GSM Complete Concepts

Saravanan.S Gold Medal

(1)
5 years 5 months ago View: 11754 Reply: 14

1F
View The Author

The GSM network is divided into four major systems:

Switching System (SS)
Base Station System (BSS)
Mobile Station (MS)
Operation and Maintenance Center(OMC)

The switching system also called as Network and Switching System (NSS), is responsible for performing call processing and subscriber-related functions. The switching system includes the following functional units:

Mobile Switching Center
Home Location Register
Visitor Location Register
Equipment Identity Register
Authentication Center

Mobile Switching Center

Mobile Switching Center (MSC) performs all the switching functions for all mobile stations, located in the geographic area controlled by its assigned BSSs. Also, it interfaces with PSTN, with other MSCs, and other system entities.

Functions of MSC

Call handling that copes with the mobile nature of subscribers considering Location Registration, Authentication of subscribers and equipment, Handover and Prepaid service.
Management of required logical radio link channel during calls.
Management of MSC-BSS signaling protocol.
Handling location registration and ensuring interworking between mobile station and VLR.
Controls inter-BSS and inter-MSC hand overs.
Acting as a gateway MSC to interrogate HLR. The MSC which is connected to the PSTN/ISDN network is called as GMSC. This is the only MSC in the network connected to the HLR.
Standard functions of a switch like charging.

Home Location Register (HLR)

Home location register contains:

The identity of mobile subscriber called International Mobile Sub Identity (IMSI).
ISDN directory number of mobile station.
Subscription information on services.
Service restrictions.
Location Information for call routing.

One HLR per GSM network is recommended and it may be a distributed database. Permanent data in HLR is changed by the man-machine interface. Temporary data like location information changes dynamically in HLR.

Visitor Location Register (VLR)

The VLR is always integrated with the MSC. When a mobile station roams into a new MSC area, the VLR connected to that MSC would request data about the mobile station from the HLR. Later, if the mobile station makes a call, the VLR has the information needed for call setup without having to interrogate the HLR each time. VLR contains information like the following:

Identity of mobile sub,
Any temporary mobile sub identity,
ISDN directory number of the mobile,
A directory number to route the call to the roaming station,
Part of the data of HLR for the mobiles that are currently located in MSC service area.

Equipment Identity Register

Equipment Identity Register consists of identity of mobile station equipment called International Mobile Equipment Identity (IMEI), which may be valid, suspect, and prohibited. When a mobile station accesses the system, the equipment validation procedure is evoked before giving the services.

The information is available in the form of three lists.

White List- The terminal is allowed to connect to the Network.
Grey List- The terminal is under observation from the network for the possible problems.
Black List- The terminals reported as stolen are not type approved. They are not allowed to connect to the network. EIR informs the VLR about the list, the particular IMEI is in.

Authentication Centre

It is associated with an HLR. It stores an Identity key called Authentication key (Ki) for each Mobile subscriber. This key is used to generate the authentication triplets.

RAND (Random Number),
SRES (Signed Response) -To authenticate IMSI,
Kc (Cipher Key) - To cipher communication over the radio path between the MS and the network.

Operation and Maintenance Centre (OMC)

It is the functional entity through which the network operator can monitor and control the system by performing the following functions:

Software installation
Traffic management
Performance data analysis
Tracing of subscribers and equipment
Configuration management
Subscriber administration
Management of mobile equipment
Management of charging and billing

Base Station System (BSS)

BSS connects the MS and the NSS. It is composed of the following:

Base Transceiver Station (BTS) also called Base Station.
Base Station Controller (BSC).

BTS and BSC communicate across the standardized Abis interface. BTS is controlled by BSC and one BSC can have many BTS under its control.

Base Transceiver Station (BTS)

BTS houses the radio transceivers and handles the radio-link protocols with the Mobile Station. Each BTS comprises of radio transmission and reception devices including antenna, signal processors, etc. Each BTS can support 1 to 16 RF carriers. The parameters differentiating the BTSs are Power level, antenna height, antenna type and number of carriers.

Functions of BTS

It is responsible for Time and Frequency synchronization.
The process of channel coding, Encryption, Multiplexing and modulation for trans-direction and reverse for reception are to be carried out.
It has to arrange for transmission in advance from the mobiles depending upon their distance from BTS (Timing Advance).
It has to detect Random access requests from mobiles, measure and monitor the radio channels for power control and handover.

Base Station Controller

BSC manages the radio resources for one or a group of BTSs. It handles radio-channel setup, frequency hopping, handovers, and control of the RF power levels. BSC provides the time and frequency synchronization reference signals broadcast by its BTSs. It establishes connection between the mobile station and the MSC. BSC is connected via interfaces to MSC, BTS and OMC.

Mobile Station

It refers to the terminal equipment used by the wireless subscribers. It consists of:

SIM -Subscriber Identity Module
Mobile Equipment

SIM is removable and with appropriate SIM, the network can be accessed using various mobile equipments.

The equipment identity is not linked to the subscriber. The equipment is validated separately with IMEI and EIR. The SIM contains an integrated circuit chip with a microprocessor, random access memory (RAM) and read only memory (ROM). SIM should be valid and should authenticate the validity of MS while accessing the network.

SIM also stores subscriber related information like IMSI, cell location identity etc.

Functions of Mobile Station

Radio transmission and reception
Radio channel management
Speech encoding/decoding
Radio link error protection
Flow control of data
Rate adaptation of user data to the radio link
Mobility management

Performance measurements up to a maximum of six surrounding BTSs and reporting to the BSS, MS can store and display short received alphanumeric messages on the liquid crystal display (LCD) that is used to show call dialing and status information.

There are five different categories of mobile telephone units specified by the European GSM system: 20W, 8W, 5W, 2W, and 0.8W. These correspond to 43-dBm, 39-dBm, 37-dBm, 33-dBm, and 29-dBm power levels. The 20-W and 8-W units (peak power) are either for vehicle-mounted or portable station use. The MS power is adjustable in 2-dB steps from its nominal value down to 20mW (13 dBm). This is done automatically under remote control from the BTS.

Transcoders

Transcoders are a network entities inserted to interface the MSC side to Mobile side. The voice coding rate on the PSTN side is 64Kbps, and in GSM over the air the voice is coded as 13Kbps. To reduce the data rate over the air interface and to reduce the loading of the terrestrial link (4 : 1), transcoders are introduced at an appropriate place, mostly with MSC.

The transcoder is the device that takes 13-Kbps speech or 3.6/6/12-Kbps data multiplexes and four of them to convert into standard 64-Kbps data. First, the 13 Kbps or the data at 3.6/6/12 Kbps are brought up to the level of 16 Kbps by inserting additional synchronizing data to make up the difference between a 13-Kbps speech or lower rate data and then four of them are combined in the transponder to provide 64 Kbps channel within the BSS. Four traffic channels can then be multiplexed in one 64-Kpbs circuit. Thus the TRAU output data rate is 64 Kbps.

Then, up to 30 such 64-Kpbs channels are multiplexed onto a 2.048 Mbps if a CEPT1 channel is provided on the A-bis interface. This channel can carry up to 120-(16x 120) traffic and control signals. Since the data rate to the PSTN is normally at 2 Mbps, which is the result of combining 30- by 64-Kbps channels, or 120- Kbps by 16-Kpbs channels.

Other Network Elements

Other network elements include components such as SMS Service Centre, Voice Mail Box, and SMS Flow.

SMS Service Centre

It interfaces with MSC having interworking functionality to provide Short Message Service (SMS) to mobile subscribers. SMS can be destined to fax machine, PC on the internet or another MS. The location of the recipient MS is queried by MSC and delivered.

Voice Mail Box

When the mobile subscriber is not in a position to answer the incoming calls due to busy/out of service area, then the call gets diverted to a mail box which has already been activated by the subscriber. For this, a separate connectivity has been established from MSC. The subscriber will be alerted through SMS later and can retrieve the message.

SMS Flow

When a user sends an SMS, the request is placed via the MSC.
The MSC forwards the SMS to the SMSC where it gets stored.
The SMSC queries the HLR to find out where the destination mobile is and forwards the message to the destination MSC if the destination mobile is available.
If the mobile is not available the message gets stored in the current SMSC itself. In most installations if a mobile is not available for SMS delivery the SMSC does not retry. Instead, the destination MSC informs the SMSC when the mobile comes back in range. SMS handling is a store and forward operation unlike USSD.
SMS has got a validity period for which it will wait for the destination mobile to be available. After that time the SMSC will delete the message. The validity period can be set by the user. Normal validity is 1 day.

BTS and MS are connected through radio links and this air interface is called the Um. A radio wave is subject to attenuation, reflection, Doppler shift, and interference from other transmitter. These effects cause loss of signal strength and distortion which impacts the quality of voice or data. To cope with the harsh conditions, GSM makes use of an efficient and protective signal processing. Proper cellular design must ensure that sufficient radio coverage is provided in the area.

The signal strength variation for mobile is due to the different types of signal strength fading. There are two types of signal strength variations.
- Macroscopic Variations: Due to the terrain contour between BTS and MS. The fading effect is caused by shadowing and diffraction (bending) of the radio waves.
- Microscopic variations: Due to multipath, Short-term or Rayleigh fading. As the MS moves, radio waves from many different path will be received.
Rayleigh Fading

Rayleigh Fading or Macroscopic Variations can be modeled as the addition of two components that make up the path loss between the mobile and the base station. The first component is the deterministic component (L) that adds loss to the signal strength as the distance (R) increases between the base and the mobile. This component can be written as:

https://www.tutorialspoint.com/umts/images/rayleigh_fading.jpg

Where n is typically 4. The other macroscopic component is a Log normal random variable which takes into account the effects of shadow fading caused by variations in terrain and other obstructions in the radio path. Local mean value of path loss = deterministic component + log normal random variable.

Microscopic Variations or Rayleigh Fading occurs as the mobile moves over short distances compared to the distance between mobile and base. These short term variations are caused by signal scattering in the vicinity of the mobile unit say by a hill, a building, or traffic. This leads to many different paths that are followed between the transmitter and the receiver (Multipath Propagation). The reflected wave is altered in both phase and amplitude. The signal may effectively disappear if the reflected wave is 180 degree out of phase with the direct path signal. The partial out of phase relationships among multiple received signal produce smaller reduction in received signal strength.

Effects of Rayleigh Fading

Reflection and multipath propagation can cause positive and negative effects.

Transmitting/Receiving Processes

There are two major processes involved in transmitting and receiving information over a digital radio link, coding, and modulation.

https://www.tutorialspoint.com/umts/images/rayleigh_fading_effects.jpg

Coverage Extension

Multipath propagation allows radio signals to reach behind hills and buildings and into tunnels. Constructive and destructive interference signals received through multi paths may add together or destroy each other.

Coding

Coding is the information processing that involves preparing the basic data signals so that they are protected and put in a form that the radio link can handle. Generally the coding process includes the Logical EXclusive OR (EXOR). Coding is included in:
- Speech coding or Trans coding
- Channel coding or Forward Error Correction coding
- Interleaving
- Encryption
Burst Formatting

Human speech is band limited between 300Hz to 3400Hz and undergoes Frequency Modulation in analog systems. In digital fixed PSTN systems band limited speech is sampled at the rate of 8KHz and each sampled is encoded into 8 bits leading to 64Kbps (PCM A-Law of encoding). Digital cellular radio cannot handle the high bit rate used for PSTN systems. Smart techniques for signal analysis and processing have been developed for reduction of the bit rate.

Speech Properties

Human speech can be distinguished in elementary sounds (Phonemes). Depending on the language, there are 30 to 50 different phonemes. The human voice is able to produce up to 10 phonemes per second, so that about 60 bit/s are required to transfer the speech. However, all individual features and intonations would disappear. To preserve the individual features, the real amount of information to be sent is a number of times higher, but still a fraction of the 64 Kbit/s used for PCM.

Based upon the phoneme production mechanism of the human organs of speech, a simple speech production model can be made. It appears that during a short time interval of 10-30 ms, the model parameters like pitch-period, voiced/unvoiced, amplification gain, and filter parameters remain about stationary (quasi stationary). The advantage of such a model is the simple determination of the parameters by means of linear prediction.

Speech Coding Techniques

There are 3 classes of speech coding techniques
- Waveform Coding : Speech is transmitted as good as possible in wave form coding. PCM is an example of waveform coding. Bit rate ranges from 24 to 64kbps and the quality of speech is good and the speaker can be recognized easily.
- Parameter Coding : Only a very limited quantity of information is sent. A decoder built up according to the speech production model will regenerate the speech at the receiver. Only 1 to 3kbps is required for the speech transmission. The regenerated speech is intelligible but it suffers from noise and often the speaker cannot be recognized.
- Hybrid Coding : Hybrid Coding is a mix of waveform coding and parameter coding. It combines the strong points of both techniques and GSM uses a hybrid coding technique called RPE-LTP (Regular Pulse Excited-Long Term Prediction) resulting in 13Kbps per voice channel.
Speech Coding in GSM (Transcoding)

The 64kbits/s PCM transcoded from the standard A-law quantized 8bits per sample into a linearly quantized 13bits per sample bit stream that correspond to a 104kbits/s bit rate. The 104kbits/s stream is fed into the RPE-LTP speech encoder which takes the 13 bits samples in a block of 160 samples (every 20ms). RPE-LTP encoder produces 260bits in every 20 ms, resulting in a bit rate of 13kbits/s. This provides a speech quality acceptable for mobile telephony and comparable with wireline PSTN phones. In GSM 13Kbps speech coding is called full rate coders. Alternatively half rate coders (6.5Kbps) are also available to enhance the capacity.

Channel Coding /Convolutional Coding

Channel coding in GSM uses the 260 bits from speech coding as input to channel coding and outputs 456 encoded bits. Out of the 260 bits produced by RPE-LTP speech coder, 182 are classified as important bits and 78 as unimportant bits. Again 182 bits are divided into 50 most important bits and are block coded into 53 bits and are added with 132 bits and 4 tail bits, totaling to 189 bits before undergoing 1:2 convolutional coding, converting 189 bits into 378 bits. These 378 bits are added with 78 unimportant bits resulting in 456 bits.

https://www.tutorialspoint.com/umts/images/channel_coding.jpg

Interleaving - First Level

The channel coder provides 456 bits for every 20ms of speech. These are interleaved, forming eight blocks of 57 bits each, as shown in figure below.

https://www.tutorialspoint.com/umts/images/first_level_interleaving.jpg

In a normal burst to blocks of 57 bits can be accommodated and if 1 such burst is lost there is a 25% BER for the entire 20ms.

Interleaving - Second Level

A Second level of interleaving has been introduced to further reduce the possible BER to 12.5%. Instead of sending two blocks of 57 bits from the same 20 ms of speech within one burst, a block from one 20ms and a block from next sample of 20ms are sent together. A delay is introduced in the system when the MS must wait for the next 20ms of speech. However, the system can now afford to lose a whole burst, out of the eight, as the loss is only 12.5% of the total bits from each 20ms speech frame. 12.5% is the maximum loss level that a channel decoder can correct.

Encryption /Ciphering

The purpose of Ciphering is to encode the burst so that it may not be interpreted by any other devices than the receiver. The Ciphering algorithm in GSM is called the A5 algorithm. It does not add bits to the burst, meaning that the input and output to the Ciphering process is the same as the input: 456 bits per 20ms. Details about Encryption are available under the special features of GSM.

Multiplexing (Burst Formatting)

Every transmission from mobile/BTS must include some extra information along with basic data. In GSM, a total of 136 bits per block of 20ms are added bringing the overall total to 592 bits. A guard period of 33 bits is also added bringing 625 bits per 20ms.

Modulation

Modulation is the processing that involves the physical preparation of the signal so that the information can be transported on an RF carrier. GSM uses Gaussian Minimum Shift Keying technique (GMSK). Carrier frequency is shifted by +/- B/4, where B=Bit rate. However using the Gaussian filter, reduces the bandwidth to 0.3 instead of 0.5.

Special Features of GSM

Listed below are the special features of GSM that we are going to discuss in the following sections:
- Authentication
- Encryption
- Time Slot Staggering
- Timing Advance
- Discontinuous transmission
- Power Control
- Adoptive equalization
- Slow Frequency Hopping
Authentication

Since the air interface is vulnerable to fraudulent access, it is necessary to employ the authentication before extending the services to a subscriber. Authentication is built around the following notions.
- Authentication Key (Ki) resides only in two places, SIM card and Authentication Center.
- Authentication Key (Ki) is never transmitted over air. It is virtually impossible for unauthorized individuals to obtain this key to impersonate a given mobile subscriber.
Authentication Parameters

The MS is authenticated by the VLR with a process that uses three parameters:
- RAND which is completely random number.
- SRES which is an authentication signed response. It is generated by applying an authentication algorithm (A3) to RAND and Ki.
- Kc which is cipher key. The Kc parameter generated by applying the cipher key generation algorithm (A8) to RAND and Ki.
These parameters (named an authentication triplet) are generated by the AUC at the request of the HLR to which the subscriber belongs. The algorithms A3 and A8, are defined by the PLMN operator and are executed by the SIM.

https://www.tutorialspoint.com/umts/images/gsm_authentication.jpg

Steps in Authentication Phase
- The new VLR sends a request to the HLR/AUC (Authentication Center) requesting the "authentication triplets" (RAND, SRES, and Kc) available for the specified IMSI.
- The AUC using the IMSI, extracts the subscribers authentication key (Ki).The AUC then generates a random number (RAND), applies the Ki and RAND to both the authentication algorithm (A3) and the cipher key, generation algorithm (A8) to produce an authentication Signed Response (SRES) and a Cipher Key (Kc). The AUC then returns an authentication triplet: RAND, SRES and Kc to the new VLR.
- The MSC/VLR keeps the two parameters Kc and SRES for later use and then sends a message to the MS. The MS reads its Authentication Key (Ki) from the SIM, applies the received random number (RAND) and Ki to both its authentication algorithm (A3) and Cipher key generation Algorithm (A8) to produce an Authentication Signed Response (SRES) and Cipher key (Kc). The MS saves Kc for later, and will use Kc when it receives command to cipher the channel.
- The MS returns the generated SRES to the MSC/VLR. The VLR compares the SRES returned from the MS with the expected SRES received earlier from the AUC. If equal, the mobile passes authentication. If unequal, all signaling activities will be aborted. In this scenario, we will assume that authentication is passed.
https://www.tutorialspoint.com/umts/images/gsm_authentication_flow.jpg

Encryption/Ciphering

Data is encrypted at the transmitter side in blocks of 114 bits by taking 114-bit plain text data bursts and performing an EXOR (Exclusive OR) logical function operation with a 114-bit cipher block.

The decryption function at the receiver side is performed by taking the encrypted data block of 114 bits and going through the same "exclusive OR" operation using the same 114-bit cipher block that was used at the transmitter.

https://www.tutorialspoint.com/umts/images/gsm_ciphering.jpg

The cipher block used by both ends of transmission path for a given transmission direction is produced at the BSS and MS by an encryption algorithm called A5. The A5 algorithm uses a 64-bit cipher key (Kc), produced during the authentication process during call setup and the 22-bit TDMA frame number (COUNT) which takes decimal values from 0 through 2715647, and has a repetition time of 3.48 hours (hyper frame interval).The A5 algorithm actually produce two cipher blocks during each TDMA period. One path for the uplink path and the other for the downlink path.

Time Slot Staggering

Time slot staggering is the principle of deriving the time slot organization of uplink from the time slot organization of the downlink. A particular time slot of the uplink is derived from the downlink by shifting the downlink time slot number by three.

Reason

By shifting three time slots, the mobile station avoids the ‘transmit and receive’ processes simultaneously. This allows an easier implementation of the mobile station; the receiver in the mobile station does not need to be protected from the transmitter of the same mobile station. Typically a mobile station will receive during one time slot, and then shifts in frequency by 45 MHz for GSM-900 or 95 MHz for GSM-1800 to transmit sometime later. This implies that there is one time base for downlink and one for uplink.

Timing Advance

Timing Advance is the process of transmitting the burst to the BTS (the timing advance) early, to compensate for the propagation delay.

Why is it Needed?

It is required because of the time division multiplexing scheme used on the radio path. The BTS receives signals from different mobile stations very close to each other. However when a mobile station is far from the BTS, the BTS must deal with the propagation delay. It is essential that the burst received at the BTS fits correctly into time slot. Otherwise the bursts from the mobile stations using adjacent time slots could overlap, resulting in a poor transmission or even in loss of communication.

Once a connection has been established, the BTS continuously measures the time offset between its own burst schedule and the reception schedule of the mobile station burst. Based on these measurements, the BTS is able to provide the mobile station with the required timing advance via the SACCH. Note that timing advance is derived from the distance measurement which is also used in the handover process. The BTS sends a timing advance parameter according to the perceived timing advance to each mobile station. Each of the mobile station then advances its timing, with the result that signals from the different mobile stations arriving at BTS, and are compensated for propagation delay.

Time Advance Process
- A 6 bit number indicates how many bits the MS must advance its transmission. This time advance is TA.
- The 68.25 bit long GP (guard period) of the access burst provides the required flexibility to advance the transmission time.
- The time advance TA can have a value between 0 and 63 bits long, which corresponds to a delay of 0 to 233 micro second. For instance the MS at 10 km away from the BTS must start transmitting 66 micro second earlier to compensate for the round trip delay.
- The maximum mobile range of 35Km is rather determined by the timing advance value than by the signal strength.
  
  The mobile station attempts to find a suitable cell by passing through the list in descending order of received signal strength, the first BCCH channel, which satisfies a set of requirements it has selected.
  
  Cell Selection Criteria
  
  The requirements that a cell must satisfy before a mobile station can receive service from it are:
  - It should be a cell of the selected PLMN. The mobile station checks whether the cell is part of the selected PLMN.
  - It should not be "barred". The PLMN operator may decide not to allow mobile stations to access certain cells. These cells may, for example only be used for handover traffic. Barred cell information is broadcast on the BCCH to instruct mobile stations not to access these cells.
  - The radio path loss between the mobile station and the selected BTS must be above a threshold set by the PLMN operator.
  - If no suitable cell is found then the MS enters a "limited service" state in which it can only make emergency calls.
  Call to an Active Mobile Station
  
  As an active mobile station (MS) moves in the coverage area of a public land mobile network (PLMN), it reports its movements so that it can be located as needed, using the update procedure locations. When a mobile services switching center (MSC) in the network needs to establish a call to a mobile station operating in its flow area, following things occur:
  - A page message its broadcast which contains the identification code of the MS. Not every Base Station Controller (BSC) in the network is requested to transmit the page message. The broadcast is limited to a cluster of radio cells that together form a location area. The last reported position of the MS identifies the location area to be used for the broadcast.
  - The MS monitors the page message transmitted by the radio cell in which it is located and, on detecting its own identification code, responds by transmitting a page response message to the Base Transceiver Station (BTS).
  - Communication is then established between the MSC and the MS via BTS that received the page response message.
  Location Update
  
  Case 1: Location never updates.
  
  If location never updates the implementation for location update, cost becomes zero. But we have to page every cell for locating the MS and this procedure will not be cost effective.
  
  https://www.tutorialspoint.com/umts/images/location_update.jpg
  
  Case 2: Location update is implemented.
  
  Location updates are taking place as per the requirements of the network, may be time or movement or distance based. This procedure involves high cost, but we have to page single cell or few cells only for locating the MS and this procedure will be cost effective.
  
  https://www.tutorialspoint.com/umts/images/location_update1.jpg
  
  Network Configuration
  
  https://www.tutorialspoint.com/umts/images/network_configuration.jpg
  
  The configuration of a Public Land Mobile Network (PLMN) is designed so that active mobile station moving in the network area is still able to report its position. A network consists of different areas:
  - PLMN area
  - Location area
  - MSC area
  - PLMN Area
  A PLMN area is the geographical area in which land mobile communication services are provided to the public by a particular PLMN operator. From any position within a PLMN area, the mobile user can set up calls to another user of the same network, or to a user of another network. The other network may be a fixed network, another GSM PLMN, or another type of PLMN. Users of the same PLMN or users of other networks can also call a mobile user who is active in the PLMN area. When there are several PLMN operators, the geographical areas covered by their networks may overlap. The extent of a PLMN area is normally limited by national borders.
  
  Location Area
  
  To eliminate the need for network-wide paging broadcasts, the PLMN needs to know the approximate positions of the MSs that are active within its coverage area. To enable the approximate positions of any MS to be represented by a single parameter, the total area covered by the network is divided into location areas. A Location Area (LA) is a group of one or more radio cells. This group fulfills the following requirements:
  - BTSs in one location area may be controlled by one or more BSCs.
  - BSCs those serve the same location area are always connected to the same MSC.
  - Radio cells with BTSs controlled by a common BSC can lie in different location areas.
  Location Area Identity
  
  Every radio transmitter in the PLMN broadcast, via a control channel BCCH, a Location Area Identity (LAI), code to identify the location area that it serves. When an MS is not engaged in a call, it automatically scans the BCCH transmitted by the base stations in the locality and selects the channel that is delivering the strongest signal. The LAI code broadcast by the selected channel identifies the location area in which the MS is currently situated. This LAI code is stored in the Subscriber Identity Module (SIM) of the mobile equipment.
  
  As the MS moves through the network area, the signal received from the selected control channel gradually diminishes in strength until it is no longer the strongest. At this point the MS re-tunes to the channel that has become dominant and examines the LAI code that it is broadcasting. If the received LAI code differs from that stored on the SIM, then the MS has entered another location area and initiates a location update procedure to report the change to the MSC. At the end of the procedure, the LAI code in the SIM is also updated.
  
  Location Area Identity Format
  
  It is a Location Area Identity (LAI) code to identify the location area in a PLMN. The LAI code has three components:
  
  Mobile Country Code (MCC)
  
  The MCC is a 3-digit code that uniquely identifies the country of domicile of the mobile subscriber (for example, India 404). It is assigned by the ITU-T.
  
  Mobile Network Code (MNC)
  
  The MNC is a 2-digit code (3-digit code for GSM-1900) that identifies the home GSM PLMN of the mobile subscriber. If more than one GSM PLMN exists in a country, a unique MNC is assigned to each of them. It is assigned by the government of each country. (For example Cell one, Chennai 64).
  
  Location Area Code (LAC)
  
  The LAC component identifies a location area within a PLMN; it has a fixed length of 2 octets and can be coded using hexadecimal representation. It is assigned by an operator.
  
  MSC areas
  
  An MSC area is a region of the network in which GSM operations are controlled by a single MSC. An MSC area consists of one more location areas. The boundary of an MSC area follows the external boundaries of the location areas on its periphery. Consequently, a location area never spans beyond the boundary of an MSC area.
  
  VLR area
  
  A VLR area is region of the network that is supervised by a single Visitor Location Register (VLR). In theory, a VLR area may consist of one more MSC areas. In practice, however the functions of the VLR are always integrated with those of the MSC so that the terms "VLR area" and "MSC area" have become synonymous.
  
  Location Related Databases
  
  Two databases are used by Location Management to store MS location related data.
  - Visitor Location Register(VLR)
  - Home Location Register(HLR)
  Visitor Location Register
  
  A VLR contains a data record for each of the MS that are currently operating in its area. Each record contains a set of subscriber identity codes, related subscription information, and a Location Area Identity (LAI) code. This information is used by the MSC when handling calls to or from an MS in the area. When an MS moves from one area to another, the responsibility for its supervision passes from one VLR to another. A new data record is created by the VLR that has adopted the MS, and the old record is deleted. Provided that aninter-working agreement exists between the network operators concerned, data transaction can cross both network and national boundaries.
  
  Home Location Register
  
  The HLR contains information relevant to mobile subscribers who are fee-paying customers of the organization that operates the PLMN.
  
  The HLR stores two types of information:
  
  Subscription Information
  
  The subscription information includes the IMSI and directory number allocated to the subscriber, the type of services provided and any related restrictions.
  
  Location Information
  
  The location information includes the address of the VLR in the area where the subscribers MS is currently located and the address of the associated MSC.
  
  The location information enables incoming calls to be routed to the MS. The absence of this information indicates that the MS is inactive and cannot be reached.
  
  When an MS moves from one VLR area to another, the location information in the HLR is updated with the new entry for the MS, using subscription data copied from the HLR. Provided that an inter-working agreement exists between the network operators, concerned data transactions can move across both network and national boundaries.
  
  Types of Identification Numbers
  
  During the performance of the location update procedure and the processing of a mobile call different types of numbers are used:
  - Mobile Station ISDN Number(MSISDN)
  - Mobile Subscriber Roaming Number(MSRN)
  - International Mobile Subscriber Identity(IMSI)
  - Temporary Mobile Subscriber Identity(TMSI)
  - Local Mobile Station Identity(LMSI)
  Each number is stored in the HLR and/or VLR.
  
  Mobile Station ISDN Number
  
  The MSISDN is the directory number allocated to the mobile subscriber. It is dialed to make a telephone call to the mobile subscriber. The number consists of Country Code (CC) of the country in which the mobile station is registered (e.g. India 91), followed by national mobile number which consists of Network Destination Code (NDC) and Subscriber Number (SN). An NDC is allocated to each GSM PLMN.
  
  The composition of the MSISDN is such that it can be used as a global title address in the Signaling Connection Control Part (SCCP) for routing message to the HLR of the mobile subscriber.
  
  Mobile Station Roaming Number
  
  The MSRN is the number required by the gateway MSC to route an incoming call to an MS that is not currently under the control of the gateway MSISDN. Using a mobile, terminated call is routed to the MSC gateway. Based on this, MSISDN gateway MSC requests for a MSRN to route the call to the current visited MSC International Mobile Subscriber Identity (IMSI).
  
  An MS is identified by its IMSI. The IMSI is embedded in the SIM of the mobile equipment. It is provided by the MS anytime it accesses the network.
  
  Mobile Country Code (MCC)
  
  The MCC component of the IMSI is a 3-digit code that uniquely identifies the country of the domicile of the subscriber. It is assigned by the ITU-T.
  
  Mobile Network Code (MNC)
  
  The MNC component is a 2-digit code that identifies the home GSM PLMN of the mobile subscriber. It is assigned by the government of each country. For GSM-1900 a 3-digit MNC is used.
  
  Mobile Subscriber Identification Number (MSIN)
  
  The MSIN is a code that identifies the subscriber within a GSM PLMN. It is assigned by the operator.
  
  https://www.tutorialspoint.com/umts/images/msin.jpg
  
  Temporary Mobile Subscriber Identity (TMSI)
  
  The TMSI is an identity alias which is used instead of the IMSI when possible. The use of a TMSI ensures that the true identity of the mobile subscriber remains confidential by eliminating the need to transfer a non ciphered IMSI code over a radio link.
  
  A VLR allocates a unique TMSI code to each mobile subscriber that is operating in its area. This code which is only valid within the area supervised by the VLR is used to identify the subscriber, in messages to and from the MS. When a change of location area also involves a change of VLR area, a new TMSI code is allocated and communicated to the MS. The MS stores the TMSI on its SIM. The TMSI consists of four octets.
  
  Location Update Scenario
  
  In the following location update scenario, it is assumed that an MS enters a new location area that is under control of a different VLR (referred to as the "new VLR") than the one where the MS is currently registered (referred to as the "old VLR"). The following diagram shows the steps of the mobile location update scenario.
  
  https://www.tutorialspoint.com/umts/images/mobile_location_update_steps.jpg
  
  The MS enters a new cell area, listens to the Location Area Identity (LAI) being transmitted on the broadcast channel (BCCH), and compares this LAI with the last LAI (stored in the SIM) representing the last area where the mobile was registered.
  - The MS detects that it has entered a new Location Area and transmits a Channel Request message over the Random Access Channel (RACH).
  - Once the BSS receives the Channel Request message, it allocates a Stand-alone Dedicated Control Channel (SDCCH) and forwards this channel assignment information to the MS over the Access Grant Channel (AGCH). It is over the SDCCH that the MS will communicate with the BSS and MSC.
  - The MS transmits a location update request message to the BSS over the SDCCH. Included in this message are the MS Temporary Mobile Subscriber Identity (TMSI) and the old Location Area Subscriber (old LAI). The MS can identify itself either with its IMSI or TMSI. In this example, we will assume that the mobile provided a TMSI. The BSS forwards the location update request message to the MSC.
  - The VLR analyses the LAI supplied in the message and determines that the TMSI received is associated with a different VLR (old VLR). In order to proceed with the registration the IMSI of the MS must be determined. The new VLR derives the identity of the old VLR by using the received LAI, supplied in the location update request message. It also requests the old VLR to supply the IMSI for a particular TMSI.
  - Location Update Scenario-Update HLR/VLR is a point where we are ready to inform the HLR that the MS is under control of a new VLR and that the MS can be de-registered from the old VLR. The steps in update HLR/VLR phase are:
    - The new VLR sends a message to the HLR informing it that the given IMSI has changed locations and can be reached by routing all incoming calls to the VLR address included in the message.
    - The HLR requests the old VLR to remove the subscriber record associated with the given IMSI. The request is acknowledged.
    - The HLR updates the new VLR with the subscriber data (mobiles subscribers’ customer profile).
  https://www.tutorialspoint.com/umts/images/mobile_location_update_step_2.jpg
  
  Steps in TMSI Reallocation Phase
  - The MSC forwards the location update accept message to the MS. This message includes the new TMSI.
  - The MS retrieves the new TMSI value from the message and updates its SIM with this new value. The mobile then sends an update complete message back to the MSC.
  - The MSC requests from the BSS, that the signaling connection be released between the MSC and the MS.
  - The MSC releases its portion of the signaling connection when it receives the clear complete message from the BSS.
  - The BSS sends a "radio resource" channel release message to the MS and then free up the Stand-alone Dedicated Control Channel (SDCCH) that was allocated previously. The BSS then informs the MSC that the signaling connection has been cleared.
  https://www.tutorialspoint.com/umts/images/tmsi_reallocation_phase.jpg
  
  Location Update Periodicity
  
  Location Update automatically takes place when the MS changes its LA. A lot of location updates may be generated if a user crosses LA boundary frequently. If the MS remains in the same LA, Location Update may take place based on time/movement/distance, as defined by the network provider.
  
  Hand Over
  
  This is the process of automatically switching a call in progress from one traffic channel to another to neutralize the adverse effects of the user movements. Hand over process will be started only if the power control is not helpful anymore.
  
  The Hand Over process is MAHO (Mobile Assisted Hand Over). It starts with the Down Link Measurements by the MS (Strength of the signal from BTS, Quality of the signal from BTS). MS can measure the signal strength of the 6 best neighboring BTS downlink (candidate list).
  
  https://www.tutorialspoint.com/umts/images/mobile_assisted_hand_over.jpg
  
  Hand Over Types
  
  There are two types of Hand Over:
  - Internal or Intra BSS Handover
    
    Intra-cell hand over
    
    Inter cell hand over
  - External or Inter BSS Hand over
    
    Intra-MSC hand over
    
    Inter MSC hand over
    
    Internal handover is managed by the BSC and external handover by MSC.
  The objectives of Hand Over are as follows:
  - Maintain a good quality of speech.
  - Minimize number of calls dropped.
  - Maximize the amount of time the mobile station is in the best cell.
  - Minimize the number of hand overs.
  When will a Hand Over take place?
  - Distance (propagation delay) between the MS and BTS becomes too big.
  - If the received signal level is very low.
  - If the received signal quality very low.
  - Path loss situation for the mobile station to another cell is better.