INTRODUCTION GSM-new standard for mobile communications in 900 MHz range.

In 1991 the first GSM system came into user operation. Time has brought substantial technological progress to GSM hardware. GSM has proved to be a major commercial success for network operators and manufacturers. Like all modern mobile networks GSM utilizes Cellular structure. The basic idea of a cellular structure is to partition the available frequency range, to assign only parts of the freq spectrum to any BTS, and to reduce the range of the base station in order to reuse the scarce frequencies available. One of the major goals of network planning is to reduce interference between different base stations. Besides the adv of reusing frequencies a cellular network has the following disadv. Increasing no. of base stations increase cost of infrastructure and no. of access lines. As an MS moves n active call is handed over from cell to cell, which is a process, know as handover. A network has to be kept informed about the location of the MS even without a call in progress, to be able to deliver an incoming call. Extensive communication b/w a MS, network and network elements is required which requires that the network should be of modular structure. OVERVIEW OF A GSM SUBSYSTEM A GSM network consists of various elements: MS, SIM, BTS, BSC, TRAU, MSC, HLR, VLR, EIR. Which together form the PLMN. MS: GSM- PLMN contains as many MSs as possible in various styles and power classes. The mandatory features are: DTMF capability SMS capability Availability of ciphering algorithms A5/1 and A5/2 Support of emergency calls without SIM Burned in IMEI SIM: GSM distinguishes b/w mobile equipment and identity of the subscriber. It is the database on the user side. Physically it consists of a chip, which the user must insert into a GSM phone before it can be used. SIM communicates directly with VLR and indirectly with HLR. BTS: each cell has a BTS, which provides connectivity b/w network, and MS via Air interface.

BSC: BTSs of an area are connected to a BSC via an interface called the Abis interface. The BSC performs central functions and the control of the subsystem called the BSS. The BSS comprises of BSC and connected BTSs. TRAU: One of the most important aspects of a mobile network is effective usage of available frequency resources. Which requires compression of data over the Air interface. In the GSM system, TRAU and MS perform data compression. The TRAU is part of the BSS. MSC: A large no. of BSCs are connected to an MSC via the A-Interface. The major tasks of MSC are routing incoming and outgoing calls and assigning user channels on the Ainterface HLR: The HLR is another sub center of GSM network. It is a large database that administers data of subscribers. Every PLMN requires at least 1 HLR. VLR: It was devised so that HLR would not be overloaded with enquiries on data about its subscribers. It contains part of subscriber data only when the particular subscriber roams in the area VLR is responsible for. EIR: It is a database, which records stolen equipment by their IMEI so as to bar fraudulent calls. BSS: Via the AIR Interface the BSS provides connection between MSs of a limited area and the MSS. It consists of one or more BTSs, one BSC and a TRAU BASE TRANSCEIVER STATION (BTS): each cell has a BTS, which provides connectivity b/w network, and MS via Air interface on the other side the BTS is connected to BSC via Abis interface. Block Diagram and signal flow of BTS is as shown. ARCHITECTURE AND FUNCTIONALITY OF BTS Transmitter/Receiver Module: GSM allows for one BTS to have up to 16 TRXs but most BTSs have 1-4 TRXs. The TRX is the most important part of a BTS. It consists of a low freq part for digital signal processing and a high freq part for GMSK modulation and demodulation. Both parts are connected via separate or integrated freq hopping unit. Operations and Maintenance unit: It consists a central unit which administers all other parts of BTS. Hence it is directly connected to BSC via O&M channel which allows O&M module to directly process commands from BSC and MSC into BTS. BTS internal clock generation is mandatory. GSM requires all TRXs of a BTS use the same clock signal. The accuracy of the signal has to have a prcision of atleast 0.05parts per million. Both input and output filters are used to limit the bandwidth of received and transmitted signals. Input filter is a non-adjustable wideband filter hat lets pass all GSM 900Mhz freq

in uplink direction. wideband filters which limit the output signal to 100KHz are used for downlink direction. BTS CONFIGURATIONS: Standard Config: All BTSs are assigned diff cell identities. A number of BTSs form a cell identity. The systems are not fine synchronized and prevent synchronized handover. It is one of the most frequently used. Umbrella Cell Config. Consists of one BTS with high transmission power and an antenna installed high above the ground that serves as an umbrella for a no. of BTSs with low transmission power and small diameters. Umbrella cell config. has a disadv that the freq of umbrella cell cannot be used by all cells of the area due to interference but it reduces overloading and increases signal quality in fast moving users. Sectorized or collocated BTSs refers to a config where several BTSs are collocated in same site but their antennas cover a small distance. It allows for synchronized handover, it is well suited for serial connection of Abis interface, it allows for reuse of freq in one sector, It eases demand for freq. BASE STATION CONTROLLER(BSC): BTSs of an area are connected to a BSC via the Abis interface. The BSC performs central functions and the control of the subsystem called the BSS ARCHITECTURE AND TASKS OF A BSC: Block diagram of BSC is as shown. Switch Matrix: function of BSC is to switch incoming traffic channel to correct Abis interface channels. The BSC therefore comes with a switch matrix that takes care of relay functionality and can be used as internal control bus. Terminal Control Elements of the Abis interface: The connection to a BTS is established via Abis-TCEs which provide control function for the BTS, independent of the BSCs central unit. Major tasks of Abis-TCEs include setting upp LAPD connection towards BTS peers, transfer of signaling data and transparent transfer of payload. TCEs of A-interface: A connection of BSC to MSC is established via A-TCEs although every BSC is connected to only one MSC a number of A-TCEs are reqd. to support AInterface since major part of signaling data of the entire BSS have to be conveyed over this interface. Task of the A-TCEs is setting up and operating SS7/SCCP connection towards MSC. Database: BSC maintains a large database in which maintenance status of whole BSS, quality of radio resources are administered. Central Module: handover and power control are major tasks of main module. TRANSCODING RATE ADAPTATION UNIT: It is situated between BSC and MSC it is used to compress and decompress data between MS and TRAU (64Kbps-16Kbps)

NETWORK SWITCHING SUBSYSTEM: Network elements within the NSS are responsible for control and database functions reqd. to set up call connections using encryption authentication and roaming. NSS consists of the following MSC, HLR, VLR, EIR. The network topology of NSS is more flexible than hierarchical structure of BSS. HLR& AuC: it is a large database with as little access times as possible. Faster the response from the database faster the call can be connected. It is capable of maintaining data of thousands of subscribers. Because of central function of HLR and sensitivity of data stored steps should be taken to prevent HLR outage. AuC is an integral part of HLR. It calculates and provides SRES, RAND and Kc VLR: VLR provides dynamic database management. As a subscriber moves from one location to another data is passed from the VLR of the location subscriber is leaving to the VLR of the location being entered. MSC: A large no. of BSCs are connected to an MSC via the A-Interface. The major tasks of MSC are routing incoming and outgoing calls and assigning user channels on the Ainterface. An with an interface to other networks is known as gateway MSC. During establishment of mobile terminating call from an external network, a call has to enter a PLMN through a gateway MSC which queries the HLR and forwards the call to the MSC where the called party is located. EIR: It is a database, which records stolen equipment by their IMEI so as to bar fraudulent calls. The IMEI contain a serial number and an identifier for every equipment. OSI REFERENCE MODEL: it separates communication process into 7 independent layers. 2 layers that lie above each other work independently. Each layer receives service from layer immediately above and provides service to layer immediately above. Each layer communicates directly with the layer immediately below and above and indirectly with its peer layer at the remote end. If a communication process involves more than 2 network nodes the intermediate nodes need to provide functionality of layers 1-3. 7 LAYERS OF THE OSI REFERENCE MODEL: Physical Layer: The physical layer is responsible for actual transmission of data and provision of necessary facilities. The data packets received from layer 2 are transmitted without additional info. With regard to Air interface of GSM, GMSK modulation and HF equipment of MS and BTS are part of Layer 1 Data Link Layer: It is responsible for packaging of data to be transmitted. Main purpose of tasks of layer 2 is error detection and correction. Data frames are formed by including

start/stop bits and calculation of checksum, which can be checked for consistency at layer 2 at the receiving side. Data link layer plays an important role in protocol testing. On GSM Air- interface layer 2 is formed by LAPDm together with channel coding and bursting. On Abis interface it is LAPD. The remaining interfaces use MTP-2 of SS7 protocol. Network Layer: The network layer deals with routing of data packets. The RR protocol belongs to network layer as well as all the information needed to route a call in an SS7 system. Transport Layer: It performs end-end data control. It checks consistency of a message when a message consists of several pieces. Session Layer: It is assigned for global synchronization process. Both users use layer 3 to co-ordinate communication b/w themselves. It is used in GSM between MS and MSC to distinguish between MTC, MOC and LU. Part of the synchronization is the ability to determine which info needs to be sent, when and by whom. Presentation layer: It is a means of data definition and presentation. It distinguishes different data types and performs data compression and decompression. Application Layer: It is the interface of the specific application to the transmission medium. Implementation depends on the user. It does not contain the application but is an interface. ABIS INTERFACE: It is interface between the BTS and the BSC. Transmission rate is 2.048Mbps, which is partitioned into 32 channels of 64 Kbps each. Line resources on Abis interface are not used efficiently because BTS has only few TRXs and hence small volume capability. BTS connection in a serial configuration: In serial configuration BTS are connected in line or ring topology only one BTS for line or 2 BTSs for ring topology are connected to a BSC. Adv of serial connection is it saves line costs and allows more efficient use of resources. Signaling on the Abis interface: OSI protocol stack on the Abis interface: The Abis interface utilizes layer 1-3 of the OSI protocol stack. The layer 1 forms the D-channel. The LAPD forms layer 2 and Layer 3 is divided into TRX management, Common channel management, radio link management, and dedicated channel management. Layer 2:Link Access Protocol for D-channel: the ISDN D-channel protocol provides basics of Signaling on the Abis interface. LAPD frame: The LAPD frame is of HDLC format. It divides the message into address field, control field, a checksum, a flag at both ends LAPD messages are divided into 3 groups

the Information frame group consists only of I-frame the supervisory frame group consists of receive-ready, receive-not-ready and reject frames. The unnumbered frame group consists of SABME, disconnected mode, UI, disconnect, UA, frame reject, XID frames

PARAMETERS OF AN LAPD MESSAGE Flag: every LAPD frame starts and ends with a flag. It consists of a 0 followed by 6 1s and ends with a 0. Frame check sequence: 16-bit long frame check sequence is used for error detection. A check sum is calculated using data between the flag and FCS. The result is sent in the FCS field the same is done at the receivers end and values of FCS is compared the receiver requests re-transmission if FCS does not match. Address field: Parameters of address field are: Service access pointer identifier : SAPI is a 6-bit field which defines type of user to which message is addressed. It also indicates transfer priority of a message. Terminal endpoint identifier: TEI is a 7-bit field it is used to distinguish among diff TRXs during analysis of a trace file. Command/Response bit: It determines whether a message consists of a command, answer or ack of command Extension address field: The address field contains one EA per octet Control Field: The control field is 8 or 16 bits long it has the foll. Parameters Polling bit/final bit Send sequence and receive sequence number Frame type Tasks of frame types: I Frame to transfer layer-3 info. Error free reception is ack by recipient with RR frame otherwise RNR or REJ is sent. It contains N(S) and N(R) RR Frame ack receipt of I frame RNR frames used to signal when no more I frames can be accepted. Sender has to wait for RR frame results in overload. REJ frame indicates transmission error condition by analysis of FCS SABME Frame: sent when no layer 2 connection is established. DM Frame: used to indicate layer 2 connection cannot be maintained. UI Frames Disconnect frames to take layer 2 connection out of service. UA, ack layer 2 connection being brought into or taken out of service. Answer to SABME FRM, indicates received message is wrong. XID used to synchronize parameters b/w user and network.

Layer 3: info for connection setup and release SAPI 0. info for administrative tasks SAPI 62,63 AIR INTERFACE: central interface of every mobile system and the only one to which the user is exposed. STRUCTURE OF AIR INTERFACE ON GSM: GSM utilizes a combination of TDMA and FDMA, which results in a 2-d channel structure. In full rate configuration 8 time slots are mapped on each freq. In a TDMA system each user sends an impulse like signal periodically. In GSM every impulse signal in a freq is called burst therefore every burst corresponds to a TS.8 bursts form a TDMA frame. Every TDMA Frame is assigned a fixed number which repeats itself in a time period of 3 hrs 28mins 53 seconds and 760 milliseconds. This time period is referred to as hyper frame. Every BTS broadcasts the frame number over SCH and thereby forms an internal clock for BTS. An MS can correspond with the BTS only after it has read SCH channel. SYNCHRONIZATION BETWEEN UPLINK AND DOWN LINK The MS and BTS do not transmit simultaneously. The MS transmits 3 time slots after the BTS but taking into account the timing advance (TA) due to propagation delay b/w the 2.The larger the distance b/w the 2. Physical channels are the available time slots of the BTS. Logical channels are laid over the grid of the physical channel. Each logical channel has a specific task. During a call the MS sends a signal always in a TDMA at the same burst position in the same TS. DISTINGUISHING BETWEEN TRAFFIC AND CONTROL CHANNELS FCCH (DL): freq reference, allows mobiles to tune to BTS frequencies. SCH (DL): PLMN /Base station identifier + synchronization number (frame number) BCCH (DL): to transmit system info between diff layers. AGCH (DL): to assign SDCCH PCH: alerts the mobile for a ringing tone CBCH: transmits cell broadcast messages. SDCCH: exchange of signaling info b/w BTS and MS when TCH is not active RACH (UL): communication request from MS to BTS SACCH FACCH: transmission of signaling data. Interleaving is distributing packages of data in different time slots. How the packets are spread depend on the type of application they present. The goal of interleaving is to minimize the short-term changes of the quality of the transmission channel. SIGNALLING ON THE AIR INTERFACE The GSM specific signaling of OSI layer 1 and 2 can be found on Air-interface where LAPDm signaling is used. LAPDm is modified version of LAPD to suit Air interface. It lacks flags at both ends, TEI, FCS. Formats of LAPDm frame: A format can be sent in both UL and DL on any DCCH B format is used for transport of data and is utilized by DCCH and ACCH

Bbis format for transport of AGCH, PCH, BCCH. They do not have headers as these are CCCHs. Reqd. for DL only. Header of LAPDm frame: Address field: start with EA, C/R and SAPI, which have same tasks as LAPD. SAPI=0 is for messages which deal with CC, RR, and MM. SAPI=3 is for SMS and supplementary services. Further it has 2-bit LPD (long link protocol discriminator). Control field of LAPDm frame defines frame type and contains N(S) and N( R) Information field carries signaling data. Frame types of LAPDm are same as LAPD except XID and FRMR Layer 3 : protocol discriminator: classifies messages into groups and allows addressing of various users. Each message is assigned a PD Radio resource management: manages physical and logical channel. RR Messages are processed by MS on BSS. Mobility management: uses channels that RR provides to transparently exchange data b/w MS and NSS. Call Control: uses channels that RR provides for info excg. Also provides interface with ISDN SIGNAL SYSTEM 7 (SS7) Provides basis for signaling traffic on all NSS interfaces and A-interface. SS7 Network consists of Signaling points(SP) and signaling transfer points(STP) SP is a network node used to address messages to it. STP functionality is related to SP but it also relays messages. SS7 without user part consists only of OSI layers 1-3. they are represented by message transfer part(MTP) MTP provides functionality of OSI Layers 1-7 for transmission of signaling data to SS7 user parts. When problems arise takes necessary steps to ensure connection is maintained and prevents loss of data. Ss7 message format- flag, FCS, information field, length, ack, flag Message types in Layer 2 FISU, LSSU, MSU Format of LSSU flag, FCS, spare, LI, FSN, BSN, flag Addressing and routing of messages on SS7: uses point codes for routing and addressing MSUs called signaling point codes assigned to every SP or STP. MSU has routing labelOPC, DPC,SLS Error detection and correction layer 2 along with FSN BSN perform error detection and correction. Overload of SP, outage of SP/STP, outage of SS7 link b/w SP and STP SIGNALLING CONNECTION AND CONTROL PART (SCCP) offers end-end addressing across several network nodes and countries. It distinguishes among several applications within a network node referred to as sub systems. For actual data transfer 2 connection --oriented and 2 connectionless services are available for the users. Services

of SCCP used by BSSAP on Air interface and TCAP with MAP on interfaces within NSS. SCCP message is hoisted in SIF of MSU. It consists of mandatory part and optional part Parameters of SCCP messages: CaPA and CdPA address consists of SPC, SSN, global title. Protocol class SSN Segmenting/Reassembling Sequencing/segmenting Message type End of optional parameters Release, refusal, return clause SLR, DLR Principle of SCCP connection: CR message, CC message connection established through SLR AND DLR. DT1 message transfer RLSD and RLC A-INTERFACE on the physical level A-interface consists of one or more PCM links b/w BSC & MSC with a transmission capacity of 2 Mbps. TRAU b/w BSC & MSC has to be taken into account. hence b/w BTS and TRAU data is compressed hence every traffic channel occupies 2 of 8 bits of the PCM channel., b/w TRAU and MSC data is uncompressed hence every traffic channel occupies 64Kbps of PCM channel. Signaling over A-interface: A-interface uses SS7 with SCCP as user part to define a new application BSSAP divided into BSSMAP and DTAP represent GSM specific user signaling on A-interface. BSSMAP consist of messages exchanged b/w BSC and MSC as RR messages and used for control tasks. DTAP comprises of messages exchanged b/w subsystem of NSS and MS. Messages are transparent to BSS TRANSCATION CAPABILITIES APPLICATION PART (TCAP) TCAP along with MAP a protocol of the SS7 protocol suite, is the basis for signaling on all NSS surfaces. It is the most important protocol of the protocol stack for GSM or any mobile system as it provides the core functionality to support roaming. It allows users to access databases and switching exchanges via the SS7 network and to invoke services or modify parameters. It is a typical implementation of OSI layers 4-6. It allows the integration of a translational functionality into a message. Addressing in TCAP: TCAP relies on SCCP services completely for addressing. It exclusively uses connectionless services of SCCP. The TCAP routes messages via STPs. Internal Structure of TCAP: It can be separated into 2 parts The transaction layer deals with setting up and maintaining end to end connection. It adds a Transaction id onto the message, which is a TCAP internal identifier. The component layer deals with synchronization and o-ordination of communication. It provides uniform data interface to its users called application protocol data unit.

Coding of parameters and data in TCAP It has to be able to process length indicators from one byte to several thousands of bytes. It must be able to distinguish among various parameter types. Every message starts with a TAG, which is an identifier, followed by a length indicator and the content of the message. The TAG and length identifier can be coded in different ways, where by the actual format is derived from the coded info and the application in use. TCAP messages used in GSM BEG, CON, P-ABORT, U-ABORT, DIALOG, COMPONENT, OTI, DTI MOBILE APPLICATION PART (MAP) MAP is the interface b/w TCAP and application. MAP Services: The communication b/w MAP and the application is done via the MAP services. Common MAP services involves communication control. Special MAP services involve carrier of signaling data. MAP primitives are request, indication, response and conformation. Diff types of MAP services are MAP-DELIMITER SERVICE MAP-OPEN SERVICE MAP-CLOSE SERVICE MAP-U-ABORT MAP-P-ABORT MAP-NOTICE Location Update in BSS & NSS. MOC, MTC in BSS and NSS. Handover scenarios: Synchronized and non-synchronized handover. Intra BTS, intra BSC, intra MSC, inter MSC handover