use means that two radio channels
within the same network can use exactly the same
pair of frequencies, provided that there is a
sufficient geographical distance (the frequency re-
use distance) between them so they will not
interfere with each other.
► Groups of frequencies can be placed together into
patterns of cells called clusters. A cluster is a
group of cells in which all available frequencies
have been used once and only once. Since the
same frequencies can be used in neighboring
clusters.
► The re-use patterns recommended for GSM are
the 4/12 and the 3/9 pattern. 4/12 means that
there are four three-sector sites supporting
twelve cells using twelve frequency groups.
GSM 23
GSM 24
 Interference

Time domain

Frequency domain

ISI Fading Time dispersion

Carrier to
Co-Channel Adjacent channel
reflection
interference interference
interference

Time delay
GSM 25
Adjacent channel interference:
Adjacent frequency (A) that are frequencies shifted
200KHZ from the carrier frequency (C) must be
avoided in the same cell and preferably in
neighboring cells also.

Signal level (dB)

Filter

GSM
Frequency 26
Adjacent channel interference
► Co-Channel interference
It is caused by the use of frequency close to the
exact same frequency, the former will interface
with the latter leading to the terms interfering
frequency (I) and carrier frequency (C) the GSM
specification recommends that the carrier to
interference (C/I) ratio is greater than 9 decibels
(db).

GSM 27
Cell Classifications
.Normal cell: A cell with no other attributes
Micro/pico cell: A cell which has a very small radius
giving location coverage so it is suitable to be used
in a shopping mall or in subway system,small cell, for
.population area
Macro cell: it is large cell for remote and separately
.population
Umbrella cell: A cell can coverage to areas that do
not have radio coverage usually the antenna is as
high as possible that the cell can fill in the gaps left
.by the other cells
Overlaid cell: A cell that gives radio coverage to the
.whole cell
underlaid cell: A cell that gives coverage only to a
.part of the whole cell
GSM 28
Introduction to cell planning
Step 1: Traffic and Coverage Analysis
► Cell planning begins with traffic and coverage analysis. The
analysis should produce information about the geographical
area and the expected capacity (traffic load). The types of
data collected are: Cost, Capacity, Coverage, Grade Of Service
(GOS), Available frequencies, Speech quality, and System
growth capability The basis for all cell planning is the traffic
demand, i.e. how many subscribers use the network and how
much traffic they generate.
► The Erlang (E) is a unit of measurement of traffic intensity. It
can be calculated with the following formula:
► A = n x T / 3600 Erlang
A = offered traffic from one or more users in the system
n = number of calls per hour T = average call time in seconds
The geographical distribution of traffic demand can be calculated
by the use of demographic data (Population distribution, Car
usage distribution, Income level distribution, Land usage data,
Telephone usage statistics subscription/call
GSM charge and price 29
of MSs.
► Calculation of required number of BTS’s
To determine the number and layout of BTS’s the
number of subscribers and the Grade Of Service
(GOS) have to be known. The GOS is the
percentage of allowed congested calls and defines
the quality of the service.
► If n=1 and T=90 seconds then the traffic per
subscriber is:
► A = 1 x 90 / 3600 = 25mE
► If the following data exists for a network::
► Number of subscribers: 10,000
► Available frequencies: 24
► Cell pattern: 4/12
► GOS: 2%
► Traffic per subscriber: 25mE
GSM 30
► This leads to the following calculations:
► Frequencies per cell = 24 / 12 = 2
► Traffic channels per cell = 2 x 8 - 2 (control
channels) =14 TCH
► Traffic per cell = 14 TCH with a 2% GOS implies
8.2 Erlangs per cell (see the above Erlang table)
► The number of subscribers per cell = 8.2E / 25mE
= 328 subscribers per cell
► If there are 10,000 subscribers then the number of
cells needed is 10,000 / 328 = 30 cells.
► Therefore, the number of three sector sites
needed is 30 / 3 = 10
GSM 31
Step 2:Nominal Cell Plan
► A nominal cell plan can be produced from the data compiled
from traffic and coverage analysis. The nominal cell plan is
a graphical representation of the network and looks like a
cell pattern on a map. Nominal cell plans are the first cell
plans and form the basis for further planning.
► TEst Mobile System (TEMS) CellPlanner, includes a
prediction package, providing coverage predictions,
composite coverage synthesis, co-channel interference
predictions and Adjacent channel interference predictions.
► TEMS cell planner is a software package designed to
simplify the process of planning and optimizing a cellular
network. With TEMS CellPlanner.
► If there are doubts about the risks of time dispersion at a
particular site the following steps could be taken:
-The site location could be changed.
-The site could be measured with respect to time dispersion.
-The site could be analyzed with a carrier–to–reflection ratio
(C/R) prediction tool. GSM 32
Step 3: Surveys
► Once a nominal cell plan has been completed and
basic coverage and interference predictions are
available, site surveys and radio measurements can
be performed.
Step 4: System Design
► Once the planning parameters have been adjusted
to match the actual measurements, dimensioning
of the BSC, TRC and MSC/VLR can be adjusted and
the final cell plan produced. As the name implies,
this plan can then be used for system installation.
New coverage and interference predictions are run
at this stage, resulting in Cell Design Data (CDD)
documents containing cell parameters for each cell.
GSM 33
Step 5&6: System Implementation and Tuning
► Once the system has been installed, it is
continuously monitored to determine how well it
meets demand. This is called system tuning. It
involves:Checking that the final cell plan was
implemented successfully Evaluating customer
complains Checking that the network performance is
acceptable Changing parameters and taking other
measurements, if necessary.
Step 7: System Growth and Change
► Cell planning is an ongoing process. If the network
needs to be expanded because of an increase
in traffic or because of a change in the environment
(e.g. a new building), then the operator must
perform the cell planning process again, starting with
a new traffic and coverage analysis.
GSM 34
 Chapter 3
GSM Radio Transmission
Analog and digital Transmission
:Analog information
.It is continuous and does not stop at discrete values
:Digital information
.It is a set of discrete values

► The problem with using digital signals to transfer

Analog information is that some information will be
missing due to the technique of taking samples,
However the more often the samples are taken the
closer the resulting digital values will be to a true
representation of the analog information.
► Advantage:Digital signal can be completely
regenerated as anew without the distortion.
GSM 36
 Analog amplification
In analog amplifying the signal amplifies the noise

Digital amplification
In digital system,a sharp value could be assigned to distinguish
between just to values,zero and one. The presence of just two values in
the digital system makes It most efficient in error detection and
detection and offers high signal to noise
GSM ratio Than analog systems. 37
Wave properties
A MS communication with a BTS by
transmitting or receiving radio waves,which
consist of electromagnetic [Link]
:speaking. A wave is defined by
► Wave length:represent the distance traveled
by the wave to move one complete cycle.
► This complete cycle called cycle duration.
► Frequency:number of cycle per second.

Speed=wave length/time of one cycle=λ/Ṭ=

λ*f
GSM 38
 Sec 1

Time

T
Frequency of wave
All Electromagnetic waves travel in air with a fixed speed equal to the
speed of light, no other phenomena move in a speed faster than the
.speed of light, 3 x 10^8 m/s
.Thus, for any electromagnetic wave, λ x f = 3 x 10^8 m/s
From this formula it can be determined that the higher the frequency,
the shorter the wavelength Lower frequencies, with longer
wavelengths, are better suited to transmission over large distances,
because they bounce on the surface of the earth and in the
GSM 39

atmosphere.
Modulation Techniques
► Audio waves ranges between 3 and 15 kHz. These
waves are extremely low power waves that can’t
propagate for a long distance by itself. To overcome
this fact, the weak audio signal is carried over a
carrier frequency, which suits the transmission
requirements and is capable to travel longer
distances. The carrier that will modulate the voice is
called the modulating wave.
The output from the modulation process is named
the modulated signal.
► Modulation:is done in GSM via Gaussian minimum
shift keying (GMSK), GMSK enables the transmission
of 270kbit/s within a 200kHz channel. This gives a
bit-rate of 1.3 bit/s per Hz. This is rather low bit-rate
but acceptable as the channel used has high
interference level in the air.
GSM 40
The GMSK modulation
has been chosen as a
compromise between
spectrum efficiency,
complexity and low
spurious radiations
(that reduce the
possibilities of
adjacent channel
interference)

GSM 41
► channelseparation:The separation between
adjacent carrier frequencies. In GSM, this is
200 kHz.

► Duplex distance: The duplex distance is 80

MHz. Duplex distance is the distance between
the uplink and downlink frequencies. A channel
has two frequencies, 80 MHz apart.
► Access method:GSM utilizes the time division
multiple access (TDMA) concept. TDMA is a
technique in which several different calls may
share the same carrier. Each call is assigned a
GSM 42

particular time slot.

► Speech coder: GSM uses linear predictive
coding (LPC). The purpose of LPC is to
reduce the bit rate. The LPC provides
parameters for a filter that mimics the vocal
tract. The signal passes through this filter,
leaving behind a residual signal. Speech is
encoded at 13 kbps.
► GSM data rate is 9.6 Kb/s.
► Frequency band:
Uplink Band (890-915 MHz ).
Downlink Band (935-960 MHz).
GSM 43
 Uplink and Downlink

High
transmitted
Uplink power

Down
link

MS

44 GSM
Frequency allocation
► The Bandwidth is the term used to describe the
amount of frequency range allocated to one
application. The bandwidth given to an application
depends on the amount of available frequency
spectrum. The amount of bandwidth available is an
important factor in determining the capacity of a
mobile system, i.e. the number of calls that can be
handled.
► Channel types

GSM 45
Time Division Multiple Access
(TDMA)
► Most digital cellular systems use the technique of
Time Division Multiple Access (TDMA) to transmit
and receive speech signals. With TDMA, one
carrier is used to carry a number of calls,each call
using that carrier at designated periods in time.
► These periods of time are referred to as time slots.
Each MS on a call is assigned one time slot
► on the uplink frequency and one on the downlink
frequency. Information sent during one time slot is
called a burst.
► In GSM, a TDMA frame consists of 8 time slots.
This means that a GSM radio carrier can carry 8
calls. The total bit rate on one channel is equal to
270 Kbit/s.
GSM 46
► and hence the bit rate for every subscriber will be
270/8=33.75 Kbit/s. The time duration for every
time slot equals 0.577 [Link], the time duration
for the whole TDMA frame equals 0.577 x 8 =4.616
ms.

GSM 47
Radio transmission problems
► A mobile communication environment suffers from many
problems related to radio transmission, which may cause
unacceptable degradation of the service quality.
We will now discuss the most important problems and
their solutions.

1-Shadowing (Normal fading)

► Fading means that the signal strength received fluctuates
around a mean value while changing
the mobile position. The reason for shadowing is the
presence of obstacles like large buildings or
hills in the path between the site and the mobile.

GSM 48
Solution to Normal Fading Problem:
• Increasing the Fading Margin

The receiver sensitivity is defined as the lowest received signal

strength required to regenerate the original signal properly. The
fading margin is defined as the difference between the mean
value of the received signal and the receiver sensitivity. To
overcome the fading problems, the fading margin should be
large enough that the lowest fading dip is still higher than the
receiver sensitivity.
GSM 49
Multi-path Fading(Rayleigh fading)-2
► This occurs when a signal takes more than one path
between the MS and BTS antennas. In this
case, the signal is not received on a line of sight path
directly from the TX antenna. Rather, it is reflected off
buildings, for example, and is received from several
different indirect paths.
Rayleigh fading occurs when the obstacles are close to
the receiving antenna. The received signal is the sum of
many identical signals that differ only in phase (and to
some extent amplitude)

GSM 50
Solutions to Rayleigh Fading Problem

(A) Antenna (Space) Diversity

The cell transceiver will use two receiving antennas instead on
one. A distance of about 5 meters will separate them, and
they will receive radio signals independently, so they will be
affected differently by the fading dips and the better signal
received will be selected.

(B) Frequency Diversity (Hopping)

During conversation, a mobile subscriber is allocated one
TDMA time slot on one of the RF carriers assigned to its
serving cell. The fading effect may not be the same for all of
the frequencies, so the time slot of the subscriber will jump or
“hop” between the frequencies of the cell when it is repeated
in each TDMA frame. GSM 51
3-Time Dispersion
► Time dispersion is another problem relating to
multiple paths to the Rx antenna of either an MS or
BTS. However, in contrast to Rayleigh fading, the
reflected signal comes from an object far away
from the Rx antenna. Time dispersion causes
Inter-Symbol Interference (ISI) where consecutive
symbols (bits) interfere with each other making it
difficult for the receiver to determine which Signal 1
symbol is the correct one.
t

GSM 52
R-Signal 1
Solutions to Time Dispersion Problem

(A) Increase Carrier to reflection Ratio (C/R)

The C/R ratio is defined as the difference in signal strength
between the signal received from the RBS and the
strongest reflected signal. Its value depends on the relative
position of the mobile subscriber.
(B) Viterbi Equalizer
This is an equalizer used to equalize the effect of at most four
bits delay, A bit pattern called the “Training Sequence” that
is known to the mobile is transmitted with every burst. The
pattern is inserted in the middle of the burst to make sure
that the channel has steady characteristics. The equalizer
compares the received pattern with the expected one and
creates a mathematical model of the channel that probably
caused the difference between the two patterns. Then a
probable transmitted bit sequence is fed to the channel
model and the output is compared with the received bits
until reaching the most probable bit sequence.
GSM 53
GSM 54
Time Delay-4
► Each MS on a call is allocated a time slot on a TDMA frame.
This is an amount of time during which the MS transmits
information to the BTS. The information must also arrive at
the BTS within that time slot. The time alignment problem
occurs when part of the information transmitted by an MS
does not arrive within the allocated time slot. Instead, that
part may arrive during the next time slot, and may interfere
with information from another MS using that other time slot.
A large distance between the MS and the BTS causes time
alignment.
Solution to time delay problem
(A) Timing Advance
► Timing advance is a solution specifically designed to
counteract the problem of time alignment. It works
by instructing the misaligned MS to transmit its burst
earlier or later than it normally would.
GSM 55
GSM radio transmission process
► Converting speech into the final bit stream that will
be transmitted over the air interface in GSM system
goes through more than one stage. Stages are:
1. Sampling.
2. Quantization.
3. Coding.
4. Segmentation and Speech coding.
5. Channel coding.
6. Interleaving.
7. Ciphering/Encryption.
8. Burst Formatting.
9. Modulation and transmission.
GSM 56
 Chapter 4
GSM Network Elements
Mobile Station (MS) )A(
Mobile Station is divided into two independent
:part
.Subscriber Identity Module (SIM) card-1
.Mobile Equipment (ME)-2

The GSM network is divided into there)B(

:systems
.Network Switching System (NSS)-1
.Base Station System (BSS)-2
The operations and maintenance center-3
.)OMC( GSM 58
Mobile Station (MS) )A(
Subscriber Identity Module (SIM) card-1
:A SIM card is an electronic smart card, which
► contains a microprocessor and a memory.
► The SIM stores three types of subscriber related
information:
-Fixed data stored before the subscription is sold: e.g.
IMSI, authentication key and security algorithms.
-Temporary network data: e.g. the location area of the
subscriber and forbidden PLMNs.
-Service data: e.g. language preference, advice of charge
GSM phase 1 SIMs contain all necessary network control
information, while phase 2 SIMs include a large number of
extra features such as a language identifier and a
preferred language option.
Two physical types of SIMs are: the”ID-1 SIM” and the ”Plug-
in SIM”.
GSM 59
International Mobile Subscriber Identity
(IMSI)
► The International Mobile Subscriber Identity (IMSI) is the number
that identifies the mobile subscriber on the radio path and through
the GSM network. This identity is stored in the Subscriber
Identity Module (SIM), as well as in the network.
► Examples of two IMSI’s are shown below and as can be seen they
are in 3 parts.
► IMSI = MCC + MNC + MSIN
MCC = Mobile Country Code.
MNC = Mobile Network Code.
MSIN = Mobile Station Identification Number.

GSM 60
Mobile Station ISDN Number (MSISDN)
► The Mobile Station Integrated Services Digital Network
(MSISDN) number is the directory number that shall be
dialed from anywhere in the world to reach a particular
subscriber. Therefore every GSM telephone number in the
world must be unique.
► In GSM 900 the MSISDN is composed of:
MSISDN = CC + NDC + SN

0020 010 1234567

Network Code Subscriber Number

Country Code
(NC) (SN)
( CC ) GSM 61
2-Mobile Equipment (ME)
► MS features are defined as mandatory or optional.
Mandatory features must be implemented as
long as they pertain to the MS type.
The choice of implementing optional features is left
up to the manufacturers. Manufacturers are
responsible for ensuring that the MS features neither
conflict with the air interface nor interfere with the
network, any other MS, or the MS itself.

GSM 62
(B) The GSM network is divided into
there systems:
1- Network Switching System (NSS)
:The Switching System consists of
(a)-Mobile Switching Center (MSC)
► The primary node in a GSM network is the MSC. It is the node, which
controls calls both to MS’s and from MS’s. The primary functions of an
MSC include the following:
• Switching and call routing: A MSC controls call set-up,
supervision and release and may interact with other nodes
to successfully establish a call. Digit Analysis tables are
thus loaded to the MSC.
• Service provisioning: the SMS service is handled by MSC’s.
• Communication with HLR.
• Communication with the VLR.
• Communication with other MSC’s.
• Control of connected BSC’s.
• Direct access to Internet services.
GSM 63
(b)-Gateway Mobile Switching Center (GMSC)
► A gateway is a node used to interconnect two
networks. The gateway is often implemented in an
MSC. The MSC is then referred to as the GMSC.

(c)-Home Location Register (HLR)

► The HLR is a centralized network database that
stores and manages all mobile subscriptions
belonging to a specific operator, The primary
functions of the HLR include Subscription database
management: as a database, the HLR must be able
to process data quickly in response to data retrieval
and update requests, Each subscriber record
contains a substantial amount of parameters such as
the IMSI, MSISDN and AMSISDN numbers,
Supplementary services are also assigned to each
subscriber’s profile. GSM 64
(d)-Visitor Location Register (VLR)
► The VLR is a database that contains temporary
information about subscribers that is needed by
the MSC in order to service visiting subscribers.
► The VLR is always integrated with the MSC. When
a mobile station roams into a new MSC area, the
VLR connected to that MSC will request data about
the mobile station from the HLR then the VLR
contains a complete copy of the necessary
subscription details, including the following
information:
- Identity numbers for the subscriber.
- Supplementary service information (e.g. Does the
subscriber has call waiting activated or not).
- Activity of MS (e.g. idle or busy).
- Current Location Area of MS.
GSM 65
(e)-Authentication Center (AUC)
► PLMN’s need a higher level of protection than traditional
telecommunication networks, because of the Appearance of
cloning cases (Cracked SIM cards) first occurred in the
United States in 1998.
► The AUC is a database connected to the HLR, which provides
it with the authentication parameters, and ciphering keys
used by the MSC/VLR to authenticate.
► The information provided by the AUC to ensure
authentication processing is called a triplet and consists of:
1. A non predictable RANDom number (RAND).
2. A Signed RESponse (SRES).
3. A ciphering Key (Kc).

GSM 66
► To protect GSM systems, the following security
functions have been defined:
[I] Subscriber authentication: by performing
authentication, the network ensures that no
unauthorized users can access the network,
including those that are attempting to impersonate
others.
[П] Radio information ciphering: the information sent
between the network and an MS is ciphered. An MS
can only decipher information intended for it.

GSM 67
► [I] Authentication Procedure
1. The MSC/VLR transmits the RAND to the MS.
2. The MS computes the signature SRES using RAND and the
subscriber authentication key (Ki) through the A3 algorithm.
3. The MS computes the Kc by using Ki and RAND through A8
algorithm. Kc will thereafter be used for ciphering and
deciphering in MS.
4. The signature SRES is sent back to MSC/VLR, which performs
authentication, by checking whether, the SRES from the MS
and the SRES from the AUC match. If so the subscriber is
permitted to use the network. If not, the subscriber is barred
from network access.
► Authentication can by operator’s choice be performed during:
- Each registration.
- Each call setup attempt.
- Location updating.
- Before supplementary service activation
GSM and deactivation. 68
► [П] Ciphering Procedure
Means that user information and signaling exchanged between
BTS’s and MS’s is not disclosed to unauthorized individuals,
A ciphering sequence is produced using Kc and the TDMA
frame number as inputs in the encryption algorithm A5.
The purpose of this is to ensure privacy concerning user
information (speech and data) as well as user related
signaling elements. In order to test the ciphering procedure
some sample of information must be used. For this purpose
the actual ciphering mode command (M) is used.
1. Kc is sent from the MSC/VLR to the BTS.
2. Data is encrypted using Kc (calculated earlier with SRES in the
authentication procedure) and the TDMA frame number, which are fed
through the encryption algorithm, A5.
3. The encrypted message is sent to the BTS.
4. Encrypted Message is decrypted in the BTS using Kc, the TDMA frame
number and the decryption algorithm, A5.
5. If the decryption of data was successful, the ciphering mode completed
message is sent to the MSC. All information over the air interface is
ciphered from this point on.
6. The same applies in the directionGSM
from the BTS to the MS. 69
(F)-Equipment Identification Register (EIR)
► It is necessary to have a separate authentication process
for the MS equipment. This ensures, e.g. that a mobile
terminal, which has been stolen, is not able to access the
network.
► The equipment identification procedure uses the identity of
the equipment itself (IMEI) to ensure that the MS terminal
equipment is valid.
1. The MSC/VLR requests the IMEI from the MS.
2. MS sends IMEI to MSC.
3. MSC/VLR sends IMEI to EIR.
4. On reception of IMEI, the EIR examines three lists:
A white list which contains all number series of all
equipment identities that have been allocated in the
different participating GSM countries.
A black list which contains all equipment identities that has
been barred.
A gray list (on operator level) which contains faulty or non –
approved mobile [Link] 70
Data Transmission Inter-working (DTI)-)g(
► The DTI implements the GSM Inter-Working Function
(IWF). It performs data handling functions such as data
rate conversion and provides the functions necessary for
data inter-working between GSM networks and other
networks, including:
► Data Traffic to/from PSTN: this involves modem and fax
calls.
► Data Traffic to/from ISDN.
► Data Traffic to/from PDNs: the DTI handles data traffic to
and from Public Data Networks (PDNs) such as the Packet
Switched PDN (PSPDN) and Circuit Switched PDN (CSPDN).
► Data Traffic between mobiles.
► HSCSD: this version of High Speed Circuit Switched Data
(HSCSD) allows the connection of 2, 3,or 4 time slots on
one radio channel each carrying 9.6 kbits/s.
GSM 71
HSCSD supports the following types of data transmission
:connections
► Transparent: by adding error correction bits to the
basic data, a more reliable connection is ensured.
However, the basic data rate is restricted to a
maximum of 38.4kbits/s.
► Non-transparent: in contrast with transparent
connections, this form does not add information to the
basic data and is therefore less reliable. However,
higher basic data rates are possible - up to 48kbits/s.

GSM 72
(h)-Message Center (MC)
► An MC may be added to a GSM network to provide one or more of the
following messaging services:
-Voice mail.
Voice mail ensures that all calls to a person can be completed, even when a
person does not answer calls. A calling party can record a voice message for
the subscriber they are calling.
-Fax mail.
Fax mail operates similarly to voice mail. For MS’s that support fax, a
subscriber can set diversion for all or some fax calls to a fax mailbox. When
the MS is next attached to the network, the network will deliver the fax
message to a fax machine identified by the MS.
-Short Message Service (SMS) text messages.
A short text message consists of up 160 alphanumeric characters, entered at a
Short Message Entity (SME) such as an MS (using the keypad) or computer
terminal. A short message always originates or terminates in a GSM
network, meaning that a short message can not be sent between two SMEs
residing outside a GSM network.
-SMS Cell Broadcast (SMSCB) text messages.
► The SMSCB service enables a message of up to 93 alphanumeric characters
to be delivered to all attached MS’s in one cell (a hospital or police station).
GSM 73
 2-Base Station System (BSS)
The Base Station System (BSS) is responsible for all the radio-related functions
.in the system

Base Station Controller (BSC)-)a(

► The BSC is the central node within a BSS and co-ordinates the
actions of Base Stations. The BSC controls a major part of the
radio network. The main functional areas of the BSC are:
• Radio Network Management.
• BTS Management.
• TRC Handling: The TRC provides the BSS with rate adaptation
capabilities. This is necessary because the rate used over the
air interface and that used by MSC/VLRs are different
33.8 Kbit/s and 64 Kbit/s respectively. A device, which
performs rate adaptation is called a transcoder.
• Transmission Network Management.
• Handling of MS connections. GSM 74

• Internal BSC Operation and Maintenance.

 Base Transceiver Station (BTS)-)b(
Radio Resources: A BTS’s
main function is to
provide connection with
the MSs over the air
interface. This includes
:the following tasks
• Configuration and system
start.
• Radio transmission.
• Radio reception.
• Signal processing.
• Synchronization.
GSM 75
Chapter 5
Air Interface
Physical Channel and Logical Channels

• GSM band is divided into 124 RF

channels, and each channel is
divided into 8 time slots using
TDMA each time slot is called
(Physical Channel).
• A physical channel may carry
different messages.
• These messages are called
logical channel.
channel
• For example on one of the
physical channels used for traffic,
the traffic itself is transmitted
using a traffic channel (TCH)
message.
GSM 77
GSM 78
.Logical channels can carry traffic or control message
Traffic Channel (TCH)-1
Once call set up procedures have been completed on
the control physical channel, the MS tunes to a
traffic physical channel. it uses the traffic channel
(TCH) logical channel. Traffic channels are thus
UP link and down link .
There are two types of TCH:
• Full Rate : Transmits full rate speech (13Kbps) ,
A Full rate TCH occupies one physical channel.
• Half Rate :Transmits half rate speech (6.5Kbps)
Two Half rate TCH occupies one physical
channel. Those doubling the capacity of call.
GSM 79
2-Control Channels (CCH)
► The control channel are divided into three types
there are :
A- Broadcast channel
EX. ( FCCH , SCH , BCCH , CBCH)
B- Common Control Channel
EX. ( PCH , RACH , AGCH )
C- Dedicated channel
EX. ( SDCCH , SACCH , FACCH )

The following table indicate them in details :

GSM 80
GSM 81
GSM 82
TDMA Burst Structure
The Burst Structure differs according to the type of
information transmitted on the TDMA time slot. We have 5
kinds of Burst.
1- Normal Burst
This type is used to carry the information of the traffic
channels and the control channels
BCCH,PCH,AGCH,SDCCH,SACCH,CBCCH and FACCH,
except RACH.

GSM 83
► The subscriber speech or data is encrypted into 57 bit
blocks ,Each burst will contain two 57 bits blocks from
different speech segments.
► One bits stealing flag will be added to each block
indicate whether the burst is stolen for the FACCH
signaling or used as a normal traffic channel.
► The training sequence is inserted in the middle of the
burst to help the viterbi equalizer to create the
channel model.
► The tail bits help the equalizer to determine the start
and the stop of the transmitted bits ,they are 3 bits
and they are always zeros.
► The guard period of 8.25 length which is equivalent to
about 30 µs,it left at the end of each burst to prevent
overlapping between consecutive burst And to
facilitate burst synchronization.
GSM 84
2- Frequency Burst
This is the one used by the channel FCH for frequency
correction of the mobile. It consists of a long
sequence of bits called the fixed bits which are all
equal to zeros, leading to a constant frequency o/p
from the GMSK modulator.

GSM 85
3- Synchronization Burst
Consecutive TDMA frames follow a cyclic numbering scheme in which each
frame is numbered from 0 to 2715647. one cycle will then take about
3.5 hours and it is called a ‘Hyper frame’ the TDMA frame number is
used by the mobile to (1) determine which control channel will be
transmitted on that frame.(2) it is used also as one of the input
parameters to the algorithm that calculates the ciphering key Kc.

► The SCH burst consists of a long synchronization sequence

along with the important information being encrypted and
divided into two blocks.
► This synchronization sequence is to make it easier for the
mobile to recognize this channel.
GSM 86
4- Access Burst
The Access Burst is used by the RACH channel. The
mobile sends this burst when it does not know the
distance to its serving BTS,which is the case when
the mobile is switched on or after it makes a
handover to a new cell.

GSM 87
Dummy Burst -5
The dummy burst is sent from the BTS when there is nothing
else to be sent. It carries no information and it has the
same structure of a normal burst with the encrypted bits
.replaced by a known bit pattern to the mobile

GSM 88
Mapping of Logical Channels onto
Physical Time Slots
It will not be suitable to dedicate one physical
channel time slot to each logical channel instead
of that. more than one logical channel will be
made to occupy the same physical time slot
alternatively.

for example a BCCH is sent on time slot 0 in one

TDMA frame and a PCH will be sent on the same
time slot in the next frame. This concept is called
“Mapping of logical Channels”.

GSM 89
Mapping of Logical Channels onto time slot 0
(Downlink)
Time Slot 0 on one of the carrier frequencies allocated to the cell is
reserved for Logical Control Channel.

GSM 90
 FCH is sent on time slot 0 in frame number 1,11,21,31 &41

 SCH is sent on time slot 0 in frame number 2,12,22,32 &42

 BCCH is sent on time slot 0 in frame number 3,4,5 & 6

 AGCH or PCH is sent on time slot 0 in frame number

7,8,9,10,13 up to 20 ,23 up to 30 ,33 Up to 40 ,and 43 up to
50 .

 Idle channel is sent on time slot 0 in frame number 51.

 After that, the cycle will be repeated this cycle takes a time
slot of 51 TDMA frames and is called a “ Multi-frame” .

GSM 91
Mapping of Logical Channels onto time slot 0(Uplink)
Time slot 0 the uplink direction is reserved for
RAACH to make random access to the system.

GSM 92
Mapping of Logical Channels onto time slot 1(Downlink)
Time slot 1 on the lowest carrier frequency also is
reserved for dedicated control channels SDCCH and
SACCH.
It is possible to have 8 SDCCH channels and 8 SACCH
channels mapped onto time slot 1.
The mapping is performed in the following manner :
► Subscriber signaling on an SDCCH requires 4
consecutive bursts, so time slot 1 in frames number 1
up to 4 will be used to send the SDCCH for one
subscriber (D0).
Thus we can have 8 SDCCH channel from D0 to D7 by
using time slot 1 in the first 32 framers.
GSM 93
► Signaling on SACCH requires also 4 consecutive bursts.
Time slot 1 in the next 16 frames is used to obtain 4
SACCH channels from A0 to A3.
• Three idle channel are sent on time slot 1 in the next three
frames to complete half a multi frame (the multi-frame in
this case consists of 102 TDMA frames).
• In the other half of the multi frame, we will have 8 SDCCH
channel from D0 to D7 again and 4 SACCH channel from
A4 to A7.

GSM 94
► Mapping of Logical Channels onto time
slot 1 (Uplink)
• On time 1 in the uplink direction ,the mobile will reply to
the BTS using a multi-frame having the same structure
as that used in downlink direction.
• The mobile needs some time to calculate its answers to the
signaling sent from the BTS. So the uplink multi frame is
delayed by a period equivalent to 15 TDMA frames.

GSM 95
Logical channels Mapped into other timeslot
• Time slot 0 and time slot 1 up and down link, are occupied by
the control channels. This leaves TS 2-7 Free for use as traffic
channel.
• There are 26 timeslots in all. After the IDLE TS the sequence
starts all over again.
T (TCH): This contains encoded speech or data, the conversion.

A (SACCH): This contains the control signaling ,an example of

this is an order to change output power.

I (IDLE): Normally ,every timeslot in every TDMA-frame contains

information about the mobile allocated to that timeslot .the one
exception is the IDLE one ,where nothing is sent .this is used
by the mobile to gain certain traffic measurements .

GSM 96
The structure of the traffic time slots is identical in both directions. The only
difference is an offset in time. The offset is three time slots. Between the
associated uplink and downlink frequencies there is always 45MHZ ‘duplex
distance’ this means that the mobile does not have to transmit and receive
.at the same time

GSM 97
TDMA Frame Structure

GSM 98
 We have previously seen in TDMA frame is used during the encryption
process .Therefore the BTS must number the frame in a cyclic pattern
and there must be a point when the counter returns to zero .

 The chosen number is 2715648 which corresponding to (( 3h 28 mm

53s and 760 ms )) this structure is called Hyper-frame

 One hyper -frame is then subdivided into 2048 super-frame ,which

have duration of 6.12 s .the super-frame itself is subdivided into
multi-frames ,
There are two types of them :
 The first is type a 26-frame multi-frame containing 26 TDMA frames
This multi-frame is used to carry TCH ,SAACH and FAACH .51 of these
multi-frame form a super-frame

 The second type is a 51-frame multi-frame containing 51 TDMA

frames ,this multi-frames is used to carry BCH and CCCH .
26 of these multi-frame form a super-frame.

GSM 99
Chapter 6
Traffic Cases
Different Types of Traffic Cases
 In fixed network ,the subscriber is tied all the
time to the switch providing the telephony
service. The wires will never be disconnected
from his serving switch and go connected to
another switch .
 In mobile network ,designed to release the
switch ties ,this doesn’t apply. A subscriber is free
to roam ,at least through his network without
feeling any problem.
When a call comes to a subscriber ,the system
should know where is the subscriber now in order
to deliver the call to him .

GSM 101
Also if the subscriber is making call and moving by his mobile
station from one location to another ,the system shouldn’t
drop his call and must guarantee its continuity. the system
must handover the call to a cell covering the new location.
Also the system must be aware if the subscriber goes out of
coverage or if he closes the mobile .This will make the
system more efficient as it will not try to deliver the call
although the subscriber is not ready to receive it.

All the above leads us to study and specify different types of

traffic cases a subscriber may be subjected to. Generally
speaking , traffic cases may be divided to :
1- Location Update.
2- Handover.
3- Mobile terminated call.
4- Mobile originated call.
GSM 102
Location Update -1
Actually ,the location update process is invited in aim to
exactly identify your location within the network so that any
.incoming call goes directly to the called subscriber
• To fulfill this aim ,one can say that we may update
the call ID each time the subscriber changes his
serving cell, The HLR will now know the exact cell
you are roaming in .This will result in a huge
amount of location update message.

• An extreme is never to make a location update and

to be paged in the entire network. This will cause
huge paging messages.

GSM 103
We can summarize the previously mentioned facts as
following :
 Location area is a part of the MSC/VLR coverage
area. Each group of cells in the same BSC is
assigned a universal unique location area identity
.Introducing the concept of location area enables us
to make an approximate estimation of your location.
 A subscriber should now inform the network each
time he changes his location area so that when a
call comes to him the system will search for him in
the area covered by the cells forming the location
area he is present in.

GSM 104
GSM 105
The LAI for paging indicates to the MCS in which
location area the mobile station is operating it is
also used for location update of the mobile
: subscribers, the LAI contains the following

LAI = MCC + MNC + LAC

MCC : Mobile Country Code
MNC : Mobile Network Code
LAC : Location Area Code

The maximum length of LAC is 16 bits, enabling 65536

different location areas to be defined in one PLMN .

GSM 106
Types of location update

1-Normal Location Update.

•Changing the Cell within the same location area.
•Changing the location area within the same MSC
coverage area.
•Changing the MSC coverage area within the same
PLMN.
2-IMSI Detach and IMSI Attach.
3-Periodic Location Update.

GSM 107
1-Normal Location Update.
• Changing the Cell within the same location area:
 MS’s are constantly moving around in the cellular
network .The MS location information stored in the
VLR is the LA .If an MS changes cells within a
LA ,the network isn’t updated.

 The MS knows that the new cell belongs to the

same LA by listing to the BCCH in the new cell.
The BCCH broadcasts the cell’s LAI. If they are
the same ,it means that the MS has not changed
LA’s and doesn't need inform the network.

GSM 108
• Changing the location area within the same MSC
coverage area :

1-The Mobile sends an “SDCCH Allocation request“

message on the RACCH CHANNEL to the BTS.

2-The BTS responds with the “ SDCCH Allocation”

message on the AGCH channel .

3-The mobile sends a “ location update request “
message along with its IMSI on the allocated SDCCH
channel to the MSC/VLR .
4-The MSC/VLR updates its location information of that
subscriber and sends a “location updating
confirmation “ message on the SDCCH channel to the
mobile and the SDCCH channel is released.
GSM 109
• Changing the MSC coverage area within the same
PLMN:
1- Authentication is performed. If authentication is successful,
the VLR checks its database to determine whether or not it
has a record for this MS-subscription.
2- When the VLR finds no record for the MS ,it sends a request
to the subscriber’s HLR for a copy of the MS-subscription.
3- The HLR passes the information to the VLR and
updates its location information for the subscriber .the HLR
instructs the old VLR to delete the information it has about
the MS-subscription .
4- The VLR stores its subscription information for the MS
including the latest location and status ( idle ).The VLR sends
acknowledgement to the MS .
GSM 110
.IMSI Detach and IMSI Attach-2
:IMSI Detach •

 In The system information broadcast on the

control channel (BCCH) ,the MS receives
information on whether the IMSI attach/detach is
used or not .

 If it is used ,the MS should inform the network

when it is entering an inactive state (switched off),
so that all the incoming calls to the MS will be
rejected .

 The benefit of using IMSI detach is the reduction

of paging message sent to a switched off mobile.
GSM 111
There types of detached subscribers are
:present
.Power off mobile -1
.Implicitly Detached -2
.MS Purged -3

GSM 112
:Power off mobile -1
1- At power off the MS requests an SDCCH signaling channel.
2- on the SDCCH ,MS sends an IMSI detach message to it’s
the serving MSC/VLR.
3- In the VLR ,an IMSI detach flag is set for that subscriber.

2- Implicitly Detached:
 If the MS sends an IMSI detach message to the system and
the radio link quality is poor, the system might not be able to
decode the information.
 Because no acknowledgement is sent to the MS, no further
attempt is made .In this case ,the system still regards the MS
as attached.
 If periodic registration is in use ,the system will soon determine
that the MS is detached .The VLR then performs an implicit
detach ,marking the MS as detached .
GSM 113
3-MS purging:
 MS purging is used to inform the HLR that the
VLR is about to remove the subscriber record
from the VLR.

 The HLR then sets the MS purged flag and

treats the subscriber as un reachable . This
save unnecessary network signaling and
database lookup

GSM 114
 For example ,an UK MS travels to Australia and
performs a location update in an MSC/VLR in Australia .
Later ,the subscriber travels back to the UK ,which takes
some time .During this period ,the subscriber is not active.
If MS purging isn’t used
when a caller make a call to the MS ,the HLR identifies the
MS as registered in Australian MSC/VLR and routes the
call to it .the MSC/VLR then informs the HLR that the
subscriber is unreachable.
If MS purging is used
the UK subscriber’s record will have been purged from the
Australian MSC/VLR . when a call is made to the
subscriber ,the HLR identifies the MS as unreachable and
doesn’t contact the Australian MSC/VLR.
GSM 115
IMSI Attach •

 This is performed by the MS to inform the network that it

has re-entered an active state (switched on),and it is still in
the same location area as it was before.
 If the MS changes it location area while being switched off,
a normal location update is performed.
1- MS requests allocation of an SDCCH .
2- on the SDCCH ,MS sends an IMSI attach message to
the serving MSC/VLR
3- The MSC/VLR removes the IMSI detach flag ,so the
mobile is ready for normal call handling .
4- VLR returns an acknowledgement to the MS .

GSM 116
.Periodic Location Update-3

 Periodic Location Updating is used if the MS

doesn’t perform any kind of location updating in a
certain period so the network forces the MS to
update its location information.
 On the BCCH ,the MS receives information in
whether periodic registration is used .If it is used
,the MS is told how frequently it is required to
register itself .

 The period between two consecutive registration is

set up by the operator using a certain cell
parameters ,if the parameters value is set to
zero ,periodic location update will not be used in
the cell.
GSM 117
 This process depends on timers in both MS and
MSC. When the MS timer expires ,the MS is
forced to perform a location updating , and then
the timers in both MS and MSC/VLR restart .

 If the MS doesn’t perform a location update after

the specified period expires ,then after another
interval of safety ,the MSC marks this MS as
Implicitly detached (probably out of coverage)

GSM 118
Handover
 When a mobile subscribers moves from one cell to
another while he is in a call ,the network should keep
the continuity of this call .This process is called
(HANDOVER).

 During call setup and conversation ,the MS performs

measurements on the transmission quality of the

neighboring cells ,and report this measurements to its
serving BTS ,while adds its own measurements on the
signal strength received from the mobile and sends
them to the BSC ,BSC is responsible for the decide of
the handover.
GSM 119
:There are four different handover cases
Intra cell :
Handover between 2 traffic channels in the same cell.
Intra BSC :
Handover between 2 cells belonging to the same BSC.
Inter BSC / Intra MSC :
Handover between 2 cells belonging to different BSCs
but to the same MSC.
Inter MSC :
Handover between 2 cells belonging to different BSCs
and different MSCs.

GSM 120
Mobile Terminated Call
1- The PSTN subscriber keys in the MS’s telephone number
(MSISDN) .the MSISDN is analyzed in the PSTN ,which
identifies that this is a call to a mobile network subscriber .A
connection is established to the MS’s home GMSC.
2- the GMSC analyzes the MSISDN to find out which
HLR the MS is registered in ,and queries the HLR for
information about how to route the call to the serving
MSC/VLR.
3-The HLR translates MSISDN into IMSI ,and determines
which MSC/VLR is currently serving the MS .The HLR also
checks if the service ,”Call forwarding to C- number “is
activated ,if so, the call is rerouted by the GMSC to that
number.

GSM 121
4- The HLR requests an MSRN from the serving MSC/VLR.
5- the MSC/VLR returns an MSRN via HLR to the GMSC.
6- the GMSC analyses the MSRN and routes the call to
the MSC/VLR.
7- the MSC/VLR knows which LA the MS is located in .A paging
message is sent to the BSC’s controlling the LA.
8-The BSC’s distribute the paging message to the BTSs in the
desired LA .The BTSs transmit the message over the air
interface using PCH .To page the MS ,the network uses an
IMSI or TMSI valid only in the current MSC/VLR service area .
9- When the MS detects the paging message ,it sends a
request on RACH for a SDCCH .
10- The BSC provides a SDCCH ,using AGCH
11- SDCCH is used for the call set-up procedures .Over SDCCH
all signaling preceding a call takes place.
This includes:
GSM 122
12- Marking the MS as “active” in the VLR.
13- The authentication procedure.
14- Start ciphering.
15- Equipment identification.
16- The MSC/VLR instructs the BSC/TRC to allocate
an idle TCH. The BTS and MS are told to tune to
the TCH. The mobile phone rings .If the subscriber
answers, the connection.

GSM 123
GSM 124
Mobile Originated Call
1- The MS uses RACH to ask for a signaling channel.
2- The BSC/TRC allocates a signaling channel ,using AGCH.
3- The MS sends a call set-up request via SDCCH to the
MSC/VLR .over SDCCH all signaling preceding a call takes
place.
This includes :
- Marking the MS as “active” in the VLR.
- The authentication procedure.
- Start ciphering.
- Equipment identification.
- Sending the B-subscriber’s number to the network.
- Checking if the subscriber has the service“ Barring of
outgoing calls “ activated.
GSM 125
4- The MSC/VLR instructs the BSC/TRC to allocate an idle
TCH. The RBS and MS are told to tune to the TCH.
5- The MSC/VLR forwards the B-number to an exchange in
the PSTN ,which establishes a connection to the
subscriber.
6- If the B-subscriber answers ,the connection is established.

GSM 126
Traffic Cases in case of international
roaming
 One of the primary features of GSM is the
ability to perform international roaming and
to handle international call cases .

 In order for a mobile subscriber to be able to

make calls while roaming in a different GSM
network ,there must be an agreement
between the subscriber’s home network
operator .
GSM 127
Location update:
 The MS is switched on and scans all GSM frequencies
within one frequency band (e.g. GSM 900) .It is searching
for a BCCH [Link] MS tunes to the BCCH carrier that
has the strongest signal strength and reads its system
information .This includes the identity of the network
operator.
 The MS compares this network identity with the list of
forbidden PLMN’s in the SIM memory, This list contains all
network identities, which the subscriber’s home operator
doesn’t have an international roaming agreement with .

 If the network ,which the MS has tuned to ,is a forbidden

network ,the MS continuous to scan for a permitted
network.
 If the MS doesn’t find a permitted network ,but has
identifies a forbidden network ,it displays the message
“Emergency Calls Only“.
GSM 128
If the MS finds a permitted network , it tunes to it and sends an
IMSI attach message.
1- If a permitted network is found ,the MS will send a location
update request by sending its IMSI.
2- The MSC present in the airport will check whither this IMSI
belongs to a series defined in it or not .Definition of IMSI
series of foreign network is a part of the roaming agreement
signed between them .
3- If the MSC finds the IMSI series defined it will route a
signaling message to the home HLR the subscriber resisted
into and will check whither he is allowed to make roaming and
international roaming.
4- If the subscribers is allowed to make roaming and
international calls ,his location data will be updated and he will
be marked as a visitor to Stockholm VLR.
5- A copy from the HLR profile will be transferred to
Stockholm VLR .
GSM 129
Mobile Originated and Mobile Terminate calls
 When an MS is roaming internationally and a call
is made to it , the procedures used is identical to
when the MS is in their home network.

 The only major difference is that the GMSC and

HLR used are in the home network ,while the
MSC/VLR is in a network in another country.

 Agreements will specify the charging method and

tariff classes used in exchanging signaling and
traffic channels between the countries.

GSM 130
Short Messages
 The short message service (SMS) allows a mobile
subscriber to send and receive text messages composed of
160 characters at most.
 These messages can be read on phone’s LCD panel and
they are delivered using the signaling channel
(SACCH) ;so short message can be received while a call
is in progress
 The short message sent or received are handled by Short
Message Service Center (SMSC).
which consists of three parts :
- Service Center (SC)
- Short Message Service GMSC ( SMS-GMSC)
- Short Message Service Inter-working MSC
(SMS-IWMSC)
GSM 131
 The Service Center: handled the delivery of short
messages to/from Short Message Entities (SME), which
can be any originator or receiver of short message such as
mobile , fax ,…. ,etc.
It stores the short messages ,creates billing files and
monitors events and alarms.
 The Short Message Service GMSC: interrogates the HLR
to determine the location of a mobile subscriber and
forwards the short message to a mobile subscriber via its
serving MSC.
 The short message service inter-networking MSC: receives
the mobile originated short message from any MSC in the
network and receives an alerts message from the HLR to
inform the SC that a mobile subscriber who was absent
during a previous short message attempt is reachable
again
GSM 132
Short Messages Delivery Process:

1- Short message is sent to MS 1.

2- MSC1 forward the short message to the SMS –IWMSC.
3- SMS –IWMSC passes the short message to the SC which checks
the message format and if correct stores it on a hard disk .
4- SC sends the short message with the destination
MSISDN address to the SMS-GMSC.
5- SMS-GMSC interrogate the HLR for the location of the destination
mobile by sending the message “Send Routing Info. For SM” .
6- HLR responds with the VLR address of the target mobile by
sending the message “ Send Routing Info. For SM”.
7- SMS-GMSC sends the short message to MSC2.
8- MSC2 forward the short message to the target mobile, and then it
will be deleted from the SC.

GSM 133
GSM 134
Unsuccessful Delivery
If the target mobile is switched off or out of service,
- the HLR responds to the SMS-GMSC with the
message “ Absent subscriber”.
- then the SMS-GMSC sends the delivery failure result
to the SC ,and the SMSC will try to deliver the
message by using one of the following methods:

1- Retry Method.
2- Usage of “Alert service Center” in the HLR.

GSM 135
:Retry Method -1

 In this method ,the SMS will assign the validity period

for the short message (default value is three days)
during which it will attempt to deliver the short
message until an attempt is successful.

 If the validity period expires the short message will be

removed from the short center.

GSM 136
2- Usage of “Alert service Center” in the HL:

1-SMS-GMSC sends the message “Set Waiting Data” to

the HLR .This is to make it possible for the HLR to
inform the SMSC when the subscriber is available
again.
2- when destination mobile becomes available again, it
register itself onto MSC ,which sends the message

“Note MS present” to the HLR to inform it that the

mobile is reachable again.
3- HLR sends the message “Alert Service Center” to the
SMS-IWMSC in order for the SMSC to retry sending
the short message again.
GSM 137
4-SC asks the SMS-GMSC to interrogate the HLR for the
location of the target mobile.
5-HLR responds with the VLR address of the target mobile.
6-SMS-GMSC sends the short message to MSC2.
7-MSC2 forwards the short message to the terminated
mobile.

GSM 138
Thanks!

GSM 139