GSM NSS components and frame hierarchy

Components of the Network Switching Subsystem (NSS)

The NSS performs call switching, mobility management and subscriber database functions in GSM. It connects to the BSS over the A interface and to external networks (PSTN/ISDN).

 BSC --A--> [MSC] ----- [GMSC] --- PSTN/ISDN
              |  \
            [VLR] [EIR]
              |
            [HLR]--[AuC]

• MSC (Mobile Switching Centre) – the central switch. Sets up, routes and releases calls; handles handoff between BSCs/MSCs, billing records, and mobility management. Works with HLR/VLR to locate users.
• GMSC (Gateway MSC) – the MSC that connects the GSM network to PSTN/ISDN/other networks; for incoming calls it asks the HLR where the subscriber is.
• HLR (Home Location Register) – permanent database of every subscriber of the operator: IMSI, MSISDN, subscribed services, and the current VLR/MSC area of the user.
• VLR (Visitor Location Register) – temporary database attached to an MSC; holds data of subscribers currently roaming in its area (copied from HLR), TMSI and location area. Reduces queries to the HLR.
• AuC (Authentication Centre) – stores each subscriber's secret key Ki and runs the A3/A8 algorithms to generate authentication triplets (RAND, SRES, Kc) for authentication and ciphering.
• EIR (Equipment Identity Register) – list of IMEI numbers: white (allowed), grey (monitored) and black (stolen/blocked) handsets.

GSM frame hierarchy

GSM uses FDMA + TDMA: each 200 kHz carrier is divided into 8 time slots, gross bit rate 270.833 kbps (bit period 3.69 µs).

 Hyperframe = 2048 superframes = 3 h 28 min 53.76 s
        |
 Superframe = 26 x 51-MF = 51 x 26-MF = 6.12 s
        |
 +------------------+--------------------+
 26-multiframe       51-multiframe
 (traffic) 120 ms    (control) 235.4 ms
        |
 TDMA frame = 8 slots = 4.615 ms
 | TS0 | TS1 | TS2 | TS3 | TS4 | TS5 | TS6 | TS7 |
        |
 Time slot = 156.25 bits = 576.9 µs

Normal burst (one time slot):

|T |  Data  |S| Training |S|  Data  |T |Guard|
|3 |   57   |1|    26    |1|   57   |3 |8.25 |

• Tail bits (3+3): all zeros; let the equalizer/Viterbi decoder start and end in a known state, and give time for power ramp.
• Data (2 × 57): coded speech/data bits.
• Stealing flags (1+1): show whether the data half-burst carries traffic or has been "stolen" for FACCH signalling.
• Training sequence (26): known pattern in the middle of the burst, used by the adaptive equalizer to estimate the channel.
• Guard period (8.25 bits ≈ 30 µs): prevents overlap of bursts from mobiles at different distances.

Other bursts: frequency correction burst (FCCH, all zeros), synchronisation burst (SCH, long 64-bit training), access burst (RACH, short, long guard of 68.25 bits), dummy burst.

• 26-multiframe (120 ms): frames 0–11 and 13–24 TCH, frame 12 SACCH, frame 25 idle.
• 51-multiframe (235.4 ms): carries FCCH, SCH, BCCH, CCCH and SDCCH control channels on TS0 of the beacon carrier.