TEMS Layer3 Messages Analysis V2 PDF

TEMS Layer3
Messages Analysis
Layer3 Messages
1. Introduction
(45 minutes)
Radio Network Planning and Optimization
Layer3 Messages
What is Layer3?
In the protocol stack of GSM signaling, composed of 3 layer, L1, L2 and L3.
In L3 there are 3 sub-layers, Radio Resource (RR), Mobility Management (MM) and Connection
Management (CM).
MS
BTS
BSC
MSC
CM
CM
MM
MM
RR
RR
RR
BTSM
BTSM
BSSAP
BSSAP
SCCP
SCCP
LAPDm
LAPDm
LAPD
MTP
MTP
Layer1
Layer1
Layer1
Layer1
Layer1
Um Interface
Abis Interface
A Interface
Layer3 Messages
What is Layer3?
From the diagram, we can imply that all the information which MS
would like to talk with the network are done in the Layer 3.
The flow of the message is so-called Message Flow Chart or
Signaling Flow Chart.
MS
Network
Note: Actual TA for the connection and MS Power level are send
in Layer1 on SACCH.
Layer3 Messages
What is Layer3?
Hierarchy of 3 sub-layers
RR sub-layer provides services to the MM
sub-layer and utilizes the services of
signaling layer 2.
MM sub-layer provides common services
to the entities of the Connection
Management (CM) sub-layer.
- the CM sub-layer includes, among others,
the CC, SS, and SMS entities, which are
independent entities.
Layer3 Messages
Practice
1.
What is the layer 1, explain roughly?

Answer:
2.
SCCP and MTP is the protocol layer of what standard?

Answer:
3.
Layer 1 specify the physical layer of the

connection.
SS7 signaling.
In what layer and channel which BSC send ordered TA and

ordered power level to the mobile station?
Answer:
Layer 1 header on SACCH/ DL.
Layer3 Messages
Layer 3 Protocol
(2 hours)
Layer3 Messages
Radio Resource Management

General Purpose
Establish, Maintain and Release the RR connection.
Cell selection/Reselection and Handover Procedure.
Provide service for the upper layer.
RR will related to the following procedure (CS)

Idle mode procedures.
RR Connection establishment.
Initiate by MS
Paging from network
Dedicated mode procedure.
Example messages
System Information Type1-8.
Handover command.
Assignment Command.
Immediate Assignment Command.
Layer3 Messages
Radio Resource Management (Cont.)

1. Idle mode Procedure
Mobile Sides
Listen to the BCCH and Paging Sub-channel of serving cell.
Measure the radio propagation and decode BCCH of
surrounding cells.
Calculate C1/C2 in order to perform Cell Selection/ Reselection.
Network Sides
Broadcast the system information on BCCH.
Paging on CCCH (PCH).
Layer3 Messages

Mobile Turn on
Comment : SS=Signal Strength
Cell Selection
PLMN Selection
From specification 3GPP 44.018

Scan RF Carrier
3-5 second average windows
Selected Strongest average SS
C 1 = A Max ( B ,0)
A = Rxlev RXLEV _ ACCESS _ MIN
No
By Search for FCCH

Is it BCCH?
No
Yes
Tuned to SCH
for decode BSIC
and decode System Info
Calculate Cell Selection

Criteria (C1)
Try at least 30 Strongest

RF channel for GSM900,
or 40 for GSM1800
or 40 for GSM 1900
Suitable Cell
Exist?
Yes
Camp on Suitable Cell
B = MSPWR _ MAX _ CCH P

CBQ
High(1)
High(1)
Low(0)
Low(0)
CB
NO (0)
YES(1)
NO (0)
YES(1)
Cell Selection Cell Reselection

Normal
Normal
Barred
Barred
Low
Normal
Low
Normal
Layer3 Messages

Cell Selection
SS DL
Allow MS Access to N/W
Not Allow MS Access

due to ACCMIN .
Not Allow MS Access due to
Mobile Class can't transmiss
Maximum Power that N/W allow.
Radio tower
Layer3 Messages

Cell Re-selection
Mobile Turn on
PLMN Selection
C 2 = C 1 + CRO TO * H ( PT t ), PT <> 11111

C 2 = C 1 CRO , PT = 11111
Cell Selection
H ( x ) = 0, x < 0
H ( x ) = 1, x 0
Ms Update SS of Serving Cell every

5 to Max(5, 5 consecutive paging block)
MS Measuring Signal and
Decode System Info from
Serving Cell
Ms Update SS of Neighboring Cells every
5 to Max(5, [(5*N+6)div7]*MFRM/4)
N=BCCH in the BA List
MFRM=Multiframe for paging group
Criteria :
1.Serving cell becomes barred.
MS Measuring Signal, BSIC and

Decode System Info from
Neighboring Cell
NO
2.MS tried to access network for the

allowed number of time.(MAXRET
time.(MAXRET))
3.MS detects a downlink signaling
failure.
fullfil Cell
Reselection
Criteria?
YES
MS Select the new Cell
4.C1 of Serving Cell <0 for 5 seconds.

5.C2 of Neighbor > C2 of Serving for 5
Seconds.
6.If Cell Reselection take place at last
15 seconds C2 of Neighbor > C2 of
Serving 5 dB for 5 Seconds .
Layer3 Messages

System Information
In idle mode, we can find the following system information broadcast on BCCH.
System Information Type 1
System Information Type 2bis
System Information Type 2ter
Optional
Mandatory
RACH control parameter and Cell channel

allocation.
RACH control parameter and BCCH Allocation
of neighbor cells.
Optional
RACH control parameter and extension of

BCCH Allocation of neighbor cells.
Optional
RACH control parameter and extension of

BCCH Allocation of neighbor cells.
Mandatory
RACH control parameter, LAI, CI and other cell

parameter for idle mode.
Mandatory
RACH control parameter, LAI, CI and other cell

parameter for idle mode.
Optional
Cell Reselection parameter.
Optional
Cell Reselection parameter.
Optional
GPRS information in cell.
Layer3 Messages

Paging
Mobile will listen to the PCH channel which carried Paging request message.
There are 3 type of Paging Request.
Paging request type 1
Identify up to 2 mobiles with TMSI or IMSI
Identify up to 3 mobiles with TMSI or IMSI
Identify up to 4 mobiles with TMSI
RACH Control Parameters

Exist in all mandatory system information in idle because it is allowed MS to
access the network any time (Random Access).
MAX Retransmission number of Maximum retransmission on RACH.
Tx-Integer Spreading time for the next retransmission.
Cell Bar Access Allow MS to camp in Idle mode.
Call Re-establishment Allow MS to re-connect to network after call drop.
Layer3 Messages

Message flow in idle mode
Network
MS
Send on BCCH
Send on BCCH
Send on BCCH
Send on BCCH
System Information Type 2ter
Send on BCCH
Synch Channel Information
Send on SCH
Paging Request Type 1
Send on CCCH (PCH)

Send on CCCH (PCH)

Send on CCCH (PCH)

Layer3 Messages

2. RR Connection Establishment
Mobile Initiate connection
Permission to access the network.
Initiate of Immediate Assignment procedure.
Answer from the network.
Assignment Completion.
Paging procedure for RR connection
Paging initiation by the network.
Paging Response
Layer3 Messages

Message flow in RR Connection Establishment
Network
MS
Paging Request Type 1, 2, 3
Send on CCCH
Channel Request
Send on RACH
Immediate Assignment
Send on AGCH
Paging Response (CM Service Request)
Send on SDCCH
GPRS Suspension Request
Send on SDCCH
Classmark Change
Send on SDCCH
Layer3 Messages

3. Dedicated mode Procedures
SACCH Procedure
Network send System Information to MS on SACCH/DL.
MS report the radio condition to network by Measurement Report on SACCH/UL.
Channel Assignment Procedure

Network initiate channel assignment by sending ASSIGNMENT COMMAND.
If successful, MS send ASSIGNMENT COMPLETE to network.
Handover Procedure
After Network prepared the target channel, network initiate Handover by sending
HANDOVER COMMAND to the MS.
Mobile send HANDOVER ACCESS in order to try to establish the physical
channel at target cell.
If MS successful to establish the connection in lower layer, HANDOVER
COMPLETE message will send to network.
Ciphering mode setting

Network send CIPHERING MODE COMMAND.
MS will do the ciphering and reply CIPHERING MODE COMPLETE.
Layer3 Messages

Message flow in Assignment and Ciphering
Network
MS
Ciphering Mode Command
Ciphering Mode Complete
Setup
Send on SDCCH
Send on SDCCH
Send on SDCCH
Call Proceeding/Call Confirmed
Send on SDCCH
Assignment Command
Assignment Complete
Send on SDCCH
Send on FACCH
Alerting
Send on FACCH
Layer3 Messages

Message flow in SACCH and Handover
Network
MS
System Information Type5 (5ter)
System Information Type6
Measurement Report
Handover Command
Handover Access
Physical Information
Handover Complete
Send on SACCH
Send on SACCH
Send on SACCH
Send on FACCH
Send on FACCH
Send on FACCH
Send on FACCH
Layer3 Messages
Mobility Management
General Purpose
Support the mobility of users, e.g. the location of users, and
provide the confidential of the users.
Provide connection management services to the upper sub-layer.
MM will related to the following procedure (CS)

MM common procedures
TMSI Reallocation.
Authentication.
Identification.
IMSI detach.
MM specific procedures
Location updating.
Periodic updating.
IMSI attach.
Connection Management sub-layer service provision
MM connection Establishment.
Layer3 Messages
Mobility Management (cont.)

1. MM Common Procedures
TMSI reallocation procedure
Protection of IMSI to transmit in the radio interface signaling.
TMSI is unique with in LAI, so usually TMSI reallocation is performed at least
when changing the location area.
However, The TMSI reallocation can be initiated by the network at any time while
a RR connection exists between the network and the MS (usually in location
update, call setup).
Authentication
permit the network to check the identity of the MS.
provide parameters for MS to calculate ciphering key.
Identification
Network request MS to provide the specific identification parameters to the
network, e.g. IMEI.
IMSI Detach
MS inform the network when switch off in order to change the status of this MS
in the VLR.
This procedure are required when ATT flag, broadcasted in System Information
is set.
MS initiate IMSI detach procedure by send IMSI DETACH INDICATION message.
Layer3 Messages

2. MM Specific Procedures
Location Update
There are 3 types of location update
Normal location update use for update the actual LAI of MS, when the LAI is
changed.
If the MS cross the location area in dedicated mode, location update is
performed after MS leave dedicated mode to MM idle state.
Location update is always initiated by MS.
Periodic updating
Controlled by T3212 in the mobile.
The timer is stopped and reset to the initial value when
LOCATION UPDATE ACCEPT or LOCATION UPDATE REJECT is received
AUTHENTICATION REJECT is received.
The first MM message is received.
MS is deactivated (switch off).
when the timer expired, location update is started.
IMSI Attach
IMSI Attach is a compliment of IMSI detach, to inform the network that MS once
again activate.
It is also controlled by ATT flag in System Information.
Layer3 Messages

Message flow in MM
Network
MS
TMSI Reallocation Command
Send on SDCCH
TMSI Reallocation Complete
Send on SDCCH
Authentication Request
Send on SDCCH
Authentication Response
Send on SDCCH
Identity Request
Identity Response
Location Update Request
Location Update Accept
IMSI Detach Indication
Send on SDCCH
Send on SDCCH
Send on SDCCH
Send on SDCCH
Send on SDCCH
Layer3 Messages
Circuit-switch Call Control (CC)

General Purpose
CC is one of Connection Management (CM) sub-layer (others are
SS and SMS).
Use to establish, maintain and release the call.
MM will related to the following procedure (CS)

Call Establishment procedures
Mobile originating call.
Mobile Terminating call.
Call Clearing
Clear initiate by mobile station.
Clearing initiate by network.
Example messages
Setup.
Alerting.
Call Proceeding.
Connect.
Layer3 Messages
Circuit-switch Call Control (Cont.)

Message flow in CC (mobile originating call)
Network
MS
Setup
Send on SDCCH
Call Proceeding
Alerting
Connect
Connect Acknowledge
Send on SDCCH
Send on FACCH
Send on FACCH
Send on FACCH
Layer3 Messages
Circuit-switch Call Control (Cont.)

Message flow in CC (mobile Terminated call)
Network
MS
Setup
Send on SDCCH
Call Confirmed
Alerting
Connect
Connect Acknowledge
Send on SDCCH
Send on FACCH
Send on FACCH
Send on FACCH
Layer3 Messages
Practice for Layer 3 Protocol

1.
Paging Response is belong to which Layer 3 sub-layer?

Answer:
2.
What will happen if T3212 is longer than Implicit detach Timer

in MSC/VLR?
Answer:
3.
RR Sub-layer.
People can not call to this mobile, because

MSC/VLR already mark it as implicit detach.
Where we can find RACH control parameters and why?

Answer:
In System Information Type 1, 2, 3 and 4

because mobile may need them to access the
network any time (Random Access).
Layer3 Messages

RACH Control Parameter
MS can send maximum Channel Request
= Max retransmission+1.
The interval between retransmission is a
random value uniformly select form the
following set {S,S+1,S+Tx-integer-1}.
TX-integer
non-combined
CCCH
combined
CCCH/SDCCH
3,8,14,50
55
41
4,9,16
76
52
5,10,20
109
58
6,11,25
163
86
7,12,32
217
115
Cell barred Access prevent MS to camp

on this cell in Idle mode (cell selection/Reselection).
Call reestablishment allow MS send
RACH to resume the connection after call
dropped.
Layer3 Messages

BCCH Allocation List
MS will get the ARFCH of BCCH of
surrounding cell it has to measure and
decode in idle mode from this messages.
MS will not scan, synch or decode any
frequencies that are not in this list
in Type 2 it will send the list of the same
band of the serving cell, BCCH allocation
list of different band will be sent in Type
2ter.
In type 2ter also contain the information
about how many neighbors from different
band mobiles have to add in the
measurement report.
NCC permitted
MS will use this value when it first enter to
dedicated mode before it get new in
formation on SACCH.
Layer3 Messages
Control channel
ATT IMSI attach/detach flag
BS-AG-BLKS-RES number of block
reserve for access grant, use in the
calculation of paging group.
CCCH-CONF indicate whether CCCH
is combined with SDCCH.
BS-PA-MFRMS Multiframe for paging
group calculation.
T3212 periodic registration timer.
PAGING_GROUP
= {(IMSI mod 1000) mod
(BS_CC_CHANS x N)} mod N
N = number of paging block
= (number of paging blocks "available"
in a 51- multiframe on one CCCH)
x BS_PA_MFRMS.
Cell Option
DTX indicator whether mobile shall
use DTX or not.
RADIO-LINK-TIMEOUT the radio link
timeout for DL connection that mobile
will use for this cell.
Layer3 Messages

Paging group calculation for particular subscriber
PAGING_GROUP (0 .. N-1) = {(IMSI mod 1000) mod (BS_CC_CHANS x N)} mod N
CCCH_GROUP (0 .. BS_CC_CHANS-1) = {(IMSI mod 1000) mod (BS_CC_CHANS x N)} div N
where
N = number of paging blocks "available" on one CCCH = (number of paging blocks "available"
in a 51-multiframe on one CCCH) x BS_PA_MFRMS.
IMSI = International Mobile Subscriber Identity, as defined in 3GPP TS 03.03.
BS_CC_CHANS = number of CCCH timeslots on BCCH frequency.
mod = Modulo.
div = Integer division.
Layer3 Messages

Broadcast as similar
information as System
Information Type3 but
less detail.
Layer3 Messages
Synch Channel Information

Synchronization data
BSIC base station Identity Code, determine the cell (6
bits).
T1, T2, T3 is the reduced frame number (19 bits).

The T1, T2, T3 was derived from the actual frame
number.
T1 (11 bits) = FN div (26x51)
T2 (5 bits) = FN mod 26
T3 (3 bits) = (T3-1) div 10
Where T3 = FN mod 51
Layer3 Messages
Paging Request Type1

Mobile Identity
Can contain maximum 2 mobile identity
with TMSI or IMSI.
Layer3 Messages

Mobile Identity
Can contain maximum 3 mobile identity
with TMSI or IMSI.
Layer3 Messages

Mobile Identity
Can contain maximum 4 mobiles identity with
TMSI only.
Layer3 Messages
Channel Request
Random Access Information

Establishment cause contain the reason for requesting the establishment of the connection.
Random reference random value as a reference to the network when channel is assigned.
Layer3 Messages
Channel Request
Bit Pattern between Random Reference and Establishment cause can be found in
specification 44.018. We can see there are some bit pattern that are not defined in the
table.
Layer3 Messages
Channel Description
The details of target physical
channel of SDCCH which MS have
to camp on in dedicated mode.
Request Reference
Include the Establishment cause
and random reference value from
the channel request.
Timing Advance
The initial timing advance values,
which BSC calculate from the delay
of random access.
Layer3 Messages
TA calculation in Call setup
Access burst
TA value (bit period)
Layer3 Messages
Classmark Change
Encryption algorithm support
mobile will declare all Encryption algorithm it
support.
MS power capability
mobile power class
GSM900
MS Power
Class
Output
power [dBm]
Sensitivity
[dBm]
39
-106
37
-106
33
-104
29
-104
GSM1800
MS Power
Class
Output
power [dBm]
Sensitivity
[dBm]
30
-104
24
-104
Layer3 Messages
Ciphering Mode Command

Cipher mode setting
It will inform mobile that in which ciphering algorithm
will be used in this connection.
RAND
Ki
Kc
data
data
A5
Kc
A8
Kc
A5
data
data
Layer3 Messages
Assignment Command
Description of the channel
Channel Type indicate the target channel (TCHF/TCHH).
TN target TCH timeslot number.
TSC training sequence code.
Hopping RF channel whether target channel is HOPPING.
MAIO start MAI for hopping.
HSN hopping sequence number.
Power Command
Power level the initial power use in this connection.
Cell channel description

Channels the frequency available in this cells.
Mobile allocation
Mobile allocation array the frequency which will use when
hopping.
Layer3 Messages
BCCH Allocation List

As same as System Information Type2 in idle mode, System Information Type5 contain the BA List
which mobile have to monitor in dedicated mode.
in Type 5 it will send the list of the same band of the serving cell, BCCH allocation list of different
band will be sent in Type 5ter.
In type 5ter also contain the information about how many neighbors from different band mobiles have
to add in the measurement report.
Layer3 Messages

Cell options
PWRC indicated.
DTX indicator whether DTX is used.
Radio Link Timeout The counter of radio link
failure and release the channel.
RLT (max)
0
Drop Call
SACCH
Radio link timeout work in following manner, when

MS fail to decode SACCH block it will decrease by
one, but if the SACCH block can be decode again
its increment is 2.
NCC permitted
MS will not report the signal level of the
cell which NCC are not belong or exist in
this list.
Layer3 Messages
Measurement Report
Serving Cell measurement
RxLev Full rxlevel of serving cell average for full
set.
Rxlev Sub rxlevel of serving cell average for sub
set
RxQual full rxqual of serving cell average for full
set.
RxQual Sub rxqual of serving average for sub
set.
Six strongest neighbor

RxLev rxlevel on BCCH of neighboring cell .
BSIC BSIC of the neighbor.
BCCH-INDEX the index of BCCH on BA List in
system information type5.
Layer3 Messages
Handover Command
Cell Description
BCCH and BSIC of the
target cell.
Channel Description
allocated channel at target
cell, in case of Hopping it will
inform MAIO and HSN.
Handover Reference
reference value use to
identify the Handover Access
from the mobile.
Synchronization
indicate the handover is
synchronous or
asynchronous. Synchronous
handover case after MS send
Handover Access, it will tune
the transceiver to the target
channel without waiting for
message.
Layer3 Messages
Handover Access
Handover Reference
Refer that this Handover Access belong to which
Handover Command.
Handover Access is a very short message (1 octet),
which using Access Burst as same as Channel
Request.
In some case , it is possible that this Handover
Access will trigger the allocation of SDCCH of
surrounding cells because they think it is the
channel request message.
This phenomena can cause the problem on
immediate assignment success rate.
Layer3 Messages
Timing Advance
This timing advance tell the mobile about the
timing advance which will use in the target cell.
The mechanism of detect the timing advance is
as same as in immediate assignment procedure
because the burst structure using for channel
request (Random Access) and handover access
is the same.
Access Burst
Layer3 Messages
Location Update Request

Location Update Type
Indicate the type of location update.
Location Area Identity

the information of current LAI stored in SIM card
(old LAI).
Mobile Station Classmark

contain MS capability.
Mobile Identity
Identity of the MS can be either TMSI or IMSI.
Layer3 Messages
Location Update Accept

Location Area Identity
the information of new LAI which will replace the
current LAI in SIM card.
Mobile Identity
New TMSI which MS will use in the new LAI, in
this case MS have to send TMSI
REALLOCATION COMPLETE in order to confirm
the use of new TMSI to the network and there are
no TMSI REALLOCATION COMAND sent in this
case.
Layer3 Messages
Authentication Request
Authentication parameter
From the Triplet, MSC send RAND to the MS in
Authentication Request Message.
MS will use this RAND value to calculate SRES and
answer the value in Authentication Response.
Layer3 Messages
MS use RAND as input of A3 algorithm together with
Ki stored in the SIM card.
The output of the operation is SRES.
MS return SRES to MSC via AUTHENTICATION
RESPONSE message.
MSC will check compare the SRES with the one that
calculated in MSC.
RAND
Ki
A3
SRES
Layer3 Messages
Setup (MOC)
Bearer Capability
MS send the bearer capability to MSC in
order to assign the TCH channel.
Called party BCD number

target MSISDN for this call.
Layer3 Messages
Setup (MTC)
Bearer Capability
This case MSC ask for the bearer capability of the
MS.
MS answer its capability and prefer channel type to
MSC on CALL CONFIRMED in order to get TCH
channel.
Calling party BCD number

MSISDN who call this MS.

TEMS Layer3 Messages Analysis V2 PDF

Caricato da

Informazioni sul documento

Titolo originale

Copyright

Formati disponibili

Condividi questo documento

Condividi o incorpora il documento

Opzioni di condivisione

Hai trovato utile questo documento?

Questo contenuto è inappropriato?

Copyright:

Formati disponibili

TEMS Layer3 Messages Analysis V2 PDF

Caricato da

Copyright:

Formati disponibili

TEMS Layer3

Radio Network Planning and Optimization

Radio Network Planning and Optimization

What is the layer 1, explain roughly?

SCCP and MTP is the protocol layer of what standard?

Layer 1 specify the physical layer of the

In what layer and channel which BSC send ordered TA and

Layer 1 header on SACCH/ DL.

Radio Network Planning and Optimization

Radio Network Planning and Optimization

Radio Resource Management

RR will related to the following procedure (CS)

Radio Resource Management (Cont.)

Radio Network Planning and Optimization

Radio Resource Management (Cont.)

Comment : SS=Signal Strength

From specification 3GPP 44.018

Selected Strongest average SS

By Search for FCCH

Calculate Cell Selection

Try at least 30 Strongest

Camp on Suitable Cell

Radio Network Planning and Optimization

B = MSPWR _ MAX _ CCH P

Cell Selection Cell Reselection

Radio Resource Management (Cont.)

Allow MS Access to N/W

Not Allow MS Access

Radio Network Planning and Optimization

Radio Resource Management (Cont.)

From specification 3GPP 44.018

C 2 = C 1 + CRO TO * H ( PT t ), PT <> 11111

Ms Update SS of Serving Cell every

MS Measuring Signal, BSIC and

2.MS tried to access network for the

MS Select the new Cell

Radio Network Planning and Optimization

4.C1 of Serving Cell <0 for 5 seconds.

Radio Resource Management (Cont.)

RACH control parameter and Cell channel

RACH control parameter and extension of

RACH control parameter and extension of

RACH control parameter, LAI, CI and other cell

System Information Type 4

RACH control parameter, LAI, CI and other cell

System Information Type 7

Cell Reselection parameter.

System Information Type 8

Cell Reselection parameter.

System Information Type 13

GPRS information in cell.

System Information Type 3

Radio Network Planning and Optimization

Radio Resource Management (Cont.)

Identify up to 2 mobiles with TMSI or IMSI

Paging request type 2

Identify up to 3 mobiles with TMSI or IMSI

Paging request type 3

Identify up to 4 mobiles with TMSI

RACH Control Parameters

Radio Network Planning and Optimization

Radio Resource Management (Cont.)

System Information Type 2ter