EE424 Communication Systems Engineering II Section 3

GSM Cellular Telephony Networks Introduction to Technology Network Structure GSM Air Interface GSM Channel Structure GSM Radio Resource,Mobility and Call Liam Kilmartin Dept. of Elec. Eng., Management NUI, Galway February 2000 GSM Services

Cellular Networks
The essential difference between a cellular and fixed telephony network is that the subscribers terminal (the Mobile Station MS) is not linked by a fixed physical connection to the network
Connection is a radio based wireless connection

In order to support this terminal mobility the geographic area which the mobile network covers is subdivided into cells

Cells
Each cell is serviced by a fixed radio transmitter\receiver known as a base station (BS) which is commonly located in the centre or corner of a cell While often drawn as hexagonal in shape, real cells have no defined shape. The actual area a cell covers depends on many parameters:
Transmitter power Terrain Weather Antenna directivity

Cells
The area a cell covers typically varies from a very small region in urban areas to quite large regions (around 35 km radius in GSM) in rural areas
Balancing of subscribers and traffic between cells

Cells are often classified as being:

Microcells Macrocells Umbrella cells Selective (directional) cells

Frequency Spectrum
Cellular networks operate within defined frequency bands of the spectrum For example, GSM-900 utilises two 25 MHz bands
890-915 MHz (Uplink - MS to BS) 935-960 MHz (Downlink - BS to MS)

These 25 MHz bands are subdivided into 124 carrier frequencies each spaced at approximately 200 kHz (FDMA)

Frequency Spectrum
Not all countries utilise the full 25 MHz and within a country the full GSM band must be subdivided among several network operators Additional frequency spectrum is allocated in most countries around 1800 MHz (GSM1800) In US, certain operators implement GSM standard on a frequency band around 1900 MHz (GSM-1900)

Frequency Re-use
In a given country with, say, two different GSM networks will each use half the 124 (i.e. 62) GSM-900 carriers Clearly, even using TDMA technology this is an extremely small number of carrier frequencies to support a GSM network in a complete country All cellular networks address this problem by what is termed frequency re-use

Frequency Re-use
Frequency re-use means that the same set of carrier frequencies being used in one cell can be re-used in the network in a different cell However, the cells re-using the same carriers must not be adjacent as they would interfere with one another In practice, these cell must be distant from one another
Typical re-use distance is 2.5 to 3 times the cell radius

Cell Clusters
Cells in a cellular network are generally grouped together into cell clusters Cellular networks are generally designed as a repeated cluster pattern The number of cells in a cluster (typically 4,7, 12 or 21) is a trade-off between the traffic capacity in the cluster and its interference with the adjacent cluster of cells (where the same frequencies will be re-used)

Trunking
In addition to frequency re-use, cellular network utilise the concept of trunking to support a very large number of subscribers using a much smaller number of channels (i.e. carriers) This is achieved due to the fact that MS access to a traffic channel in all cells is by demand assignment
They must first negotiate with the network over a signalling channel to gain access to a traffic channel for the duration of a call

As with all trunked systems, there is always the possibility that subscribers will not be able to access the network due to the limited number of traffic channels available

GSM Cellular Standard

All GSM networks and equipment conform to a defined GSM standard issued by ETSI (European Telecommunications Standard Institute) GSM is a second generation or digital cellular technology
All transmissions (signalling as well as traffic speech) between MS and BS is by digital modulation of frequency carrier

Currently, the most widely used of several second generation digital cellular telephony standards

Justification for GSM

GSM development started in the early 1980s to replace first generation (analogue) cellular technology The proposed system had to meet certain criteria
Good subjective speech quality Low terminal and network equipment costs Support of international roaming Integration of various bearer, supplementary and tele-services in a single mobile network Efficient use of available spectrum

Meeting these Criteria

GSM has been very successful in meeting all of these criteria
Widely used in well over 100 countries Equipment costs are low Voice, data and new services available

However,
Still not a single global standard MS to BS bearer rates are still very slow for non-voice services

Third generation global standard UMTS

GSM Network Architecture

Mobile Station
The MS consists of the mobile equipment (terminal) and a smart card called the subscriber identity module (SIM) It is the SIM card which contains all the network relevant subscriber identity information SIM provides subscriber with personal mobility rather than the terminal (as in first generation systems) Access to SIM protected by security codes (PIN and PUK codes)

Mobile Station
Typical information stored on the SIM includes
International Mobile Subscriber Identity Number (IMSI) which is the unique identification of the subscriber (not the same as their mobile phone number) Information used in authenticating the SIM when it attempts to access the number Information indicating which bearer, supplementary and tele-services the subscriber has access to

The mobile equipment is also uniquely identified by what is called the International Mobile Equipment Identity (IMEI) but this is not of particular importance to the standard operation of the network

Base Station Sub-system

The BSS consists of two parts:
Base Station Controller (BSC) Several Base Transceiver Station (BTS)

The BTS primarily consists of a number the radio transmitter\receivers required to cover an individual cell plus an functionality required to support traffic transmission over the radio link (e.g. channel coding, speech coding, encryption, RF modulation) The BSC is a more sophisticated device which manages the radio links between the BSSs, under its control, and any MS in the cells covered by the BSSs
Allocation of channels to MS for calls Measuring and controlling transmitter power levels

BTSs typically linked to BSC via microwave and fixed links

Network Subsystem
The network sub-system primarily consists of a network of telephone exchanges termed Mobile Switching Centres (MSC)
MSC interconnect using standard inter-exchange TDM links

In addition, however, it also includes equipment to support the particular requirements of GSM mobile telephony network A special MSC termed a Gateway MSC (GMSC) is used to interconnect the GSM network with other circuit and packet switched networks

Home Location Register

The HLR is essentially a large database system which is connected to, or integrated into, one or many MSC in the network Every subscriber on a GSM network will have a permanent entry in one of the HLR on their home network
Subscribers are nominally allocated to a particular home HLR in a network

The subscribers entry (identified by their IMSI) in their home HLR contains important information such as their current location in the GSM network and the services which the subscriber can access

Visitor Location Register

Every MSC in the network will have a VLR attached to it (typically integrated into MSC) The database will contain a temporary entry for each MS that is currently within cells under the control of that MSC When a new MS enters one of these cells, it passes its IMSI to the VLR which then accesses the HLR of that MS and downloads some of its HLR data to the VLR

Visitor Location Register

Once the VLR has this information, it can seamlessly handle any call requests relating to that MS without reference to its HLR Once the MS moves from the area controlled by the MSC, or is powered off, its VLR information is removed Typically, a MS that is in a cell controlled by its home MSC will have an entry in that MSCs VLR (even though the same data exists in the HLR attached to that MSC)

Authentication Centre
AuC is a further database which supports certain aspect of network security In particular, it contains information, known as a key, which is used to authenticate the identity of a SIM when an attempt is made by the SIM to access the network The same information is also involved in the process by which the digital radio transmissions to\from a mobile can be encrypted

Equipment Identity Register

The EIR is also involved in provide network security It may also be used by a network to validate the mobile equipment (IMEI) rather than the SIM when it attempts to access the network The EIR is a database which contains a list of stolen and\or terminals that have failed GSM type approval tests Not widely used in many networks

Other Network Functions

Additional functions that can be found in GSM networks
Operations and Maintenance Centre (OMC) Billing Centres Voice Mail Service (VMS) Short Messaging Service Centre (SMSC) Cell Broadcast Centre (CBC)

The role of some of these will be discussed later

GSM Air Interface

Previously outlined the FDMA nature of the air interface, with potentially several frequency carriers used in each cell Each frequency carrier also has a TDMA nature The TDMA frame length of approximately 8x0.577 ms consists of 8 timeslots (burst periods) each nominally of a 156.25 bits duration (270.8kbps) Therefore, each frequency carrier actually supports 8 physical channels Typically, burst period 0 in each frame is typically not used for traffic data but for signalling data

GSM Air Interface

TDMA timing structure used by both the BS and any transmitting MS in the cell is defined by the continuous downlink transmission from the BS The uplink and downlink frame structures are deliberately offset from one another by 3 timeslots - Time Division Duplexing (TDD)
MS does not have to transmit and receive at the same time - conservation of power/complexity of RF circuitry

TDD Nature of GSM Transmission

Physical Channels
A single Physical Channel consists of one burst period per TDMA frame on a specific FDMA carrier However, the relationship between physical channels and the data they contain is NOT simple
For example, a specific burst period on a carrier is NOT used to carry user traffic every frame For example, burst period N on a carrier has a different meaning dependent on which frame it is in a 26 or 51 frame multi-frame Even more complex time-relationships exist on burst periods used to carry control, or signalling, information

Overview of GSM Timing Structures

8 Burst Periods (576.9 ms) = 1 TDMA Frame (4.615 ms) TDMA frames grouped into either:
26 TDMA frames (120 ms) 51 TDMA frames (235.4 ms)

to form a multi-frame (depending upon use of burst periods - signalling or traffic) 51 x 26 frame multi-frames, or 26 x 51 frame multi-frames form a super-frame (6.12 s) 2048 super-frames form a cryptographic hyper-frame (3 hr 28 min 53 s)

Burst Transmission
The timeslots are termed burst periods because the GSM transmitter must transmit its data in a short burst within the time slot
Time slot (156.25 bits) is longer than transmitted packet duration (up to 148 bits) - 8.25 bit difference is a guard period Transmitter must ramp power up quickly at the start of the period and ramp it down at the end of the period Guard period is required (specifically in the uplink direction) to allow for slight deviations in the arrival times (synchronisation )of burst from different MS using adjacent burst periods

Power Ramping Template for GSM Transmitter

Types of Bursts
Four different types used in GSM depending on function of transmission
Normal Burst (used in both MS and BS in most cases) Frequency Correction Burst (transmitted by BS to supply all MS with a frequency reference to aid receiver carrier synchronisation) Synchronisation Burst (transmitted by BS to aid MS equalisation circuits) Random Access Burst (transmitted by MS when first attempting to transmit to a BS in a cell)

GSM Burst Types

Role of Bits in Bursts

Training sequence\synchronisation sequence is a defined patterned used to aid receiver equaliser circuitry (to compensate for radio channel impulse response and multi-path propagation) Tail bits (TB) are useless bits transmitted as transmitter ramps up\down power Encrypted bits contain encrypted data (signalling or user traffic) being conveyed over radio link
In normal burst, 1 bit in each of two 58 bit blocks of normal burst are stealing bits used to indicate if the encrypted date have been stolen to contain signalling information rather than user traffic bits

Random Access Burst and Maximum GSM Cell Size

The Random Access Burst is much shorter than the normal burst as it is transmitted by an MS when it is unaware of its distance from the BS It can receive the BS transmission and hence deduce (and synchronise to) the air interface TDMA frame structure BUT the received BS will have been delayed by an unknown time in propagating from the BS to the MS
This unknown time t =MS distance from BS(r)/speed of light(c)

Random Access Burst and Maximum GSM Cell Size

The maximum cell radius (rmax) is defined by the condition where the MS is located at this distance from the BS and the MS transmits a Random Access Burst The end of the burst must still arrive at the BS before the end of the burst period
The MS does not know it is the start of the burst period for tmax=rmax/c after the actual start It then transmits the burst of 88 bits which will be delayed a further time tmax before arriving back at the BS Clearly, tmax +88 bits/270bps +tmax =576.9ms Therefore, rmax= 37,646m=37.6 km

Other Air Interface Issues

A number of other GSM air interface issues should be examined:
Timing Advance Power Control Discontinuous Transmission Discontinuous Reception Frequency Hopping

All of these may, or may not, be implemented in particular GSM networks but are included in the GSM specification (and hence must be implemented on all GSM MS) as an aid in minimising interference and maximising MS power usage

Timing Advance
Clearly, it is vital that the burst transmission from MS in a cell arrive within the bounds of the burst period allocated to that MS This is made difficult as the MS may be moving and hence the propagation delay between MS and BS can vary BS monitors the arrival position of a MS burst in the allocated burst period It must then inform the MS to either advance or retreat their timing to ensure than subsequent burst arrive well within the bounds of their allocated burst period The BS continuously performs this task while a communication session is in progress with an MS

Adaptive Power Control

As well as monitoring the timing situation, the BS also performs power measurements on the signal it receives from the MS BS can instruct the MS to either increase or decrease its transmitter power level in order to ensure that the MS is transmitting at only the maximum power necessary such that the BS can receive it
Conservation of battery life

The MS can also monitor the power it receives from the BS during its allocated burst period and instruct the BS to increase\decrease the transmitter power during that burst period - Also minimises co-channel interference Both of these will occur continuously while an MS is in a communication session with a BS

Possible Power Profile of GSM BTS

Discontinuous Transmission
In order to help maximise MS battery life and minimising co-channel interference, GSM MS and BS only transmit normal burst containing speech information in their allocated burst period, during a call, if the mobile user is actually speaking DTX utilises a Voice Activity Detector (VAD) in the MS software which analyses the incoming speech samples to distinguish between speech and background noise At the other end of the radio link, comfort noise is injected during periods of DTX so that the listener does not hear dead silence

Discontinuous Reception
The MS does not have to continuously monitor the transmissions being emitted from the BS either during calls or when idle (in case of incoming call requests) This means that the MS can power down its reception circuitry except during the periods when it must listen to the BS transmission This helps conserve MS battery life

Frequency Hopping
GSM standard does include a slow frequency hopping capability for FDMA carriers in order to counteract the effect of frequency dependent distortion of carriers (e.g. multi-path fading) on quality of link
Frequency hops every TDMA frame

Many networks do not implement frequency hopping in BS but ALL MS must BS must inform all MS of the frequency hopping algorithm being implemented in that cell

GSM Channel Structure

We have already introduced the physical channels used in GSM, namely 8 burst periods per frame on an FDMA carrier We have also seen the need for the transmission of two distinct types of information between MS and BS, namely control (signalling) and user traffic information This leads to the concept of two types of channels:
Traffic Channel (TCH) used to convey user traffic information Control Channels (CCH) used to convey signalling information between MS and network

GSM Channel Structure

Typically, burst period 0 in a frame is used (in both directions) as a CCH Remaining seven burst periods in the TDMA are nominally TCHs However, this simple picture is not the complete picture We have already seen that the normal burst in a burst period which carries TCH can be stolen to carry specific types of urgent signalling information
Up to four consecutive frames can be stolen for this Fast Associated Control Channel (FACCH)

GSM Channel Structure

For example, the 26 channel multi-frame structure applies to burst periods used as TCH In this multi-frame structure,
In frames 0 to 11, the burst period acts as a TCH In frame 12, it acts as a means of transmitting specific type of control information (Slow Associated Control Channel SACCH) In frames 13 to 24, it again acts as a TCH In frame 25, it is actually unused to allow the MS to do other tasks

Similarly, the 51 frame multi-frame used on burst period carrying certain CCH (e.g. burst period 0) is used in a similarly manner to separate when different types of signalling information (or channels) are

Logical Channels
The GSM standard not only specifies then when of different channels in that different types of information is transmitted in different burst periods, frames, multi-frames superframes etc. It also distinguish the why of the information under the phrase of logical channels For example, it is not sufficient to identify between TCH and CCH. The GSM standard identifies the different types of CCH and TCH that are used

Control Channels
There are four important different classes of control channels defined:
Broadcast Channels (BCH) Common Control Channels (CCCH) Dedicated Control Channels (DCCH) Associated Control Channels (ACCH)

Each class is further subdivided to identify specific logical channels The mapping of these logical channels onto physical channels is quite complex but some examples have already been mentioned

Broadcast Channels
Broadcast channels are transmitted by the base station to convey information to ALL MS in the cell Three different logical BCH exist:
Broadcast Control Channel (BCCH) conveys all information required by the MS to access and identify the network - transmitted in burst period 0 on only one (non-hopping) carrier in a cell Synchronisation Channel (SCH) contains the synchronisation burst when transmitted Frequency Correction Channel (FCCH) contains the frequency correction burst when transmitted

Common Control Channels

CCH are shared among all MS in a cell and are used in setting up calls from either the MS or network side
Three different types of CCH are defined: Paging Channel (PCH) is used by the BS to alert MS to an incoming call Random Access Channel (RACH) is used by MS when it attempts to request access to the network
Access by MS in a slotted Aloha manner using Random Access Burst

Access Grant Channel (AGCH) is used by BS to tell MS which DCH to use after it has sent a message over the RACH

Dedicated Control Channels

The Standalone Dedicated Control Channels (SDCCH) are allocated to specific mobiles to exchange information with the network for a specific duration A typical use of the SDCCH would be to exchange signalling relating to a call set up

Associated Control Channels

Two types of ACH which have already been mentioned:
Slow ACH (SACCH) which is transmitted in the TCH burst period once every TCH multiframe and is used for signalling of a non-urgent nature relating to the call (e.g. supplementary service and call related requests) Fast ACH (FACCH) which is formed by stealing up to four consecutive TCH bursts (frames) to convey urgent signalling information (e.g. handover, power control, timing advance)

Logical TCHs
TCH are also classified accord to the type of traffic that they are carrying The main ones are:
TCH/F : Full rate speech codec traffic channel (1 per burst period) TCH/H : Half rate speech codec traffic channel (2 per burst period) TCH/n : n (e.g. 9.6, 4.8) kbps data traffic channel (1 per burst period)

GSM Speech Codecs

Three types of speech codec used
Full Rate Codec Half Rate Codec Enhanced Full Rate (EFR) Codec

The Full Rate codec buffers 20 ms (160 samples) worth of 8kHz sampled speech and develops a mathematical model used to predict the 20 ms of speech The parameters of this model are encoded using 260 bits (every 20 ms yields 13 kbps)

GSM Speech Codecs

Channel coding and interleaving is used to protect the bits (as with all types of TCH contents) which are then split into smaller blocks for transmission in a normal burst every frame Half rate codec is not widely used but was proposed in order to encode speech at 6.5 kbps and hence double capacity of each burst period EFR codec is a more sophisticated compression algorithm encoding speech at 13 kbps but at a higher quality (particularly for non-voice signals)

Network Support for MS Operation

Comprehensive examination of the air interface which provides a wireless communication channel between MS and network (via the BSS) To support terminal mobility and roaming,the network must provide a standardised means by which MS registration, authentication, call routing and location updating are carried All of these require a significant amount of signalling between the MS and various parts of the network Already examined the means by which various types of signalling channels

Network Support for MS Operation

A data link protocol (LAPDm mobile) ensures reliable data link of the wireless signalling channels Within network, signalling messages are passed between entities using a CCS protocol called Signalling System No.7 (SS7) Layer 3 of the GSM stack is formed of three sub-layers
Radio Resource (RR) Management Mobility Management (MM) Connection Management (CM)

MS software implements all three sub-layers but different devices in the networks implement the other end of the three network sub-layers

Radio Resource Management

RR sub-layer is concerned with the establishment, maintenance and termination of the link (radio and possibly fixed) between an MS and the MSC to support calls MS, BSS and MSC are involved are the main components of the network involved RR sub-layer session is initiated by the MS either by:
MS initiating a RR session to set up an outgoing call MS responding to a paging messaging to support an incoming call

RR sub-layer has responsibility for management of radio features such as power control, timing advance, DTX, DRX and Handover

Call Handover
Fundamentally important function to support seamless terminal mobility Allows MS to continue a call in progress while moving between different cells in the network
Support of the call is handed over to a different BTS to ensure continuity of the call as the MS moves

The procedures and operation of handover are one of the most important function of the RR sub-layer Handover is normally by MS or MSC (to distribute traffic or loading more evenly in a cell or cell cluster)

 An MS with a call in progress continuously monitors the strength (quality) of signals (in the BCH) received from up to 16 neighbouring cells List of the six best possible candidate cells for handover is transmitted to the BSC (and MSC) once every second MSC may initiate call handover under limited circumstances as a means of load or traffic balancing The four types of Handover involve transferring support of the call between:
Traffic channels in the same cell BTS controlled by the same BSC BTS controlled by different BSC but belonging to the same MSC BTS controlled by different BSC

Call Handover

Types of Call Handover

The first two are termed internal handovers are controlled by the RR software on the controlling BSC without reference to the MSC The last two are termed external handovers are handled by the RR software on the controlling MSC, possibly in communication with the new controlling MSC The call remains routed through the original anchor MSC and it DOES remain responsible for most aspects of call support
New controlling MSCs, the relay MSC, primary responsibility is to support any future inter-BSC handovers

Handover Decision Algorithms

Minimum Acceptable Performance algorithm only allows handover to be considered if increasing the MS transmitter signal power (under instruction from BSS) does not result in an improvement in quality of signal received
Very simple and commonly used but can result in cell boundary smearing as a MS continues to transmit at peak power even after moving into area covered (at lower power) by another BTS

Power Budget algorithm allows handover to initiated if the link (signal) quality can be maintained by another BTS at the same, or lower, power
Far more complicated to implement but much reduced co-channel interference implications

Mobility Management
Mobility Management uses the RR sub-layer (to maintain a signalling link) and its primary functions are to support :
terminal mobility aspects of security Authentication

Primary role is to support a mechanism by which the network knows the location of a poweredon MS in order to efficiently route calls to that mobile To this end, the network of cells is divided into location areas which are typically a group of cell clusters controlled by the same MSC

Location Updating
A powered on MS is informed of an incoming call by a signalling message This must be transmitted in the Paging channel of the cell the MS is in In practice it is transmitted in ALL the cells of the location area the MS in currently in
Smaller location areas result is much higher signalling traffic as MS move around Larger location areas result excessive paging of MS on incoming calls

MS must update certain network elements of its location :

When it first powers on (known as IMSI attach) When it moves from one location area to a new one At regular timed intervals while powered on When it powers off (known as IMSI detach)

Location Updating Procedures

Location updating involves MSCs, HLR and VLR When an MS switches on, or moves into a new location area, it must inform the network of this MS informs the MSC\VLR controlling the area of the location area it is in The VLR then informs the HLR of the MS (by an SS7 signalling message) that it should be interrogated if any incoming calls need to be routed to the MS HLR verifies that the MS is allowed access and sends to the VLR all information from its records need to support calls to\from that MS HLR also informs the old VLR the MS was registered on to cancel its database entry

Location Updating Procedures

MS must also send regular (at a network defined interval) location updating messages to the network Failure to do so (such as when an MS goes out of coverage) results in that MS being marked as out of reach\de-activate thus resulting in their VLR entry being cancelled Similar operation occurs when the IMSI detaches when the MS is powered off (rather than going out of coverage)

Authentication Procedure
Authentication procedure carried out at beginning of each access by MS to network AuC and SIM implement the A3 authentication algorithm with the same random number generated by AuC Both entities carry out the algorithm with the subscribers secret key SIM transmits the result of the algorithm back to AuC which compares it to its own result to authenticate SIM access Secret key is stored on SIM and in AuC but NEVER transmitted

Security Procedures - Encryption

Already examined possible role or EIR to provide mobile equipment security Encryption of all transmissions over air interface is also an option Using random number and key used in authentication, a ciphering key can be generated using the A8 algorithm by both ends of the air interface link Ciphering keyed used to encrypt the 114 bits (2x57 bits) of data in each normal burst Bits are de-ciphered at other end of air interface

Security Procedures - TMSI

Security for the IMSI, particularly, over the air interface is vital (to prevent any possibility of cloning) Another aspect of security is minimise how often the IMSI is transmitted across the air interface The IMSI is only transmitted across the air interface, in signalling messages, during the very first exchange of signalling messages at the start of a network access by an MS Network responds to access attempt with a signalling message containing a Temporary Mobile Subscriber Identity Number (TMSI) The TMSI identifies the MS in all subsequent signalling messages transmitted across the air interface during that communication session

Communication Management
CM sub-layer is responsible for call control and supplementary and teleservice management Call Control (CC) responsibility relate to the establishment, invoking of additional services and releasing of a call Initiation of outgoing calls from mobile is easily handled by MSC\VLR using information regarding MS downloaded from HLR Routing of incoming calls to an MS needs to be examined in a little more detail

MS Terminated Call
A caller to an MS (from say a fixed network) dials the Mobile subscriber ISDN (MSISDN) number which has been allocated to that subscriber
Contains country code and national destination code (NDC) which identify mobile network Remaining digits identify the subscriber (and specifically their HLR)

Call is routed to the Gateway MSC (GMSC)

GMSC is capable of interrogating the HLR for the destination MS (as determined by analysis of the dialled MSISDN number) over SS7 signalling network

MS Terminated Call
HLR interrogates the VLR where the MS is located over the SS7 signalling network which returns a (temporary) Mobile Station Roaming Number to the HLR This MSRN is returned to the GMSC and allows it to set up a speech circuit for the call as far as the MSC to which the VLR is attached When the call reaches that MSC, the VLR translates the received MSRN back to the IMSI of the destination MS The MSC then instructs the require BTS to page the MS in all the cells in its current location area

GSM Supplementary Services

Comprehensive set of supplementary services defined in GSM
Call Forwarding\Hold\Waiting\Barring Conference Call Calling Line ID (Restriction) Connected Line ID (Restriction) Closed User Groups Advice of Charge

GSM Teleservices
Wide range of Teleservices
Telephony Group 3 Fax Service Voice\Fax Mail Short Messaging Service (SMS) Cell Broadcast Service (CBS)

Delivered over various speech and data bearer services Data services can be transparent or utilise a comprehensive data link layer protocol (Radio Link Protocol (RLP) Data\Fax services utilise a digital bearer service and hence do NOT have a modem at the MS
Network (MSC) requires a inter-working function (IWF) (i.e. a modem bank) to allow inter-working with non-ISDN terminals (e.g. PSTN)

Short Messaging Service

SMS allows 160 character messages to be sent to specific subscriber(s) Messages are transmitted to\received by MS over signalling channels All incoming short messages are processed by the Short Messaging Service Centre (SMSC) Messages stored (for a certain duration) on SMSC if desired recipient MS is powered off SMSC will receive messages from:
GSM subscribers Voice or modem (DTMF) equipped Messaging Bureau Internet

Cell Broadcast
Uni-directional messaging service controlled by a Cell Broadcast Centre (CBC) Messages of up to 93 characters delivered to MS over signalling channel Messages can be broadcast to all the MS is specific geographic areas

New Data Services

Two new GSM data (bearer) services have been standardised
High Speed Circuit Switched Data Service (HSCD) General Packet Radio Service (GPRS)

Current data bearer services only offer up to 9.6 kbps HSCD allows a high speech data connection by allocating multiple (up to 7) burst periods on a carrier to an MS GPRS provides a high speed (> 100 kbps) packet switched service to MS by dynamically utilising unused burst periods over the air interface