7.5 Location Management
The remainder of this Chapter is concerned with system aspects: location and roaming
management, and handover.
The terminals of a mobile network are allowed to receive services at every point in the
network where radio signals are received. In principle, this requirement is independent of
which operator is offering the service1. The capability to receive services over a wide
geographic area is usually called roaming. Roaming consists of two elements: a localisation
service allowing the network to know where each mobile terminal is located, and a calling
services allowing the mobile user to make and receive calls at different locations independent
of which operator owns the access point.
Cell Cell Cell Cell
area Cell area Cell
Cell Cell Cell Cell
area Cell area Cell
Figure 7.14 Hierarchical composition of mobile network
Figure 7.14 shows a hierarchical decomposition of a mobile system. This model was
first developed by the ITU in 1980, that is, before GSM was conceived, with the purpose of
deriving a general definition the term location within a system. The model is independent of
the geographic location but defines the coordinates relative to the infrastructure of the system.
The particular coordinate system used in GSM is shown in Figure 7.14. The location of a
mobile terminal is determined from four coordinates: system, operator, location area and cell.
The uppermost construct is the system. This coordinate is usually implicitly
understood. The coordinate represents the whole area in which the mobile terminals can roam.
All the GSM networks worldwide constitute a system in this definition. The GSM system is
homogeneous because the technology is the same everywhere. Future mobile network with
multipurpose terminals capable of accessing GSM, UMTS, WLAN and low-earth orbit
satellites (LEOs) constitutes also a system. This system is technologically heterogeneous
since the same terminal can access different subsystems designed with different technologies.
The next coordinate is the operator. This is related to the ownership of a particular
network within the system. Several operators can offer services in the same geographic area.
The constraint in GSM that a mobile terminal cannot receive services from a competing operator in the same
geographic area is not a technical constraint. The reason is competition and the constraint was introduced in
order to maintain customer relationships by forcing them to use the particular network with which they have
subscription. The users can roam freely between networks that are not competing in the same geographical area.
The restriction may not be applied in new systems because it is counterintuitive to the user.
In the model, these operators have distinctly different system coordinates though their
geographic coordinates are equal.
Each network (or subnetwork) owned by an operator is divided into location areas.
The location areas consist of cells where each cell corresponds to an antenna site (in some
cases just a part of an antenna site). The cell is the finest granularity by which the location of
a mobile terminal can be defined relative to the system.
The purpose of the location area is to allow a coarser granulation of location required
for roaming. The reason is trade-off between different types of traffic load on the radio
system. This trade-off will be explained below.
The location coordinate system is illustrated in Figure 7.15. The coordinates are
written as the triplet operator.location_area.cell (ignoring system). Cells with coordinates
A.1.1 and A.1.2 belong to location area 1 of operator A; the cell with coordinate A2.2 belongs
to location area 2 of operator A; cells with coordinates B.2.1, B.2.2 and B.2.3 belong to
location area 2 of operator B.
The coordinates of a cell are broadcast to the mobile terminals able to receive radio
signals in that cell. The coordinates enable the mobile terminal to determine when it leaves
one cell and enters another. For example, the mobile terminal knows that it entered a new cell
if the coordinate changes from B.2.1 to A.3.1 or from A.3.1 to A.3.2.
Figure 7.15 Location co-ordinates
In the first case, the mobile terminal entered the network of a new operator. In the
second case, the mobile terminal moved from one cell to another within the same location
area. The convention used in GSM is that if the mobile terminal moves from one location area
to another, the change of location must be reported to the network. If the mobile station
moves between cells in the same location area, the location change is not reported. This
means that the change from cell B.2.1 to cell A.3.1 is reported while the change from cell
A.3.1 to cell A.3.2 is not reported.
Before explaining how updating takes place, we have to define the architecture of the
mobile system. The general architecture of mobile systems is shown in Figure 7.16. The
different entities are called by generic names in order to avoid confusion with existing
architectures. The GSM architecture contains these elements but with different names. The
architecture proposed for UMTS is much more complex but all the functions explained here
are included. The elements of this architecture are:
• Subscription database. There is one2 such entity for each operator delivering services to
mobile subscribers. The database contains all information required for handling the
subscription and the related services. The database also contains the location of the mobile
subscriber. There may be operators only offering mobile services without owning any
other infrastructure of the mobile network than the subscription database (virtual mobile
operators). In GSM, this database is called home location register or HLR.
• Local control computer controls service execution and switching in the mobile network.
The database contains the identity of all mobile stations in the location areas it controls. It
may also contain, as in the GSM network, subscription data replicated from the
subscription database (HLR) in order not to request such information for every call event.
This is only a design concern where the trade-off is between the cost of local storing and
replication of data and the cost of making remote database queries for every call. In the
GSM system, the first solution is normally used because it is cheapest; but the latter
solution has been implemented in order to support new services that are not generally
available. The local control computer is called visitor location register or VLR in the GSM
• Switch and base station controller acts both as switch between the fixed network and the
base stations and as resource manager of the base station infrastructure. In GSM, this
function is divided between base station controller (BSC) and mobile-services switching
• Base station offering the radio interface to the mobile terminals.
Figure 7.16 Infrastructure of mobile network
The database can be distributed consisting of several interconnected elementary databases. Therefore, we can
safely say that there is only one such database per operator.
Note that the entities described above are just computers and databases in a distributed
system. They perform a set of functions: information storing, location management, switching
and service control, and access and configuration management. There are additional functions
not included here such as security management, fault management, recording of data for
charging and statistics, and tracing of equipment and users.
These databases and computers in mobile systems must offer important characteristics
that are not common for databases in administrative systems because of extreme real-time
requirements. The subscription database must be able to handle several thousand transactions
per second with response time of 10 ms or less for each transaction. The data must also be
accessible by several database keys, some of which being random.
Figure 7.17 shows how this infrastructure can be used for location updating. The local
control database (VLR in GSM) contains the identity of the user, the current location
coordinate, and possibly some user related service execution data. The identity of the
subscription database (HLR in GSM) is derived from the identity of the user. The subscription
database contains the current location coordinate of the mobile station (coordinate B.2) with
granularity corresponding to location area.
Identity, B.2, all service data
New Identity, A.3, all service data
<identity, A.3.1> Update
registration A.3 Local
Identity, A.3, some service data B.2
Identity, B.2, some service data
Figure 7.17 Location updating
<identity, Provide info
called number> <identity,
Call request Switch network
Figure 7.18 Call from a mobile terminal
In the figure, the mobile terminal detects that it accesses a new base station because
the coordinate information contained in the coordination message received from the base
station changes from B.2.1 to A.3.1. The mobile terminal then sends a message containing the
coordinate of the new cell and its own identity3 to the local control computer. The local
control database stores the new registration and sends the new coordinate (A.3) of the mobile
terminal to the subscription database where it replaces the previously stored coordinate (B.2).
If the new registration is accepted, the subscription database provides the new local control
computer with service execution data for this mobile user. The previous local control
computer is requested to remove the stored location entry. The location coordinate of the
mobile user is then stored in two places: in the control database of the current location area
(VLR in GSM), and in the subscription database of the user (HLR).
Figure 7.18 shows how calls originating in the mobile terminal are handled. The call
processing is simple and does not deviate significantly from that of calls in the fixed network.
The local control computer receives the call request from the mobile terminal and processes
of the call before it is routed into the fixed network. The call processing includes execution of
call restriction such as not allowing calls to certain numbers, nondisclosure of the identity of
the mobile user, and restricted access to the network, for example to a competing network in
the same geographic area. Remember that the subscription database sent the call processing
information to the local control computer during location updating.
Note that the public identity may not be sent but an encrypted version of it or a temporary identity as in GSM.
This will prevent that anyone can trace the caller by intercepting to the radio communication.
Figure 7.19 Call to a mobile terminal
Figure 7.19 shows a call originating in the fixed network. The network exchange (in
the fixed network or in a mobile network) recognising that this is a call to a mobile user
requests the subscription database to provide routing information (the message provide
routing information <number>). The routing information must be such that the network can
route the call to the local control computer in charge of the current location of the user. This
capability is constrained by the numbering used in different networks. In the telephone
network, the routing address must be a telephone number; in the Internet the routing address
must be an IP number. The coordinate indicating the location is meaningless as a routing
address in these or other networks.
The problem was solved in the GSM system in the following way. When the request
arrives at the subscription database (HLR), the database uses the stored location coordinate to
identify which local control computer (VLR) is in charge of the location area. This computer
is then requested to allocate a routing number to the call (the message provide info). The
routing number is called roaming number in GSM. Having received the roaming number, the
subscription database forwards the roaming number the exchange requesting the routing
information. The number is then used by this exchange to forward the call to the destination.
In GSM, this roaming number exists until the call has been established (duration of the order
of a second). If the call is not established for some reason, the allocation of the roaming
number is removed after about one minute. Roaming numbers can then be reused frequently
so that only a small number of them need to be allocated to each VLR.
A similar method is used for allocation of temporary IP addresses (care-of address) in
the mobile IP system. The resemblance with the GSM is striking, except that the care-of
address is allocated for the time the terminal is in its new location. The reason for quasi-
permanent allocation of care-of addresses is that the IP service is connectionless requiring that
the full address of the termination is included in each datagram. If a new address had to be
allocated for each dagram by the remote server, this would have resulted in a very inefficient
communication system requiring much time and much network resources for delivering one
datagram. In stead, the remote server allocates the care-of address for the time the terminal is
registered in the remote server and announces this address to the home server of the terminal.
Datagrams are then sent to the home server. The home server inserts the complete datagram in
the information field a new IP datagram containing the care-of address as routing address. The
remote server then retrieves the original datagram and delivers it to the terminal. This
procedure is called tunnelling.
Quasi-permanent allocation of the routing address was not done in the GSM system
for particularly two reasons. First, two telephone numbers had then to be allocated at all time
to each mobile user, that is, one invariant number identifying the user and the subscription,
and one roaming number identifying the location of the terminal. Second, the restart of a VLR
computer could easily cause numbering confusion since a roaming numbers has to be
allocated whenever the terminal enters a new area, and removed when the terminal leaves this
area. Previously used roaming numbers must be reallocated to new terminals entering the area
in order not to waste too many numbers. This represents a particular problem in GSM because
the time a terminal spends within a location area can be very short, requiring frequent location
updating. The relationship between roaming number and the real identity of a terminal is
therefore a very dynamic one. If a failure of one of the databases occurs, the database is
restarted automatically with location data read from a data dump to a backup storage device at
previous instant. The data dump takes place at regular intervals, e.g., every 15 or 30 minutes.
Because of the dynamics of the mobile units, the location information may have changed
considerably from one data dump to the next and the probability that calls are routed to the
wrong user becomes significant.
The solution developed for call handling in the GSM system is similar to that of the
intelligent network (IN) developed by Bellcore during the same period. The development of
GSM and IN were independent but the motives were the same, that is, providing efficient
routing for calls with nongeographic addresses, and remote processing of switching and
Handover4 is also an aspect of roaming. In small-cell systems, the likelihood that a mobile
terminal is leaving one cell and entering another during conversation is high. If it is not
possible to hand over the call from the first cell to the next, the call will be interrupted.
Handover is, as the terminology suggests, the mechanism that ensures that calls are handed
over from one cell to another in order to ensure continuity of the conversation. Handover was
developed already for the first-generation systems in order to avoid this problem. It is an
essential procedure in all land mobile systems. It is also an essential procedure for satellite
systems using low-earth orbit (LEO) satellites since the time each such satellite is visible
above the horizon is less than ten minutes.
The components of the system (mobile terminal, base station and so on) must perform
a number of tasks in order to perform the handover:
• Establishment of the handover criterion by monitoring the quality of the signals received
from different base stations, that is, determination of when and to which new cell
handover should take place.
• Rearrange the access and network resources in order to establish the new connectivity.
• Perform fast switchover in order to avoid that the connection is interrupted or prematurely
Usually called handoff in the USA.
Figure 7.20 Determination of handover criterion
The mechanisms required for implementing handover are different in different
systems. In NMT, the base station determines when handover shall take place; in GSM, the
mobile terminal detects when handover is required. The criterion used in land mobile systems
can be based on measuring the received signal level, the signal-to-noise ratio, the bit error rate
and the distance from the base station5. The handover criterion used in LEO systems can be
the combination of high bit error rate and low elevation angle of the satellite. Handover then
takes place when the elevation angle is below a certain lower limit or if the received signal
power drops below a certain level.
Figure 7.20 shows the handover method used in GSM. The mobile terminal
determines both when handover shall take place and to which base station the call shall be
handed over. In the figure, the terminal is located in area where it receives signals from cells
B.2.1, B2.2 and A.3.1, where B.2.1 etc are the cell coordinates defined above. The mobile
terminal undertakes comparative measurements (power level and bit error rate) of the signals
received from the different base stations and determines the preferred handover candidate
from these measurements. Preferably, the handover should be between cells in the same
location area, that is, from B2.1 to B.2.2. If this is not possible, the mobile terminal chooses a
base station in another location area (A.3.1).
A TDMA system such as GSM must be synchronised. The way this is done in GSM establishes limits to how
far from the base station a mobile terminal can synchronise to the frame pattern. This limit is about 35 km in
GSM. For this reason, handover must take place even if the received signal level is well above the receiver
Signalling link 70
Figure 7.21 Just before handover
Since GSM is a TDMA system, the mobile terminal can use the time between frames
to perform measurements on adjacent cells. Each base station also broadcast the cell
coordinates and the channel arrangement of adjacent base stations in order to facilitate the
measurements required for taking the proper handover decision.
The next step is then to perform the handover. Figures 7.21 and 7.22 show the case
where handover takes place between base stations in different location areas. Handover may
also take place between base stations in the same area. In both cases, the procedure is the
same on the radio path but the procedures in the network are different.
The bold full lines show the speech connection6; the bold dotted lines indicate control
channels (or signalling channels).
Suppose that the mobile terminal has found that handover from cell B.2.1 to cell A.3.1
is required. The mobile terminal then requests the local control computer of cell B.2.1 to
initiate the handover. The local control computer of cell B.2.1 requests cell A.3.1 to allocate a
new channel for the call and prepare it for the following handover activity. When this is done,
the local control computer establishes a connection between the exchanges of cells B.2.1 and
A.3.1 and reserves it for the call to be handed over. The connection is extended all the way to
the radio interface in cell A.3.1. The connection is established in the usual way using
resources in the fixed network. When all this has been completed, the base station in cell
B.2.1 signals to the mobile terminal that the call can be handed over to the radio channel
assigned for it in cell A.3.1. As soon as the call is established in cell A.3.1, the radio
connection in cell B.2.1 is released. The resulting connection is shown in Figure 7.22. The
new speech path is complex. However, the major points are:
A data connection will have the same configuration.
Figure 7.22 After handover
• The call control is retained in the control computer of the original cell (B.2.1). This means
that service information and call states are not transported from one computer to another
during the conversation. That process would have been tremendously complex and
difficult to develop further for new versions of the system. Subsequent signalling between
the mobile terminal and the network is between the mobile terminal and the control
computer of cell B.2.1. The exchange of cell A.3.1 is only a passive relay remotely
connecting base station A.3.1 to the control computer of cell B.2.1.
• Not more than two mobile-services exchanges will be involved in the call. If the mobile
terminal moves on to a cell connected to yet another mobile-services exchange (say,
A.4.5), a connection will be established between the original exchange and the new
exchange in the same way as just described. The connection to the exchange of A.3.1 is
released because this exchange is no longer needed in the connection. If the mobile
terminal moves back to the original location area, the handover will again result in the
configuration as shown in Figure 7.21.
If handover takes place within one location area, the exchange simply switches the call
from the outlet to one base station to the outlet to another base station.
The handover procedure just described was developed by the ITU in 1980 in the first
effort to specify an international land mobile system. The principle is implemented in the
GSM system and the UMTS system.
7.7 General Mobility
We have still not answered the essential question: what is mobility? Radio-mobile systems as
described above offer terminal mobility. GSM and UMTS also offers continuous mobility
since the location updating procedure and the handover procedure together offer access to and
continuity of services everywhere.
Mobility may also be discrete. One obvious example is the use of payphones or
telephones owned by third parties, that is, to move from one apparatus to another. The
problem with this type of mobility is that the user does not get access to his or her services.
This capability is, however, not what we understand by mobility.
Another example is to move a PC from one ISDN plug to another. If the user is a
member of a local area network, he or she may gain access to services by calling the
destination number of the local area network. This type of mobility is called discrete mobility
because it is only available at certain locations. The user may not move the PC at all but
employ any suitable PC in the location where he or she is, dial up the local area network and
log in remotely as user. This is called personal mobility. Management of home offices is an
example of discrete and personal mobility. Discrete mobility means in this case that the same
PC can be connected both at work and at home; personal mobility means that the person may
move between different PCs, one at home and one at work. It is often a problem to offer
discrete and personal mobility because of protection systems such as firewalls. This is
particularly difficult if mobility takes place across firewalls since one screening mechanism is
to restrict access depending on the IP number of origin.
The user may also move active applications or sessions from one computer to another.
Sessions may be suspended at one place and resumed at another. This is called application
mobility or session mobility.
User User profile
Application Application parameters
Terminal Terminal capabilities
Network access point Network characteristics
Interfaces that may be mobile
Figure 7.23 Relationships across mobile interfaces
Note that terminal mobility, personal mobility, application mobility and session
mobility may be continuous or discrete. The user referred to in these concepts may be a
physical device, a software program or a human being.
Figure 7.23 shows the relationships that may exist between the different entities. The
philosophy is as follows. The user (in this case a person) “owns” the application, which can
be e-mail, voice mail, file management, database management and executable programs.
The user has a user profile stored in a database somewhere. The user profile can be
simple or complex depending on the system and services required. Typical elements of a user
profile can be private address directories, service options, access control information related
to these services and to management information, charging and usage conditions, and security
management. In GSM, the profile is stored in the home location register (HLR). In local area
networks the information may partly be stored in the user’s PCs and in servers such as e-mail
server, firewall, directory server and file server.
The application (e.g., Microsoft Office, Internet, e-mail) is run in accordance with
parameters stored in a server in a local area network or in the local PC. Every application is
run on a terminal, for example a PC, offering a set of capabilities. Some of the terminal
capabilities are stored in the PC; other capabilities are stored in the server to which the PC is
connected. Finally, the PC is connected to a network access point (the socket in the wall). The
access point has some characteristics that must be stored somewhere. Such characteristics
include physical address, data rate and protocol.
In principle, the interfaces shown in the figure can be mobile interfaces of some kind.
The user may move between PCs. The PC may be connected at different access points at
different times. The network access point can be an access point in a land mobile system.
Land mobile systems with this degree of flexibility are UMTS and WLANs. The full
exploitation of mobility requires dedicated software that takes care of the different types of
mobility independently of the applications running in the system. One way of achieving this is
to develop a middleware offering a mobility independent interface toward the applications
and a machine dependent interface toward the operating system of the computer. Still such
middleware does not exist but it is required in order to support peer-to-peer communication
and communication between sensors, control systems and actuators.