TEMS Layer3 Messages Analysis

(1)

TEMS Layer3

(2)

What is Layer3?

• In the protocol stack of GSM signaling, composed of 3 layer, L1, L2 and L3.

• In L3 there are 3 sub-layers, Radio Resource (RR), Mobility Management (MM) and Connection

Management (CM).

Layer1

LAPDm

RR

MM

CM

Layer1

LAPDm

RR BTSM Layer1 LAPDm BTSM _SCCP BSSAP

Layer1

MTP

SCCP

MM

CM

BSSAP

RR Layer1

MTP

MS

BTS

BSC

MSC

(3)

What is Layer3?

• From the diagram, we can imply that all the information which MS

would like to talk with the network are done in the Layer 3.

• The flow of the message is so-called Message Flow Chart or

Signaling Flow Chart.

Note: Actual TA for the connection and MS Power level are send

in Layer1 on SACCH.

(4)

What is Layer3?

Hierarchy of 3 sub-layers

• RR sub-layer provides services to the MM

sub-layer and utilizes the services of

signaling layer 2.

• MM sub-layer provides common services

to the entities of the Connection

Management (CM) sub-layer.

- the CM sub-layer includes, among others,

the CC, SS, and SMS entities, which are

independent entities.

(5)

Radio Resource Management

• General Purpose

• Example messages

• Establish, Maintain and Release the RR connection.

• Cell selection/Reselection and Handover Procedure.

• Provide service for the upper layer.

• RR will related to the following procedure (CS)

• Idle mode procedures.

• RR Connection establishment.

• Initiate by MS

• Paging from network

• Dedicated mode procedure.

• System Information Type1-8.

• Handover command.

• Assignment Command.

(6)

Radio Resource Management (Cont.)

1. Idle mode Procedure

•

• Mobile Sides

Mobile Sides

•

• Listen to the BCCH and Paging Sub

Listen to the BCCH and Paging Sub

-

channel of serving cell.

•

• Measure the radio propagation and decode BCCH of

Measure the radio propagation and decode BCCH of

surrounding cells.

•

• Calculate C1/C2 in order to perform Cell Selection/ Reselection

Calculate C1/C2 in order to perform Cell Selection/ Reselection

.

• Network Sides

• Broadcast the system information on BCCH.

• Paging on CCCH (PCH).

(7)

Mobile Turn on Comment : SS=Signal Strength

PLMN Selection

Scan RF Carrier 3-5 second average windows

Selected Strongest average SS

Is it BCCH?

No

By Search for FCCH

Yes

Tuned to SCH for decode BSIC and decode System Info

Calculate Cell Selection Criteria (C1)

Suitable Cell Exist?

No

Try at least 30 Strongest RF channel for GSM900, or 40 for GSM1800 or 40 for GSM 1900

Camp on Suitable Cell

Yes

Radio Resource Management (Cont.)

P

CCH

MAX

MSPWR

B

MIN

ACCESS

RXLEV

Rxlev

A

B

Max

A

C

−

=

−

=

−

=

_

)

0 ,

(

1 From specification 3GPP 44.018

CBQ CB Cell Selection Cell Reselection

High(1) NO (0) Normal Normal

High(1) YES(1) Barred Barred

Low(0) NO (0) Low Normal

Low(0) YES(1) Low Normal

Cell Selection

(8)

Radio tower

SS DL

Allow MS Access to N/W _{Not Allow MS Access}

due to ACCMIN .

Not Allow MS Access due to Mobile Class can't transmiss Maximum Power that N/W allow.

Radio Resource Management (Cont.)

Cell Selection

(9)

Mobile Turn on PLMN Selection Cell Selection

MS Measuring Signal and Decode System Info from

Serving Cell

MS Measuring Signal, BSIC and Decode System Info from

Neighboring Cell

Ms Update SS of Serving Cell every 5 to Max(5, 5 consecutive paging block)

Ms Update SS of Neighboring Cells every 5 to Max(5, [(5*N+6)div7]*MFRM/4) N=BCCH in the BA List

MFRM=Multiframe for paging group

fullfil Cell Reselection

Criteria?

NO

YES

MS Select the new Cell

Radio Resource Management (Cont.)

11111

,

1

2 11111

),

(

*

1

2 =

−

=

<>

−

+

=

PT

CRO

C

PT

t

PT

H

TO

CRO

C

From specification 3GPP 44.018

0 ,

1 )

(

0 ,

0 )

(

≥

=

<

=

x

H

x

H

1.Serving cell becomes barred. 1.Serving cell becomes barred.

2.MS tried to access network for the 2.MS tried to access network for the allowed number of

allowed number of time.(time.(MAXRETMAXRET))

4.C1 of Serving Cell <0 for 5 seconds. 4.C1 of Serving Cell <0 for 5 seconds. 5.C2 of Neighbor > C2 of Serving for 5 5.C2 of Neighbor > C2 of Serving for 5 Seconds.

Seconds.

6.If Cell Reselection take place at last 6.If Cell Reselection take place at last 15 seconds C2 of Neighbor > C2 of 15 seconds C2 of Neighbor > C2 of Serving

Serving 5 dB for 5 Seconds5 dB for 5 Seconds..

3.MS detects a downlink signaling 3.MS detects a downlink signaling failure.

failure. Criteria : Criteria :

Cell Re

(10)

Radio Resource Management (Cont.)

• System Information

In

idle mode

, we can find the following system information broadcast on BCCH.

System Information Type 1

System Information Type 1 Optional

RACH control parameter and Cell channel allocation.

System Information Type 2 Mandatory

RACH control parameter and BCCH Allocation of neighbor cells.

System Information Type 2bis

System Information Type 2bis Optional

RACH control parameter and extension of BCCH Allocation of neighbor cells.

System Information Type 2ter

System Information Type 2ter Optional

RACH control parameter and extension of BCCH Allocation of neighbor cells.

RACH control parameter, LAI, CI and other cell parameter for idle mode.

System Information Type 7 Optional Cell Reselection parameter.

System Information Type 8 Optional Cell Reselection parameter.

(11)

Radio Resource Management (Cont.)

• Paging

Mobile will listen to the PCH channel which carried Paging request message.

There are 3 type of Paging Request.

Paging request type 1

Paging request type 1 Identify up to 2 mobiles with TMSI or IMSI

Paging request type 2 Identify up to 3 mobiles with TMSI or IMSI

Paging request type 3 Identify up to 4 mobiles with TMSI

• RACH Control Parameters

Exist in all mandatory system information in idle because it is allowed MS to

access the network any time (Random Access).

• MAX Retransmission – number of Maximum retransmission on RACH.

• Tx-Integer – Spreading time for the next retransmission.

• Cell Bar Access – Allow MS to camp in Idle mode.

(12)

Radio Resource Management (Cont.)

• Message flow in idle mode

MS

Network

System Information Type 2ter

Paging Request Type 1

Send on BCCH

Synch Channel Information

Send on BCCH

Send on SCH

Send on CCCH (PCH)

(13)

Radio Resource Management (Cont.)

2. RR Connection Establishment

•

• Mobile Initiate connection

Mobile Initiate connection

•

• Permission to access the network.

Permission to access the network.

•

• Initiate of Immediate Assignment procedure.

Initiate of Immediate Assignment procedure.

•

• Answer from the network.

Answer from the network.

•

• Assignment Completion.

Assignment Completion.

•

• Paging procedure for RR connection

Paging procedure for RR connection

•

• Paging initiation by the network.

Paging initiation by the network.

•

(14)

Radio Resource Management (Cont.)

• Message flow in RR Connection Establishment

MS

Network

Paging Request Type 1, 2, 3

Channel Request

Immediate Assignment

Paging Response (CM Service Request)

GPRS Suspension Request Classmark Change

Send on CCCH

Send on RACH

Send on AGCH

Send on SDCCH

(15)

3. Dedicated mode Procedures

Radio Resource Management (Cont.)

•

• SACCH Procedure

SACCH Procedure

•

• Network send System Information to MS on SACCH/DL.

Network send System Information to MS on SACCH/DL.

•

• MS report the radio condition to network by Measurement Report on SACCH/UL.

MS report the radio condition to network by Measurement Report

on SACCH/UL.

•

• Channel Assignment Procedure

Channel Assignment Procedure

•

• Network initiate channel assignment by sending ASSIGNMENT COMMAND.

Network initiate channel assignment by sending ASSIGNMENT COMMAN

D.

•

• If successful, MS send ASSIGNMENT COMPLETE to network.

If successful, MS send ASSIGNMENT COMPLETE to network.

•

• Handover Procedure

Handover Procedure

•

• After Network prepared the target channel, network initiate Handover by sending

After Network prepared the target channel, network initiate Hand

over by sending

HANDOVER COMMAND to the MS.

•

• Mobile send HANDOVER ACCESS in order to try to establish the physical

Mobile send HANDOVER ACCESS in order to try to establish the ph

ysical

channel at target cell.

•

• If MS successful to establish the connection in lower layer, HANDOVER

If MS successful to establish the connection in lower layer, HA

NDOVER

COMPLETE message will send to network.

•

• Ciphering mode setting

Ciphering mode setting

•

• Network send CIPHERING MODE COMMAND.

Network send CIPHERING MODE COMMAND.

•

(16)

Radio Resource Management (Cont.)

MS

Network

Ciphering Mode Command

Ciphering Mode Complete

Setup Assignment Command Assignment Complete

Send on SDCCH

Send on FACCH

• Message flow in Assignment and Ciphering

Call Proceeding/Call Confirmed

(17)

Radio Resource Management (Cont.)

• Message flow in SACCH and Handover

MS

Network

System Information Type5 (5ter)

Measurement Report

Handover Command

Handover Access

System Information Type6

Physical Information Handover Complete

Send on SACCH

Send on FACCH

(18)

Mobility Management

• General Purpose

• Support the mobility of users, e.g. the location of users, and

provide the confidential of the users.

• Provide connection management services to the upper sub-layer.

• MM will related to the following procedure (CS)

• MM common procedures

• TMSI Reallocation.

• Authentication.

• Identification.

• IMSI detach.

• MM specific procedures

•Location updating.

• Periodic updating.

• IMSI attach.

• Connection Management sub-layer service provision

• MM connection Establishment.

(19)

Mobility Management (cont.)

1. MM Common Procedures

•

• TMSI reallocation procedure

TMSI reallocation procedure

•

• Protection of IMSI to transmit in the radio interface signaling.

Protection of IMSI to transmit in the radio interface signaling.

•

• TMSI is unique with in LAI, so usually TMSI reallocation is per

TMSI is unique with in LAI, so usually TMSI reallocation is per

formed at least

when changing the location area.

•

• However, The TMSI reallocation can be initiated by the network at any time while

However, The TMSI reallocation can be initiated by the network

at any time while

a RR connection exists between the network and the MS (usually i

a RR connection exists between the network and the MS (usually in location

n location

update, call setup).

•

• Authentication

Authentication

•

• permit the network to check the identity of the MS.

permit the network to check the identity of the MS.

•

• provide parameters for MS to calculate ciphering key.

provide parameters for MS to calculate ciphering key.

•

• Identification

Identification

•

• Network request MS to provide the specific identification parameters to the

Network request MS to provide the specific identification param

eters to the

network, e.g. IMEI.

•

• IMSI Detach

IMSI Detach

•

• MS inform the network when switch off in order to change the st

MS inform the network when switch off in order to change the st

atus of this MS

in the VLR.

•

• This procedure are required when ATT flag, broadcasted in System Information

This procedure are required when ATT flag, broadcasted in Syste

m Information

is set.

(20)

Mobility Management (cont.)

2. MM Specific Procedures

•

• Location Update

Location Update

•

• There are 3 types of location update

There are 3 types of location update

•

• Normal location update use for update the actual LAI of MS, when the LAI is

Normal location update use for update the actual LAI of MS, whe

n the LAI is

changed.

•

• If the MS cross the location area in dedicated mode, location u

If the MS cross the location area in dedicated mode, location u

pdate is

performed after MS leave dedicated mode to MM idle state.

•

• Location update is always initiated by MS.

Location update is always initiated by MS.

•

• Periodic updating

Periodic updating

•

• Controlled by T3212 in the mobile.

Controlled by T3212 in the mobile.

•

• The timer is stopped and reset to the initial value when

The timer is stopped and reset to the initial value when

•

• LOCATION UPDATE ACCEPT or LOCATION UPDATE REJECT is received

LOCATION UPDATE ACCEPT or LOCATION UPDATE REJECT is received

•

• AUTHENTICATION REJECT is received.

AUTHENTICATION REJECT is received.

•

• The first MM message is received.

The first MM message is received.

•

• MS is deactivated (switch off).

MS is deactivated (switch off).

•

• when the timer expired, location update is started.

when the timer expired, location update is started.

•

• IMSI Attach

IMSI Attach

•

• IMSI Attach is a compliment of IMSI detach, to inform the network that MS once

IMSI Attach is a compliment of IMSI detach, to inform the netwo

rk that MS once

again activate.

•

(21)

Mobility Management (cont.)

• Message flow in MM

MS

Network

TMSI Reallocation Command

TMSI Reallocation Complete

Authentication Request

Authentication Response

Identity Request

Identity Response

Location Update Request

Location Update Accept

IMSI Detach Indication

Send on SDCCH

(22)

Circuit-switch Call Control (CC)

• General Purpose

• CC is one of Connection Management (CM) sub-layer (others are

SS and SMS).

• Use to establish, maintain and release the call.

• MM will related to the following procedure (CS)

• Call Establishment procedures

• Mobile originating call.

• Mobile Terminating call.

• Call Clearing

• Clear initiate by mobile station.

• Clearing initiate by network.

• Example messages

• Setup.

• Alerting.

• Call Proceeding.

• Connect.

(23)

Circuit-switch Call Control (Cont.)

• Message flow in CC (mobile originating call)

MS

Network

Setup Call Proceeding Alerting Connect Connect Acknowledge

Send on SDCCH

Send on FACCH

(24)

Circuit-switch Call Control (Cont.)

• Message flow in CC (mobile originating call)

MS

Network

Setup Call Confirmed Alerting Connect Connect Acknowledge

Send on SDCCH

Send on FACCH

(25)

System Information Type1

RACH Control Parameter

MS can send maximum Channel Request = Max retransmission+1.

• The interval between retransmission is a random value uniformly select form the following set {S,S+1,…S+Tx-integer-1}.

• Cell barred Access prevent MS to camp on this cell in Idle mode (cell selection/Re-selection).

• Call reestablishment allow MS send RACH to resume the connection after call

TX-integer non-combined CCCH combined CCCH/SDCCH 3,8,14,50 55 41 4,9,16 76 52 5,10,20 109 58 6,11,25 163 86 7,12,32 217 115

(26)

System Information Type2

BCCH Allocation List

MS will get the ARFCH of BCCH of surrounding cell it has to measure and decode in idle mode from this messages. • MS will not scan, synch or decode any frequencies that are not in this list

• in Type 2 it will send the list of the same band of the serving cell, BCCH allocation list of different band will be sent in Type 2ter.

• In type 2ter also contain the information about how many neighbors from different band mobiles have to add in the

measurement report.

NCC permitted

MS will use this value when it first enter to dedicated mode before it get new in

(27)

System Information Type3

Control channel

• ATT IMSI attach/detach flag

• BS-AG-BLKS-RES number of block reserve for access grant, use in the calculation of paging group.

• CCCH-CONF indicate whether CCCH is combined with SDCCH.

• BS-PA-MFRMS Multiframe for paging group calculation.

• T3212 periodic registration timer.

Cell Option

• DTX indicator whether mobile shall use DTX or not.

• RADIO-LINK-TIMEOUT the radio link timeout for DL connection that mobile

PAGING_GROUP

= {(IMSI mod 1000) mod

(BS_CC_CHANS x N)} mod N

N = number of paging block

= (number of paging blocks "available" in a 51- multiframe on one CCCH) x BS_PA_MFRMS.

(28)

System Information Type4

Broadcast as similar

information as System

Information Type3 but

less detail.

(29)

Synch Channel Information

Synchronization data

• BSIC base station Identity Code, determine the cell (6 bits).

• T1, T2, T3’ is the reduced frame number (19 bits).

From specification 3GPP 45.002

• The T1, T2, T3’ was derived from the actual frame number.

• T1 (11 bits) = FN div (26x51) • T2 (5 bits) = FN mod 26 • T3’ (3 bits) = (T3-1) div 10 Where T3 = FN mod 51

(30)

Paging Request Type1

Mobile Identity

• Can contain maximum 2 mobile identity with TMSI or IMSI.

(31)

Paging Request Type2

Mobile Identity

• Can contain maximum 3 mobile identity with TMSI or IMSI.

(32)

Paging Request Type3

Mobile Identity

• Can contain maximum 4 mobiles identity with TMSI only.

(33)

Channel Request

Random Access Information

• Establishment cause contain the reason for requesting the establishment of the connection. • Random reference random value as a reference to the network when channel is assigned.

(34)

Immediate Assignment

Channel Description

• The details of target physical channel of SDCCH which MS have to camp on in dedicated mode.

Request Reference

• Include the Establishment cause and random reference value from the channel request.

Timing Advance

• The initial timing advance values, which BSC calculate from the delay of random access.

(35)

Classmark Change

Encryption algorithm support

• mobile will declare all Encryption algorithm it support.

MS power capability

• mobile power class

MS Power MS Power Class Class Output Output power [ power [dBmdBm]] Sensitivity Sensitivity [ [dBmdBm]] 2 39 -106 3 37 -106 4 33 -104 5 29 -104 GSM900 MS Power MS Power Class Class Output Output power [ power [dBmdBm]] Sensitivity Sensitivity [ [dBmdBm]] 1 30 -104 2 24 -104 GSM1800

(36)

Ciphering Mode Command

Cipher mode setting

• It will inform mobile that in which ciphering algorithm will be used in this connection.

A5

data

Kc Kc

data

A8

Kc

RAND

Ki

data

(37)

Assignment Command

Description of the channel

• Channel Type indicate the target channel (TCHF/TCHH). • TN target TCH timeslot number.

• TSC training sequence code.

• Hopping RF channel whether target channel is HOPPING. • MAIO start MAI for hopping.

• HSN hopping sequence number.

Power Command

• Power level the initial power use in this connection.

Mobile allocation

• Mobile allocation array the frequency which will use when hopping.

Cell channel description

(38)

System Information Type5

BCCH Allocation List

• As same as System Information Type2 in idle mode, System Information Type5 contain the BA List which mobile have to monitor in dedicated mode.

• in Type 5 it will send the list of the same band of the serving cell, BCCH allocation list of different band will be sent in Type 5ter.

• In type 5ter also contain the information about how many neighbors from different band mobiles have to add in the measurement report.

(39)

System Information Type6

Cell options

• PWRC indicated.

• DTX indicator whether DTX is used.

• Radio Link Timeout The counter of radio link failure and release the channel.

NCC permitted

• MS will not report the signal level of the cell which NCC are not belong or exist in this list.

SACCH

RLT (max)

0

Drop Call

Radio link timeout work in following manner, when MS fail to decode SACCH block it will decrease by one, but if the SACCH block can be decode again its increment is 2.

(40)

Measurement Report

Serving Cell measurement

• RxLev Full rxlevel of serving cell average for full set.

• Rxlev Sub rxlevel of serving cell average for sub set

• RxQual full rxqual of serving cell average for full set.

• RxQual Sub rxqual of serving average for sub set.

Six strongest neighbor

• RxLev rxlevel on BCCH of neighboring cell . • BSIC BSIC of the neighbor.

• BCCH-INDEX the index of BCCH on BA List in system information type5.

(41)

Handover Command

Cell Description

• BCCH and BSIC of the target cell.

Channel Description

• allocated channel at target cell, in case of Hopping it will inform MAIO and HSN.

Handover Reference

• reference value use to

identify the Handover Access from the mobile.

Synchronization

• indicate the handover is synchronous or

asynchronous. Synchronous handover case after MS send Handover Access, it will tune the transceiver to the target channel without waiting for Physical Information

(42)

Handover Access

Handover Reference

• Refer that this Handover Access belong to which Handover Command.

Handover Access is a very short message (1 octet), which using Access Burst as same as Channel Request.

In some case , it is possible that this Handover Access will trigger the allocation of SDCCH of surrounding cells because they think it is the channel request message.

This phenomena can cause the problem on immediate assignment success rate.

(43)

Physical Information

Timing Advance

• This timing advance tell the mobile about the timing advance which will use in the target cell. • The mechanism of detect the timing advance is as same as in immediate assignment procedure because the burst structure using for channel request (Random Access) and handover access is the same.

(44)

Location Update Request

Location Update Type

• Indicate the type of location update.

Location Area Identity

• the information of current LAI stored in SIM card (old LAI).

Mobile Station Classmark

• contain MS capability.

Mobile Identity

(45)

Location Update Accept

Location Area Identity

• the information of new LAI which will replace the current LAI in SIM card.

Mobile Identity

• New TMSI which MS will use in the new LAI, in this case MS have to send TMSI

REALLOCATION COMPLETE in order to confirm the use of new TMSI to the network and there are no TMSI REALLOCATION COMAND sent in this case.

(46)

Authentication Request

Authentication parameter

• From the Triplet, MSC send RAND to the MS in Authentication Request Message.

• MS will use this RAND value to calculate SRES and answer the value in Authentication Response.

(47)

Authentication Response

• MS use RAND as input of A3 algorithm together with Ki stored in the SIM card.

• The output of the operation is SRES.

• MS return SRES to MSC via AUTHENTICATION RESPONSE message.

• MSC will check compare the SRES with the one that calculated in MSC.

A3

SRES

RAND

Ki

(48)

Setup (MOC)

Bearer Capability

• MS send the bearer capability to MSC in order to assign the TCH channel.

Called party BCD number

(49)

Setup (MTC)

Bearer Capability

• This case MSC ask for the bearer capability of the MS.

• MS answer its capability and prefer channel type to MSC on CALL CONFIRMED in order to get TCH channel.