TEMS Investigation

& Layer 3 Messages

Presented By:

Mohammad Imran

Basic Components of a standard L3

message
Definitions
Information element type and value part :
When present, the IEI of a standard IE consists of a half octet or one octet. A standard IE with
IEI consisting of a half octet has format TV, and its value part consists of a half octet. The
value of the IEI depends on the standard IE, not on its information element type.

Length indicator
When present, the LI of a standard IE consists of one octet. It contains the binary encoding of the number of
octets of the IE value part. The length indicator of a standard IE with empty value part indicates 0 octets.
Standard IE of an information element type such that the possible values may have different values must be
formatted with a length field, i.e., LV or TLV.

Header
The header of a standard L3 message is composed of two octets, and structured in three main parts, the
protocol discriminator (1/2 octet), a message type octet, and a half octet used in some cases as a Transaction
Identifier, in some other cases as a sub-protocol discriminator, and called skip indicator otherwise.

Protocol discriminator

Bits 1 to 4 of the first octet of a standard L3 message contain the protocol discriminator (PD) information
element. The PD identifies the L3 protocol to which the standard layer 3 message belongs. The
correspondence between L3 protocols and PDs is one-to-one.
For future evolution an extension mechanism is foreseen which allows the use of protocol discriminators with
one octet length, where bits 4 to one are coded as 1 1 1 0. Messages of such protocols may not be standard
L3 messages. In particular, the rest of the header may not respect the structure described in this sub-clause.

Basic Components of a standard L3

message
The PD can take the following values:

Basic Components of a standard L3

message
Skip indicator:
Bits 5 to 8 of octet 1 of a standard L3 message may be used differently, depending on the protocol. The use of
this half-octet is consistent for a given PD. One possibility is that this half-octet contains the skip indicator.
Unless otherwise specified in the protocol, the skip indicator IE is a spare field.

Transaction identifier:
A L3 protocol may define that bits 5 to 8 of octet 1 of a standard L3 message of the protocol contains the
transaction identifier (TI). The TI allows to distinguish up to 16 different bi-directional messages flows for a
given PD. Such a message flow is called a transaction.

Message type octet

The message type octet is the second octet in a standard L3 message.
When a standard L3 message is expected, and a message is received that is less than 16 bit long, that
message shall be ignored.

L2 Pseudo Length octet

This octet, the L2 pseudo length indicator octet, indicates the length in octets of the subsequent octet string
that can be analysed as a standard L3 message.
The octet is structured as follows:
Bits 3 to 8 encodes in binary the L2 pseudo length, i.e., the length of the part to be analysed as a
standard L3 message;
Bit 2 is set to "0";
Bit 1 is set to "1".
A receiver expecting a message so structured and receiving a message with bit 1 of octet 1 (i.e., the 8th
bit of the message) set to "1" and bit 2 of octet 1 (i.e., the 7th bit of the message) different from "0",
shall abandon the analysis of the message.

Rest Octets
The part after the part structured as a standard L3 message, and up to the end of the message as
constrained by lower layers, is presented as a non standard IE of variable length (sometime indicated as
of type 5), the rest octets IE.
The rest octets element may be described by table description, or, preferably, using the compact
notation.

Measurement Report
Measurement Report

Six Neighbours Measurement Reports

Parameter:
allAdjacentCellsAveraged= 0 (The Six Best adjacent
Cells) &
1(All adjacent Cells)

With this parameter you indicate

whether the signal measurement
results will be averaged for all adjacent
cells, or only for the six best adjacent
cells

Paging Messages

Explanation
Normal Paging
Extended Paging
Paging Reorganization
Etc
Paging type 1: can page 2 subscribers
using IMSI/TMSI
Paging type 2: can page 3 subscribers 2
by TEMSI and 1 by IMSI
Paging type 3: can page 4 subscribers by
TMSI

Paging Messages

Sync Messages
T1, T2, T3 & ARFCN.

REDUCED TDMA FRAME STRUCTURE.

T1 = SUPERFRAME NUMBER
T2 = 26 FRAME MULTIFRAME NUMBER
T3` = IS THE REDUCED 51 FRAME MULTIFRAME 3 .
ACTUAL 51 FRAME VALUE IS = T3`*10+1

Call Setup

(Channel Request & Immediate Assignment )

Call Setup

(Paging Response & Class mark Change)

Call Setup

(Measurement Report)

Call Setup

(Ciphering Mode Command & Ciphering Mode

Complete )

Call Setup

(Setup & Call Confirmed)

Call Setup

(Assignment Command (DL) & Assignment

Complete (UL))

Alerting & Connect (UL)

Connect Acknowledge

Handover

(Handover Command & Access)

Handover

(TA & Handover Completion)

Call Disconnect

System Information Overview

System information (SYS INFO) contains network parameters sent to MS
through air interface (Um), including network identity parameters, cell
selection parameters, system control parameters and network function
parameters. By reading system information, MS can access the network,
perform cell selection, fully utilize various services provided by the network,
and achieve favorable cooperation with the network.
SYS INFO can be divided into two parts:
SYS INFO sent on BCCH, including SYS INFO 1, 2, 2BIS, 2TER, 3, and 4, which
are used by MS in idle mode.
SYS INFO sent on SACCH, including system information 5, 5BIS, 5TER, and 6,
which are used by MS in dedicated mode.
SYS INFO 7 and SYS INFO 8 messages are sent if the SYS INFO 3 or 4
Messages does not contain all the in elements needed for Cell (Re)Selection
(Phase2).
SYS INFO 13 is dedicated to support GPRS.

Types of System Information with Logical

Channels

System Information
Types

SI-Type 1 (optional)
messages are used for
frequency hopping.
SI-Types 2, 3 and 4 are
broadcast on the BCCH.
SI-Types 5 and 6 are
broadcast on an SACCH.
SI-Types 7 and 8 (optional)
are an extension to type 4
and are broadcast on the
BCCH.
SI-Type 13 is Broadcast on
BCCH.

BCCH Mapping & Transmission Cycle

SI Type 1

SI Type 1
It contains random access
control information (RACH)
and cell frequency
allocation table (i.e. CA
It is transmitted on
table).
Content
BCCH.

- - Cell Channel Description

Format

- - RACH
RACH Control
Parameter
Control

Parameters
Maximum number of
retransmission: 1,2,4 or 7
Number of time slots to spread
transmission from 3 up to 50
Parameter indicating if the cell is
barred or not
Parameter indicating if the call reestablishment is allowed or not
Parameter indicating if the
emergency calls are allowed or
not
Access classes control

SYS INFO 1 - CA Description Format

Bit8 Bit7 Bit4 Bit3 Bit2

Format Type

bit map 0

1024 range

512 range

256 range

128 range

variable bit map

The above cell channel description formats correspond to different

requirements on the configured frequencies in a cell.

Cell Channel Description Format

Value range: Bitmap 0, 1024, 512, 256, 128,
variable length

Content: That is CA table. Presently, the

parameter has been automatically selected by
the program according to actual CA
configurations.

Specifically, there are altogether 124 bits from D3 bit of the 2nd byte
to D0 bit of the 17th byte, which are respectively marked as carriers
124, 123, 122......3, 2, 1.

SYS Control Parameter

These control parameters include:
Maximum re-transmitting times (MAX retrans)
Extended transmission timeslots (Tx_interger)
Cell Bar access (CBA, CELL_BAR_ACCESS)
Common access control level(AC)
Call reestablish permitted (RE)
Emergency call permitted (EC)

MS MAX Re Value range: 1, 2,

trans:

4, 7

Unit: Times
Content: One of the parameters of random access control information. i.e. MS MAX. Retrans Times. It is the upper limit of times that MS is allowed to send Channel Request
in one immediate assignment procedure.
Recommendation: Set to 7:For areas with low traffic (suburban or rural area) and the
cell radius more than 3 km.Set to 4: For areas with ordinary traffic (non-busy area in
the city) and the cell radius less than 3km. Set to 2: For micro-cellular Set to 1: For
micro-cellular with heavy traffic or with obvious congestion. And 4 or more is
recommended to set for satellite transmission BTS.

SYS Control Parameter

Extended transmission timeslots (Tx-interger):
Value range: 3~12, 14, 16, 20, 25, 32, 50
Unit: Number of RACH timeslots (equivalent to one timeslot, 0.577ms)
Content: Extended Transmission Timeslots(T), used to calculate the number of
timeslots in the interval between two channel requests sent by MS.
Recommendation: 25 (If the cell immediate assignment success rate is low,
then set the larger value to reduce the transmission delay).
S=32 for satellite communication for reducing transmission delay (Also See in Note given below)

Cell Bar access (CBA, CELL_BAR_ACCESS):

Value range: Yes (0), No (1)
Unit: None
Content: Cell Bar Access, worked together with CBQ to set the priority status of
the cell in idle mode for cell selection and reselection.
Recommendation: Yes
Cell access permitted is the parameter that the network operator can set. Usually all cells allow MS to access, thus it is set as Yes. But in the
special cases, the operator may want a cell to be used for handover service only, which can be realized by setting the parameter as No (CBQ
should be No).

SYS Control Parameter

Common access control level (AC):
Value range: Check box, including level 0 forbidden,lever
1 forbidden,till level 9 forbidden

Content: One of the parameters of random access control

information. i.e. 0~9 bits of AC. It is used for load control
of ordinary subscribers, to permit or forbid the network
access of some common level users. 1 stands for
forbidden and 0 for permitted.

Recommendation: 000000000

Emergency call permitted (EC):

Default value is set to 0 for allowing all MSs.

SI Type 2

SI Type 2

It contains access control information

(RACH), network color code permitted (NCC
Permitted), and neighbor cell frequency
allocation list (BA1 list). It is transmitted on
BCCH. Generally speaking, SYS INFO 2,
2BIS, 2TER contains different parts of the
neighbor cell BCCH frequencies. Via
reading and decoding BA1 list, MS can
perform cell reselection in idle mode. For a
MS of GSM900 PHASE I, it only reads the
neighbor cell BCCH frequencies defined in
SYS INFO 2, and ignores those carried by

2BIS and 2TER.

Content

SYS

INFO 2 - - Neighbor Cell Desc.

- - NCC permitted
- - RACH Control Parameter

SYS Control Parameter

Neighbor Cell Desc:
There are two types of BA info (table BA1 and table
BA2).
Table BA1 describes BCCH frequencies of the adjacent
cells to be measured when the MS is in idle mode.
Table BA2 describes BCCH frequencies of the adjacent
cells to be measured when the MS is in dedicated mode.

MS keeps on measuring the BCCH signal levels of the serving cell as well as the neighbor cells. In order to
know the adjacent cells, neighbor cell description information will be broadcast periodically in system
information of each cell. This information lists the BCCH of all neighbor cells. MS extracts the information from
system information and use it as basis for neighbor cell measurement.
For GSM network, the neighbor relationship between cells is finalized when designing the network topology.
During the network construction, the neighbor cell relationship must be configured in accordance with the
topology design that has been planned. Moreover, after the commission of network, neighbor relationship
should be modified according to the data of driver test and traffic measurement. When networks architecture
is changed (e.g. Adding BTS or changing the network frequency configuration.), network operator must strictly
follow the changed cell neighbor relationship, reset and verify it. Improper neighbor cell description is usually
one of the important reasons of call drop. Besides, since the actual network topology structure is often greatly
different from the theoretical calculation result, and network is in the ever-changing environment, network
operator must modify the neighbor cell description information according to the real situation.

SYS Control Parameter

NCC

Permitted:

Value range: Check box, including options 0~7.

Content: Network Color Code, to be sent in system messages
2 and 6. It lists NCC that need be measured by MS. If a
neighbor cell with NCC permitted, MS will report M.R. Of the
neighbor cell to the network.
Recommendation: Subject to the concrete conditions.

RACH

Control Parameter:

See in System control parameter of SI Type 1

SI Type 2bis

SI Type 2bis

2BIS contains RACH control data and

neighbor cell BCCH frequencies (part
of

BA1

list).

It

is

optional

and

transmitted on BCCH. As the number

of frequencies in BA1 list carried by
SYS INFO 2 is limited; SYS INFO 2BIS
carries

the

rest

of

the

BCCH

frequencies in the BA1 list that are

Content
from
the same band as in SYS INFO 2.

SYS INFO 2BIS - - Neighbor Cell Desc.

- - RACH Control Parameter
(Same as that in SYS INFO 1)

SI Type 2ter
2TER contains neighbor
BCCH frequencies (part of
BA1 list). It is transmitted
on BCCH. Only dual band
MS can read this
information, and single
band 900 or 1800 MS will
ignore it. Since this
information carries BCCH
frequencies that belong to
different band as those in
INFO 2, it is
SYS
Content
unnecessary for single band
SYS INFO 2TER - MS to read.

Neighbor Cell Desc. (extended)

SI Type 3

SI Type 3

It

contains

parameters

LAI,
related

cell
to

identity,
cell

RACH

selection.

and
It

is

transmitted on BCCH. It is one of the most

important information in SYS INFO.

Content
SYS

INFO 3 - - Cell Identity

- - LAI( location area identity)
- - Control Channel Desc
- - Cell Option BCCH
- - Cell Selection Parameter
- - RACH Control Parameter

SI Type 3
Cell Identity and Location Area Identity:

Cell Global Identity (CGI) consists of Location Area Identity

(LAI) and Cell Identity (CI).

And LAI includes Mobile Country Code (MCC), Mobile Network

Code (MNC), and Location Area Code (LAC).
SYS INFO 3, 6, and 4 contain all or part of the information of CGI.
According to the received SYS INFO, MS decodes the CGI, and
decide whether it can register in the network based on the MCC
and MNC indicated by CGI. At the same time, it can judge
whether the current location area is changed, so as to decide
it globally.
is necessary
to start
the location
MCC iswhether
allocated
It consists
of three
decimalupdating
numbers.process.
For example,
Pakistan is 410. MNC is allocated by the country. It consists of two decimal
numbers. 00 is for Mobile, 06 is for Telenor. LAC and CI are planned by each GSM
network operator. They consist of two bytes. Please note that the value range of
CI is 0X0001- 0XFFFE. 0X0000 and 0XFFFF are reserved for other use.

SI Type 3
Control Channel
Description:
Control channel description includes the following
parameters
IMSI Attach-Detach Allowed (ATT, Attach-Detach allowed)
Common Control Channel Configuration (CCCH-CONF)
Access Granted Blocks Reserved (BS_AG_BLKS_RES)
Paging Channel Multi-frames (BS-PA-MFRAMS)
Periodic Location
Updating
(T3212)
IMSI Attach-Detach
Allowed
(ATT, Timer
Attach-Detach
allowed)
Value range: Yes, No
Content It is Attach-Detach allowed (ATT) in data management system. It is
used to inform MS whether IMSI attach-detach is allowed in this cell. If it is set to
Yes, the network will not process the connection to the subscriber called when
MS is power-off. Thus network processing time and resource are saved. Otherwise
the network will process the connection even though the MS has been powered
off.
Recommendation Yes

SI Type 3
Common Control Channel Configuration (CCCH-CONF):
Value range: 1 non-combined CCCH, 1 combined CCCH, 2 non-combined CCCH, 3 noncombined CCCH, 4 non-combined CCCH.
Content: It is Common Control Channel Configuration.The number of CCCH message blocks
in one corresponding BCCH multi-frame are 9, 3, 18, 27, and 36 respectively. CCCH
configuration determines the capacity of PCH, AGCH and RACH.
Unit: None
Recommendation: When there is one TRX in the cell, one combined CCCH is recommended
(in a system with few paging messages in location area). For others, it is configured
according
to the number of TRX in the cell.
BS-AG-BLKS-

RES :

Value range: 0~2 (1 combined CCCH), 0~7 (others)

Unit: Block
Content: It is also called Access Granted Blocks Reserved. It is the number of
CCCH channel message blocks that are reserved for access granted
channels(AGCH).
Recommendation: 2

SI Type 3
Paging Channel Multi-frames (BS-PA-MFRAMS)
Value range: 2 9
Unit: Multi-frame period (51 frames)
Content: It is Paging Channel Multi-frames. It defines the number of multi-frames
used as a loop of paging sub-channels.
Recommendation: 2

Periodic Location Updating Timer (T3212)

Value range: 0~255

Unit: 6 minutes

Content: It is Periodic Location Update Timer. It defines the period length of

location updating.
T3212:
Recommendation:

30 (for urban area), 20 (for suburban area)

MS will make location update when detecting the change of location, besides, MS will make periodic location update controlled by
parameter T3212. Once MS read T3212 from system info., it will store it in SIM card. When the time exceeds T3212 value, the location
update process will be triggered. The shorter the period the better the performance, but it will bring more signaling load for system. On
setting of this parameter, the processing capabilities of MSC and BSC should be considered, also the flows of A interface, Abis interface,
Um interface as well as those of HLR and VLR. Generally larger value for continuous covered urban area while smaller in the suburb,
countryside or the place with poor coverage.
Large T3212( 16 hours 20 hours) is recommended for the area with much traffic, and small T3212 (3 hours, 2 hours) for the area with a
little traffic. For the area where the traffic exceeds the system capacity, it is recommended to set T3212 as 0 (no periodic location
update). To set the value of T3212 properly, its necessary to conduct long-term measurement on the processing capability and flow of
each entity in the system. If any overload occurs, increase the value T3212. Note that this value should be smaller than the period by
which the network queries the IMSI attached subscriber. Otherwise, the following situation occurs: When MS has not done any operation
in a certain time, and it is not yet the time for periodic location update, the network will set IMSI flag of MS as detach, because its query
result shows that MS has not done any operation. Thus, the network will not process the paging of this MS. So, before MS initiates
another round of periodic location update, once there is a call for the MS, the network will voice the calling subscriber that the called MS

SI Type 4

SI Type 4
It consists LAI, RACH, cell selection
parameters and optional CBCH
channel information. It is
transmitted on BCCH. When the
system supports cell broadcast
function, CBCH together with the
CBCH MA describe the configuration
CBCH and the relevant frequency
of Content
information.
SYS INFO 4
- - LAI
- - Cell Selection Parameter
- - RACH Control Parameter
- - CBCH Channel Desc. (optional)
- - CBCH Mobile
Allocation(optional)
- - SI4 Rest Oct.(parameters

Among them, LAI, Cell Selection Parameter, and RACH Control Parameter have been explained above.

related to cell reselection)

SI Type 4
CBCH Channel Desc. and
CBCH MA:
These two parameters are optional. When system supports cell
broadcast, CBCH Channel Desc. explains the CBCH channel
configuration situation. When CBCH Channel Desc. is in frequency
MA
isand
also
needed.
CBCH channelhopping
descriptionmode,
includes:CBCH
channel
type
TDMA
offset, Timeslot Number (TN), Training Sequence
Code (TSC), Hopping channel indication (H), Mobile Assignment Indication Offset (MAIO), Hopping Sequence
Number (HSN), Absolute Radio Frequency Channel Number (ARFCN). CBCH mobile configuration contains
sequence of frequency hopping channels and cell channel description.

Rest Oct:

It contains the following

parameters:

Cell reselection parameter indicator

(PI)

Cell Bar Qualify (CBQ)

Cell Bar Access (CBA)

Cell_Reselect_Offset (CRO)

Temporary_Offset (TO)

Penalty_Time (PT)

SI Type 5

SI Type 5
SYS INFO 5

It describes the neighbor cell

BCCH frequencies(BA2 list). It is
mandatory and is transmitted on
SACCH. Different from SYS INFO
2, MS can read the frequency
described in SYS INFO 5 in
dedicated mode, report the
relevant information of neighbor
cells in measurement report,
and use it as the basis for
handover. Similarly, for 900 MS
of PHASE 1, it only recognizes
the neighbor cell frequency
information described by SYS
Content
INFO 5, and ignores that carried
SYS INFO
by SYS
5BIS andCell
5TER.
5 -INFO
- Neighbor
Desc.

Corresponding to System Information 2(System Information 2 describes

BA1),System Information 5 is part of the BA2 table. It is used when MS is in the
dedicated mode. Generally, the contents of BA1 and BA2 are the same. In special
cases, such as they are modified for radio network optimization purpose, their
contents can be different.

SI Type 5bis

SI Type 5bis
SYS INFO 5
5 BIS describes neighbor cells BCCH frequencies.These
frequencies are part of BA2 list. It is optional and is transmitted
on SACCH. Generally, as the number of frequencies which can
be described by SYS INFO 5 is limited, SYS INFO 5 BIS carries
the rest BCCH frequencies in the BA2 that are belong to the
same band as SYS INFO 5 for transmitting to MS.

Content
SYS INFO 5BIS - - Neighbor Cell Desc.
Corresponding to System Information 2BIS(2BIS is for BA1), the content of 5BIS is
part of the content of BA2 table. It is used when MS is in dedicated mode. The
neighbor cells frequencies which belong to the same band as the serving cell
BCCH will be put into 5BIS for transmitting to the MS while there is no room in
System Information 5.

SI Type 5ter

SI Type 5ter

SYS INFO 5

5 TER describes neighbor cells BCCH frequencies,these

frequencies are also part of the BA2 list. It is transmitted
on SACCH channel. Similarly, only dual band MS can read
this information, and single band GSM900 or GSM1800
MS will ignore it. It carries the BCCH frequencies of
neighbor cells whose band are different from the serving
Content
cells.
SYS

INFO 5TER - - Neighbor Cell Desc.(Extended)

Corresponding to System Information 2TER,(2TER is for BA1)the content

of the 5TER is part of the content of BA2. It is used when MS is in the
dedicated mode. The neighbor cells frequencies which belong to the
different band (900, 1800)from the serving cell in the BA2 will be put
into 5TER for transmitting to the MS.

SI Type 6

SI Type 6
It describes LAI, cell identity, and
some parameters describing
functions of the cell. It is
transmitted on SACCH. It is also
one of the most important
information in system
Content
information.
SYS
INFO 6 - - Cell Identity

- - LAI
- - Cell Option
- - NCC Permitted

Including part of the contents of SYS INFO 2 and 3. It is used for dedicated mode.

SI Type 13

SI Type 13

SI Type 13

System Information type 13 is only related to the GPRS service. SI Type 13 need only be
sent if GPRS support is indicated in one or more of System Information. Type 3 or 4 or 7
or 8 messages. These messages also indicate if the message is sent on the BCCH Norm
or if the message is transmitted on the BCCH Ext. In the case that the message is sent
on the BCCH Norm, it is sent at least once within any of 4 consecutive occurrences of TC
= 4.

Target Cell Selection - Standard Selection

SI 13 message is broadcast by the network on the BCCH. The message provides the mobile
station with GPRS cell specific access-related information. The information in this message
should be the same as provided in the PSI 13 message on PACCH.
If GPRS is required the MS shall read SI 13 message. SI 13 may indicate if PBCCH is
present in the cell.
If PBCCH is present in the cell, the MS shall camp on it. If PBCCH is not present in the cell,
the necessary system information related to GPRS is contained in SI 13 message (and
extended if necessary to SI 14 and SI 15 messages).
SI 13 message contains:
If PBCCH is present:
- Channel description for the PBCCH.
TN: Timeslot number used for PBCCH and PCCCHs.
TSC: Training sequence code for PBCCH and corresponding PCCCH.
ARFCN: non-hopping radio frequency absolute RF channel number.
- Localization of PSI type 1 information.
If PBCCH is not present:
- The routing area code (RAC).
- Options available in GPRS cell:
NMO: Network Mode of operation (Mode I,mode II, mode III).
ACCESS_BURST_TYPE (PRACH on 8 or 11 bits).
EGPRS cells capability
- Network control order parameters (NC0, NC1, NC2).
- GPRS power control parameters.

Conditions for Target Cell Selection (contd)

An EDGE Capable MS shall monitor the GPRS Cell Options on the BCCH (SI13)
or on the PBCCH (PSI1/PSI13) for the cell's EGPRS capability.
If EGPRS is supported by the cell, the Extension Information field contains the 2
following EDGE information:
EGPRS_PACKET_CHANNEL_REQUEST (1 bit field)
(0) EGPRS capable MSs shall use EGPRS PACKET CHANNEL REQUEST
message for uplink TBF establishment on the PRACH when there is a PBCCH in
the cell or on the RACH when there is no PBCCH in the cell.
(1) EGPRS capable MSs shall use two phase packet access with PACKET
CHANNEL REQUEST message on the PRACH for uplink TBF establishment
when there is a PBCCH in the cell. EGPRS capable MSs shall use two phase
packet access with CHANNEL REQUEST message on the RACH when there is
no PBCCH in the cell.
BEP_PERIOD (4 bit field)
bit error probability (BEP) filter averaging period.