Hi..... Add 4G parameters in tems window|| https://www.youtube.com/watch?v=FmKi0O9dWpQ&t=3s Training of 2G+3G+4G ON TEMS https://www.youtube.com/watch?v=F2Ly5n4S8Xs Like subscribe and share

1. 2G (GSM)
PARAMETERS AND EVENTS
DESCRIPTION
BY-ANKUR TOMAR

2. GSM:-
GLOBAL SYSTEM FOR MOBILE
COMMUNICATION

3. HANDOVER
“When MS jump from source cell to target cell
without call drop is called handover”.
Source cell
 BCCH ARFCN: 661
 BSIC: 6-1
Target cell
 BCCH ARFCN: 696
 BSIC: 7-7

4. EVENT PRACTICAL VIEW

5. MISSING GSM NEIGHBOR, GSM SYMMETRY
“ Source cell not in target cell's neighbor list”.
 Missing Neighbor Detected.
 Serving cell ARFCN: 695 BSIC: 2-1
 Missing neighbor ARFCN: 699 BSIC: 4-0

6. MISSING NEIGHBOR VIEW

7. HANDOVER FAILURE LAYER 2 FAILURE
 HANDOVER IS NOT DEFINED .
Source cell
 BCCH ARFCN: 658
 BSIC: 3-0
Target cell
 BCCH ARFCN: 697
 BSIC: 7-3

8. H.O. FAILURE VIEW

9. H.O. FAILURE REASON
 Check UE power control parameter is
setup properly, Handover failure is
mainly due to missing neighbor and
if the cell is targeted, kindly check
also the a1 events. kinly add
reputation .
 it is not congestion issue

10. H.O. FAILURE REASON
 1. RF Interference at the target cell
2. tight reuse of the same pair of BSIC and
BCCH ARFCN
 3. Same frequency but different BSIC, but
same BCC may also cause handover failure
 4. Synchronisation Problem
 5. different ciphering settings between 2 cells
which belong to 2 different MSCs/BSCs if you
have ciphering enabled.

11. H.O. FAILURE REASON
 6. DL and UL unbalance, for example, TMA, DL signal is
strong but UL signal is weak, this will cause handover
failure
7. Too high BTS output power, too low MS power setting.
 8. Lower power on TCH than on BCCH in target Cell Check
power parameter setting.
 9. low/incorrect handover power level in the HANDOVER
COMMAND so target cell can't detect the handover access
message
10. target cell problem that didn't send the physical
information for non-synchronized handover.

12. DROP TYPE: RE-ESTABLISHMENT FAILURE
 MM Cause: Call cannot be identified
 Call duration: 88986 ms
 BCCH ARFCN: 697
 BSIC: 2-2
 CGI: 404 04 118 25242
 Call Direction: MO
 Call Domain: Circuit Switched
 Call Index: 1
 Call Failure MO

13. CAUSES OF DROPPED CALL IN GSM
1) POOR DL COVERAGE:
 Last best server Rxlev_Sub is below
user defined Rxlev Threshold
2) DL Interference:
Last best server RxqualSub is below user
defined Rxqual Threshold
3) RL Timeout goes down

14. CAUSES CALL DROPS?
 Inadequate coverage which can be due to multiple
reasons
 Lack of tower infrastructure
 Improper network planning
 Non-optimization of network
 Overloaded cell towers – number of subscribers
are growing day by day and most of them are on
smartphones. The network capacity is simply not being
ramped up at the same pace resulting in overloaded
networks

15. CAUSES CALL DROPS?
 Cityscape changes – there have been instances where a
new multistoried building comes up and the adjacent building’s
subscribers lose cell reception. Such instances are very common with
rapidly changing cityscapes and call for routine network data analysis
from service providers.
 Switching between towers – this situation occurs when a
person is traveling or moving around while talking. If a call handover
takes place from one BTS to another, especially in case of overloaded
networks, there are chances of dropped calls.
 Technical Failures – this is beyond anyone’s control and
operators generally monitor downtimes through well-equipped network
operation centers

16. FREQUENCY BAND
Initially 900MHz spectrum was
used, but later GSM was
introduced on an 1800MHz band

17. SWITCHING TECHNIQUES
only circuit-switched networks.

18. 2G-TEMS WINDOWS
 GSM RADIO PARAMETER
 GSM CURRENT CHANNEL WINDOW
 GSM SERVING+NEUGHBORS WINDOW
 LAYER 2 MESSAGE
 EVENTS
 MAP
 GPS

26. RADIO PARAMETERS
 Rxlev: Receiving signal strength
 Range-(0 to -120)dbm

27. RXQUAL
 Voice Quality:
 Range: 0 t0 7
 Subranges:

28. ARFCN BCCH
 Absolute radio frequency channel number.
 Broadcast control channel.
 ARFCN is a unique number given to each radio channel in
GSM.
 The ARFCN can be used to calculate the exact frequency of
the radio channel.
 Within the GSM900 band ARFCN 1 to 124 are used. In the
GSM1800 band ARFCN 512 to 885 are used.

29. BSIC
 The base station identity code (BSIC), is a
code used in GSM to uniquely identify a base
station. The code is needed because it is
possible that mobile stations receive the
broadcast channel of more than one base
station on the same frequency
 This is due to frequency re-use in a cellular
network..

30. BSIC=NCC+BCC
 The BSIC consists of 6 bits of which the first three identify
the network (Network Colour Code, NCC). The other 3 bits
are used by the operator to uniquely identify base stations
within a certain area.
 As long as base stations use different frequencies for their
broadcasting channel, there is no problem in using the same
Base Station Identity Code.
 Unique identification of a base station is especiallly
important in border areas, where at both sides of the border
there is a different operator who might use the same
broadcasting channel on the same frequency.

31. BSIC=NCC+BCC
 In GSM system, each BTS is allocated with a color code,
which is called BSIC. MS can identify two cells with the
same BCCH by the help of BSIC. In network planning, effort
should be made to make sure that BCCH of neighbor cells
are different from the serving cell’s BCCH to reduce the
interference.
 Practically it is still possible that a same BCCH is re-used in
the surrounding cells. For cells using the same BCCH in a
relevant near distance, their BSIC must be different so that
MS can identify two neighbor cells with same BCCH.
 BSIC is transmitted on Synchronous Channel (SCH) of each
cell.

32. USEFUL FULL FORMS
 BTS=BASE TRANSCEIVER STATIO
 MS=MOBILE STATION
 CGI=CELL GLOBAL IDENTITY
 MCC=MOBILE COUNTRY CODE
 MNC=MOBILE NETWORK CODE
 LAC=LOCATION AREA CODE
 CI=CELL IDENTITY

33. CI=CELL IDENTITY
 A GSM Cell ID (CID) is a generally unique
number used to identify each base
transceiver station (BTS) or sector of a BTS
within a location area code (LAC) if not within
a GSM network.

34. CI-CELL IDENTITY
 CI is composed of 16 bits, The available range is
0~65535
 Cell Identity (CI) is one part of Cell Global Identity
(CGI), transmitted in system information of each
cell.
There is generally no restriction for the allocation of
CI. Value from 0 to 65535 (decimal) can be obtained.
But it should be ensured that one location area
cannot have two cells with the same CI.

35. CI-CELL IDENTITY
 CI is usually determined in the network design.
Except for some special cases, CI value should not
be changed during the operation of the system.
 Please note that one location area is not permitted
to have two or more cells using the same CI.
 CI on MSC should be the same as that on BSC.
Otherwise, MS cannot make calls in this cell.

36. FER=FRAME ERROR RATE
 Frame Error Rate (FER) measurement is
used to test the performance of a mobile
station's receiver.

37. GSM TRAFFIC CHANNEL
 Full rate speech(TCH/FS). AND
 Half rate speech(TCH/HS).
 Traffic channel in GSM carry user speech
OR Data in other technology.
 Traffic channel used both in the uplink and
downlink after mobile has established
connection with the GSM cell (BTS).

38. GSM TRAFFIC CHANNEL
 TCH/FS stands for traffic channel at Full rate
speech. And
 TCH/HS stands for traffic channel at half rate
speech.

39. TCH/F AND TCH/F
 TCH/FS channel carrying full rate speech
digitized at 13kbps data rate. After channel
coding is applied the rate becomes 22.8kbps.
 TCH/F9.6, TCH/F4.8 and TCH/F2.4 channels
carry data at the speed of 9.6kbps,4.8kbps and
2.4kbps respectively. All these channels after
channel coding is applied is converted to data
rate of 22.8kbps.

40. TCH/HS
 TCH/HS is also defined which is used to
carry half rate speech information. The main
purpose behind this is to support two calls in
one gsm time slot and hence it helps double
the traffic channel capacity of a GSM cell.
Two half rate TCH channels use one physical
channel.

41. GSM TRAFFIC CHANNEL CONFIGURATION

42. SPEECH CHANNEL (TCH/FS) PROCESSING
 Traffic channel carrying speech signal is processed
through Low pass Filter(LPF), ADC, Speech
encoder, Rate-1/2 Convolutional Encoder ,
Interleaver , ciphering and packed into 4
consecutive normal bursts before being passed
through differential encoder and GMSK modulator.
The modulated signal is later processed through
RF device and transmitted into the air. For more
detail explanation refer following link on GSM
physical layer.

43. CONTROL CHANNEL
 • GSM BCCH(Broadcast Control Channel)
• GSM FCCH(Frequency Correction Channel)
• GSM SCH(Synchronization Channel)
• GSM RACH(Random Access Channel)
• GSM PCH(Paging Channel)
• GSM CCCH(Common Control Channel)
• GSM FACCH(Fast Associated Control Channel)
• GSM SACCH(Slow Associated Control Channel)
• GSM SDCCH(Standalone Dedicated Control Channel)
• GSM TCH(Traffic Channel)
• GSM AGCH(Access Grant Channel)

44. ACCESS GRANT CHANNEL(AGCH).
 AGCH is the channel from the network to the
Mobile Subscriber (MS) in the downlink
of GSM system.
 It carry information by which mobile will
determine whether the access to the network
has been allowed or denied.

45. ACCESS GRANT CHANNEL(AGCH).
 It provides very useful information about which
TCH/SDCCH channels mobile need to use further
during communication with the network.
 It uses normal burst for mapping the AGCH
information as shown in the figure. In the 51 frame
multi frame structure, first two time slots (TS0) in
consecutive TDMA frames are occupied for FCCH
and SCH and this repeats every 10 frame. The next
four are reserved for BCCH and rest by CCCH
(AGCH/PCH).

46. ACCESS GRANT CHANNEL(AGCH).
 The structure where CCCH (AGCH/PCH)
and SDCCH/SACCH maps vary based non-
combined configuration and combined
configuration (Low capacity cell and high
capacity cell).

47. BROADCAST CONTROL CHANNEL
 It is the downlink only signalling channel
carrying following information to mobiles
segregated to different SI messages called
as System Information messages.
 This is the very critical of all control channels
and transmitted/broadcasted to all the
Mobiles in the cell.

48. BROADCAST CONTROL CHANNEL(BCCH)
 It is transmitted in 51 frame multi frame
structure in frame next to SCH on TS0. It
requires at least 4 consecutive TDMA frame
to carry complete BCCH information. If
needed next four frames are also used for
the purpose.

49. BROADCAST CONTROL CHANNEL(BCCH)
 Base Station continuously broadcasts critical system
information (SI) messages. When frond-end synchronization
is completed mobile reads these informations which helps
mobile determine whether it can camp on to this GSM cell or
not and also helps access the GSM network. Some of the SI
messages are mandatory and some are optional to be
transmitted. There are also some SI messages which are
transmitted using SACCH channel. To know more on SI-
1,SI-2,SI-2bis,SI-2ter, SI-3,SI-4,SI-7,SI-9,SI-13,SI-16 and
SI-17 message content follow link mentioned below.

50. BROADCAST CONTROL CHANNEL(BCCH)
 System information messages are transmitted on either
BCCH normal or BCCH extended or on SACCH.
 SI messages are transmitted in TC=0 to 7 in a cyclic order
repeating every eight TCs of the 51 frame multi frame. TC is
the sequence number of the 51 frame MF.
SI1 to SI4 - Transmitted on BCCH
SI5 / SI6 - associated with SACCH
SI7 / SI8 -BCCH Extended
SI-2quater and SI13 - BCCH Normal or BCCH extended

51. BROADCAST CONTROL CHANNEL(BCCH)

52. SDCCH(STANDALONE DEDICATED CONTROL CHANNEL)
 SDCCH is a signalling channel exist
between GSM Mobile and GSM BTS.
 This SDCCH channel exist independent of
whether TCH exist or not.
 It always exist and no frame stealing is
needed here.

53. SACCH(SLOW ASSOCIATED CONTROL CHANNEL)
PAGE-1
 SACCH is available always between Mobile
and Base station(BTS) in GSM when a
dedicated traffic link is active.
 In the full rate traffic channel case, one
SACCH burst appears once in every 26
frame multi frame structure.

54. SACCH(SLOW ASSOCIATED CONTROL CHANNEL)
PAGE-2
 It takes four bursts to transmit complete SACCH
information in four consecutive 26 frame MF.
 It takes about 480ms.
 One 26 frame MF is of duration 120ms.
 Slow Associated Control Channel is called as
"associated" as this channel is always associated
with either TCH or SDCCH.

55. SACCH(SLOW ASSOCIATED CONTROL CHANNEL)
PAGE-3
 It also maps on the same physical
channel(T0,F0) as TCH/SDCCH.
 T0 is time slot and F0 is frequency.
 In the downlink, SACCH is used to convey
transmit power level control instructions and
timing advance information to the GSM
mobile.

56. SACCH(SLOW ASSOCIATED CONTROL CHANNEL)
PAGE-4
 In the uplink, SACCH carries received signal
strength, TCH quality information and
measurement report of neighboring cells etc.
 GSM mobile carry signaling information
using SACCH, while being connected with
BTS during call flow.


57. SACCH(SLOW ASSOCIATED CONTROL CHANNEL)
PAGE-5
 SACCH reports neighbour cell information
such as signal level to the serving cell which
helps make handover decision.

58. SACCH(SLOW ASSOCIATED CONTROL CHANNEL)
PAGE-6

59. SACCH(SLOW ASSOCIATED CONTROL CHANNEL)
PAGE-7
 Figure depicts GSM SACCH data processing
through physical layer.
 As shown 184 bits are SACCH information is
first passed through fire codes.
 This fire coder will add 40 parity bits resulting
into 224 fire coded bits, after which 4 zero tail
bits are added to form 228 bits.

60. SACCH(SLOW ASSOCIATED CONTROL CHANNEL)
 The second module in SACCH processing is
1/2 rate convolution encoder of two
polynomials.
 This makes 456 coded bits.
 The block interleaver is used after C.E. which
results into interleaving over all four bursts.

61. SACCH(SLOW ASSOCIATED CONTROL CHANNEL)
 Hence total 456 of information is carried by
consecutive four bursts after
encryption(cyphering) is applied.
 As mentioned SACCH carry TA(Timing
advance), MS PC (Mobile Station Power
control) and measurement response.

62. RACH(RANDOM ACCESS CHANNEL)
 This channel RACH is used by Mobile to
access the GSM network during call set-up
time.
 Access burst is used for mapping RACH
information.
 Whenever mobile wants to make a MO call it
schedules the RACH.

63. RACH(RANDOM ACCESS CHANNEL)
 here is a probability that two or more mobiles
transmit at the same time and their
transmissions collide in the medium(air) and
they will not be granted access to the
network.
 This happens because limit for no. of mobiles
transmitting in one RACH time slot is not
defined in the GSM standard.

64. RACH(RANDOM ACCESS CHANNEL)
 If collision happens then mobile waits for
random period of time and transmits the
RACH again. This waiting time is also
random.
 RACH uses GSM 51 frame multiframe
structure in the uplink to transmit information.

65. RACH(RANDOM ACCESS CHANNEL)
 Mostly TS1 is used but in high capacity GSM
cell areas, TS2,TS4 and TS6 is also used for
RACH leaving TS0(mainly used for
broadcast frequency).

66. RACH(RANDOM ACCESS CHANNEL)
PROCESSING

67. RACH(RANDOM ACCESS CHANNEL)PROCESSING
 RACH channel is used by mobile to obtain
GSM network access.
 The figure depicts RACH channel processing
through the physical layer.

68. PCH(PAGING CHANNEL)
 PCH refers to paging channel.
 Mobile in idle mode monitors PCH for paging
continuously and check for its address.
 It is mainly used by network to page or alert
mobile for mobile terminated call from
another calling mobile.

69. PCH(PAGING CHANNEL)
 In the slotted mode, PCH is grouped into
paging sub blocks.
 Here Mobile listens as per assigned paging
sub blocks from network and goes to sleep
mode during rest of the time.
 Normal burst is used for PCH information
mapping.

70. PCH(PAGING CHANNEL)

71. FACCH(FAST ASSOCIATED CONTROL CHANNEL)
 FACCH is used both in uplink as well as
downlink.
 FACCH is used to exchange information
between GSM Mobile Station(MS) and Base
Transceiver Station(BTS) more quickly than
possible with SACCH.
 FACCH information message can easily be
transmitted in 20 ms duration, as used by traffic
channel(TCH).

72. FACCH(FAST ASSOCIATED CONTROL CHANNEL)
 SACCH usually is trasmitted once every 26
frame and hence if fast information to be
conveyed than FACCH is employed.
 One signalling block of FACCH replace one
TCH speech block.
 In case higher data rate is required, TCH
time slot is usually stolen to be used by
FACCH.

73. FACCH(FAST ASSOCIATED CONTROL CHANNEL)

74. FACCH(FAST ASSOCIATED CONTROL CHANNEL)
 The figure depicts FACCH channel
information through the physical layer.

75. COMMON CONTROL CHANNEL(CCCH)
 CCCHs(Common Control Channels) are
used for conveying information from network
to the Mobile Subscribers(MSs) and provide
access to the Mobile Subscribers.
 GSM CCCHs include PCH,RACH,AGCH and
CBCH.

76. FREQUENCY CORRECTION CHANNEL(FCCH)
 It is a downlink channel.
 FCCH carry continuous wave signal which
helps mobile find the frequency offset
between BTS and MS.
 Information here in this burst is all zeros
which produces continuous sine wave of
about 67.7 KHz above the RF carrier centre
frequency.

77. FREQUENCY CORRECTION CHANNEL(FCCH)
 This FCCH channel uses FB for transmission.
 GSM FCCH (Frequency correction channel)
uses 51 frame multi frame structure transmitted
on broadcast GSM frequency.
 In 51 frame multi frame, it occupies first time
slot TS0 and repeats transmission once in 10
TDMA frames.

78. SCH(SYNCHRONIZATION CHANNEL)
 Once the Mobile is frequency synchronized
with BTS, it need to be time synchronized
which is done using GSM SCH transmitted
by BTS in downlink.
 SCH stands for synchronization channel.
 It uses SB (synchronization burst).

79. SCH(SYNCHRONIZATION CHANNEL)
 SCH carry frame number and BSIC (Base
Station Identity Code) which helps Mobile
synchronize with GSM frame structure as
well as helps in identification of the Base
station in the GSM network.
 SCH is carried in 51 frame multi frame
structure and it follows the FCCH in the GSM
TDMA frame.

80. SCH(SYNCHRONIZATION CHANNEL)
 SCH carries 25 bits of information divided
into 19 bits of reduced frame number and 6
bits of BSIC.
 6 bits of BSIC consists of 3 bits of BCC
(Base station Color code) and 3 bits of NCC
(Network Color code).

81. SCH(SYNCHRONIZATION CHANNEL)

82. SCH(SYNCHRONIZATION CHANNEL)
 25 bits of SCH information is added with 10 bits of CRC
which gives 35 bits.
• 4 tail bits of all zeros are added to 35 bits which gives total
39 bits of uncoded data.
• This 39 bits of data are fed to the rate 1/2 convolutional
encoder to produce 78 bits of coded data.
• This gets easily fits into information field of
Synchronization burst(SB) and no interleaving is performed
on this set of data.
• This SB is modulated and transmitted over the air from
BTS to GSM Mobile or UE(User Equipment).

83. MO MT CALL FLOW IN GSM.
 Mobile originated (MO) call flow between
Mobile(UE) and network.
 covers messages exchanged between Layer
3 entities(RR,MM,CC) at both side.
 It include
channels(RACH,AGCH,SDCCH,FACCH,TC
H) used at layer 1 to carry these messages
over the air.

84. MO MT CALL FLOW IN GSM.
 Initial frequency and time synchronization is
done between UE and Network

87. MO MT CALL FLOW IN GSM.
 Mobile terminated call flow between
Mobile(UE) and network.
 It covers messages exchanged between
Layer 3 entities(RR,MM,CC) at both side.
 It include
channel(PCH,RACH,AGCH,SDCCH,FACCH,
TCH) used at layer 1 to carry these
messages over the air.

90. PACKET SWITCHED DATA CALL IN GSM DOWNLINK(PS CALL FLOW)
 PS (Packet Switched) call flow between
Mobile(UE) and network for downlink(to
download data).
 It covers messages exchanged for GPRS
attach and PDP context activation
procedures between mobile and
SGSN/VLR/HLR/GGSN.

91. PACKET SWITCHED DATA CALL IN GSM DOWNLINK(PS CALL FLOW)
 It include
channels(PPCH,PRACH,AGCH,PDCH) used
at layer 1 to carry various messages over the
air.

93. PACKET SWITCHED DATA CALL IN GSM UPLINK (PS CALL FLOW)
 PS call flow between Mobile(UE) and network for
uplink(to upload data).
 It covers messages exchanged for GPRS attach
and PDP context activation procedures between
mobile and SGSN/VLR/HLR/GGSN.
 It include channels(PPCH,PRACH,AGCH,PDCH)
used at layer 1 to carry various messages over the
air.

95. CIRCUIT SWITCHING
 In circuit switching network dedicated
channel has to be established before the call
is made between users.
 The channel is reserved between the users
till the connection is active.
 For half duplex communication, one channel
is allocated and for full duplex
communication, two channels are allocated.

96. CIRCUIT SWITCHING
 It is mainly used for voice communication
requiring real time services without any much
delay.

97. CIRCUIT SWITCHING
 As shown in the figure 1, if user-A wants to
use the network; it need to first ask for the
request to obtain the one and then user-A
can communicate with user-C.
 During the connection phase if user-B tries to
call/communicate with user-D or any other
user it will get busy signal from the network.

98. PACKET SWITCHING
 In packet switching network unlike CS
network, it is not required to establish the
connection initially.
 The connection/channel is available to use
by many users.
 But when capacity or number of users
increases then it will lead to congestion in the
network.

99. PACKET SWITCHING
 Packet switched networks are mainly used
for data and voice applications requiring non-
real time scenarios.

100. PACKET SWITCHING
 As shown in the figure 2, if user-A wants to send
data/information to user-C and if user-B wants to
send data to user-D, it is simultaneously possible.
 Here information is padded with header which
contains addresses of source and destination.
 This header is sniffed by intermediate switching
nodes to determine their route and destination.

101. GSM PART-2
BE CONTINUED…..
Thank you
By-ANKUR TOMAR

102. 2G-GSM
PART-2

103. GSM TUTORIAL
 Network Architecture
 Network Elements
 System specifications
 Applications,
 GSM burst types
 GSM frame structure or frame hierarchy
 GSM mobile phone network entry or call setup
or Power ON procedure

104. GSM TUTORIAL
 VAMOS
 AMR
 MSK/GMSK modulation
 physical layer,
 protocol stack
 mobile phone basics
 RF planning
 PS call downlink and PS call uplink.

105. GSM INTRODUCTION
 GSM is the short form of Global System for
Mobile Communications.
 It is called 2G or Second Generation
technology.
 It is developed to make use of same
subscriber units or mobile phone terminals
throughout the world.

106. GSM INTRODUCTION
 There are various GSM standards such as
GSM900, EGSM900, GSM1800 and GSM
1900; they mainly differ based on RF carrier
frequency band and bandwidth

107. GSM NETWORK ARCHITECTURE
 GSM network consists.
1- Mobile station.
2- Base station subsystem.
3- Network and operation subsystem.

108. GSM NETWORK ARCHITECTURE

109. GSM NETWORK ARCHITECTURE
 Mobile Station- This Mobile station is GSM
mobile phone equipment which houses
DSP,RF chip and SIM(subscriber Identity
Module). This SIM is enough to carry to avail
the service of GSM network. SIM contains
subscriber related all the information,
network with which subscriber is subscribed
with and encryption related information.

110. GSM NETWORK ARCHITECTURE
 Base station Subsystem- Base station subsystem
houses Base Transceiver station-BTS and Base station controller-BSC.
This subsystem take care of radio control related functions and provides
GSM air interface for GSM mobile phones to connect with GSM network.
To provide GSM service, region/city on earth is divided into various cells.
The cell size is usually about 100m to about 35 km. BTS coverage is
limited to this cell. Like this many BTSs cover entire region. All this BTSs
are interfaced with one BSC in various ways mesh, star etc. This BSC
takes care of radio frequency assignments to the mobile phones, takes
care of handoff within BSS i.e. between one BTS and the other BTS.

111. GSM NETWORK ARCHITECTURE
 Network Subsystem (NSS) - This subsystem
provides interface between cellular system and circuit
switched telephone network i.e. PSTN. It performs switching
and operation & maintenance related functions. NSS takes
care of call processing functions such as call setup,
switching, tear down and also hand over between BSCs.
NSS takes care of security and authentication related
functions. There are various network elements in this
subsystem as mentioned in GSM network architecture
above. They are explained below. These are basically
database elements.

112. GSM NETWORK ARCHITECTURE
 HLR-Home Location Register, it stores
permanent and temporary subscriber related
information.
 VLR- Visitor Location Register, it stores
visitor subscriber related information about
its facilities, the network it is subscribed to,
and its home location and so on.

113. GSM NETWORK ARCHITECTURE
 AUC- Authentication center, used to
authenticate activities in the system. It holds
encryption (A5 key) and authentication keys
(A3 key)in both HLR and VLR.
 EIR- Equipment Identification Register, it
helps in security as it keeps track of
equipment type available in Mobile Station or
Terminal.

114. GSM INTERFACES
• Air interface between Mobile station and
BTS.
 Abis interface between BTS and BSC.
 A interface between BSC and MSC.
 SS7 interface between MSC and PSTN

115. GSM SYSTEM SPECIFICATIONS
 Access Method- TDMA/FDMA
Uplink frequency band- 890 to 915 MHz
Downlink frequency band- 935 to 960 MHz
System Bandwidth- 200 KHz
No. of frequency channels or ARFCN (Absolute Radio
Frequency Channel Number)-124
Users per channel-8
Frame duration-4.615ms
Spectral efficiency-1.35 b/s/Hz
Data rate per user- 33.6 kbps (270.833 kbps Gross data
rate for 8 users/8users)

116. GSM NETWORK INTERFACES-
UM,A,ASUB,ABIS,B,C,D,E,F,G

117. GSM INTERFACE
DESCRIPTION WITH POSITION
 Um
It is the air interface used between MS and BTS.
It carries the GSM bursts carrying data and control
information.
Also referred as Air interface.
 A or Asub
It is used between BSC and MSC/VLR. It supports
2Mbps standard digital connection as per CCITT.

118. GSM INTERFACE
DESCRIPTION WITH POSITION
 Abis
It is used between BTS and BSC. It supports
two types of communication links viz. traffic
channel at 64 kbps and signaling channel at 16
kbps.
 B
It is used between MSC and VLR.

119. GSM INTERFACE
DESCRIPTION WITH POSITION
 C
It is used between HLR and GMSC. Also
between MSC and HLR.
 D
It is used between HLR and VLR.
 E
It is used between MSC and another MSC or
G-MSC.

120. GSM INTERFACE
DESCRIPTION WITH POSITION
 F
 It is used between EIR and MSC and
between EIR and G-MSC.
 G
It is used between VLR and another VLR.

121. GSM PROTOCOL STACK
 This article describes basics of GSM protocol stack which
covers Layer-1, Layer-2 and Layer-3 modules of MS(Mobile
Station),BTS(Base Transceiver Station),BSC(Base Station
Controller) and MSC(Mobile Switching Center). To gain in
depth knowledge one has to understand all the message
formats of all the modules such as
radio,LAPD,LAPDm,RRM,MM,CM,BTSM,BSSMAP,SCCP,MTP as
described in 3GPP release documents. Following figure describes
the GSM protocol stack at the GSM network elements.

122. GSM PROTOCOL STACK

123. GSM LAYER 1
 As mentioned in the figure, FDMA/TDMA is the air
interface(radio), also called Um interface.
 At MS, FDMA/TDMA is used which is also followed
at BTS, BTS takes this format from MS and convert
it to 64kbps digital format for the digital link and
interfaces with BSC.
 BSC communicates with MSC in the same format.

124. GSM LAYER 2
 Layer 2 is the data link layer, which does
following three main functions.
- Establish, maintain and tear down the link
- Flow control
- Error detection
- Work on the Layer-3 frames

125. GSM LAYER 2
 At Layer-2 LAPD and LAPDm is used. LAPD is the
ISDN(Integrated Services Digital Network) protocol for D
Channel. LAPDm is the modified version of LAPD for mobile
station. LAPDm does not have CRC for Error detection. This
layer uses any of the following format to carry frames.
1.)Format A for DCCHs(for channels having no information
field) 2.)Format B for DCCHs(containing an information
field) 3.)Format Bbis for BCCH, PCH, and AGCH. 4.)Format
C for random access signals The maximum LAPDm frame
length is 23 bytes i.e. 184bits.

126. GSM LAYER 2
 Depending on type of frame format LAPDm will have
Address field(8 bits), Control field(8 bits), Frame Length(8
bits),signaling data(23 octets) and fill in data. Address field
carry two important parameters C/R and SAPI. C/R
indicates whether the frame is command or response and
also mention whether the direction of frame is BS to MS or
from MS to BS. SAPI takes either value of 0,3 or other
values. For SAPI of 0 is used for messages from the
RRM,MM and CC , and SAPI of value 3 for message from
the SMS and Supplementary Services (SS) messages.

127. GSM LAYER 2
 Control field of this layer-2 contains sequence numbers and
type field to differentiate various frames. There are three
type of frames supported here, supervisory,unnumbered
information transfer and control function( unacknowledged
mode), numbered information transfer(multiframe
acknowledged mode). The frame length field contains the
length of the layer 3 message within the information field of
the LAPDm frame. If the message is less than the length
specified in parameter N201 (standard specifies this) of the
radio interface, fill-in data octets are used to fill up the
remaining gap. Value of fill-in data is specified in GSM TS
document.

128. GSM LAYER 2
 LAPD at BTS converts potentially unreliable
physical link of MS into reliable link. This connects
with BSC's MTP part. This is done with the use of
CRC and ARQ techniques. ARQ stands for
Automatic Repeat Request. ARQ works on the
principle of re-transmission of packet when the
erroneous packet is received at the receiver.
 GSM protocol stack can be explored by studying
deep into protocol layers at various network
elements viz. MS, BTS, BSC and MSC.

129. GPRS PROTOCOL STACK

130. GPRS PROTOCOL STACK
 As shown in figure, SM (Session Management) and
GMM (GPRS Mobility Management) layers are
depicted which are used for signaling. SNDCP (Sub
Network dependent convergence protocol) is used
for data. Above these layers there reside IP and
Application layers. The data from SNDCP and
GMM will go through LLC, RLC, MAC and PHY
layers.

131. GPRS PROTOCOL STACK
 GPRS Layer 3
 SM (Session management of layer 3)
It establishes data calls and negotiates QoS. Negotiated QoS
parameters are reliability, delay, throughput & precedence. It passes
PDP_context_activation_request OR Modify_PDP_context_accept
frame.
It adds SM header before passing the PDP to GMM layer.PDP Context
consists of following fields.
-PDP Type, e.g. IPv4
-PDP Address, e.g. 192.1.1.40
-Negotiated QoS
-GGSN Address
-NSAP

132. GPRS PROTOCOL STACK
 GMM (GPRS Mobility Management of layer 3)
It adds GMM header to the PDP context activation request which comes
from SM layer. GPRS attach request directly fed to GMM layer which
adds GMM header. GMM does following functions in general.
-Registration
-Authentication
-Attach
-Location management (Routing area update, perform cell update)
-Encryption management
-TLLI management
GMM states are IDLE, STANDBY and READY.

133. GPRS PROTOCOL STACK
 SNDCP (Sub network dependent convergence protocol
of layer 3)
It does N-PDU compression, storage and segmentation to
n201 size. Convert and segment external network formats
(N-PDUs) to sub network format (GPRS format). This format
is called SN-PDUs. It does following functions also.
-Compression of N-PDUs
-Negotiation of compression parameters between MS and
sub-network.
-Management of multiple PDP context PDU transfer.

134. GPRS PROTOCOL STACK
 GPRS Layer 2
 LLC (Logical Link Control of Layer2)
-Takes GMM PDUs as input for signaling and SN PDUs as
input for data transmission.
-In addition it performs functions such as encryption,
Protection and framing, storage (this feature is not available
for connectionless mode), L2 data connection
(connectionless mode for GMM PDUs).
-Encrypted SN PDU called LLC PDU has max. length of
1560 octets.

135. GPRS PROTOCOL STACK
 RLC (Radio Link Control of Layer2)
LLC PDU is divided into RLC blocks called segmentation
and inserts RLC header.
RLC layer segments this LLC PDU into octets of length 23.
This 23 octet RLC/MAC block has following breakup.
MAC header - 1 octet
RLC header and control octets - 2 or 3 or 4 or 6 octets
LLC PDU data - 20 or 19 or 18 or 16 octets, For CS1
operation.
 MAC
Inserts MAC header and take care of logical/physical
channels scheduling, control and management.

136. GPRS PROTOCOL STACK
 RLC and MAC Control/Data Block
 RLC/MAC is the block which is transmitted through
Layer-1 over the air. It carries signaling/data
information. BCS(Block Check Sequence) is
included at the end of the block for error detection.
Control block is of size 22 bytes and are encoded
using CS-1 coding type.

137. GPRS PROTOCOL STACK
 RLC/MAC Downlink Control Block
MAC Header- PT, RRBP, S/P, USF
Optional Bytes- RBSN, RTI, FS, AC, PR, TFI, D
Control message content
PT indicates type of data either control or data.
USF is 3 bit field and is used as multiplexing field for more than one MSs
wanted to use a single uplink time slot. It is unique for each MS.
RBSN- Reduced Block Sequence Number, used for sequencing the
RLC/MAC control blocks.
TFI(Temporary Flow Identifier)- which indicates a uplink or downlink
TBF(Temporary Block Flow).
D-Direction of TBF.

138. GPRS PROTOCOL STACK
 RLC/MAC Uplink Control Block:
MAC Header-PT,Spare bits,R
Control message content

139. GPRS PROTOCOL STACK
 RLC Downlink Data Block:
MAC Header- PT, RRBP, S/P, USF
PR,TFI,FBI,BSN,E
Optional bytes- multiples of (LI,M,E)
RLC Data information

140. GPRS PROTOCOL STACK
RLC Uplink Data Block:
MAC Header- PT,CV,SI,R
Spare, PI,TFI,TI,BSN,E
Optional bytes-LI, M,E,TLLI, PFI,E
RLC Data information
CV is the Countdown Value which indicates no. of RLC
blocks with a particular TBF left to be transmitted by Mobile
Subscriber(UE). TLLI will identify GPRS user. and TLLI
indicator(TI) dictates presence of TLLI field. E bit is reserved
for future use.