3
GSM System
∗
3.1 The GSM Recommendation
The early 1980s were marked by the development of a number of national
and incompatible radio networks in Europe; see Table 1.2 and Figure 1.3.
The seven different mobile radio networks made the prospect of the mobile
telephone unattractive to many potential customers because of high tariffs
and equipment costs.
For this reason, at its general meeting in Vienna in June 1982, CEPT (see
Appendix B.2.2) decided to develop and standardize a Pan-European cellular
mobile radio network. The aim was for the new system to operate in the
900 MHz frequency band allocated to land mobile radio.
A working group, called Group Sp´ecial Mobile (GSM), was set up under
the direction of CEPT. There were no guidelines on how the new mobile radio
system was to transmit analogue or digital speech and data. The decision to
develop a digital GSM network was not made until the development stage. But
it was agreed from the beginning that the system being planned—called the
GSM mobile radio system after the working group that developed it—should
incorporate and consider new technology from the area of telecommunications,
such as ITU-T Signalling System No. 7, ISDN and the ISO/OSI reference
model.
Six working groups and three supporting groups were formed to cope with
the enormity of the standardization work. The tasks of the different GSM
working groups are listed in Table 3.1.
The GSM objectives for its Public Land Mobile Network (PLMN) were to
offer [1]:
• A broad offering of speech and data services
• Compatibility with the wireline networks (ISDN, telephone networks,
data networks) using standardized interfaces
• Cross-border system access for all mobile phone users

Table 3.2: Original timetable for introducing the GSM system
Date Phase
February 1987 Invitation for tenders
Mid 1988 Letters of Intent
End 1988 Validation of interfaces
Mid 1990 System validation
March 1991 Start of equipment deliveries
June 1991 Operation of first base station
1993 Coverage to metropolitan areas and major roads
since 1995 Area-wide operation
• Support of different types of mobile terminal equipment (e.g., car,
portable and hand-held telephones)
• Digital transmission of signalling as well as of user information
• Supplier-independence
• Low costs for infrastructure and terminal equipment
The GSM group tested a number of prototypes for digital cellular radio
systems, and in 1987 decided on a standard that combined the best charac-
teristics of different systems. A timetable drawn up at the same time for the
implementation of the plan gained the full support of the European Union
(EU) (see Table 3.2).
3.1 The GSM Recommendation 123
Table 3.3: The series of the GSM recommendation
Series Content
00 Preamble
01 General aspects, terminology and service introduction phases of the
GSM Public Land Mobile Network (PLMN)
02 Definition of telecommunications services, technical aspects concerning
tariffs and international billing procedures
03 Definition of network functions such as traffic routing, handover, secu-
rity issues relating to network access, network planning

total around 8000 pages. In 1990 alone another 500 GSM change requests were
passed. The entire set of GSM recommendations is divided into 13 series,
which cover different aspects of the GSM system, as shown in Table 3.3 (see
also Appendix E).
124 3 GSM System
The GSM recommendations contain detailed specifications for the radio in-
terface which in part are borrowed from the concepts for the analogue national
cellular standard and ITU-T Rec. X.25. However, large parts of the radio in-
terface are specific to the GSM system. Some of the important features of
GSM include:
Frequency band The frequency range between 935 and 960 MHz is used as
the base station transmitting frequency (downlink) and the frequencies
between 890 and 915 MHz are used as the base station receiving fre-
quency (uplink). The carrier frequencies of the FDM radio channels
have 200 kHz channel spacing in each band, thus providing 124 FDM
channels. With time-division multiplexing (TDM), eight communica-
tions channels (time slots) are supported per FDM channel.
Handover Handover from one base station to another is a mechanism that
allows the connection quality of calls between users to be maintained,
interference to be minimized and traffic distribution to be controlled. In
addition, procedures are defined for the re-establishment of a connection
if a handover fails.
Power control In the area over 30 dB the equipment of the mobile user and
of the base station controls power in 2 dB steps in order to minimize
interference.
Discontinuous transmission (DTX) GSM offers the option of discontinuous
transmission of speech using voice activity detectors. With DTX, trans-
mitter battery power is only used when speech or data is being trans-
mitted, which minimizes interference and improves the utilization of
frequency spectrum.

EIR
OMC
AuC
HLR
VLR
BSC
BTS
BTS
BSC
MSC
BTS
MS
A
O
BTS-BSC PSTN
ISDN, PDN
(BSS)
Base Station Subsystem
Radio Subsystem
O (see below)
Points of reference:
Interface to
Transition to
Interface
Radio Interface
other Networks
Figure 3.1: Functional architecture of the GSM mobile radio network
3.2 The Architecture of the GSM System
3.2.1 Functional Structure of the GSM System
In GSM specification 1.02 the GSM system is divided into the following sub-

able/hand-portable devices and, according to GSM Rec. 2.06, are divided
into five different classes depending on the allowable transmitter power; see
Table 3.4.
These classifications also characterize different types of devices: mounted,
portable and hand-portable devices. Equipment for the GSM-900 class 1 (8–
20 W) has not yet been developed. Instead, portable and mounted equipment
is typically found in class 2 (5–8 W). Hand-portable equipment mostly con-
forms with class 4 (0.8–2 W). Class 5 (up to 0.8 W) is also being planned for
hand-portable equipment, but places a considerable strain on cellular radio
signal supply. This is one of the reasons why it is more suitable for urban
environments with small cells, but it is hardly being used anywhere yet. An
MS can have facilities for both voice as well as data transmission.
In addition to the network-dependent radio and protocol functions that
enable access to operation in the network, a mobile station outwardly has at
least one other interface to the mobile subscriber (see Section 3.2.2). It is
intended either for a human user (man–machine interface) or for coupling the
terminal adapter of another terminal, such as a computer or a fax machine or
3.2 The Architecture of the GSM System 127
Table 3.4: Power classes of mobile stations according to GSM or DCS 1800
GSM 900 DCS 1800
Class Max. transmit. Type of device Max. transmit. Type of device
power [W] power [W]
1 20 Mounted 1 Hand-portable
and portable
2 8 Portable and 0.25 Hand-portable
mounted
3 5 Hand-portable − –
4 2 Hand-portable − –
5 0.8 Hand-portable − –
a combination of the two. The GSM specifications leave the conversion and

in module is smaller in size and based on the GSM Rec. 02.17 [6]. In addition
to their size, the cards are also used differently. Whereas the standard SIM
card can be activitated simply by being inserted into the card slot provided in
the mobile telephone, the smaller module slides into the equipment mounted
on a cut-down card, which involves first removing the battery. The smaller
plug-in SIM card has been successful with hand-held mobile telephones.
The subscriber-related data is stored in the non-volatile memory of the
SIM. It can be changed statistically as well as temporarily. The permanent
data includes the following elements [6]:
• SIM card type
• IC card identification: serial number of the SIM; identifies card holder
at the same time
• SIM service table: list of additional services subscribed
• IMSI (International mobile subscriber identity)
• PIN (Personal identity number)
• PUK (PIN unblocking key)
• Authentification key K
i
Before a SIM card is assigned to a subscriber, it is first initialized with
this data, and only then can the subscriber use the card to check into the
network. On the other hand, the dynamic data, which is permanently updated
when the terminal is switched on, accelerates the checking-in process because
relevant information is already stored centrally and there is no need for it to
be requested from the network. This includes the following data items [6]:
• Location information: consists of a TMSI, a LAI, a periodically changed
location updating timer, and update status
• Ciphering key K
c
for encoding, and its sequence number
• BCCH information: list of carrier frequencies for cell selection during

PUK A blocked SIM card can only be released through the use of an PIN
unblocking key PUK. The subscriber is allowed 10 attempts in which to enter
the correct PUK code or else the card will be blocked permanently and can only
be unblocked by the service provider. The PUK is an eight-digit permanent
number that is divulged to the subscriber when he receives the card [6].
3.2.1.2 Base Station Subsystem (BSS)
The BSS comprises all the radio-related functions of the GSM network.
Depending on the radio transmitting and receiving capabilities of the base
transceiver system, which because of limited transmitter power only supplies
coverage to a specific geographical area within the network, radio cells are cre-
ated in which the mobile subscriber is free to roam or communicate. The size
of the individual cells depends on a number of parameters, including char-
acteristics of radio wave propagation, local morphology, and expected user
density in the region.
130 3 GSM System
A BSS uses transceivers and the following hardware and software to enable
it to connect a mobile subscriber to a number in the public telephone network
(PSTN) and allow it to communicate:
• signalling protocols for connection control
• speech codecs (coders/decoders) as well as data-rate adaptation (trans-
coder/rate adapter unit, TRAU) for access to the network
• digital signal transmission for coded data.
These functions already give an indication of some of the other important
tasks of the BSS. Various interfaces have been specified between the BSS and
GSM network elements and other networks for the exchange of information
between subscribers and the GSM network or other networks; see Figure 3.1.
The interface to the mobile subscriber is called the U
m
-interface. It contains
specific parameters for digital radio transmission, such as GMSK modulation,

3.2.1.3 Network and Switching Subsystem (NSS)
Switching and network-oriented functions are carried out in a Network and
switching subsystem (NSS). It forms the gateway network between the ra-
dio network and the public partner networks (e.g., Public Switched Telephone
Network (PSTN), Integrated Services Digital Network (ISDN), Public Switched
Data Network (PSDN)). In their entirety not only are the elements of an NSS
purely physical components but, more importantly, the switching subsystem
provides a large number of functions that are the responsiblity of the manu-
facturer and network operator to implement appropriately.
The NSS components include the Mobile Services Switching Centre (MSC),
the Home Location Register (HLR) and the Visitor Location Register (VLR).
Mobile services switching centre (MSC) The MSC is a high-performance
digital switching centre that carries out normal switching tasks and manages
the network. Each MSC is usually allocated several base station controllers,
and in the geographical area assigned to it carries out the switching between
mobile radio users and other PLMNs and also forms the link between the
mobile radio network and the wireline networks (PSTN, ISDN, PDN). The
MSC is responsible for all the signalling required for setting up, terminating
and maintaining connections, carried out in accordance with Common Chan-
nel Signalling System No. 7, and mobile radio functions such as call rerouting
when there is strong interference, as part of a handover and the allocation
and deallocation of radio channels.
Transmission functions for data services are supported through the use
of specific interworking functions (IWF) that are integrated into each MSC.
The respective communications channel functions are carried out by facilities
called data service units (DSU). The DSU contains functions such as rate
adaptation, modem and codec of layer 1, and protocol functions of layer 2.
The other tasks of the MSC include the supplementary services familiar
from ISDN, such as call forwarding, call barring, conference calling and call
charging to the user called. The MSC can be envisaged as an ISDN switch-

control of an MSC and is used to manage the subscribers who are currently
roaming in the area under the control of the MSC or, more precisely, in one
of possibly several location areas of the MSC. It stores information (e.g., au-
thentication data, international mobile subscriber identity (IMSI), telephone
number, agreed services) transmitted by the responsible HLR for the mobile
users operating in the area under its control, thereby allowing the MSC to
make a connection. The VLR also controls the allocation of roaming numbers
(MSRN) to the mobile stations as well as of the TMSI. A special dialogue up-
dates the VLR if a mobile user moves through several of the MSC’s location
areas. The same procedure applies when there is a change of MSC. The VLR
avoids frequent interrogation of the HLR.
The functions location area update and call setup and the roles played by
the HLR and the VLR in these functions are described in Sections 3.7 and 3.8.
3.2.1.4 Operation Subsystem (OSS)
The operation subsystem in GSM comprises all the important functions for op-
eration and maintenance. The user is only indirectly aware of these functions
through his experience with a smoothly functioning mobile radio network.
The functions of an OSS are allocated to three areas of responsibility (see
Figure 3.2):
• Subscription management
• Network operation and maintenance
• Mobile equipment management
3.2 The Architecture of the GSM System 133
The following network elements are part of the OSS:
• Operation and maintenance centre (OMC)
• Authentication centre (AuC)
• Equipment identity register (EIR)
Subscription management Subscription management is able to authenticate
a GSM user from the personal data stored in the HLR (see Section 3.13.1) and
provide him with the agreed services (subscriber data management). This data

service between supplier and customer.
134 3 GSM System
Network management Supports all network elements and helps to activate
functions with similar elements of a network.
Network element management Facilitates access to individual network ele-
ments.
GSM uses standardized concepts for network management, thereby facili-
tating the integration of the network elements of different suppliers.
The TMN has links with defined interfaces to the network elements of the
active network and to the workstation computers of operating personnel. OSS
network elements that are connected to several BSS or MSS units are referred
to as OMCs. A radio OMC, for example, is responsible for several BSCs and
their BTSs.
Mobile equipment management The management of mobile equipment by
the OSS only concerns information about owner and equipment identity,
whereas the MSS coordinates the movements of the equipment, including
roaming, handover and paging. For example, an OSS can search for stolen or
defective equipment using its own database, an EIR, for storing data about
equipment and its ownership (some operators have not established the EIR).
Operation and maintenance centre (OMC) The OMC centrally monitors
and controls the other network elements and guarantees the best possible ser-
vice quality for a network. It relies on services of the network management
and control functions allocated to the network elements by the hierarchical
network management system (TMN). Operator commands are used for inter-
vention into the network elements, while the network management is alerted
of any unexpected occurrences in the network. The OMC is connected to all
network elements over the standardized O-interface (an X.25-interface). The
management functions of the OMC include administration of subscribers and
equipment, billing, and generation of statistical data on the state and the
capacity utilization of network elements.

The white list contains the IMEI list of valid mobile radio stations; the black
list contains all the IMEIs of stolen or suspended mobile radio stations. The
grey list includes a list of IMEIs for malfunctioning equipment that is not
receiving any services.
3.2.2 Interfaces of the GSM System
3.2.2.1 User Interface of the Mobile Station
A GSM mobile station consists of the terminal equipment (TE) to which the
subscriber has direct access, a terminal adapter (TA) (if required) and a part
that contains the functions shared by all the services and referred to as mobile
termination (MT) in the GSM specifications. The subscriber interface on the
terminal (TE) contains the network termination and the different equipment
functions (see Figure 3.3).
The following mobile network terminations are used:
MT0 (Mobile Termination Type 0) A network termination for the transmis-
sion of speech and data integrating the terminal equipment, the terminal
equipment functions and sometimes a TA.
MT1 (Mobile Termination Type 1) A network termination with an external
ISDN S-interface to which an ISDN terminal (TE1) can be connected.
136 3 GSM System
Conventional terminal equipment (TE2) corresponding to the ITU-T,
V or X-series can be connected to an MT1 through the use of an ISDN
terminal adapter (TA).
MT2 (Mobile Termination Type 2) This is a network termination with an
external R-interface to which conventional terminal equipment corre-
sponding to the ITU-T, V or X-series can be connected.
TE1, TE2 and TA correspond to comparable functional groups of the ISDN
concept. The radio interface that supports ISDN-compatible access over traffic
and signalling channels is located at reference point U
m
.

mobile station and the base transceiver station (BTS). But, viewed logically,
3.3 The Interface at Reference Point U
m
137
1 40 2 3 5 6 7 1 40 2 3 5 6 77
1 40 2 3 5 6 7 1 40 2 3 5 6 77
n
F
1 40 2 3 5 6 7 1 40 2 3 5 6 77
n+1
F
n-1
F
Frequency
Physical channel, characterized through the frequency F and the time slot 0
n+1
0.577 0.577 0.577 0.577 0.577 0.577 0.577 0.577 0.577 0.577 0.577 0.577
Time (ms)
0.577 0.577 0.577
4.615
Figure 3.4: Realization of physical channels using FDM and TDM
the mobile stations are communicating with the base station controller (BSC)
and the mobile switching centre (MSC). The gross transmission rate over the
radio interface is 270.833 kbit/s.
3.3.1 Multiplex Structure
Along with voice coding and modulation, multiplexing is also very important.
In the GSM recommendations a combination of frequency-division multiplex-
ing (FDM) and time-division multiplexing (TDM) has been standardized, pro-
viding multiple access by mobile stations to these systems (FDMA, TDMA).
Figure 3.4 shows how a physical channel is produced through a combination

BTS of the frequencies allocated to a cell and morphological conditions.
Thus cells in rural areas can have a radius of up to 35 km. Larger cell
radii would cause a higher round-trip propagation delay; the maximum delay
is 0.233 ms, much larger than specified in the standard. In metropolitan areas
the radius might only be at 300 m, which allows a traffic volume of up to
200 Erl./km
2
. Cells are divided into sectors in order to increase capacity (see
Section 2.4).
3.3.1.1 Frequency-Multiplexing Structure
One of the most important criteria in designing a radio interface was efficient
utilization of the available frequency band. In Europe two 25 MHz wide fre-
quency bands in the 900 MHz band were reserved for GSM. Transmission
from the mobile unit to the base station (uplink) takes place in the 890 MHz
to 915 MHz range; in the reverse direction (downlink) the 935–960 MHz fre-
quency band is used in a frequency-division duplex (FDD) mode of operation.
15 MHz at the lower band limit and 1 MHz at the upper band limit will not be
available until 2001. After current use is discontinued, an additional 10 MHz
between 880 and 890 MHz and between 925 and 935 MHz will be available as
a GSM extension band (see Appendix C). A duplex interval of 45 MHz exists
between the transmit and receive frequencies.
The frequency bands are divided into 200 kHz bandwidth channels, there-
fore providing a total of 124 FDM channels each for transmitting and receiving
operations (see Figure 3.5).
Each mobile station can occupy all 124 carrier frequency pairs, although
according to the GSM specifications use of channels 1 and 124 should be
avoided if possible. The respective 200 kHz bandwidth is kept as a guard band
for the neighbouring systems in the frequency band. If the carrier frequencies
on the uplink are denoted by F
u

d
(n) = 925.2 MHz + 0.2(n − 1) MHz (1 ≤ n ≤ 50) (3.4)
3.3.1.2 Time-Multiplexing Structure
With the TDM method a carrier frequency is divided into eight physical TDM
channels in which the time axis is divided into eight periodic time slots of
0.577 ms duration. Eight time slots are combined into a TDM frame of
4.615 ms duration (see Figure 3.6). Because these time channels are used
in multiple access, the frame is referred to as TDMA frame in the GSM rec-
ommendations.
A physical channel is characterized by its carrier frequency and the time
slot available to it, which recurs every 4.615 ms. Each time slot has a length
corresponding to the duration of 156.25 bits or 0.577 ms (15/26 ms). This
length is produced from the transmission rate of the modulation method
(1625/6 kbit/s) and the number of bits to be transmitted in a slot. A slot is
used by a burst with a length of 148 bits, which, corresponding to the guard
time, is 8.25 bits shorter in duration than the slots to avoid overlapping with
other bursts. Data is transmitted in bursts. If messages are longer than a
burst, they are split up among several bursts and then transmitted.
Overall there are five types of bursts (see Figure 3.7 [14]) which differ from
one another in function and content. The tail bits that occur in all bursts
are defined as modulation bits and always have the same value as specified in
the standard. The bursts are sent so that the bits with the lowest value are
transmitted first.
Normal burst For transmitting messages in traffic and control channels.
140 3 GSM System
Encrypted
Bits
TB
3
TB: Tail-Bit

TB
Normal Burst
Frequency Correction Burst
Synchronization Burst
Dummy Burst
Access Burst
0.577 ms or 156.25 bit
1
Training
Training
26
26 1
3
3
3 8.25
8.25
58
39
142
57
57
58
418 36 3 68.25
8.25
Figure 3.7: Bursts used in GSM
Figure 3.8: Envelope of the radio signal of a burst
Access burst Used for call setup. This burst is shorter than the others be-
cause it does not require the MS to be fully synchronous with the BTS.
Synchronization burst Sent by the base station and used for synchronization.
Frequency correction burst Sent by the base station and used for frequency

✻
❄❆❅❈❇❊❉ ❋
●
❍
❉❇❅❄■
❋
●
❍
❄❆❅❈❇❊❉
❋
●
❍
❉❇❅❄■
❋
●
❍
❄❆❅❈❇❊❉
❋
●
❍
❉❇❅❄■
❋
●
❍
■
■
■
❋
❋
❋

❄❆❅❈❇❈❉
❋
●
❍
❉❇❅❄■
❋
●
❍
❄❆❅❈❇❈❉
❋
●
❍
❉❇❅❄■
❋
●
❍
■
■
■
❋
❋
❋
❡❤❥▲❙❬✉❣
❄
❫
❡❤❥▲❙❬✉❣
❅
❫
❡❤❥✇❙❬❛❫
❄■

tion passes is calculated with an algorithm implemented in each MS. The
advantage of this procedure is that all mobile subscribers are guaranteed
transmission channels with nearly the same quality. During data transmis-
sion, interference from co-channels in the cycle is limited for each frequency
142 3 GSM System
10 2 3 4 5 6 7
10 2 3 4 5 6 7
10 2 3 4 5 6 7
10 2 3 4 5 6 7
C0
C1
C2
0 1 2 3 4 5
Downlink (Own Cell)
C0’
C1’
C2’
Uplink (Own Cell)
D0
E0
Downlink (Co-channel Cell)
Frequencies: C0, C1, C2, C0’, C1’, C2’, D0, E0
Figure 3.10: Frequency hopping method
K2
Time Slots of the Corresponding TDMA Frames
K1 K1 K1
K1K1 K2 K1 K1K1 K2
K1 K1 K1 K1 K1K1K1 K1K2 K2
K1
Physical Channel with Data Rate 4

4.8 kbit/s full-rate TCH for data TCH/F4.8
4.8 kbit/s half-rate TCH for data TCH/H4.8
≤ 2.4 kbit/s full-rate TCH for data TCH/F2.4
≤ 2.4 kbit/s half-rate TCH for data TCH/H2.4
Cell broadcast channel CBCH
3.3.3.1 Traffic Channels
Traffic channels (TCH) are logical channels over which user information are
exchanged between mobile users during a connection. Speech and data are
digitally transmitted on these channels using different coding methods.
Different transmission capacities are required depending on the type of
service used (e.g., voice transmission, short-message service, data transfer,
facsimile). A distinction is therefore made between the following traffic chan-
nels:
B
m
-channel Transmission over a B
m
-channel (m=mobile), which is also called
a full-rate traffic channel (full-rate TCH ), is carried out at a gross data
rate of 22.8 kbit/s. Digitalized and coded speech only require 13 kbit/s
for transmitting voice information. The remaining capacity in voice
transmission is used for error correction. It is possible to transmit data
at 12, 6 or 3.6 kbit/s over a B
m
-channel.
L
m
-channel The half-rate traffic channel (half-rate TCH ) transmits at a gross
rate of 11.4 kbit/s. The number of channels in GSM can be doubled
in a given frequency band because of the speech codecs available for

of control channels were defined in GSM:
• Broadcast control channel (BCCH)
• Common control channel (CCCH)
• Dedicated control channel (DCCH)
Table 3.6 contains a list of all the control channels defined in the GSM rec-
ommendations, and in the directional column indicates the directions possible
on each channel (uplink, downlink or both).
Broadcast Control Channel (BCCH) This channel is used to transmit in-
formation about the PLMN from the base station to the mobile stations in
the radio cell through a point-to-multipoint connection. The kind of informa-
tion conveyed over a BCCH includes identification of the network, availability
of certain options such as frequency hopping and voice activity detection and
identification of the frequencies being used by the base station and neighbour-
ing base stations.
One of the subchannels of the BCCH is the frequency correction channel
(FCCH), used for transmitting a frequency correction burst to the mobile
station for possibe correction of the transmitting frequency.
Another subchannel of the BCCH is the synchronization channel (SCH),
used for transmitting synchronization bursts to a mobile station to allow it to
time-synchronize.
Messages transmitted over the BCCH and its subchannels are transmitted
exclusively in simplex mode by the base station to the terminal equipment.
3.3 The Interface at Reference Point U
m
145
Common control channel (CCCH) This designation is an umbrella term
for control channels that handle the communication between the network and
the mobile phone. Included among the CCCH channels are:
Paging channel (PCH) This channel exists only on the downlink, and is ac-
tivated for the selective addressing of a called mobile terminal during a

This channel can handle bit rates of 4600 bit/s or 9200 bit/s.