Вы находитесь на странице: 1из 153

GSM Signaling Matrix

Databases

PSTN

DTAP

BSSMAP

DTAP

RR

RIL3

RSM 08.58

RSM 08.58

BSS MAP

MAP TCAP

ISUP

TUP

BSSAP

BSSAP

RIL3

SCCP
LAPDm LAPDm

SCCP MTP Level 2 & 3 MTP Level 1 MSC A

LAPD

LAPD

MTP Level 2 ,3

Rad Int MS Air

Rad Int G.703

G.703
BSC

MTP Level 1

BTS
Abis

Company Confidential

10/4/99

Map Interfaces
A,B,C,D,E,F,G,H,I = SS7 Abis = LAPD OML = X.25 BSC MSC B

VLR
G D

VLR
C F
HLR/AUC

HLR/ AUC

Abis

BTS
OML I E

EIR
OMC SUPP H GMSC
GSMSC IWMSC

PSTN

SS7/R2

Company Confidential

10/4/99

MAP Messages - Points to be noted

MAP messages are between Switching and Database interfaces MAP messages are not present on the Air Interface Not much significance related to Drive Testing Can be useful in analyzing some Protocol failures experienced on the air interface during drive testing.

Company Confidential

10/4/99

Base Station Application Part ( BSSAP )

DTAP

BTS DTAP

BSC BSSMAP

BSSMAP

MSC BSSMAP

DTAP

Distribution Layer
BSSAP SCCP MTP

Distribution Layer BSSAP SCCP MTP

Company Confidential

10/4/99

BSSMAP & DTAP message


BSSMAP ( Base Station Subsystem Mobile Application Part)

Between BSC and MSC Linked to certain messages on the Air Interface Useful in troubleshooting certain Blocked Calls and Dropped Calls problems in conjunction with Drive Testing

DTAP (Direct Transfer Application Part)


Transparent Messages between MSC and MS Further divided into sub-categories ( MM ,CC,SMS,SS)

Company Confidential

10/4/99

BSSMAP Messages
Connectionless Messages Block Block Acknowledge Paging Reset Reset Acknowledge Reset Circuit Reset Circuit Acknowledge Resource Indication Resource Request Unblock Unblocking Acknowledge Connection Oriented Messages Assignment Complete Assignment Failure Assignment Request Candidate Response Cipher Mode Command Cipher Mode Complete Classmark Update Complete Layer 3 Information Handover Candidate Enquiry Handover Command Handover Complete Handover Detect Handover Failure Handover Performed Handover Request Handover Request Acknowledge Handover Required Reject Trace Invocation Queuing Indication
Company Confidential

10/4/99

DTAP Messages
Types of DTAP Messages*
CC

: Call control and call related SS Messages -- related to call setup and activation/deactivation of SS between .

MM : Mobility Management Messages

--- location updates, security procedures and connection management .


SS

: Non-Call related Supplementary Messages --- like call barring, call forwarding etc.

SMS : Short Message Service Messages

--- related of transmission and reception of SMS.

Company Confidential

10/4/99

DTAP Messages

MM Message Authentication Request Authentication Response CM Re-Establishment Request CM Service Accept CM Service Reject CM Service Request Identity Request Identity Response IMSI Detach Location Updating Accept Location Updating Reject Location Updating Request TMSI Reallocation Command TMSI Reallocation Complete

CC Messages Alerting Call Confirmed Call Proceeding Connect Connect Acknowledge Disconnect Emergency Setup Facility Hold Hold Acknowledge Modify Modify Complete Notify Progress Release Release Complete Retrieve Retrieve Acknowledge Setup

SS Messages Hold Hold Acknowledge Hold Reject Retrieve Retrieve Acknowledge Retrieve Reject Facility Register

SMS Messages CP-Ack CP-Data CP-Error RP-Ack RP-Data RP-Error

Company Confidential

10/4/99

Air Interface

DTAP

04.08/ 04.10

RR

04.08/ 04.10

RIL3

RIL3

LAPDm

LAPDm

Rad Int
MS

04.04

04.04 Rad Int BTS

Company Confidential

10/4/99

Radio Interface ( Layer 1 )


--- The Physical Layer on the Air interface is Radio --- Messages are sent on Radio Interface through appropriate logical channels

Functions of Layer 1
----------------Mapping of Logical Channels to Physical Channel Channel Coding Ciphering Cell Selection and Reselection Connection Establishment on Logical Channels Measurement of serving and neighbouring cells signal level Setting of Timing Advance Transmit Power Control as commanded by BTS.

Company Confidential

10/4/99

10

Radio Interface (Layer 3)


Air Interface L3 Message categories

DTAP Messages :

transparent to BTS -- CC -- MM -- SS -- SMS

RR :

Radio Resource messages specific to MS and BTS Related to testing procedures ( like loopback etc.)

Test Messages :

Company Confidential

10/4/99

11

RIL3 Messages
Message Type

DTAP
MM Message
Authentication Request Authentication Response CM Re-Establishment Request CM Service Accept CM Service Reject CM Service Request Identity Request Identity Response IMSI Detach Location Updating Accept Location Updating Reject Location Updating Request TMSI Reallocation Command TMSI Reallocation Complete

CC Messages
Alerting Call Confirmed Call Proceeding Connect Connect Acknowledge Disconnect Emergency Setup Facility Hold Hold Acknowledge Modify Modify Complete Notify Progress Release Release Complete Retrieve Retrieve Acknowledge Setup

SS Messages
Hold Hold Acknowledge Hold Reject Retrieve Retrieve Acknowledge Retrieve Reject Facility Register

SMS Messages
CP-Ack CP-Data CP-Error RP-Ack RP-Data RP-Error

Company Confidential

10/4/99

12

RIL3 Messages
Message Type

RR
Assignment Command Assignment Complete Assignment Failure Channel Mode Modify Channel Mode Modify Acknowledge Channel Release Channel Request Ciphering Mode Command Ciphering Mode Complete Classmark Change Frequency Redefinition Handover Access Handover Command Handover Complete Handover Failure Immediate Assignment Immediate Assignment Extended Immediate Assignment Reject Measurement Report Paging Request Type 1 Paging Request Type 2 Paging Request Type 3 System Information Type 1 System Information Type 2 System Information Type 3 System Information Type 4 System Information Type 5 System Information Type 6 System Information Type 2bis

Company Confidential

10/4/99

13

Mobile Phone Mode


BCCH & PCH RACH & AGCH SDCCH Initial Message Initial Message Ack

RR Idle Mode RR Connection Establishment Mode RR Connected Mode MM Connection Establishment Mode MM Connected Mode

Call Control Process

CC Release MM Release

RR Release

Company Confidential

10/4/99

14

Air Interface Communication Procedures


Non-call Related Call Related

Access Procedure
( RACH/AGCH)

Access Procedure
( RACH/AGCH)

MM CM Procedure
( SDDCH) MM Common Procedures ( SDDCH) MM Specific Procedures ( SDDCH)

MM CM Procedure
( SDDCH) MM Common Procedures ( SDDCH) CC Procedures
( SDDCH)

RR Procedures
( TCH )

Release Procedures ( SDDCH)

CC Procedures
(TCH)

Release Procedures ( SDDCH)

Company Confidential

10/4/99

15

Cell Selection & Reselection

Criteria for Camp on to a cell

Reliably
High

decode downlink data

probability of communications on the uplink

Company Confidential

10/4/99

16

Cell Selection and Reselection

Definitions

Available PLMN -- one for which at least 1 cell is unbarred and C1>0
Suitable Cell -- part of selected PLMN -- unbarred -- C1 > 0

The MS uses BA list for camp on


Company Confidential

10/4/99

17

WHAT IS CELL BARRING ?

BTS
Every Mobile has an access class on the SIM Every cell defines the Mobile classes which are barred access.

Company Confidential

10/4/99

18

USE OF CELL BARRING

Reserving Cells for Handovers.


Reserving Cells for a certain Mobile Class.

Company Confidential

10/4/99

19

Cell Selection & Reselection


In the camp on process, mobile checks for ' C 1 ' C1 ' is the path loss criteria. ' C1' calculations are done by mobile while camping On

and for cell reselection.


Cell reselection means leaving the existing cell and

selecting a new cell in the idle mode.

Company Confidential

10/4/99

20

Path Loss Criterion ' C1 '


C1 = A - max ( B,0 )

A = Average Received signal Level - Min Receive Level


B = Access Power - Max power of Mobile ( Classmark )

A = + = Good Downlink Path B = -- = Good Uplink Path


For Cell selection C1 > 0 For Cell Reselection C1 of new cell > C1 of current cell or C1

falls below 0, both for a period of 5 seconds.

Company Confidential

10/4/99

21

Mobile Camp On

A Mobile Subscriber is issued with a SIM to access the network. The SIM card has the preferred list which contains 8 PLMN codes. This list can be updated by the user The Mobile also has forbidden list , which is dynamically updated by the mobile. It has 4 PLMN codes.

Company Confidential

10/4/99

22

Camp on with preferred list


Scans 124 ARFCN's Locks on to best Searches for FCH IF Found Yes Lock on to next best No Locks on to next best in BA list Yes Cell barred 5 samples/ARFCN spread over 3 to 5 secs A

No No
C1 > 0

Read BCCH Info NC matches No

Yes CAMP ON

Yes A

Company Confidential

10/4/99

23

No preferred list
Scans 124 ARFCN's Lock on to next best Locks on to best Searches for FCH No IF Found Yes Puts PLMN in forbidden list No Successful Yes Next in BA list Stores the BA list Location Update

Read BCCH Info


Yes

Cell barred

No
C1 > 0 A

Company Confidential

10/4/99

24

Abnormal Cases
Invalid Network Response

PLMN not allowed. IMSI unknown or illegal MS

Does Cell Reselection, if still PLMN not allowed Search 30 strongest RF channels Camps on to determine next PLMN availability

If 30 RF channels are scanned and no suitable PLMN is found (provided 1 of 30 is BCCH ), Mobile goes to No SIM state .

Company Confidential

10/4/99

25

Abnormal Case
No suitable cell found

Cell reselection as per BA If no suitable cell found, then No SIM sate

Company Confidential

10/4/99

26

Abnormal Case
No SIM State

Only Emergency Calls allowed Will do Cell Reselection

Company Confidential

10/4/99

27

Mobile Frame Synchronization


The purpose of Synchronizing is to read the BCCH message Mobile gets Synchronized with the cell by SCH Mobile locates SCH with the help of FCCH FCCH Burst
TB3

Fixed Bits ( all zeros ) 142

TB3

GP

FCCH has a easily recognizable structure with all zeros Mobile knows that SCH follows FCCH The maximum time allowed for synchronization is 0.5s, and the maximum time allowed to read the BCCH data, when being synchronized with the BCCH carrier, is 1.9 secs.

Company Confidential

10/4/99

28

Mobile Frame Synchronization


SCH Burst Contains the TDMA Frame No and BSIC
TB3 Information
39 Midamble 64 Information 39

TB3

SCH Burst

Frame Number (19 Bits)

BSIC (6 Bits)

Actual Information in SCH

Superframe No 11 Bits

Multiframe No 5 Bits

SCH Frame No 3 Bits

Frame No = 11bits ( To point Superframe No out of 2048 Superframes ) 5bits ( To point Multiframe No out of 26 Mulitframes ) 3bits ( To Point out the SCH Frame No out of 5 in 1 Multiframe ) MS calculates the TDMA Frame no from this information
0 1 S 1 11 S 2 21 S 3 31 S 4 41 S 5 50

1 Multiframe
10/4/99 29

Company Confidential

Cell Reselection

Primarily based on comparison of C1 of serving and neighbor cells. In order to optimize cell reselection, C2 calculations can be optionally implemented , for which additional parameters are broadcasted on the BCCH of each cell.

Company Confidential

10/4/99

30

C2 Calculations - Parameters
CELL_RESELECT_OFFSET : ( 0 - 126 dB // 2 dB steps ) Used to achieve cell prioritization, i.e to encourage MS's to select some suitable cells in the presence of others. More useful for Multiband and Umbrella cells architecture. Applies a positive or a negative offset to each cell TEMPORARY_OFFSET : ( 0 - 60 dB // 10 dB steps) For a neighbor cell , when placed on the list of the strongest carriers by the MS, it starts a timer and applies a negative offset to the C1 of that neighbor for the duration of this timer. The offset can also be infinite, which means the cell never be selected in the reselection process. PENALTY_TIME : ( 20s to 620s // 20secs steps) The duration for which the Temporary_Offset is applied.

Company Confidential

10/4/99

31

"C2" Calculations
For Serving Cell,

C2 = C1 + CELL_RESELECT_OFFSET
If Penalty Time = 620 secs, then

C2 = C1 - CELL_RESELECT_OFFSET

Company Confidential

10/4/99

32

"C2" Calculations
For Neighbor Cells,

C2 = C1 + CELL_RESELECT_OFFSET - TEMPORARY_OFFSET(t) t = 1 , till the Penalty timer equals the set value t = 0 , after the Penalty timer has expired

If Penalty Time = 620 secs, then C2 = C1 - CELL_RESELECT_OFFSET

Company Confidential

10/4/99

33

Measurements for Cell Reselection


F S B B B B

"ON"

Measurements (optional to MS)

"ON"

P 0P 0P 0P 0

Measurements

Company Confidential

10/4/99

34

Measurements for Cell Reselection


Serving Cell

A running average of 5 measurement samples are required per receive level average value. Measurement samples should be collected over a period of : 5 secs to Max ( 5s, five consecutive paging blocks of that MS)

Neighbor Cells

A running average of 5 measurement samples are required per receive level average value of each neighbor cell. Measurement samples should be collected over a period of : 5 secs to Max [ 5s, (5*N + 6) DIV 7) * BS_PA_MFRMS / 4 ] N is the number of non-serving cell BCCH carriers in the BA list

Company Confidential

10/4/99

35

Cell Reselection - Measurements and BCCH decode


MS shall calculate the C1 and C2 for serving and non-serving cells every 5 secs. MS shall attempt to decode the full BCH data of the serving cell at least every 30 seconds. MS shall attempt to decode the BCCH data block that contains the parameters affecting cell reselection for each of the 6 strongest neighbor cell BCCH carriers at least every 5 minutes. When MS recognizes a new BCCH carrier has become one of the 6 strongest, the BCCH data for the new carrier within 30 seconds. MS shall attempt to decode the BSIC for each of the 6 strongest carriers at least 20 seconds, to confirm that it is monitoring the same cell. If the change in BSIC is detected,then the carrier would be treated as a new carrier.

Company Confidential

10/4/99

36

Cell Reselection
Cell in the same LA
C2 for new cell should exceed C2 of current cell and should

remain high for a period of 5 secs.


C1 of current cell falls below zero.

Cell reselection occurring within 15 secs, C2 of the new cell shall exceed the C2 of

the serving cell by at least 5 dB for a period of 5 secs.


The left cell on reselection shall not be returned within 5 secs if another suitable cell

can be found.

Cell in the different LA


Depends on Reselect hysteresis.

Company Confidential

10/4/99

37

Reselect Hysterisis

Reselect Hysterisis Value is broadcasted on BCCH

For the new cell in different Location Area, the value for C1 for new cell

> the C1 for serving cell by the hysterisis value broadcasts on the serving cell BCCH for a period of 5 secs.

This hysterisis is to avoid exorbitant Location Updates when the mobile

is on border of two location areas.

Company Confidential

10/4/99

38

Reselect Hysterisis
Location Area 1

C1 = 13 dB

Location Area 2 Hysterisis = 5 db C1 = 10 dB

Company Confidential

10/4/99

39

Mobile - Cell Access


Location Update Signaling Diagram
BTS
Channel Req Channel Reqd Channel Activation Chan Actvn Ack Imm Assgn Cmd Establish Ind

BSC

MSC

Immediate Assgn Loc Upd Req ( SABM )

Complete Layer 3 Info

Authentication Request
Auth Req Auth Resp Data Request Data Ind

Authentication Response

Data Request Loc Upd Accept

Loc Upd Accept Clear Command Clear Complete

Company Confidential

10/4/99

40

Mobile Cell Access

RACH

Channel Request

T3120 Re-transmission T3120


Immediate Assignment

AGCH
Reserves SDCCH

T3101 Response

Company Confidential

10/4/99

41

Immediate Assignment Procedure


BSC

BTS
Channel Request Channel Required

T3120
Channel Activation Channel Activation Ack Immediate Assign Command Immediate Assignment

T3101

Company Confidential

10/4/99

42

Message Contents
Channel Request Random Access

TB SYNCH 8 41
5 bits

Information 36

TB 3

G P
6 bits
BSIC (coded in parity bits)

3 bits
Establishment Cause

Random Reference No.

Establishment Cause
100 -- Answer to paging 101 -- Emergency Call 110 -- Call re-establishment 111 -- Originating Call 0000 -- Location Update 0001 -- IMSI Detach, SMS, SS Management 011 - Reserved for future use
10/4/99 43

Company Confidential

Message Contents
Channel Required

Channel Number --- Indicates on which channel the message was received ( RACH ) Request Reference --- Contains RACH info ( Random No, Cause ), Frame No Access Delay ---- Delay in terms of bit period ( 0- 63 ) Physical Context --- Optional for manufacturer to add more information ( RxLev etc, )
Immediate Assignment Command Channel Number --- channel on which the message is to be sent ( AGCH ) Message type --- Immediate Assignment Channel Description --- SDCCH/4 or SDCCH/8. Sub-channel Number TSC, ARFCN, Single or Hopping, HSN Mobile Allocation Table Request Reference --- Contains RACH info ( Random No, Cause ), Frame No Timing Advance ---- Timing Advance value ( 0 -63 ) Mobile Allocation --- MAI table if hopping is used Starting time --- TDMA Frame No if frequency for new channel changes ( NC - case )

Company Confidential

10/4/99

44

Message Contents
BTS
Channel Request
Channel Request Immediate Assign Command Immediate Assign Extended

BSC

Immediate Assignment Command

Immediate Assignment Extended


Channel Description 1 Request Reference 1 Timing Advance 1 Channel Description 2 Request Reference 2 Timing Advance 2 Mobile Allocation Starting time

Channel Number -- AGCH Message type -- Immediate Assign Extended Channel Description 1 Request Reference 1 Timing Advance 1 Channel Description 2 Request Reference 2 Timing Advance 2 Mobile Allocation Starting time
Company Confidential

10/4/99

45

Immediate Assignment Procedure Completion


BTS
Channel Request

RACH

AGCH Stops

Immediate Assign Command

T3120
Initial MS message

SDCCH

(Location Update Request CM Service Request Paging Response CM Reestablishment Request IMSI Detach)

Company Confidential

10/4/99

46

Abnormal Cases
No Channel ( SDCCH ) available
BTS Channel Request Channel Required Immediate Assignment Reject Stops T3120 Starts T3122 Immediate Assignment Reject Request Reference 1 -- EC, Ref no, Fr.No Wait Indication -- T3122 ......... Request Reference 5 -- EC, Ref no, Fr.No Wait Indication -- T3122 Immediate Assign Command BSC

Immediate Assignment Command


Channel Number -- AGCH Message type -- Immd Assgn Reject Request Reference 1 -- EC, Ref no, Fr.No Wait Indication -- T3122 ......... Request Reference 5 -- EC, Ref no, Fr.No Wait Indication -- T3122

Company Confidential

10/4/99

47

Abnormal Cases

Lower Layer Failure on MS before establishment on SDCCH


----Allocated Channels are released MS returns to Idle Mode Transaction is process are aborted Cell reselection may take place

Timer T3101 on Network expires before MS responses -- Allocated Channels are released -- Request Forgotten

Company Confidential

10/4/99

48

RACH Collisions
TWO Mobiles Send RACH at same Frame No with same Reference No and EC

If both strong
No

YES

One may reach and one may not reach Network assigns AGCH with the same RRN Both will tune to SDCCH One will release the channel during setup
Company Confidential

Both rejected and follow the Re-transmission Process

10/4/99

49

ALOHA Process

RACH T3120

RACH

Rejected
T3120

Re-transmission

AGCH

AGCH

T3120 = 3 - 12,14,16,20,25,32,50 RACH Slots Maximum Re-transmission = 1,2,4,7 For every Re-transmission T3120 is randomly generated
Company Confidential

10/4/99

50

RACH Collision ( B )
-- One RACH reaches one does not

RACH RACH Both Wait for AGCH Immediate Assignment Both tune to SDCCH SABM ( Initial Message ) SABM ( Loc Upd Req ) UA ( Initial Message ) UA ( Initial Message ) DROPS ( since IMSI mismatches )

Initial Message = IMSI

Company Confidential

10/4/99

51

MM - Common Procedures
TMSI Reallocation Procedure

Authentication Procedure
Identification Procedure

Ciphering *
IMSI Detach Procedure

* Ciphering is not a MM procedure, but since it is linked with other


procedures discussed here , it is covered in this section

Company Confidential

10/4/99

52

TMSI Reallocation

Loc Upd ( IMSI ) TMSI Allocation Call Setup ( TMSI )

TMSI Reallocation

Company Confidential

10/4/99

53

TMSI REALLOCATION
Purpose

Provide identity confidentiality

Operational Requirements

TMSI is an unambiguous identity associated with LAI Must be performed at change of Location Areas Initiated in ciphered mode Can also be associated with some other procedure

Company Confidential

10/4/99

54

TMSI REALLOCATION
MSC
TMSI Reallocation Command

T3250

TMSI Realacation Complete

Stops T3250

TMSI Reallocation Complete No Elements

TMSI Reallocation Command Location Area Identification Mobile Identity : TMSI / IMSI

Company Confidential

10/4/99

55

MM - Common Procedures
Authentication
Purpose -- To verify Subscriber Identity ( IMSI and SIM ) -- To provide a new ciphering key to the Mobile Station Operational Requirement -- at each registration -- at every call attempt ( MOC & MTC ) ( left to operators , but should be done for visiting subscribers ) -- before performing some supplementary services activation, de-activation, registration or erasure -- required for Location Updating for roaming -- not mandatory prior to IMSI Attach and Detach Authentication process is always initiated and controlled by the network

Company Confidential

10/4/99

56

MM - Common Procedures
Authentication Ki RAND Ki

RAND

A3

A3
SRES SRES

=
10/4/99 57

Company Confidential

MM - Common Procedures
Authentication
MSC
Authentication Request

T3260

Authentication Response

Authentication Request

Stops T3260

Ciphering Key Sequence No -- Values ( 0-6 ) , 7 = No key Authentication Parameter RAND - 128 bits Random Number Authentication Response Authentication Parameter SRES -- 32 bits Signed Response

Company Confidential

10/4/99

58

MM - Common Procedures
Unsuccessful Authentication Authentication Reject BTS
Data Request
Authentication Req Authentication Resp Data Indication Authentication Resp Data Request Authentication Rej

BSC
Authentication Req

MSC T3260

Invalid SRES
Stops T3260

Authentication Rej

Sets Authentication Failure Flag Waits for Connections to be released Delete its TMSI,LAI,Ciphering Key, CKSN Return to IDLE no IMSI state

RR- Connection All MM-Connections Release procedure Released initiated

Authentication Reject No elements

Company Confidential

10/4/99

59

MM - Common Procedures
Abnormal Cases
Expiry of timer T3260 MSC Authentication Request Starts T3260 Authentication Request T3260 Expires Re-Starts T3260

Authentication Reject

T3260 Expires
RR - Connection Release Procedure initiated

Company Confidential

10/4/99

60

MM - Common Procedures
Identity Check

Identity Check ( IMEI ) Sends IMEI

EIR

White listed / Grey listed / Black listed ?????

Company Confidential

10/4/99

61

MM - Common Procedures
Identification

MSC requests the Mobile to send its identity , for verification Identity could be IMSI, TMSI,IMEI IMEI shall only be sent in ciphered mode MSC
Identity Request

T3270

Identity Response

Stops T3270 Identity Response Mobile Identity

Identity Request Identity type : IMSI / IMEI / TMSI

Company Confidential

10/4/99

62

MM - Common Procedures
Identification Abnormal Case
Expiry of timer T3270 MSC Identification Request

Starts T3270
Identification Request T3270 Expires Re-Starts T3260 T3270 Expires
Releases RR - Connection

Company Confidential

10/4/99

63

MM - Common Procedures
Ciphering
Purpose -- privacy of speech and data -- privacy of signaling information

Operational Requirements -- Implementation dependent -- Ciphering should be done before confidential signaling information is passed ( Called Number, Calling Number, TMSI )

* Note : IMSI and IMEI are also confidential signaling information ,but they require physical protection

Company Confidential

10/4/99

64

MM - Common Procedures
RAND
Ki Ciphering

A8
Frame No

Kc

A5

Ciphering Stream Information Bits ( 114 )

XOR Ciphered Bits


10/4/99 65

Company Confidential

MM - Common Procedures
Ciphering
BTS
Encryption Cmd Cipher Mod Cmd Start ciphering & deciphering correct L2 frame Ciph Mod Comp

BSC
Cipher Mod Cmd

MSC

start deciphering

start ciphering
Data Indication Cipher Mode Comp

Cipher Mode Command


Cipher Mode setting : No Ciphering Start Ciphering

Encryption Command
Channel Number Encryption Information : Algorithm Identifier Key L 3 Information

Cipher Mode Command


Layer 3 Header Information Algorithm Identifier : No encryption/ A5 / 1 Key : Ciphering key

Cipher Mode Complete


No Elements

Company Confidential

10/4/99

66

MM - Common Procedures
Ciphering Key Sequence No ( CKSN )

Authentication Request ( RAND + CKSN )


Ki A3/A8 Authentication Response ( SRES )

Network
( CKSN )

FNo ( Kc + CKSN )
( stored in SIM )

( stored in MSC/VLR

Channel Request Immediate Assignment Initial Message ( CKSN ) If CKSN Checked , No authentication

Network

Company Confidential

10/4/99

67

IMSI Detach Procedure


Purpose

To mark the Mobile as inactive in the network

Conditions

Mobile Station Power down SIM is removed

Operation

If no RR-connection exists, RR-connection will be first established If RR-connection exists, then all MM - connections will be first released If Location Update procedure is On, than it will be finished, then this procedure will be started

Company Confidential

10/4/99

68

IMSI Detach Procedure


MSC
IMSI Detach Indication

Starts T3220

Marks MS as detached in VLR Will not sent any page

Wait for RR-Connection Release If T3220 expires, MS will localy release RR-Connection

IMSI Detach Indication


PD : MM TI : 0 MT : IDI Mobile Station Classmark 1 Mobile Identity

Abnormal Case
RR-Connection cannot be established or RR-

Connection is lost before message is sent, then the IMSI detach is aborted by the MS

Company Confidential

10/4/99

69

Importance of Location Area

L.Area = 1

L.Area = 2

L.Area = 3

Reduce Paging Load Resource Planning

Company Confidential

10/4/99

70

What is Location Update ?


MSC should know the Location of the Mobile for paging. Mobile is continuously changing Location Area. Mobile when changes Location Area informs the MSC about its new L.A Process of informing MSC about new Location Area is Location Update

Location Update

L.Area = 1

L.Area = 2

L.Area = 3

Company Confidential

10/4/99

71

Location Updating Procedure


IMSI Attach

-- Power on in same LAI -- Compliment to Explicit IMSI Detach


Normal Location Update

-- Change in LAI due to mobility -- Power on in new LAI -- MS unknown in VLR as a response to Connection establishment request
Periodic Updating

-- Expiry of Periodic Update Timer ( T3212 ) -- In the event of MS out of Service , on exit, MSC will mark it as Implicit Detach in the VLR -- Timer is reset to "0" on any Loc Update, first MM message recd , MS responded to page, on expiry of timer

Company Confidential

10/4/99

72

Location Update Procedure


Location Update is done at VLR or VLR and HLR Update at VLR -- When MS roams into a new Location Area -- Periodically Update at HLR -- When MS registers in a new VLR -- When MS registers in the same VLR, but MSC Location Area has changed and HLR requires new routing information -- On HLR or VLR Restoration

Company Confidential

10/4/99

73

Location Update Signaling Diagram


BTS
Channel Req Channel Reqd Channel Activation Chan Actvn Ack Imm Assgn Cmd Establish Ind

BSC

MSC

Immediate Assgn Loc Upd Req ( SABM )

Complete Layer 3 Info

Authentication Request
Auth Req Auth Resp Data Request Data Ind

Authentication Response

Data Request Loc Upd Accept

Loc Upd Accept Clear Command Clear Complete

Company Confidential

10/4/99

74

Location Update Procedure


BTS
( SABM ) Loc Upd Req Establish Indication

BSC
( CR )Comp Layer 3 Info

MSC

Starts T3210
( UA ) Loc Upd Req

MM - Security Procedures
Data Request Loc Upd Accept Loc Upd Accept

Stops T3210 Loc Upd Request : MS Identity(IMSI/TMSI), Classmark, and OLD LAI

Company Confidential

10/4/99

75

Location Update Procedure


Abnormal Cases
Location Update Rejection BTS BSC
Loc Upd Reject

MSC

Data Request Loc Upd Reject

Stops T3210 Stores the Reject Cause Starts T3240

Location Update Reject Reject Cause -- IMSI Unknown


-- PLMN not allowed -- LA not allowed -- TMSI not allocated

Waits for n/w to release RR-Connection Upon release of RR-Connection, take necessary action based on Reject Cause

Company Confidential

10/4/99

76

Location Update Procedure


Abnormal Cases on MS side
Random Access Fails

No response to RACH after max_retransmissions Timer T3213 is started MS goes for a cell reselection, with return to cell inhibited for 5 secs After 5 secs , the MS returns to the cell where Random access failed On expiry, procedure is initiated again

Company Confidential

10/4/99

77

Mobile Originated Call


Channel Request Immediate Assign Service Request Authentication Ciphering Set Up Call Proceeding Assignment Alerting

Connection

Company Confidential

10/4/99

78

CC - Call Establishment Procedures


Mobile Originated Call
MS
Channel Req

BTS
Channel Reqd Channel Actvn Chan Actvn Ack Imm Assgn

BSC

MSC

Imm Assgn CM Serv Req

Establish ind

CL3 Informtn

Authentication CM Service Accept Cipher Mode Setting and TMSI Reallocation Set Up Call Proceeding Assgn Cmd Assign Comp Assgn Cmd Assgn Req

Assign Comp
Alert Connect Connect Ack Speech

Assign Comp

Company Confidential

10/4/99

79

CC- Call Establishment Procedure


Service Request
CM Service Request

MSC

Starts T3230 & T303


CM Service Accept

Stops T3230 CM Service Request

CM Service Accept

PD : MM TI : 1-7 MT : CSR
--- No Information Elements

PD : MM TI : 1-7 MT : CSR CM Service Type : MOC , Emergency Call, SMS transfer, SS activation Ciphering Key Sequence Number : 000 - 111 Mobile Station Classmark 2 : Power , Revision , Encryption,Frequency, SMS Mobile Identity : IMSI, TMSI , IMEI

Company Confidential

10/4/99

80

CC - Call Establishment Procedures


Abnormal Case
CM Service Rejection MSC

CM Serv Reject

Stops T3230 Network starts RR connection release

CM Service Reject Reject Cause


#4 : IMSI unknown in VLR #17 : Network Failure #22 : Congestion #32 : Service Option not supported #33 : Requested Service option not subscribed #34 : Service option temporarily out of order #38 : Call cannot be identified
10/4/99 81

T3230 Expires -- Mobile aborts the RR connection

Company Confidential

CC - Call Establishment Procedures


SETUP
MSC
Setup

Call Proceeding

Stops T303 Starts T310

Call Proceeding
PD : CC TI : 1-7 MT : CP Repeat Indicator : Used for in-call modification procedure Bearer Capabilities : Included if the network has to specify the connection element Progress Indicator : *

Setup

PD : CC TI : 1-7 MT : S Bearer Capabilities : * Mobile Identity : IMSI, TMSI , IMEI Calling Party Sub-Address : X.213 / ISO 8348 AD2 coding , user specifed coding Called Party Sub-Address : X.213 / ISO 8348 AD2 coding , user specifed coding User -User : Convey information between the MS & the remote ISDN user. *

* Detailed Information follows


Company Confidential

10/4/99

82

CC - Call Establishment Procedures


Abnormal Cases Invalid Call Information
MSC
Setup

Release Complete

Stops T303
Releases the MM connection Returns to Idle Mode

Release Complete
PD : CC TI : 1-7 MT : RC Cause : See next page

Company Confidential

10/4/99

83

CC - Call Establishment Procedures


1 Unassigned ( unallocated) number 3 6 16 17 18 19 21 22 26 27 28 29 30 31 34 38 41 42 43 No route to destination Channel unacceptable Normal clearing User busy No user responding User alerting, no answer Call rejected Number changed Non selected user clearing Destination out of order Invaid num format( incomplete num ) Facility Rejected Response to Status Enquiry Normal, unspecifed No circuit / channel available Network out of order Temporary failure Switching equipment congestion Access information discarded 44 requested circuit/chan unavailable 47 49 50 57 58 63 65 69 70 79 81 88 91 95 127 Resources unavailable,unspecified Quality of Service unavailable Requested facility not subscribed Bearer Capability not authorized Bearer Capability not presently available Service or option not available Beare Service noit implemented Requested facility not implemented Only restricted data capability available Service or option not implemented Invalid transaction identifier value Incompatible destination Invalid transit network selection Invalid message, unspecified Interworking, Unspecified # 96 - # 101 = Protocol error 102 Recovery on timer expiry

Company Confidential

10/4/99

84

CC - Call Establishment Procedures


Channel Assignment

MSC
Assignment Command

TCH
Assignment Complete

( FACCH )

Company Confidential

10/4/99

85

CC - Call Establishment Procedures


Assignment Command
PD : RR TI : 0 MT : AC Channel Description Channel type & TDMA offset
00001 0001T 001TT 01TTT

-- TCH / F -- TCH / H -- SDCCH/ 4 -- SDCCH/ 8 T indicates the subchannel

Channel Mode : signaling only, speech full rate, speech half rate Data- 9.6 / 4.8 / 2.4 kbps full Data- 9.6 / 4.8 / 2.4 kbps half

Timeslot Number : 0 - 7 TSC : BCC - 0 - 7 Hopping Channel : Single , Hopping Channel Selector : For single Channel -- Band Number, ARFCN For Hopping Channel -- MAIO ( 0 - 63 ), HSN ( 0 - Cyclic 1 - 63 = Algorithm ) Power Command : Power Level ( 0 to 31 ) Cell Channel Description : Used to decode the Mobile Allocation table Mobile Allocation table

Company Confidential

10/4/99

86

CC - Call Establishment Procedures


Abnormal Cases

MSC
Assignment Command

SDCCH
Assignment Complete

( SDCCH )

Assignment Failure
PD : RR TI : 0 MT : AF RR Cause : No cell allocation available Invalid Message Invalid Information element contents Protocol Error

Company Confidential

10/4/99

87

CC - Call Establishment Procedures


Alerting

MSC
Alerting

Stops T310

Alerting
PD : CC TI : 1 -7 MT : A Progress Indicator : Coding standard - Q.931 , GSM Location - connected element ( explained earlier ) Progress Indicator - In band information or appropriate pattern ( RBT,BT ) now available

Company Confidential

10/4/99

88

CC - Call Establishment Procedures


Call Connection

MSC
Connect Connect Acknowledge

Connect

PD : CC TI : 1 -7 MT : C PD : CC TI : 1 -7 MT : C Progress Indicator : ---- no information elements Coding standard - Q.931 , GSM Location - connected element ( explained earlier ) Progress Indicator - In band information or appropriate pattern ( RBT,BT, Connection tone ) now available

Connect Acknowledge

Company Confidential

10/4/99

89

Emergency Calls
-- GSM Specs define ' 112' as emergency number

-- '112' is accessible with or without SIM


-- Without SIM it is sent on the best channel

-- Mobile on sensing '112' sets the establishment cause to emergency call in the RACH
-- Routing of this call can be done to a desired location defined in the Switch.

Company Confidential

10/4/99

90

CC - Call Establishment Procedures


Service Request

Emergency Calls
MSC
CM Serv Request CM Service Accept Emergency Setup

Call Proceeding

CM Serv Request
PD : MM TI : 1-7 MT : CSR CM Service Type : Emergency Call CKSN : 000 - 111 Mobile Station Classmark 2 : Mobile Identity : IMSI, TMSI , IMEI

Emergency Setup
PD : CC TI : 1-7 MT : CSR Bearer Capability : Only significance is for full rate/ half rate speech coding

Company Confidential

10/4/99

91

CC - Call Establishment Procedures


Call Re-establishment
MSC
CM Re-estb Request CM Service Accept
Assignment Command (TCH)

Conditions:

Call Re-establishment should be allowed in the cell Occurs only on lower layer failure ( RF Link ) Mobile should be in active mode on TCH New cell should be in the same BSC Re-establishment will occur within 20 secs

Company Confidential

10/4/99

92

Paging

Paging is process by which Mobile receives incoming calls Mobile has to monitor the paging channel to receive paging messages Mobile will not monitor all paging channels, it will monitor the channel specific to its CCCH_Group and Paging Group

CCCH_ GROUP

BCCH defines the number of PCHN ( timeslots ) supporting CCCH CCCH can be allocated only to TN 0,2,4,6 CCCH will have the same structure on all allocated timeslots ( 9 blocks ) Each PCHN supporting CCCH is alloted a CCCH_Group No ( range : 0 .. 3 ) Each CCCH_Group carries its own group of Mobiles. Mobiles will listen to paging messages and send RACH's only in their specific group

0 1 2 3 4 5 7 6

B D C T C T C T 9 b l o c k s 9 b l o c k s 9 b l o c k s 9 b l o c k s

Company Confidential

10/4/99

93

Paging Group

Within the CCCH_Group , Mobile listen to paging in specific paging (CCCH) blocks only The block specific to a mobile is its Paging Group

T N
D 1

F S B C F S C C F S C C F S C C F S C C I 0

I S B C I I C C I I C C I I C C I I C C I 2 T 3

I S B C I I C C I I C C I I C C I I C C I 4 T 5

I S B C I I C C I I C C I I C C I I C C I 6 T 7

C C C H _ G R O U P

P a g i n g G r o u p

Company Confidential

10/4/99

94

Paging
How to derive CCCH_Group and Paging Group for a mobile ?

Let us understand some parameters required to achieve this .

1. BS_CC_CHANS : Total No of PCHN supporting CCCH ( Sys Info Type 3 ) Range : 1 - 4 2. BS_AG_BLKS_RES : Blocks reserved for AGCH 3. BS_PA_MFRMS : Multiframe Repetition rate

4. IMSI : 15 digit Mobile Identity

We will now understand 2 & 3

Company Confidential

10/4/99

95

Paging
BS_AG_BLKS _RES

5 1 F r a m e C o m b i n e d ( B + D ) M u l t i f r a m e S t r u c t u r e [ T N 0 ]

F S B C F S C C F S D D F S D D F S A A I

5 1 F r a m e M u l t i f r a m e N o n C o m b i n e d ( B ) s t r u c t u r e [ T N 0 ]

F S B C F S C C F S C C F S C C F S C C I

A d d i t i o n a l P C H N s u p p o r t i n g C C C H ( B + C )

I I B C I I C C I I C C I I C C I I C C I

Each BCCH and CCCH block = 4 Frames CCCH = AGCH + PCH For Non-Combined & B+C, CCCH = 9 For Combined , CCCH = 3

Company Confidential

10/4/99

96

Paging
BS_AG_BLKS _RES --- Some CCCH Blocks can be reserved for AGCH --- This parameter broadcasted on BCCH informs the Mobile about the number of blocks reserved for AGCH The value for Non-Combined MF structure ranges between 0 - 7 For combined MF structure it ranges between 0-2 Example

5 1 F r a m e C o m b i n e d ( B + D ) M u l t i f r a m e S t r u c t u r e [ T N 0 ]

F S B C F S C C F S D D F S D D F S A A I

5 1 F r a m e M u l t i f r a m e N o n C o m b i n e d ( B ) s t r u c t u r e [ T N 0 ]

F S B C F S C C F S C C F S C C F S C C I

A d d i t i o n a l P C H N s u p p o r t i n g C C C H ( B + C )

I I B C I I C C I I C C I I C C I I C C I
* Each Paging block ( P ) is a paging group
Company Confidential

10/4/99

97

Paging
Available Paging Blocks on 1 CCCH_Group
Available Paging Blocks = CCCH Blocks -- bs_ag_blks_res
Maximum AGCH Reservation for Non-Combined = 7 Available Paging Blocks = 2 Maximum AGCH Reservation for Combined = 2 Available Paging Blocks = 1 Mimimum AGCH Reservartion for Non-Combined = 0 Available Paging Blocks = 9 Minimum AGCH Reservation for Combined =0 Available Paging Blocks = 3 No of Paging Blocks will have a range of 1 - 9
10/4/99 98

Company Confidential

Paging
BS_PA_MFRMS
-- No of Multiframes after which Same Paging Group is repeated -- This Parameter is broadcasted on BCCH -- Ranges between 0 -- 9 Multiframes

F S B A F S A A F S A A F S A A F S I P 0 P 1

M F 2

F S B A F S A A F S A A F S A A F S I P 2 P 3

M F 3

F S B A F S A A F S A A F S A A F S I P 0 P 1

Mobile belonging to Paging Group P0 will remain idle during P1 ,P2,P3 Mobile utilizes power only during PO. This is known as DRX
Company Confidential

10/4/99

99

Paging
Total No of Paging Groups on 1 CCCH_Group ( N )

No of Paging Groups = Paging Blocks x Repitition of Paging BLock N = [ CCCH - bs_ag_blks_res ] x bs_pa_mfrms

Range of Paging Groups on 1 CCCH_Group


Minimum Available Paging Groups = Min Pag blocks x Min bs_pa_mfrms = 1 x 1 = 1 Maximum Available Paging Groups = Max Pag blocks x Max bs_pa_mfrms = 9 x 9 = 81

Company Confidential

10/4/99

100

Paging
How does a Mobile knows it CCCH_Group Paging Group No ?

CCCH_Group = [ ( IMSI mod 1000 ) mod ( BS_CC_CHANS x N ) ] div N

Pag Grp No = [ ( IMSI mod 1000 ) mod ( BS_CC_CHANS x N ) ] mod N

N = Total Paging Groups = No of Paging Blocks x bs_pa_mfrms

Company Confidential

10/4/99

101

Would you like to do an exercise ?

Calculate the CCCH_Group & Paging group for a Mobile with IMSI 404001234765898 in a cell with 2 PCHN's for CCCH and 7 blocks reserved for AGCH, and paging group repetition is after 5 multiframes ?

C=1 & P=8

Company Confidential

10/4/99

102

Paging
Paging Procedures

M S C B S C B T S

f o r c e l l s o f L A I ( I M S I / T M S I , I M S I , L A I ) P a g i n g C o m m a n d
( I M S I o r T M S I , P a g G r p N o )

P a g R e q C a l c u l a t e s P a g G r p N o P a g i n g T y p e 1 / 2 / 3

BTS packs some paging requests and sends them together in Paging

Requests messages on Air Interface. The Mobile on the other hand listens to it corresponding Paging Group On getting a Paging Message belonging to its IMSI/TMSI it sends a response

* Detailed Paging Procedure will be explained with Mobile Terminated Calls


Company Confidential

10/4/99

103

Paging
Packing of Paging Requests Paging Request Type 1 Paging Request Type 2 Paging Request Type 3 Paging Mode Normal mode : Paging Message is specific Paging Group only Full Mode : Paging Message for that group can occur in any Paging Block Extended : If paging message has more data, it follows in next block -----> -----> -----> 2 IMSI or 2 TMSI 2 TMSI and 1 IMSI or TMSI 4 TMSI

Company Confidential

10/4/99

104

Mobile Terminated Call


P a g i n g C h a n n e l R e q u e s t I m m e d i a t e A s s i g n P a g i n g R e s p o n s e A u t h e n t i c a t i o n C i p h e r i n g S e t U p C a l lC o n f i r m e d A s s i g n m e n t A l e r t i n g C o n n e c t i o n
Company Confidential

10/4/99

105

Mobile Terminated Call


MS
Paging Request
Channel Req

BTS
Paging Command Channel Reqd Channel Actvn Chan Actvn Ack Imm Assgn Establish ind CM Service Accept Security Procedures Set Up Call Proceeding TCH Assignment Alert Connect Connect Ack Speech

BSC
Paging

MSC

Imm Assgn Paging Response

CL3 Informant

Company Confidential

10/4/99

106

Paging
BTS BSC
Paging Command Paging Request 1/2/3 Paging

MSC

Starts T3113
Paging

Paging Request 1

PD : RR TI : 0 MT : PR Page Mode : Normal, Extended Re-organization, Same as before Mobile Identity : IMSI, TMSI Mobile Identity : IMSI, TMS --------------------------------------------------------------------------------

Message Type : P IMSI : 15 digits TMSI : ( omitted if not used ) Cell Identifier List : Cell Id Discrimtr - CGI,LAC & CI, CI,LAC, All cells

Paging Request 2
TMSI TMSI Mobile Identity : IMSI, TMSI

Paging Request 3
TMSI TMSI TMSI TMSI
Company Confidential

Paging Command
Channel Number : PAGCH Paging Group :

10/4/99

107

Paging Response
BTS
Paging Request 1/2/3 Channel Request Immd Assign
( SABM )Paging Response ( UA )Paging Response Establish Indication Complete L3 Info

BSC
Paging

MSC

Starts T3113

Paging Response

Stops T3113

PD : RR TI : 0 MT : PR Ciphering Key Sequence Number : 000 - 111 Mobile Station Classmark 2 : Power , Revision , Encryption,Frequency, SMS Mobile Identity : IMSI, TMSI , IMEI Abnormal Case
T3113 Expires : --- Paging message is retransmitted --- No of retransmission and the value of T3113 are implementation dependent

Company Confidential

10/4/99

108

CC - Call Establishment Procedures


SETUP
MSC
Setup Call Confirmed

Setup
PD : CC TI : 1-7 MT : S Bearer Capabilities : * Mobile Identity : IMSI, TMSI , IMEI Calling Party BCD Number : Number of the calling party User -User : Convey information between the MS & the remote ISDN user. *

Call Confirmed
PD : CC TI : 1-7 MT : CP Repeat Indicator : Used for in-call modification procedure Bearer Capabilities : Included if the network has to specify the connection element

* Detailed explained earlier in MOC


109

Company Confidential

10/4/99

Alerting
MSC
Alerting Connect Connect Acknowledge

Alerting
PD : CC TI : 1 -7 MT : A Progress Indicator : Coding standard - Q.931 , GSM Location - connected element ( explained earlier ) Progress Indicator - In band information or appropriate pattern now available

Company Confidential

10/4/99

110

Active Mode Procedures


Mobile in Active Mode

-- Mobile receives the signal strength of the serving cell -- Mobile transmits -- During the Idle timeslots measures signal strength of neighbor

0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 I I I I I I I 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 B T S

5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 0 1 2 3 4 5 6 7 0 I I I I I I I

Measurement Period Available to Mobile


End of Reception to start of Transmission is = 2 Timelsots End of Transmission to start of Reception is = 4 Timeslots End of Transmisson in 25th frame to start = 12 Timelsots of reception in 1st frame in next MF --- Mobile does measurement of neighbors in last two cases only

Company Confidential

10/4/99

111

Measurements in Active Mode


Measurements are made over each SACCH multiframe . SACCH multiframe is 104 TDMA frames(480ms) for TCH and 102 TDMA frames (470.8ms) for a SDCCH. MS shall make a RxLev measurement in every TDMA frame on at least one of the BCCH carriers indicated in the BA one after another . Measurements on the frame preceding the idle frame may be optionally omitted to allow more time to MS for BCCH synchronization. If frequency hopping is used and if BCCH carrier is in the hopping sequence and PWRC indicator is set , then the BCCH carrier bursts will not be used in the averaging process for RxLev, but for RxQual it will be used. Measurements made during the previous recording period are to be discarded.

Company Confidential

10/4/99

112

Measurements in Active Mode


Full and Sub
Rxlev_Full & RxQual_Full : Measurements taken over full set of TDMA frames Full set of TDMA frames : 102 for SDCCH Full set of TDMA frames : 104 TCH

Rxlev_Sub & RxQual_Sub : Measurements taken over subset of TDMA frames If even one frame is not transmitted in the measurement period, then it is considered as subset of TDMA frames.

When are sub measurements done practically ?


When DTX used, and the receiver enters the DTX mode , then the measurement is done over all the frames is not valid. With DTX, if there is completely no speech for 480ms, then still there will be 8 frames of SID and 4 frames of SACCH, these 12 subset frames will be used for sub measurements . DTX is not used on BCCH carrier (all timeslots) , hence if the call is on a TCH which is on a BCH carrier, then it will always be FULL, and in the measurement report both Sub and Full values will be same. DTX is not used on the SDCCH also , hence the above clause applies to this also. On a TCH carrier, when DTX was used by the BTS in the previous 480ms period, measurement is Sub, else it is full. If Frequency Hopping was used, and BCH carrier was a part of it, and dowlink power control is used, then the measurements for Rx_Lev will always be sub ( since BCH carrier frames are not included in the measurement averaging)

Company Confidential

10/4/99

113

Mobile in Active Mode


--- Mobile also has to verify Neighbor ARFCN by decoding BSIC --- BSIC can be decoded by getting SCH of neighboring cells which is on its TS 0 --- Mobile uses the Idle time slot to locate TS0 of neighbor Will the mobile hit SCH on TS0 of neighbor ? --- TCH MF is 26 and CCH MF is 51 ( non-divisible ) --- Sliding Multiframe Cycles helps mobile in getting SCH ( next pg ) --- As seen, Within 11 cycle, idle TS will align with SCH ( about 1.2 seconds ) --- Within 10 secs mobile will be able to decode BSIC of 6 neighbors --- MS shall keep on decoding the BSIC for each carrier at least one in 10s

T C H u l t i f r a e 2 5

T T T T T T T T T T T T A T T T T T T T T T T T T I

0 T 2 3 4 5 6 7 0 I I I I I I I

Company Confidential

10/4/99

114

Sliding Multiframe Cycle

C C C C F S C C C C C C C C F S C C C C C C C C I F S B B B B C C C C F S C C C C C C C C F S C C C C

T T T T T T T T T T T T A T T T T T T T T T T T I T T T T T T T T T T T T A T T T T T T T T T T T T

I T T T T T T T T T T T T A T T T T T T T T T T T I T T T T T T T T T T T T A T T T T T T T T T T T T

T I T T T T T T T T T T T T A T T T T T T T T T T T T I T T T T T T T T T T T T A T T T T T T T T T T

T T I T T T T T T T T T T T T A T T T T T T T T T T T I T T T T T T T T T T T T A T T T T T T T T T T

T T T I T T T T T T T T T T T T A T T T T T T T T T T T I T T T T T T T T T T T T A T T T T T T T T T

T T T T I T T T T T T T T T T T T A T T T T T T T T T T T I T T T T T T T T T T T T A T T T T T T T T

T T T T T I T T T T T T T T T T T T A T T T T T T T T T T T I T T T T T T T T T T T T A T T T T T T T

T T T T T T I T T T T T T T T T T T T A T T T T T T T T T T T T I T T T T T T T T T T T T A T T T T T

1 3 2 5
T T T T T T T T T T T A T T T T T T T T T T T T I T T T T T T T T T T T T A T T T T T T T T T T T T I

Company Confidential

10/4/99

115

Measurement Reporting
--- Mobile sends the measurement report to the BTS in every SACCH Frame --- Measurement Report is of 18 octets and takes 4 SACCH bursts --- It takes 480ms to send 1 Measurement Report

T C H M u l t i f r a m e 2 T C H M u l t i f r a m e 1 2 5 0 2 5

T T T T T T T T T T T T A T T T T T T T T T T T T I T T T T T T T T T T T T A T T T T T T T T T T T T I

1 2 0 m s

Company Confidential

10/4/99

116

SACCH Report From Mobile


Layer 1 Header

--- MS Tx Power Level --- Timing Advance


Serving Cell ------------BCCH Indicator DTX( indicates whether DTX was used by the MS in measurement period) RXLEV ( 0 - 63 ) = ( -110dbm to -48dbm ) RXQUAL ( 0 - 7 ) = ( > 0.2 % to 12.8 % )

Neighbouring Cells ( 6 ) ------------

No of cells measured RXLEV of each cell ( 0 - 63 ) = ( - 110dbm to -48dbm ) ARFCN of each cell BSIC of each ARFCN

The MS has to take at least 32 samples for each measurement

Company Confidential

10/4/99

117

Measurement on BTS
Measurement Result from BTS
--- BS Power --- Received Signal Strength on Uplink ( --110dbm to -48dbm ) --- Receive Quality on Uplink ( BER >0.2 % to 12.8 % ) --- Layer 3 MS Info ( Measurement Report send by MS ) --- Layer 1 MS Info ( MS Power & Timing Advance )

The BTS has to take at least 32 samples for each measurement of RxLev and RxQual

Company Confidential

10/4/99

118

Measurement Averaging
--- The BSC Averages the Measurement received after a set period ( Hreqave ) --- The averaging could be following types :

Unweighted Average Weighted Average

Modified Median

Hreqave : Averaging Period for Rxlev,Rxqual & Timing Advance ( In terms of SACCH Frames ( 480ms ). Range : ( 1, 31 )

Company Confidential

10/4/99

119

Exercise !!!
23 1 0 2 9 8 9 0 9 6 -1 0 1 1 0 0 9 8 3 4 5 6 7 8 9 1 0 5 2 6 5 1 5 5 5

R e p o r t R N 2 N 3 N 4 N 5 N 6 N 7 N 8 N 9 x q u a lR x l e v ( s )N 1 M S > B T S N u m b e r ( S A C C H )1 2 9 8 9 7 9 0 9 4 -1 0 2 -9 8 1 0 0

-9 7 9 4 9 9 -1 0 1 1 0 2 9 9 1 0 2 9 6 9 9 9 7 - 9 6 9 7 1 0 0 1 0 4 9 9 1 0 1 1 0 5 1 0 0 1 0 0 9 9 9 9 -- 9 7 9 8 1 0 3 9 5 - 9 6 9 9 - - 9 6 9 9 1 0 2 9 7 9 8 - 9 4 9 7 - - 9 4 9 8 1 0 0 1 0 4 1 0 3 9 9 9 6 9 4 -- 9 4 9 6 1 0 4 9 5 - 9 5 9 5 9 9 - 9 6 9 8 1 0 5 9 4 9 6 9 8 1 0 0 9 7 9 8 -

R e s u l t R x q u a l R x l e v N u m b e r B T S 1 3 4 5 6 7 8 9 1 0 2 9 9 4 3 5 5 0 4 5 5 1 0 3 1 0 0 1 0 3 1 0 2 9 7 1 0 2 1 0 2 1 0 4 2 2 9 7

+B S C
( A b i s )

G e n e r a t e t h e M e a s u r e m e n t R e s u l t s t a b l e a t B S C i f H R E Q A V E = 2
120

Company Confidential

10/4/99

Answer
D o w n l i n k M e a s u r e m e n t s
A v e r g R x q u a lR x l e v ( s ) N u m b e r 12 . 59 9 23 . 5 1 0 0 . 5 35 . 5 1 0 4 4 3 1 0 0 . 5 5 5 1 0 4 . 5

U p l i n k M e a s u r e m e n t s

R e s u l t R x q u a l R x l e v N u m b e r

1 29 8

23 . 5 1 0 1 . 5

3 5 1 0 2 . 5

4 29 9 . 5 5 5 1 0 2 . 5

N e i g h b o u r M e a s u r e m e n t s

A v e r g N 2 N 3 N 4 N 5 N 6 N 7 N 8 N 9 N 1 N u m b e r

11 0 0 9 7 . 5 9 0 9 5 -1 0 2 1 0 1 9 9

2 -9 6 . 5 9 5 . 5 9 9 . 5 1 0 4 1 0 0 1 0 1 . 5 9 9 9 6 . 5

3 9 7 . 5 1 0 0 9 7 . 5 9 9 --9 6 . 5 9 8 . 5 4 1 0 0 . 5 -

9 5 9 5 . 5 - - 9 4 9 7 1 0 0

59 5 -9 4 . 5 9 5 . 5 9 8 . 5 1 0 0 9 6 . 5 9 8 -

Company Confidential

10/4/99

121

Power Control Procedure


MS Power Control MS
SACCH

BTS
MS Power Control

BSC
MS Power Control
Channel Number : MS Power : Power step 1 to 31

BS Power Control ( optional )


MS

BTS
BS Power Control

BSC

BS Power Control
Channel Number : BS Power : Power step 1 to 31

Company Confidential

10/4/99

122

Handover

Cell 1

Cell 2

Handover is a process by which the control/communication of a Mobile is transferred from one cell to another
Company Confidential

10/4/99

123

Criteria for Handover


--- Receive Quality (RXQUAL) on Uplink & Downlink. --- Receive Signal Strength (RXLEV) on Uplink & Downlink. --- Distance ( Timing Advance ). --- Interference Level. --- Power Budget.

Company Confidential

10/4/99

124

Internal Inter-Cell Handover

SYNCHRONISED

BTS C0 C0

Handover between cells of same BTS


Company Confidential

10/4/99

125

Internal Inter-Cell Handover


Non-synchronized
BTS

MSC

BSC

BTS
--- This type of Handover takes place if the cell to which which handover is to be done belongs to the same BSC. --- In this the BSC handles everything without involving MSC. --- The MSC will be informed by the BSC after Handover.

Company Confidential

10/4/99

126

Inter-Cell Handover Procedure


MS BTS (Old) BSC CH Actvn CH Actvn Ack Hand CMD Hand Access
Starts T3124 Stops T3124

BTS (New)

MSC

DR ( Hand Cmd )
Starts T3103

Hand Detec Phys Info

Any Correct Frame Hand Complete


RF CH Release DI ( Hand Comp )
Stops T3103

Starts T3105 Stops T3105

Hand Performed RF CH Release Ack

Inter-Cell Handover
Company Confidential

10/4/99

127

Inter-Cell handover Procedure


MS BTS (Old) BSC
CH Actvn CH Actvn Ack DR ( Hand Cmd ) Hand CMD
Starts T3103

BTS (New)

Handover Command
PD : RR TI : 0 MT : HC Cell Description : BA-NO : Band 0 or 1 NCC & BCC : BSIC value ARFCN No: 1 - 124 Synchronization Indication : Non Synchronized / Synchronized Cell Channel Description : CA - table ( ARFCN's ) for hopping Channel Mode : Signaling,Speech F/H,Date : 9.6,4.8 f/h, 2.4f/h Mobile Allocation : MA Table Starting Time : Starting TDMA Frame No , FN Module 42432

Channel Description --- SDCCH/4,SDCCH/8 or TCH, TN Number or Subchannel No ( SDCCH ) TSC, ARFCN, Single or Hopping, HSN Mobile Allocation Index Offset Handover Reference --- 0 - 255 Power Command --- Power Level ( 0 - 31 )

Company Confidential

10/4/99

128

Inter-cell Handover Procedure


Synchronous MS
BTS(Old)
BSC BTS(New) Handover Access MS Hand CMD Handover Detection

BTS starts transmission on the activated channel with ciphering BTS starts transmission on SACCH also MS sends Handover Access burst in four successive slots, immediately starts ciphering & starts sending and receiving information. BTS on receiving the correct Handover Access Burst starts reception on the activated channel

Asynchronous
BTS(Old) BSC BTS(New) Handover Access Physical Info Correct Frame

MS
Starts T3124 Stops T3124

MS

Hand CMD

Handover Detection
Starts T3105 Stops T3105

BTS starts transmission on the activated channel with ciphering,but not on SACCH MS starts T3124,sends Handover Access burst continously, activates deciphering, starts reception BTS sends a Physical Information Message, starts T3105, starts transmission on SACCH , also starts reception on main ch. MS stops T3124 and starts the normal transmission and reception on the main channel

Company Confidential

10/4/99

129

Inter-Cell Handover Procedure


BTS(Old) BSC BTS(New) MS
Starts T3124

MS

Hand CMD

Handover Detection
Starts T3105 Stops T3105

Handover Access Physical Info


Correct Frame

Handover Access

T B S Y N C H I n f o r m a t i o n T B G P 8 4 1 3 6 3

8 b i t s 6 b i t s

H a n d o v e r R e f e r e n c e N o B S I C ( B S I C i s X O R w i t h P a r i t y B i t s )

Physical Information
PD : RR TI : 0 MT : HC Timing Advance : 0 - 63 bits

Handover Detection
Channel Number : TCH ,SDCCH/4,SDCCH/8 TN No ,Subchannel No (SDCCH )

Company Confidential

10/4/99

130

Inter-Cell Handover Procedure


BTS(Old) RF Channel Release

BSC

BTS(New) Handover Complete

MS

DI (Handover Complete)

Stops T3103

MSC Handover Performed

Handover Performed
Message Type : HP Cause : Uplink Quality,Uplink Strength Uplink Strength,Downlink strength Distance, O & M Intervention, Call Control, Better Cell, Equipment Failure,No Resource

Handover Complete
PD : RR TI : 0 MT : HC RR Cause : Normal Release ( of old channels )

Cell Indentifier : * Cell identification discriminator : -- Whole CGI/ LAC&CI / CI only Cell identification 1 : MCC + MNC + LAC + CI Radio Channel Identity : * Channel Description, MA table, Starting time

* Optional

Company Confidential

10/4/99

131

Inter-Cell Handover Procedure


Abnormal Cases
BTS(Old)

BSC

MS
Hand CMD

BTS(New) Handover Access

MS
Starts T3124

Handover Detection

T3124 Expires ( asynchronous ) Lower layer failure occurs

MS Deactivates new channels Activates Old Channels, & sends Handover Failure

DI (Handover Failure)

Stops T3103

Handover Failure

MS resumes normal operation ( as no handover attempt had occurred )

PD : RR TI : 0 MT : HC RR Cause : Abnormal Release ( unspecified ), Channel Unacceptable, timer expired, Invalid Message( unspecified ), No CA available, Protocol errors

Company Confidential

10/4/99

132

External Inter-Cell Handover


BSC

BTS

MSC

BSC

BTS

--- In this type of Handover,the Mobile is handed over to a cell which belongs to another BSC. --- The MSC is completely involved in this Handover

Company Confidential

10/4/99

133

External Inter-Cell Handover Procedure


MS

BTS

BSC(Old)
Hand Reqd
Starts T7

MSC

BSC(New)

BTS

Hand Reqst Hand Reqst Ack

CH Actvn CH Actvn Ack

Hand CMD
Hand CMD DI(Hand CMD)
Stops T7

Hand Access
Phy Info

Hand Detect

Hand Detection

Hand Comp
Clear CMD

Hand Comp

DI(Hand Comp)

INTER - BSC Handover


Company Confidential

10/4/99

134

External Inter-Cell Handover Procedure

MS

BTS

BSC(Old)

MSC

BSC(New)

BTS

Hand Access
Phy Info

Hand Detect

Hand Detection

Hand Comp Hand Comp


DI(Hand Comp)

Handover Command
Message Type : HC

Handover Command
Message Type : HC RR Cause : Normal Release ( old channels ) - Optional

Company Confidential

10/4/99

135

External Inter-Cell Handover Procedure


Abnormal Case
Failure at MS
MS
BSC(Old) Handover Failure MSC BSC(New)

Handover Failure

Clear Command

Handover Failure
PD : RR TI : 0 MT : HC RR Cause : Abnormal Release ( unspecified ), Channel Unacceptable, timer expired, Invalid Message( unspecified ), No CA available, Protocol errors

Handover Failure
PD : RR TI : 0 MT : HC Cause : Radio Interface Failure , reversion to old channel RR Cause : Abnormal Release ( unspecified ), Channel Unacceptable, timer expired, Invalid Message( unspecified ), No CA available, Protocol errors

Company Confidential

10/4/99

136

Intra-Cell Handover

C0
BTS

C1

Handover between channels / timeslots of same cell


10/4/99 137

Company Confidential

Interference

Handover on Interference is based on RXQUAL & RXLEV


If RXQUAL is poor and RXLEV is good , then Handover takes place Interference Handover is an Intra-cell Handover

Company Confidential

10/4/99

138

Intra-Cell Handover
MS BTS
Channel Activation Channel Actvn Ack Assignment Command Old Channel Assignment Complete New Channel DR ( Assgn Command) Starts T10 DI ( Assgn Complete ) Stops T10 RF Channel Release RF Channel Release Ack Channel Activation
Channel Number : Activation Type : intra cell handover Channel Mode : Channel Identification : Encryption Information : BS Power, MS Power , Timing Advance: BS & MS Power Parameter :

BSC

Company Confidential

10/4/99

139

CC - Call Clearing
Release of Call
TCH F A C C H Disconnect Starts T305 Release Stops T305 Release Comp
Channel Release Disconnect
PD : CC TI:1 -7 MT : D Cause : #16 - Normal Clearing #38 - Network Out of Order

MSC

Release
PD : CC TI:1 -7 MT : R Cause : Not reqd

Channel Release

PD : RR TI : 0 MT : CR Cause : - Normal Release - Abnormal Release, unspecified - No activity on radio path Release Complete - Preemptive release - No CA available ( handover ) PD : CC TI:1 -7 MT : R Cause : Not reqd
Company Confidential

10/4/99

140

Radio Link Failure


Radio Link Failure is based on SACCH Messages It is controlled by the Radio Link Counter ( S )

The max value of ' S ' is broadcasted on BCCH If Mobile is not able to decode SACCH message
' S ' decreases by 1 If Mobile is able to decode SACCH message ' S ' increases by 2 If ' S ' reaches 0 , Radio Link failure is declared
Company Confidential

10/4/99

141

Radio Link Failure


BCCH = ' S ' is 4
4 3
'S'

2
1 0

SACCH Blocks
Company Confidential

10/4/99

142

Radio Link Failure in Idle Mode

Idle Mode Link Failure depends on the counter DSC

DSC is initialized to the nearest integer of 90 / Bs_pa_mfrms.


For every Paging Message non-decode ( BFI=1), DSC is decreased by 4. For every successful decode, it is increased by 1. Once DSC reaches "0", link failure is declared and Mobile does cell reselection.
Company Confidential

10/4/99

143

Air Interface - L2 Signaling

DTAP

04.08/ 04.10

04.08/ 04.10

RIL3

RR

RIL3

LAPDm

LAPDm

Rad Int 04.04 MS

04.04

Rad Int BTS

Company Confidential

10/4/99

144

Link Access Protocol on Dm ( LAPDm)


LAPDm signaling is done using Frames. LAPDm frames contain Address, Control and L3 information. LAPDm has a window size of 1 ( every frame sent must be

acknowledged before next is sent, in acknowledge mode ) Lapdm frame supports maximum 23 octets only Lapdm frame structure has no flags ( since blocks channels available ).
Lapdm message has two SAPI's

----- SAPI 0 ----- SAPI 3

= for DTAP and RR signaling = for Short Message Service

** SAPI : Service Access Point Identifier


10/4/99 145

Company Confidential

LAPDm Frames
Modes of LAPDm
Acknowledge : Every frame sent must receive acknowledgement Unacknowledged : No acknowledgement required for the frames sent

Type of LAPDm frames


Unnumbered Frames ( U - Frame ) : These provide setting up of acknowledge mode and unacknowledged Information ( I - Frame ) transfer. Information Frames ( I - Frames ) : These convey the actual information ( message ) in acknowledge mode. Supervisory Frames ( S- Frame ) : These manages the flow of I-frames by acknowledging or requesting retransmission of I-frames.

Company Confidential

10/4/99

146

LAPD Frames
Unnumbered Frames
SABM ( Set Asynchronous Balance mode ) : This frame is sent to begin acknowledge mode of information transfer ( I -frame ) Disc ( Disconnect Mode ) : This frame is sent to terminate acknowledge mode of Information Transfer UI ( Unnumbered Information ) : This is used for Unacknowledged Information transfer UA (Unnumbered Acknowledge) : This is used to acknowledge the SABM & DISC frames DM ( Disconnect Mode ) : This indicates the disconnection and SABM could be performed These frames don't use sequencing [ N(R) & N(S) ] SABM DISC UI UI UI UI UA DM ( or UA )

Company Confidential

10/4/99

147

LAPD Frames
Information Frames
These frames are used to transfer Layer 3 Information ( RSL,OML,L2M messages ) in sequence,that is is in acknowledged mode. These frames uses Sequencing

Supervisory Frames
RR ( Receive Ready ) : Positive Acknowledgement. RNR ( Receive Not Ready ) : Stop sending messages ( buffer is full ). REJ ( Reject ) : Negative Acknowledgement These Frames uses Sequencing [ only N ( R ) ]

Company Confidential

10/4/99

148

LAPDm Frames Flow


Acknowledge Mode
Layer 2

Layer 2 Layer 3

Layer 2
Layer 3 Layer 2 Layer 2 Layer 2 RR Disc

Company Confidential

10/4/99

149

Lapdm Modes

Acknowledge Mode ( with window size of 1 ) Unacknowledged mode

Lapdm modes vary on the type of logical channel the information is sent For SAPI 0 : BCCH Unacknowledged CCCH Unacknowledged SDCCH Unacknowledged and Acknowledged SACCH Unacknowledged FACCH Unacknowledged and Acknowledged

For SAPI 3 : SDCCH Acknowledged SACCH (TCH) Acknowledged

Company Confidential

10/4/99

150

LAPDm Frame Structure


1 octet Length Indicator Field 6
Lenght Indicator

22 Octets Layer 3 Information (RIL 3 Message ) 1 1


More bit ELI

Fill Bits

LAPDm frame for BCCH,RACH,AGCH,PCH

1 octet Address Field


1 0

1 octet Control Field


2

1 octet Length Ind Field


3

20 Octets Layer 3 Information Fill Bits Lapdm frame for SDCCH,SACCH,FACCH ( RIL3 Message )
2 C/ R 1 Extended Address

Link Protocol Discrmntr

SAPI

Link Protocol Discriminator = 00 ( not used for GSM ) More bit = 1 indicates more information to follow ( in next block ) = 0 indicates end of information ( message )
Company Confidential

10/4/99

151

LAPD Frame Structure - Control Field


8 1 6 1 6 m a x 2 4 9 o c t 1 6 8 F L A G F l a g A d d r e s sC o n t r o l I n f o r m a t i o n F C S

( A c k n o w l e d g e M o d e )
N ( S ) P / F N ( R ) ( 7 b i t s )( 1 b i t )( 7 b i t s ) F i x e d B i t s C / R

( U n a c k n o w l e d g e d M o d e )
T y p e D i r e c t i o n C / R V a l u e C o m m a n d B S t o M S C o m m a n d M S t o B S R e s p o n s e B S t o M S R e s p o n s e M S t o B S
Company Confidential

1 0 0 1
152

10/4/99

LAPDm Message in a Burst


8 Flag 16 Address 16 Control max249oct Information 16 FCS 8 FLAG LAPD

Maximum 249 Octets


Length Indicator Field

22 Octets Information

Address Field

Control Field

LIF

20 Octets Information

Address Field

Control Field

LIF

18 Octets Information

BCCH & CCCH 23 Octets

FACCH & SDCCH 23 Octets Error Coding

SACCH 21 Octets 1 octet for Tim Adv & 1 octet for Pwr Control 23 Octets

456 bits
Interleaving done over 4 bursts 57 57 57 57 57 57 57 57

57

26

57

TDMA Burst

Company Confidential

10/4/99

153