MSISDN : CC + NDC + SN (max 15), A SIM can hold several MSISDN for Data.

voice
IMSI : MCC+ MNC + MSIN (Max Len 15 GSM) transmitted first time during the initial call.
TMSI : allocated by HLR, VLR 15 max to keep subscriber info confidential in Air interface.
LMSI : Additional searching key to accelerate database searches in VLR
MSRN : CC + NDC + SN for roaming numbers. Assigned by local roaming area VLR
IMEI : TAC + FAC + SNR + SP ( Max 15)
LAI : MCC + MNC + LAC MS pages to MSC, Identify the locartion of MS within the system
CGI : MCC + MNC + LAC + CI ( CI= Max 16) ( to identify cell globally)
BSIC: Used to distinguish neighbouring base stations ( NCC + BCC)
BSC Decides handovers
IMSI detach HLR set bit.
Protocols:
MS – BTS : LAPDm( Link Access procedure) for RR (Radio Resourse management). It use logical
channels
BSC – BTS : ABIS interface between BSC – BTS, It use LAPD protocol.
BSC-MSC : Called A interface use BSSAP protocol which is combination of DTAP & BSSMAP,
DTAP for transparent messages(Mobility management & Call control), BSSMAP for non transparent
mostly RR(Radio Resourse management) messages.
Most of the messages are transparent to BTS.
Connection control CC : These are messages to and from telephone part of mobile phone and are
responsible for setting up and clearing down of telephone call( Between Mobile phone and MSC).
Mobility Management MM : Concerned with mobility aspect of mobile phone and pass between
mobile phone HLR VLR.
Radio Resource : These Messages are concerned with the establishment, maintenance and clearing of
radio link and are exchange between mobile and BSS.
PCM 13 kb/s = 260 bits / 20 ms
How many speech chennel an E1 link carry on ABIS interface.
Explian : Speech is divided in 20ms samples each of which is encoded and 260 bits.Speech coder
output 260 bits/ 20 ms = 13 kbps, +3 kbps to control the TRAU , so total 16 kbps, So it become 4
speeches per timeslit of 64kbps. The full title of speech encoding isn Linear predictive coding- Regular
Pulse Excitation-Long term predictor( LPC-RPE-LTP).
PSTN 3.1 Khz Analogue -> PSTN Exchange 64 kbps -> GMSC 64 kbps -> TRAU 16kbps -> BSC 16
kbps -> BTS 13 kbps
.577 ms(1 burst) -> 156.25 bits -> total bit rate 270.833
1 TDMA frame = 8 TS 8 * .577 ms = 4.615 ms
26 TDMA frame for circuit switched TCH = Mulltiframe, 51 mulltiframe= superframe, 2048
superframe= Hyperframe.
51 TDMA frame for circuit switched Signalling = Mulltiframe, 26 mulltiframe= superframe, 2048
superframe= Hyperframe
GPRS 160k max with certain coding scheme and all 8 TS. In GPRS mobil are divide in class A, Class
B, Class C.
GSM supports 9.6 kbps speed strictly 8 kbps.
HSCSD 57.6 kbps it allow to use 2,3,4, TS on one channel and each TS carries 9.6kbps.
GPRS 160 kbps strictly 40 kbps
In 900 BAND : 890 – 960 Mhz freq band in GSM, 890 – 915 uplink 935 – 960 downlink
spacing = 200 Khz in 8 TS effective bandwidth per user is 25 Khz.
Channels 124 carriers or ARFCN.
In 1800 BAND : 1710 – 1785 Mhz uplink and 1805 – 1880 Mhz downlink, 374 ARFCN
In 1900 BAND : 1850 – 1910 uplink and 1930 – 1990 Mhz downlink, 299 ARFCN
Dual band phone user would be identified in call setup allocated first TCH of 1800 so that 900 can be
used by other.
If C/I ratio < 6 db than freq can be reused. For normal voice C/I ( 6-17 if 17 very clear).
Spatial Diversity : 2 receiving antenna so that mulltipath signal received and combined together.
CDMA-> IS 95 puts everyone is the same channel. 4.4 trillion code, 1 code for each forward land
reverse link. CDMA uses FDD means different frequency on forward & Reverse link.
1.25 MZ wideband channel bandwith which is equal to 42 AMPS channels
All cell use 1.25 Mhz freq, Freqence resuse factor is 1.6 actually.
CDMA mobile contain max 6 rake receivers which accept mulltipath signal combine into strongest
signal. Normally 4 , 3 modulators and 1 searcher which search the pilots of BTS. CDMA use mobile
assisted handloff.
Power control is used in dummy bursts and is done by mobils & BTS both ex 20,8,5,2.
In UMTS same freq in Big area, spreading factor used, scrambling factor used.
IP V4 32 bit IP address

Local AreaRegitration process and Call flow :1) MS turned on it first acquire a synchronisation with
GSM sytem, So it acquire FCCH burst on BCCH frequency and picks the highest strength ARFCN
from timeslot 0.
2) After frequency correction burst detected , the MS try to synchronise with synchronoze burst.
3) If the synchronisation is successful, then it read TDMA frame and BSIC from BCCH, BCCH
contain such item like adjacent cell list, minimum receive signal strength, and LAI and frequency of
surrounding cells.
4) Then it moves to BCCH channel number if diifrent from abov. Then it must maintain information on
neighbouring BCCH.
Handover in GSM: MS measure the neighbouring cell parameters and send it to BTS and BTS add
some parameters into it. So intra BSC handower BSC decide and manages it.
In Inter BSC handover BSC decide and infor through signalling to MSC.
Freq hoping: MS& BTS transmit each TDMA frame in on a different frequency.

Freq Hoping: On every frame RF channel used for carrying signalling channel timeslot or TCH
timeslot change freq to prevent interference.

Picco cells : Designed for building coverage, BTS basement or Transceovers on floors.
Micro Cells: Designed to street coverd by buildings. Antenna below roottop. 200-300 meters, Low
power levels.

GSM Channel Coding : Forward Error correction or channel coding by adding some additional bits to
source data. Convoltion codeing is used.
Bit Interleaving : Interleaving is mixing up several bits in between the close bise bits in the modulated
signal. Usefull because bit error tend to occour continuously. So it spread one code word into number
of burst fo beter transmission performance.

Broadcast Control channel: FCCH, SCH, BCCH : The Freq Corr Burst is long burst whose purpose is
th to enable th MS to find and demodulate S( Synch Burst) in the same. So it 1 st correct internal freq
and then look SCH burst on same frequency. Timeslot 0 . BCCH downlink only to decide which BTS
communicate. It provide LAI, Frequency list, Cell ids, Power control level. Handover measurment
parmeters. When BCCH has no info to send then Dummy burst send.
Common Control Channels: PCH, RACH, AGCH : PCH (Downlink in Dummy burst)used by network
to call MS, RACH(Uplink use Access burst) to transmit access req to network. MS use access burst.
Then BSS send AGCH(Downlink), which allocate a SDCCH.
Dedicated Control Channels: SDCCH , SACCH, FACCH(All Uplink & Downlink both) : SACCH
Can be used as TCH or SDCCH and send info to MS about power level and timing, and send to thr
network info about link quality and receive level strength. FACCH is send to pass messages like
handover sequence, authentication,

GMSK is the modulation technique, with modulation rate 270 5/6 kbauds

GSM architrcture
Ciphering Algorith used A5 or A7 or A8

Func of BTS= BTS contains a) RF hardware b) Antenna system

a) Timing adwance inform to tranmit early as distance increase
b) Measurement reporting for handovers
c) Freq hoping for interference
d) Traffic & control channel management
e) Paging
f) Power control both uplink (MS inform BTS) and downlink( BTS inform MS)
BSC

a) Provide a terristrial link from MSC to the air interface.

b) Perform handovers between radio channels on th BTC

RXCDR: Can be located either with BSC or MSC. BSS will only accept traffic from MSC once it‟s
passed through XCDR. The 64 Kb/s TCH arrives from MSC and then converted to 13kbit/s +3 kbit/s
(Transcoder rate adaption unit) which is transmitted to BTS. At BTS TRAU is removed to form gross
rate of 22.8 kbit/s for onward transmission on Air interface
So in GSM 13kb/s encoded voice /9.6kb/s data.

MSC/VLR : Provide all call switching include

a) Data/Voice call setup
b) Function of EIR
c) Function of delivering Shot message
d) Inter BSS/Inter MSC handover
e) Subscriber validation and location
c) Other functions like Billing, OMC support
d) Location update of mobile subscribers
HLR : Hold subscriber profile/database like
a) Imsi and MSISDN
b) Current availability in which VLR
c) Supplementry services provision/withdrwl. And activate/deactivate them
d) AUC key and functionality
e) MSRN number
VLR : contain all information about users who are active in the network. In case of number of VLR in
one network then actual VLR address available in HLR. One VLR contain many LAI.

If me in Saudi then VLR allocate me TMSI and if I go to Kuwait then HLR allocate me MSRN number
to route calls.
AUC

SIM keep Ki and A5 or A8 or A3 algo,

VLR send RAND, CKCN(cipher key seq number)
MS calculate SRES and Kc

Ki is the 128-bit Individual Subscriber Authentication Key utilized as a secret key shared between the
Mobile Station and the Home Location Register of the subscriber's home network.

RAND is 128-bit random challenge generated by the Home Location Register.

SRES is the 32-bit Signed Response generated by the Mobile Station and the Mobile Services
Switching Center.

Kc is the 64-bit ciphering key used as a Session Key for encryption of the over-the-air channel. Kc is
generated by the Mobile Station from the random challenge presented by the GSM network and the Ki
from the SIM utilizing the A8 algorithm.

MS calculate SRES & Kc this value compared at HLR and Air interface which is used for encryption.

EIR keeps white list , Grey list Black list subscriber info.
Total
8,456,261 Busy Hour Call Attempts
99.26 BH Succ calls (%)
46.28 BH B-Answer (%)
0.76 BH Congestion (%)
 94,428 BH Traffic (Erlang)
86.86 Mean Call holding Time(Second)
28.60 Erlang /Subscriber at GOS 2% (40mE)
97,965,232 Daily total Call Attempt (24 Hours)
1,207,911 Daily Total Traffic (24 hours)
4.761727 Daily SMS traffic
1.13 Dropped call %
5.36 Blocked call %

Every hour somewhere around 200,000 messages goes from 6 smscs

Total MSC 22, HLR 4, BSC 82, BTS 3437, Cells 9673

SS7
OSI layers
7 Applcation layer,
6 Presentation layers
5 Session layer
4 Transport layer
3 Network layer
2 Data link layer
1 physical layer

1 - 3 :MTP & SCCP perform function of 1-3 layer.

MTP provide transport service. The main function is to reliably transfer user part informations
across the SS7 network between SPs without error, in sequence and without duplication. MTP
mange network failures. Further divided into 3 levels performinf different functions. Which
include signalling data link(Level 1 include Electrical & physical attribute on SDL), Signalling
link functions( Level 2 include error control & flow control, MSU LSSU,FISU) , 3 Level divide
into Signalling message handling( Delivering a message from orig node to Dest node via
Signalling link, So routing fuction is performed) and signalling network management( Includes
procedure to maintain when signalling link or point is failed..
ITU series ke Q series reccomendation .

SCCP for non circuit related messages destined for outside home network, SCCP is required
which provide unique global title and translate them to point required PC. Date may be
transmitted as connectionless or connection oriented..
4 - 7 : TC User map related & TC (transaction capabilities) for non circuit related signalling. For
circuit related ISDN, TUP, NUP(National user part), Data user part. All user par has function of
call control protocols.

GPRS : Packet switched high speed mobile data 160 kbit/s. Resources are not reserved for the call. It
packized. GPRS as data channel for SIM updates. Fast Session setup/ Always on line
More efficient use of the air interface as timeslots can be shared among
several users.
Charging can be based on amount of data instead of time
allowing the handset to
stay connected and use the GPRS network only when sending or receiving
information. There is no cost connected to being online, only for data transfer and
temporary loss of connection does not stop downloading of data.
GPRS as bearer for OTA services. GPRS 160k max with certain coding scheme and all 8 TS. In
GPRS mobil are divide in class A, Class B, Class C.
In GPRS BSC contain PCU( packet control unit) and BTS (Channel contril unit), BTS need upgrade
only upgrade software but BSC need software+Hardware
GGSN: SGSN & GGSN connected through IP backbone network. GGSN provide connectivity to
external Packet data network( IP/X.25)IP network OR X.25.

Function of SGSN:
a) Main peer of MS for all GPRS related transactions.
b) With Gs interface it can even forward circuit switched paging towards mobile stations
c) Mobility management in GPRS, Like MSC/VLR in circuit switching, which means GPRS
attach/detach, cell update, Routing areas update.
d) SGSN assign P-TMSI and keep track of subscriber state & location
e) Ciphering & Data compression perform while in GSM TRAU & BTS.
f) CDR generations

Function of GGSN:
a) It‟s also packet switch which Interconnect PLMN tpwards external packet data network.
b) From the perspective of external networks like internet the PLMN look like IP-subnetwork and
GGSN appears to be an IP router.

GPRS supports IP,PPP and IHOSS as packet data protocol(PDP), which PDP are supported depend on
GGSN capabilities. While activating PDP context, MS need to access correct GGSN that may serve
the request. Another option is let SGSN choose the correct GGSN. (Ex 1 GGSN support connection to
ISP, other interconnect PLMN towards internet)

Three states mobile idle state, ready state, standby state . In Ready state no paging is required and
shorten the way to allocate resources. In this state SGSN know serving cell of MS. So no paging
is necessary in downlink. Ready state stays until T3314 timer value, def val=44sec.
MS will move into GMM ready state after having sent an LLC frame via the RLC/MAC protocol.
SGSN will change the GMM state for MS to Ready on receiving LLC frame. MS update it GMM
(GPRS mobility management) context when change its location. PDP context cannot be activated
before a GMM context. So handover decide by MS which has stored algorithm.
Class A mobile : Connected to both GPRS & GSM net simultaneously.
Class B mobile : Can Connected to GPRS & GSM network but not at same time.
Class C mobile : Can be Connected to Either GPRS & GSM net simultaneously
0506368846

EDGE enhanced data rate for GSM Evolution

W-CDMA Wideband CDMA
ANSI American national standardization institute
GERAN GSM/EDGE Radio Access network
UTRAN Universal terristrial Radio access network
WIN Wireless Intelligent network

Digital cellular technologies : 1) GSM

2) TDMA ( Anlalog version name AMPS, Digital AMPS (DAMPS)‟,
which facilitated the ability of handsets to switch between analog and digital operation.

3) PDC : Exclusively in Japan

4) CDMA ( IS-95) CDMAone (also referred to as IS-95), a solution
that Qualcomm introduced in the mid 1990s, picked up toward the end of the decade. CDMA
in general uses digital encoding and spread-spectrum techniques to letmultiple users share the
same channel; it differentiates users‟ signals by encoding them uniquely,
transmitting through the frequency spectrum, and detecting and extracting the users‟
information at the receiving end. CDMA is noted to increase system capacity by about ten to
fifteen times compared with AMPS, and by more than three times compared with TDMA.
The industry recognizes CDMA as a superior air interface technology compared with that
used in GSM/TDMA. However, what makes GSM popular is its international roaming
feature.7

GSM is a typical 2G system in that it handles voice efficiently, but provides limited support
for data and Internet applications. Operators frequently point to GSM penetration levels of
more than 50% in order to justify required investments in 3G licenses, network construction,
and services development.
GSM was destined to employ digital rather than analog technology and operate in the
900 MHz frequency band. Most GSM systems operate in the 900 MHz and 1.8 GHz frequency bands,
except in North America where they operate in the 1.9 GHz band. GSM divides up the radio spectrum
bandwidth by using a combination of Time- and Frequency Division Multiple Access (TDMA/FDMA)
schemes on its 25 MHz wide frequency spectrum, dividing it into 124 carrier frequencies (spaced 200
Khzapart). Each frequency is then divided into eight time slots using TDMA, and one or more carrier
frequencies are assigned to each base station. The fundamental unit of time in this TDMA scheme is
called a „burst period‟ and it lasts 15/26 ms (or approx. 0.577 ms). Therefore the eight „time slots‟ are
actually „burst periods‟, which are grouped into a TDMA frame, which subsequently form the basic
unit for the definition of logical channels. One physical channel is one burst period per TDMA frame.

GSM networks at 900 MHz (GSM 900), and also at the higher 1,800 MHz frequency (DCS
1800)and now 1,900 MHz (PCS).

European Telecommunications Standards Institute (ETSI) was created in order to take

responsibility for specification development from the GSM Permanent Nucleus.

GSM (and its twin system operating at 1800 MHz, called DCS1800)
The ITU, which manages the international allocation of radio spectrum, allocated the 890-915 MHz
bands
for the uplink (mobile station to base station) and 935-960 MHz bands for the downlink (base station to
mobile station) for mobile networks in Europe. “…Since this range was already being used in the early
1980s by the analog systems of the day, the CEPT had the foresight to reserve the top 10 MHz of each
band
for the GSM network that was still being developed.”41 It should be noted that the World Radio-
Communications Conference (WRC) in 1992 identified frequency bands for FPLMTS (Future Public
Land
Mobile Telecommunications Systems), which is in fact the original name of IMT-2000 (UMTS).42
The
existing second-generation bands for second-generation GSM services consist of spectrum between
862 and
960 MHz and the totality of the GSM1800 band 1710 - 1880 MHz.

The ITU, which manages the international allocation of radio spectrum, allocated the 890-915 MHz
bands for the uplink (mobile station to base station) and 935-960 MHz bands for the downlink (base
station to mobile station) for mobile networks in Europe. “…Since this range was already being used in
the early 1980s by the analog systems of the day, the CEPT had the foresight to reserve the top 10 MHz
of each band for the GSM network that was still being developed.”41 It should be noted that the World
Radio-Communications Conference (WRC) in 1992 identified frequency bands for FPLMTS (Future
Public Land Mobile Telecommunications Systems), which is in fact the original name of IMT-2000
(UMTS).42 The existing second-generation bands for second-generation GSM services consist of
spectrum between 862 and 960 MHz and the totality of the GSM1800 band 1710 - 1880 MHz.

A Look Ahead at IMT-2000

3.1 From GSM to IMT-2000
The relationship between 2G and 3G is captured intrinsically in the migration process. The migration to
3Gservices
from 2nd generation systems is a broad topic area, depending on the starting point of the analysis; for
example, CDMA-based systems have a very different road to IMT-2000 than TDMA counterparts.
Such
systems point to „CDMA 2000‟ systems as equivalent to „3G‟, while for TDMA systems (including
GSM),
the Ericsson-proposed W-CDMA standard represents attainment of „3G‟. Interestingly, CDMA-based
carriers believe that their migration path43 will be more inexpensive than that of GSM/TDMA-based
carriers, because many will have only to change channel cards in the base stations and upgrade the
network software as opposed to implementing entire network overlays. In any case, the focus of the
present analysis will remain the path of GSM towards 3G. Enhancements upon 2nd generation GSM
systems include HSCSD (High Speed Circuit Switched Data),GPRS (General Pack Radio Service), and
EDGE (Enhanced Data Rate for GSM evolution) – all of which allow for higher data transmission
rates. (See Figure 3.1 and Table 3.2) The goal of GSM migration is to reach UMTS, which is part of
the ITU‟s „IMT-2000‟ vision of a global family of „third-generation‟ (3G) mobile communications
systems. All of these 2.5 generation systems are now well on their way to development and deployment
– and the question now is which one will be most relevant, versatile, costeffective, and able to cope
with the demands of a complex telecommunications service landscape? Which
system will succeed in effectively offering which services? (See Table 3.1) And, will these „half-steps‟
toward elusive 3G-roll-out pre-empt the need for 3G itself, or just delay its introduction?

3.1.3 EDGE, Enhanced Data GSM Environment

Enhanced Data rates for Global Evolution (EDGE) is a radio based high-speed mobile data
standard thatallows data transmission speeds of 384 Kbit/s to be achieved when all eight
timeslots are used. EDGE does not change much of the core network, however, which still
uses GPRS/GSM. Rather, it concentrates on improving the capacity and efficiency over the
air interface by introducing a more advanced coding scheme where every time slot can
transport more data. In addition, it adapts this coding to the current conditions, which means
that the speed will be higher when the radio reception is good. Implementation of EDGE by
network operators has been designed to be simple, with only the addition of one extra EDGE
transceiver unit to each cell. With most vendors, it is envisaged that software upgrades to the
BSCs and Base Stations can be carried out remotely. The new EDGE capable transceiver can
also handle standard GSM traffic and automatically switches to EDGE mode when needed.
„EDGE-capable‟ terminals are also needed, since existing GSM terminals do not support new
modulation techniques, and need to be upgraded to use EDGE network functionality.
The main idea behind EDGE is to squeeze out even higher data rates on the current 200 kHz
GSM radio carrier, bychanging the type of modulation used, whilst still working with current
circuit (and packet) switches.

IMT-2000 Technology
European UMTS (which stands for Universal Mobile Telecommunications System), falls
within the ITU's IMT-2000 vision of a global family of 3G mobile communication systems. It
includes WCDMA radio access technologies, together with a core network specification
based on the GSM/MAP (Mobile Application Part) standard. As reflective of 3G in Europe
and specifically the focus of this paper in GSM context, UMTS is actually intended to provide
the kinds of data speeds and protocols to allow people with appropriate handsets to access the
Internet, watch movies, exchange large data files and have video conference calls to and from
locations of temporary choice and convenience. The new network, improving upon previously
described shortcomings, has to allow for data traffic, which comes in unpredictable bursts,
voice conversations, which should not be interrupted, and the streaming of large contents like
movies. The goal for 3G is to provide standard facilities good enough for mobile devices to
handle color video. IMT-2000 itself offers the capability of providing value-added services
and applications on the basis of a single standard. The system envisages a platform for
distributing converged fixed, mobile, voice, data,Internet and multimedia services. One of the
key aspects of its vision is the provision of seamless global roaming, enabling users to move
across borders while using the same number and handset. It also aims to provide seamless
delivery of services, over a number of media (including satellite, fixed, etc.). It is expected
that IMT-2000 will provide higher transmission rates than currently possible, i.e., a minimum
speed of 2Mbit/s for stationary or walking users, and 348 Kbit/s in a moving vehicle.

All of the spectrum between 400 MHz and 3 GHz is technically suitable for third generation
mobile.

SS7

In band signaling Signalling carried on same path as voice.

Out band signaling Signalling carried on diiffrent path as voice.

Associated signaling: Allocate one of the path between each interconnected pair of switches as the
signaling link.
Quassi associated sugnalling : Which provide indirect signaling path between network element are
eferred to as providing Quassi associated sugnalling.

SS7 link types: Defined according to there use in the network

A link(Access links) interconnect an STP and either SSP or SCP, which are collectively referred as end
points
C link(Cross link) are link that interconnect matted STP. They are used to enhance the reliability of
signaling network

B link, D link and B/D links interconnecting 2 mated pair of STP. B stands for Bridge describe the
quad of linkjs interconnecting peer pair of STP. The D stand for diagonal and describe the quad of links
interconnecting mated pair of STPs at different hiarchical level

E links are extended links provide the backup connectivity to ss7 network in the event that home STP
can not be reached via A link

SS7 layers
MTP1 : Physical layer carry physical & electrical charreteristic of the signaling link, it usually carry a
rate of 56kbps or 64kbps

MTP2 provide link layer functionality, it ensures that 2 end point of signaling link can reliably
exchange signaling messages. It incorporate such capability as error chcking, flow control, sequence
checking

MTP3 provide network layer functionality, ensure that messages can be delivered regardless of direct
connectivity. It includes such capability as node addressing, routing, alternate routing, and congestion
control

SCCP: a) capability to address application within signaling point, the MTP can only receive & deliver
messages from node as a whole, mtp does not deal with application as whole.
It does GTT translation.
SCCP provide connectionless & connection oriented services

ISDN , it defines the message and protocol used in establishment and tear down of voice & data calls
over PSTN. The ISDN User Part (ISUP) defines the protocol used to set-up, manage and
release trunk circuits that carry voice and data between terminating line exchanges (e.g.,
between a calling party and a called party). ISUP is used for both ISDN and non-ISDN calls.
However, calls that originate and terminate at the same switch do not use ISUP signaling.

TCAP defines the message and protocol used to communicate between application( Subsystem) in
node. It is used for database services such as calling 800. TCAP supports the exchange of non-
circuit related data between applications across the SS7 network using the SCCP
connectionless service. Queries and responses sent between SSPs and SCPs are carried in
TCAP messages. For example, an SSP sends a TCAP query to determine the routing
number associated with a dialed 800/888 number and to check the personal identification
number (PIN) of a calling card user. In mobile networks (IS-41 and GSM), TCAP carries
Mobile Application Part (MAP) messages sent between mobile switches and databases to
support user authentication, equipment identification and roaming.