Cellular System

From Mullet Chapter3

Common Cellular System Components

Objectives
– List the components of a wireless cellular network.
– Discuss the functions of the following cellular network hardware
components:
• MS, RBS, BSC, and MSC.
– Discuss the use of identification numbers with cellular network
components.
– Explain the basics of SS7 signaling used in wireless cellular
telecommunications networks.
– Explain the basic operations needed for call setup and call
release.
Introduction – Wireless cellular n/w technology
• Cellular system – sophisticated and complex
• Increasing no. of subscribers
• Hardware n/w elements:
i. Mobile or subscriber device – users link to WL n/w
ii. Base Station system – wireless s/m’s link to the
subscriber over air i/f
iii. Wireless switching system –
- I/f to PSTN & PDN
- correct info. & connections to locate subscriber
- Databases to support s/m operations
• Structure & operation of 2G & 2.5G n/w h/w elements
(i.e. SD, RBS, BSC, MSC, GMSC) is described
• Functions of various n/w nodes that supply database info.to
the WL n/w (HLR,VLR,AUC,EIR, etc..) are presented

WL- Wireless
Introduction – Wireless cellular n/w technology..
• Insight into the signaling operations performed over SS7
• Architectural model for 3G
• Numbering & recommended identification s/m’s used by
wireless n/w’s
• Examples of call setup and release operations

WL- Wireless
Common cellular n/w componentsRouting of voice calls & data services

User Mobility
Air I/F

SD

Fig: Typical wireless cellular system components

 Network switching system
▪ RBS – Radio Base station – Air interface
Functions with MS -Mobile station.
▪ Subscriber Device & RBS is usually
Controlled by BSC.
▪ Collectively all these called as BSS.
▪ A fixed switching System (SS) handles
The routing of voice calls, data with MSC.
▪ GMSC - Gate way MSC with PSTN &
PDN.

▪AUC – Authentication Center.

▪ ILR –Internetworking Location Register.
▪ HLR – Home location Register.
▪ EIR – Equipment Identity Register.
▪ FNR – Flexible Numbering Register.
▪ VLR –Visitor Location Register.
▪ IWF – Internetworking Function.
Subscriber devices

Fig: Typical Subscriber device block diagram

• Mobile Station / Subscriber Device(SD) / End Terminal(ET)- the mobile transceiver

▪ SD is the link between the customer and the wireless network.

1. MAN – MACHINE INTERFACE : a standard telephone keypad,

Multimedia capability, display of video messages, video cameras for transmission.
Battery charging ,service / data port to PC.

2. RF TRANSCEIVER SECTION.- High frequency RF electronics for

digital modn/ demodn, Ability to transmit and receive RF signals.

3. SIGNAL PROCESSING SECTION – Processing based on DSP technology. Function

performed are Speech Sampling and coding, channel coding, audio and video
processing.
4. SYSTEM CONTROL PROCESSOR- Subscriber device management,
I/F with other WL n/w elements to provide radio resource, connection
management & mobility mgmt. through s/w control

5. POWER SUPPLY / MANAGEMENT SECTION- Energize entire s/m.

sophisticated algorithms to save & minimize power usage, charging of
battery when discharged.
 Base station system components
1. A Base Station System :
Many RBS (radio base stations), Base station Controller (BSC), Transcoder contoller
( TRC).

• In 1G s/m RBSs directly connected MSC.

• Base transceiver s/m (BTS) – radio equipment required to serve one cell. A single
radio base station might contain 3 base Transceiver systems used to serve a cell
site.

▪ Antenna , transmission lines, power couplers, RF Power amplifiers, tower mounted

Pre-amplifiers are present in RBS.

▪ BSC supervise the operations of various RBSs. It provides air link to PSTN and PDN.

▪ Location and hand-off operations & gathering radio measurement data

▪ Indication of faults in abnormal conditions.

▪ Alarming to sub systems.

▪ Trancoder controller ( TRC) does rate adaptation, i.e. converts voice information to
standard digital PCM format transmitted within PSTN over standard T1/E1/J1 telephone
ckts at 64 kbps.

▪ Vocoding process of converting audio to digital formats suitable for cellular

transmission.

Fig: The Basestation Controller’s Function

Fig: Typical cellular wireless equipment(BSC, TRC & RBS)
are contained in standard radio relay rack enclosures
Radio Base Station - RBS
▪ Radio and transmission interface equipment needed to establish a Radio link
with MS.
▪ Transmission and Reception with MS done using different freq.

▪Two major wireless cellular s/m’s used for air I/F function are TDMA & CDMA

▪ In TDMA RBS – Consists of a distribution switch & processor used to cross

connect individual time slots of an incoming data stream to the correct
transceiver units and provide overall s/m synchronization

▪ CDMA RBS – same as TDMA RBS. The timing and frequency module receives
timing information from GPS(Global Positioning S/m) receiver colocated with the
RBS
Base Station Controller(BSC)
• BSC controls all RBS’s.
• BSC is I/F b/w MSC and Packet Core N/w(PCN)

BSC

Fig: Typical CDMA wireless s/m

Base Station Controller(BSC)

• BSC directs incoming voice calls from MSC to the correct RBS.
• BSC also supports subrate data transmissions (<64kbps)
• BSC provides timing signals & connectivity to every subsystem within it.
Transcoder Controller(TRC)

• TRC consists of subsystems that perform transcoding & rate

adaptation
• TRC does Vocoding i.e. process of converting audio to digital formats
suitable for cellular transmission. (results in reduced data rate)
• TDMA & CDMA systems transmit speech over the air interface using
digital encoding techniques with data rates less than 16kbps
• PSTN uses a PCM encoding with data rates of 64kbps for voice
• TRC does transcoding operation : Voice messages originating from
PSTN or Voice messages originating from mobile station must be
transcoded into a format suitable for cellular system
Switching System Components [ N/w Components ]
• Routing of voice calls and data services to and from mobile station
Switching System Components
• MSC in switching s/m connects to radio n/w portion of BSS and to
PSTN, PLMNs & PDN
• MSC connects to n/w support nodes and gateways
• Functional Databases (HLR, VLR, AUC/EIR) contain info about the
subscribers (their n/w privileges, services, location etc…)
Functions & operations of various switching s/m subsystems and
databases such as

• VLR, MSC, HLR, ILR, AUC, EIR, Gateway MSC, Interworking units,
N/w mgmt s/m, other nodes – SC, BGW, SOG

Visitor Location Register (VLR)

• Database that temporarily stores MS info that attaches to a RBS

in the area serviced by MSC
• One VLR for every Location Area in network
• Typically an MSC covers a location area
• VLR contains information on every subscriber (visitor) currently
operating in the domain of MSC
• Entries are added when visitors enter new RBS
• Entries are deleted when visitors leave RBS
• HLR and VLR jointly facilitate mobility
• VLR requests subscriber info from MSs HLR
• HLR sends the subscriber info to the VLR
 Mobile Switching Center(MSC)

• Mobile switching centers control and coordinate the

cellular network.
• They serve as intermediary between base stations that
may be handing off users between each other.
• Base stations communicate with each other via the MSC.
• MSC keep track of cell phone user subscription.
• MSC connects to the wired phone network (rest of the
world).
Mobile Switching Center (MSC)

• MSC is at the center of the cellular switching s/m

• It is responsible for setting up, routing and supervision of voice calls to
& from the MS to the PSTN

BSC

Fig: Typical MSC Subsystems

Mobile Switching Center (MSC)

⮚Most of the time MSC combines with VLR.

⮚ Main function is continuity of voice with handoff. (providing

service without interruption)

⮚ call routing to roaming subscriber.

⮚ registration, updating, billing, delivery of SMS, Signaling to BSC

and other controlling functions.

⮚ Ability to Mux and Demux signals from PSTN.

⮚ The Group switch (GS) facilitates voice calls to and from PSTN
to MS by assigning particular time slot to voice call and directing
it to correct BSC.
Home Location Register (HLR)

 HLR is a database that stores info about subscriber

 Network’s subscribers, Services chosen, present Location, MS
identification numbers, etc…
 HLR plays a major role in the process of handling calls terminating at the
MS in association with MSC/VLR where subscriber’s mobile is registered
 HLR services VLR based on request
HLR/AUC Interconnection Authentication Center (AUC)

• AUC provides authentication and encryption information for the MSs

being used in the cellular n/w
• AUC is a database that is connected to HLR
• For GSM s/ms, triplets are provided for the authentication of a mobile
• Triplet contains ( ciphering key, random number & signed response)

Process of authentication of Mobile to use radio resources of the n/w:

• Upon VLR request  HLR receives triplet
• Then HLR request AUC for verification of a subscriber
• HLR forwards random number to MSC/VLR  Mobile receives
• Mobile performs calculation using random number and returns to
MSC/VLR then to HLR
• If results are same as signed response then mobile is authenticated to
access radio resources of the n/w
Interworking Location Register (ILR)

• Provide intersystem roaming ( among 1G,2G,3G,4G etc…)

• It allows subscriber to roam in several different systems
• Using ILR, subscriber could roam b/w an AMPS s/m and a PCS s/m.
• In this case, ILR consists of AMPS HLR and parts of a PCS VLR
 Authentication Center and Equipment Identity Register [AUC & EIR ]

• AUC provides HLR with authentication parameters and ciphering keys for
GSM s/ms.
• EIR stores IMEI (International Mobile Equipment Identifier) of MSs
• EIR database is used to validate the status of mobile equipment
• In GSM s/ms, the MSC/VLR can request the EIR to check the current status
of an MS through the global database maintained by the GSM association.
• Hence we come to know whether MS is black listed or white listed.
• Each MS has a unique IMEI(International Mobile Equipment Identifier)
number
• Dial *#06# to know IMEI from your mobile
• Phone carriers and manufacturers share IMEI numbers to enable tracking
of smartphones that may be stolen or compromised.
Gateway MSC [GMSC]

• GMSC is an MSC that interfaces the wireless mobile n/w to other

telecommunications n/ws.
• GMSC will contain an interrogation function for obtaining location info
from the HLR of a subscriber
• Ability to reroute a call to an MS using the info provided by HLR
• Charging & Accounting functions are carried out at GMSC
Interworking Units (IWUs) / IWF (Interworking Function)

• IWUs are required to provide an I/F to various data n/ws

• IWUs are used to connect BSC and RBS to various data services n/w
• MSC uses circuit switching, so need for IWUs for data services
• For TDMA s/ms gateway GPRS support nodes(GGSNs) are IWUs
• For CDMA s/ms packet core n/w (PCN) nodes are IWUs
SMS Gateways and IWUs
• Provide short message service(SMS) – text message 160 ANC to or from
a mobile
• Two n/w elements are required in GSM n/ws:
i. Short message service gateway MSC(SMS-GMSC)
ii. Short message service interworking MSC (SMS-IWMSC)
• SMS-GMSC : capable of receiving a short message from an SMS service
center to MS.
• SMS-IWMSC: capable of sending a short message from MS to SMS
service center
Network Management System(NMS)

• NMS is a part of all modern telecommunication n/ws

• Provides overall n/w surveillance & support O&M of entire n/w
• N/w operations center(NOC) devoted to the use of this NMS to provide
24/7 coverage of the s/m
• NMS provides fault mgmt., performance mgmt., trouble mgmt.,
configuration mgmt. & security mgmt.
• NMS provides ckt, packet and radio n/ws mgmt
Other Nodes

Other nodes connected to s/wing s/m

i. Service Center (SC) or SMS: store & forward center for short messages
ii. Billing gateway (BGW) : collects billing info from MSC & GMSC
iii. Service Order gateway (SOG) : subscription mgmt. functions
 Hardware and Software Views of the Cellular Network
* Microcells RBSs
* Macrocells

* Large Geographical area

* Subscriber base: Approx 1 lakh
* 2MSCs, 6 BSCs, several RBSs

Fig: Hardware view of a cellular system

Possible Hardware Layout used to cover a specific geographic area
 Hardware and Software Views of the Cellular Network

• To complete calls, tracking mobile’s location, maintain radio links through

hand-off etc… functions are all directed by n/w elements under software
control
• N/w is defined by Location area identity (LAI) numbers and cell global
identity (CGI) numbers
• The CGI numbers locate a particular cell whereas the LAI numbers define
an area for paging
• Incoming call to the mobile will result in a page to every cell within the
location area
• If mobile moves into another location area, location updation with VLR for
the new location area
Software View of the Cellular Network

LAC – Location Area Code

 3G Cellular System Components

Fig: The 3G radio network controller

 3G Cellular System Components..

• Transformation in n/w elements towards an all-IP or Packet n/w

[VoIP services]
• BSC  RNC(Radio n/w controller)
• RNCs supervise all RBSs
• RNC node provides the I/F b/w the wireless subscriber and the core n/ws
• Core n/ws : include both circuit-switched voice & data calls
and PCN(packet core n/w) for all packet data calls
• Iub, Iu and Iur I/Fs all carry both user data and signalling.
• Every I/F has signalling protocols of their own
Cellular Component Identification

• To switch a voice call from the PSTN to a mobile subscriber the correct
cellular n/w elements must be involved
• Addressing n/w elements correctly is necessary
• ITU  Recommendation E.164  International public telecommunication
numbering plan [IPTNP]
• Assigning numbers to PSTN telephone and cellular telephones  Dialable
number
• We study Basic numbering schemes used in wireless mobile
networks for the different n/w elements
Subscriber Device Identification
 Info about Type of cellular technology employed by the n/w
 Info about Scope of the n/w (national or international)

• Mobile Station ISDN Identification Number(MSISDN)

• International Mobile Subscriber Identity (IMSI)
• International Mobile Equipment Identity (IMEI)
Mobile Station ISDN Identification Number(MSISDN)
ISDN – International Subscriber Directory Number
In North America:
• Dialable number / Phone Number MSISDN = CC + NPA + SN
• Usually 14 or 15 digits long CC = Country Code
NPA = Number Planning Area
SN = Subscriber Number

Ex: +1-413-732-XXXX
+91-AAAAA-
BBBBB

In Rest of the world:

MSISDN = CC + NDC + SN
CC = Country Code
NDC = National Destination Code
identifies type of n/w ( fixed, wireless etc.)
SN = Subscriber Number

The Country Code identifies a country or geographical area, and may be between 1-3 digits.
The ITU defines and maintains the list of assigned country codes.
 International mobile subscriber identity(IMSI)

• For international PLMN an IMSI number is assigned to each subscriber

• For GSM N/w, IMSI no. is stored in SIM card (subscriber identity
module) provided by the service provider
• Usually a 15-digit number, but can be shorter

• technical identifier, used by the network

operator.

• IMSI = MCC+MNC+MSIN
 Mobile Country Code; Mobile N/w Code; Mobile Subscriber ID No.
• Helps in international roaming
The first 3 digits are the mobile country codeThe first 3 digits are the
mobile country code (MCC), which are followed by the
mobile network codeThe first 3 digits are the mobile country code
(MCC), which are followed by the mobile network code (MNC), either 2
digits (EuropeanThe first 3 digits are the mobile country code (MCC),
which are followed by the mobile network code (MNC), either 2 digits
(European standard) or 3 digits (North American standard). The length
of the MNC depends on the value of the MCC.[1] The remaining digits
are the mobile subscription identification number (MSIN) within the
network's customer base.

Example:
IMSI: 404685505601234 [3+2+10]

MCC 404-405 India

MNC 68 MTNL Delhi
MSIN 5505601234
 Example:
IMSI:310150123456789 [3+3+9]

MCC 310 USA

MNC 150 AT&T Mobility
MSIN 123456789
 1 Check digit /
International mobile equipment identity (IMEI) 2 SVN

IMEI / IMEI SV
14-1 or 14-2

Serial Number (SNR): assigned by the

manufacturer.
• For international mobile n/ws, an IMEI no. is defined & used to
Uniquely Identify a MS as a piece of equipment to be used within the
network
• The model and origin comprise the initial 8-digit portion of the IMEI/SV, known as
the Type Allocation Code (TAC).
• TAC was six digits long and was followed by a two-digit Final Assembly Code
(FAC),
• From January 1, 2003 until that April 1, 2004, the FAC for all phones was 00. After
April 1, 2004, the Final Assembly Code ceased to exist and the Type Allocation
Code increased to eight digits in length.
• The "software version number" identifying the revision of the software installed
on the phone. 99 is reserved.
Cellular system component addressing

• Cellular n/w hardware components: Switching S/m or BSS

• They are assigned signalling Point (SP) addresses or logical names
• Logical names of devices are assigned by s/m operator
• Physical areas of n/w coverage : defined & given logical ID names &
no.s
 for mobility mgmt. functions or billing areas for regional or national

• Location area identity (LAI)

• Cell global identity (CGI)
• Radio base station identity code
• Location numbering
• Addressing cellular network switching nodes
• Global Title and Global Title Translation
 Software View of the Cellular Network
LAI & CGI

LAC – Location Area Code

Location area identity (LAI)
 LAI is used for paging an MS during an incoming call & for location
updating of mobile subscribers
 LAI = MCC+MNC+LAC
 Usually 16-bits in length  65,536 areas or codes possible
 Code is assigned by the mobile operator

Ex: 310-64-11

In a mobile network, the paging operation is used to

indicate the subscriber's position in order to establish a
connection with another user, calling from a fixed or
Cell Global Identity (CGI)
 CGI is used for the unique identification of a cell within a location area
 CGI = LAI + CI
65,536 cell sites

Ex: 310-64-11- 58
Radio base station identity code(RBSIC)
• RBSIC is used by the service provider to identify RBSs within the wireless
n/w
• Code allows an MS to distinguish b/w different neighbouring BSs
• RBSIC Consists of 3-bit n/w color code (for each service provider) & a 3-
bit base station color code

Location Numbering
• Regional or National Areas are assigned ID numbers by SP
• To provide subscriber features(calling plans) based on regions
Addressing Cellular Network Switching Nodes

• Network switching elements and processing nodes are assigned signaling

point addresses or point codes
• This facilitates exchange of messages b/w PSTN & PLMN n/w elements
over SS7 n/w

Signaling System 7 (SS7) is an international

telecommunication protocol standard that
defines how the network elements in a
public switched telephone network (PSTN)
exchange information and control signals.
Nodes in an SS7 network are called signaling
Global Title and Global Title Translation
• GT is address of a fixed n/w element
• GT is used for the addressing of N/W nodes such as MSCs, HLRs, AUCs
and EIR

MNC MSIN

NDC

MSISDN 

MSIN

Fig: Formation of the Mobile Global Identity Number

Call Establishment

• Call establishment was introduced in first-generation analog AMPS

system
• Handshaking functions: B/w MS & BS and b/w BS & MSC to complete
call setup & handoff functions
• Now we will see the n/w elements and databases involved
• Radio resource mgmt., connection mgmt. and mobility mgmt.
operations are done to maintain link b/w MS, BSS & MSC.
Mobile-terminated call (Incoming call to mobile from PSTN)

7 8 9
3
Location 3
2 5 4 MSRN
request
9
10
Call
Connected
1 Routing Routing 6
MS

9
MSRN : MS Roaming Number
Mobile-Originated call (Out going call from mobile to PSTN)

2
2
VLR sets status of mobile BUSY

Requests
service

1
Signalling
channel
3 AUC & Encryption performed
MS

MS specifies service & No.

4 MSC/VLR acknowledges
5 Traffic Channel Seized
MSC/VLR sets up connection to PSTN
Alerting message to MS Connect message to MS
6 Connect Accepted message

Call Setup process completed,

Conversation begins
Call Release (Initiated by the mobile)

2
3

4
LAPDm frame
5
6 LAPDm ACK frame

7
8

RBS