TEMS Layer3 Messages Analysis V2

TEMS Layer3 Messages Analysis

Layer3 Messages

1. Introduction (45 minutes)

Radio Network Planning and Optimization

Layer3 Messages

What is Layer3? • In the protocol stack of GSM signaling, composed of 3 layer, L1, L2 and L3. • In L3 there are 3 sub-layers, Radio Resource (RR), Mobility Management (MM) and Connection Management (CM).

MS

BTS

BSC

MSC

CM

CM

MM

MM RR

RR RR

BTSM

BTSM

BSSAP

BSSAP

SCCP

SCCP

LAPDm

LAPDm

LAPD

MTP

MTP

Layer1

Layer1

Layer1

Layer1

Layer1

Um Interface Radio Network Planning and Optimization

Abis Interface

A Interface

Layer3 Messages

What is Layer3? • From the diagram, we can imply that all the information which MS would like to talk with the network are done in the Layer 3. • The flow of the message is so-called Message Flow Chart or Signaling Flow Chart. MS

Network

Note: Actual TA for the connection and MS Power level are send in Layer1 on SACCH. Radio Network Planning and Optimization

Layer3 Messages

What is Layer3? Hierarchy of 3 sub-layers • RR sub-layer provides services to the MM sub-layer and utilizes the services of signaling layer 2. • MM sub-layer provides common services to the entities of the Connection Management (CM) sub-layer. - the CM sub-layer includes, among others, the CC, SS, and SMS entities, which are independent entities.


Layer3 Messages

Practice 1.

What is the layer 1, explain roughly? Answer:

2.

SCCP and MTP is the protocol layer of what standard? Answer:

3.

Layer 1 specify the physical layer of the connection.

SS7 signaling.

In what layer and channel which BSC send ordered TA and ordered power level to the mobile station? Answer:

Layer 1 header on SACCH/ DL.


Layer3 Messages

Layer 3 Protocol (2 hours)


Layer3 Messages

Radio Resource Management • General Purpose • Establish, Maintain and Release the RR connection. • Cell selection/Reselection and Handover Procedure. • Provide service for the upper layer.

• RR will related to the following procedure (CS) • Idle mode procedures. • RR Connection establishment. • Initiate by MS • Paging from network • Dedicated mode procedure.

• Example messages • System Information Type1-8. • Handover command. • Assignment Command. • Immediate Assignment Command. Radio Network Planning and Optimization

Layer3 Messages

Radio Resource Management (Cont.) 1. Idle mode Procedure • Mobile Sides • Listen to the BCCH and Paging Sub-channel of serving cell. • Measure the radio propagation and decode BCCH of surrounding cells. • Calculate C1/C2 in order to perform Cell Selection/ Reselection. • Network Sides • Broadcast the system information on BCCH. • Paging on CCCH (PCH).


Layer3 Messages

Radio Resource Management (Cont.) Mobile Turn on

Comment : SS=Signal Strength

Cell Selection

PLMN Selection

From specification 3GPP 44.018 Scan RF Carrier 3-5 second average windows

Selected Strongest average SS

C 1 = A − Max ( B ,0) A = Rxlev − RXLEV _ ACCESS _ MIN

No

By Search for FCCH Is it BCCH?

No Yes

Tuned to SCH for decode BSIC and decode System Info

Calculate Cell Selection Criteria (C1)

Try at least 30 Strongest RF channel for GSM900, or 40 for GSM1800 or 40 for GSM 1900

Suitable Cell Exist?

Yes

Camp on Suitable Cell


B = MSPWR _ MAX _ CCH − P CBQ High(1) High(1) Low(0) Low(0)

CB NO (0) YES(1) NO (0) YES(1)

Cell Selection Cell Reselection Normal Normal Barred Barred Low Normal Low Normal

Layer3 Messages

Radio Resource Management (Cont.) Cell Selection SS DL

Allow MS Access to N/W

Not Allow MS Access due to ACCMIN . Not Allow MS Access due to Mobile Class can't transmiss Maximum Power that N/W allow.

Radio tower


Layer3 Messages

Radio Resource Management (Cont.) Cell Re-selection

Mobile Turn on

PLMN Selection

From specification 3GPP 44.018

C 2 = C 1 + CRO − TO * H ( PT − t ), PT <> 11111 C 2 = C 1 − CRO , PT = 11111

Cell Selection

H ( x ) = 0, x < 0 H ( x ) = 1, x ≥ 0

Ms Update SS of Serving Cell every 5 to Max(5, 5 consecutive paging block) MS Measuring Signal and Decode System Info from Serving Cell Ms Update SS of Neighboring Cells every 5 to Max(5, [(5*N+6)div7]*MFRM/4) N=BCCH in the BA List MFRM=Multiframe for paging group

Criteria : 1.Serving cell becomes barred.

MS Measuring Signal, BSIC and Decode System Info from Neighboring Cell

NO

2.MS tried to access network for the allowed number of time.(MAXRET time.(MAXRET)) 3.MS detects a downlink signaling failure.

fullfil Cell Reselection Criteria?

YES

MS Select the new Cell


4.C1 of Serving Cell <0 for 5 seconds. 5.C2 of Neighbor > C2 of Serving for 5 Seconds. 6.If Cell Reselection take place at last 15 seconds C2 of Neighbor > C2 of Serving 5 dB for 5 Seconds .

Layer3 Messages

Radio Resource Management (Cont.) • System Information In idle mode, we can find the following system information broadcast on BCCH. System Information Type 1 System Information Type 2 System Information Type 2bis System Information Type 2ter

Optional Mandatory

RACH control parameter and Cell channel allocation. RACH control parameter and BCCH Allocation of neighbor cells.

Optional

RACH control parameter and extension of BCCH Allocation of neighbor cells.

Optional

RACH control parameter and extension of BCCH Allocation of neighbor cells.

Mandatory

RACH control parameter, LAI, CI and other cell parameter for idle mode.

System Information Type 4

Mandatory

RACH control parameter, LAI, CI and other cell parameter for idle mode.


Optional

Cell Reselection parameter.


Optional

Cell Reselection parameter.


Optional

GPRS information in cell.



Layer3 Messages

Radio Resource Management (Cont.) • Paging Mobile will listen to the PCH channel which carried Paging request message. There are 3 type of Paging Request. Paging request type 1

Identify up to 2 mobiles with TMSI or IMSI

Paging request type 2

Identify up to 3 mobiles with TMSI or IMSI

Paging request type 3

Identify up to 4 mobiles with TMSI

• RACH Control Parameters Exist in all mandatory system information in idle because it is allowed MS to access the network any time (Random Access). • MAX Retransmission – number of Maximum retransmission on RACH. • Tx-Integer – Spreading time for the next retransmission. • Cell Bar Access – Allow MS to camp in Idle mode. • Call Re-establishment – Allow MS to re-connect to network after call drop.


Layer3 Messages

Radio Resource Management (Cont.) • Message flow in idle mode Network

MS System Information Type 1 System Information Type 2 System Information Type 3 System Information Type 4

Send on BCCH Send on BCCH Send on BCCH Send on BCCH

System Information Type 2ter

Send on BCCH Synch Channel Information

Send on SCH Paging Request Type 1

Send on CCCH (PCH) Paging Request Type 2

Send on CCCH (PCH) Paging Request Type 3

Send on CCCH (PCH) Radio Network Planning and Optimization

Layer3 Messages

Radio Resource Management (Cont.) 2. RR Connection Establishment • Mobile Initiate connection • Permission to access the network. • Initiate of Immediate Assignment procedure. • Answer from the network. • Assignment Completion. • Paging procedure for RR connection • Paging initiation by the network. • Paging Response


Layer3 Messages

Radio Resource Management (Cont.) • Message flow in RR Connection Establishment Network

MS Paging Request Type 1, 2, 3

Send on CCCH

Channel Request

Send on RACH Immediate Assignment

Send on AGCH Paging Response (CM Service Request)

Send on SDCCH GPRS Suspension Request

Send on SDCCH Classmark Change

Send on SDCCH


Layer3 Messages

Radio Resource Management (Cont.) 3. Dedicated mode Procedures • SACCH Procedure • Network send System Information to MS on SACCH/DL. • MS report the radio condition to network by Measurement Report on SACCH/UL.

• Channel Assignment Procedure • Network initiate channel assignment by sending ASSIGNMENT COMMAND. • If successful, MS send ASSIGNMENT COMPLETE to network.

• Handover Procedure • After Network prepared the target channel, network initiate Handover by sending HANDOVER COMMAND to the MS. • Mobile send HANDOVER ACCESS in order to try to establish the physical channel at target cell. • If MS successful to establish the connection in lower layer, HANDOVER COMPLETE message will send to network.

• Ciphering mode setting • Network send CIPHERING MODE COMMAND. • MS will do the ciphering and reply CIPHERING MODE COMPLETE. Radio Network Planning and Optimization

Layer3 Messages

Radio Resource Management (Cont.) • Message flow in Assignment and Ciphering Network

MS Ciphering Mode Command Ciphering Mode Complete Setup

Send on SDCCH Send on SDCCH Send on SDCCH

Call Proceeding/Call Confirmed

Send on SDCCH Assignment Command Assignment Complete

Send on SDCCH Send on FACCH

Alerting

Send on FACCH


Layer3 Messages

Radio Resource Management (Cont.) • Message flow in SACCH and Handover Network

MS System Information Type5 (5ter) System Information Type6 Measurement Report Handover Command Handover Access Physical Information Handover Complete


Send on SACCH Send on SACCH Send on SACCH Send on FACCH Send on FACCH Send on FACCH Send on FACCH

Layer3 Messages

Mobility Management • General Purpose • Support the mobility of users, e.g. the location of users, and provide the confidential of the users. • Provide connection management services to the upper sub-layer.

• MM will related to the following procedure (CS) • MM common procedures • TMSI Reallocation. • Authentication. • Identification. • IMSI detach. • MM specific procedures •Location updating. • Periodic updating. • IMSI attach. • Connection Management sub-layer service provision • MM connection Establishment. Radio Network Planning and Optimization

Layer3 Messages

Mobility Management (cont.) 1. MM Common Procedures • TMSI reallocation procedure • Protection of IMSI to transmit in the radio interface signaling. • TMSI is unique with in LAI, so usually TMSI reallocation is performed at least when changing the location area. • However, The TMSI reallocation can be initiated by the network at any time while a RR connection exists between the network and the MS (usually in location update, call setup).

• Authentication • permit the network to check the identity of the MS. • provide parameters for MS to calculate ciphering key.

• Identification • Network request MS to provide the specific identification parameters to the network, e.g. IMEI.

• IMSI Detach • MS inform the network when switch off in order to change the status of this MS in the VLR. • This procedure are required when ATT flag, broadcasted in System Information is set. • MS initiate IMSI detach procedure by send IMSI DETACH INDICATION message. Radio Network Planning and Optimization

Layer3 Messages

Mobility Management (cont.) 2. MM Specific Procedures • Location Update • There are 3 types of location update • Normal location update use for update the actual LAI of MS, when the LAI is changed. • If the MS cross the location area in dedicated mode, location update is performed after MS leave dedicated mode to MM idle state. • Location update is always initiated by MS.

• Periodic updating • Controlled by T3212 in the mobile. • The timer is stopped and reset to the initial value when • LOCATION UPDATE ACCEPT or LOCATION UPDATE REJECT is received • AUTHENTICATION REJECT is received. • The first MM message is received. • MS is deactivated (switch off). • when the timer expired, location update is started.

• IMSI Attach • IMSI Attach is a compliment of IMSI detach, to inform the network that MS once again activate. • It is also controlled by ATT flag in System Information. Radio Network Planning and Optimization

Layer3 Messages

Mobility Management (cont.) • Message flow in MM Network

MS TMSI Reallocation Command

Send on SDCCH

TMSI Reallocation Complete

Send on SDCCH Authentication Request

Send on SDCCH

Authentication Response

Send on SDCCH Identity Request Identity Response Location Update Request Location Update Accept IMSI Detach Indication


Send on SDCCH Send on SDCCH Send on SDCCH Send on SDCCH Send on SDCCH

Layer3 Messages

Circuit-switch Call Control (CC) • General Purpose • CC is one of Connection Management (CM) sub-layer (others are SS and SMS). • Use to establish, maintain and release the call.

• MM will related to the following procedure (CS) • Call Establishment procedures • Mobile originating call. • Mobile Terminating call. • Call Clearing • Clear initiate by mobile station. • Clearing initiate by network.

• Example messages • Setup. • Alerting. • Call Proceeding. • Connect. Radio Network Planning and Optimization

Layer3 Messages

Circuit-switch Call Control (Cont.) • Message flow in CC (mobile originating call) Network

MS Setup

Send on SDCCH Call Proceeding

Alerting

Connect

Connect Acknowledge


Send on SDCCH

Send on FACCH

Send on FACCH

Send on FACCH

Layer3 Messages

Circuit-switch Call Control (Cont.) • Message flow in CC (mobile Terminated call) Network

MS Setup

Send on SDCCH Call Confirmed

Alerting

Connect

Connect Acknowledge


Send on SDCCH

Send on FACCH

Send on FACCH

Send on FACCH

Layer3 Messages

Practice for Layer 3 Protocol 1.

Paging Response is belong to which Layer 3 sub-layer? Answer:

2.

What will happen if T3212 is longer than Implicit detach Timer in MSC/VLR? Answer:

3.

RR Sub-layer.

People can not call to this mobile, because MSC/VLR already mark it as implicit detach.

Where we can find RACH control parameters and why? Answer:

In System Information Type 1, 2, 3 and 4 because mobile may need them to access the network any time (Random Access).


Layer3 Messages

System Information Type1 RACH Control Parameter MS can send maximum Channel Request = Max retransmission+1. • The interval between retransmission is a random value uniformly select form the following set {S,S+1,…S+Tx-integer-1}.

TX-integer

non-combined CCCH

combined CCCH/SDCCH

3,8,14,50

55

41

4,9,16

76

52

5,10,20

109

58

6,11,25

163

86

7,12,32

217

115

• Cell barred Access prevent MS to camp on this cell in Idle mode (cell selection/Reselection). • Call reestablishment allow MS send RACH to resume the connection after call dropped. Radio Network Planning and Optimization

Layer3 Messages

System Information Type2 BCCH Allocation List MS will get the ARFCH of BCCH of surrounding cell it has to measure and decode in idle mode from this messages. • MS will not scan, synch or decode any frequencies that are not in this list • in Type 2 it will send the list of the same band of the serving cell, BCCH allocation list of different band will be sent in Type 2ter. • In type 2ter also contain the information about how many neighbors from different band mobiles have to add in the measurement report.

NCC permitted MS will use this value when it first enter to dedicated mode before it get new in formation on SACCH.


Layer3 Messages

System Information Type3

Control channel • ATT IMSI attach/detach flag • BS-AG-BLKS-RES number of block reserve for access grant, use in the calculation of paging group. • CCCH-CONF indicate whether CCCH is combined with SDCCH. • BS-PA-MFRMS Multiframe for paging group calculation. • T3212 periodic registration timer. PAGING_GROUP = {(IMSI mod 1000) mod (BS_CC_CHANS x N)} mod N N = number of paging block = (number of paging blocks "available" in a 51- multiframe on one CCCH) x BS_PA_MFRMS.

Cell Option • DTX indicator whether mobile shall use DTX or not. • RADIO-LINK-TIMEOUT the radio link timeout for DL connection that mobile will use for this cell. Radio Network Planning and Optimization

Layer3 Messages

System Information Type3 Paging group calculation for particular subscriber • PAGING_GROUP (0 .. N-1) = {(IMSI mod 1000) mod (BS_CC_CHANS x N)} mod N • CCCH_GROUP (0 .. BS_CC_CHANS-1) = {(IMSI mod 1000) mod (BS_CC_CHANS x N)} div N • where • N = number of paging blocks "available" on one CCCH = (number of paging blocks "available" in a 51-multiframe on one CCCH) x BS_PA_MFRMS. • IMSI = International Mobile Subscriber Identity, as defined in 3GPP TS 03.03. • BS_CC_CHANS = number of CCCH timeslots on BCCH frequency. – mod = Modulo. – div = Integer division.

From specification 3GPP 45.002


Layer3 Messages

System Information Type4 Broadcast as similar information as System Information Type3 but less detail.


Layer3 Messages

Synch Channel Information Synchronization data • BSIC base station Identity Code, determine the cell (6 bits). • T1, T2, T3’ is the reduced frame number (19 bits).

From specification 3GPP 45.002 • The T1, T2, T3’ was derived from the actual frame number. • T1 (11 bits) = FN div (26x51) • T2 (5 bits) = FN mod 26 • T3’ (3 bits) = (T3-1) div 10 Where T3 = FN mod 51


Layer3 Messages

Paging Request Type1 Mobile Identity • Can contain maximum 2 mobile identity with TMSI or IMSI.


Layer3 Messages

Paging Request Type2 Mobile Identity • Can contain maximum 3 mobile identity with TMSI or IMSI.


Layer3 Messages

Paging Request Type3 Mobile Identity • Can contain maximum 4 mobiles identity with TMSI only.


Layer3 Messages

Channel Request

Random Access Information • Establishment cause contain the reason for requesting the establishment of the connection. • Random reference random value as a reference to the network when channel is assigned. Radio Network Planning and Optimization

Layer3 Messages

Channel Request Bit Pattern between Random Reference and Establishment cause can be found in specification 44.018. We can see there are some bit pattern that are not defined in the table.


Layer3 Messages

Immediate Assignment Channel Description • The details of target physical channel of SDCCH which MS have to camp on in dedicated mode.

Request Reference • Include the Establishment cause and random reference value from the channel request.

Timing Advance • The initial timing advance values, which BSC calculate from the delay of random access.


Layer3 Messages

Immediate Assignment TA calculation in Call setup Access burst

TA value (bit period)


Layer3 Messages

Classmark Change Encryption algorithm support • mobile will declare all Encryption algorithm it support.

MS power capability • mobile power class GSM900 MS Power Class

Output power [dBm]

Sensitivity [dBm]

2

39

-106

3

37

-106

4

33

-104

5

29

-104

GSM1800 MS Power Class


Output power [dBm]

Sensitivity [dBm]

1

30

-104

2

24

-104

Layer3 Messages

Ciphering Mode Command Cipher mode setting • It will inform mobile that in which ciphering algorithm will be used in this connection.

RAND Ki

Kc

data data

A5


Kc

A8

Kc

A5

data data

Layer3 Messages

Assignment Command Description of the channel • Channel Type indicate the target channel (TCHF/TCHH). • TN target TCH timeslot number. • TSC training sequence code. • Hopping RF channel whether target channel is HOPPING. • MAIO start MAI for hopping. • HSN hopping sequence number.

Power Command • Power level the initial power use in this connection.

Cell channel description • Channels the frequency available in this cells.

Mobile allocation • Mobile allocation array the frequency which will use when hopping.


Layer3 Messages

System Information Type5

BCCH Allocation List • As same as System Information Type2 in idle mode, System Information Type5 contain the BA List which mobile have to monitor in dedicated mode. • in Type 5 it will send the list of the same band of the serving cell, BCCH allocation list of different band will be sent in Type 5ter. • In type 5ter also contain the information about how many neighbors from different band mobiles have to add in the measurement report.


Layer3 Messages

System Information Type6 Cell options • PWRC indicated. • DTX indicator whether DTX is used. • Radio Link Timeout The counter of radio link failure and release the channel. RLT (max)

0 Drop Call

SACCH

Radio link timeout work in following manner, when MS fail to decode SACCH block it will decrease by one, but if the SACCH block can be decode again its increment is 2.

NCC permitted • MS will not report the signal level of the cell which NCC are not belong or exist in this list.


Layer3 Messages

Measurement Report Serving Cell measurement • RxLev Full rxlevel of serving cell average for full set. • Rxlev Sub rxlevel of serving cell average for sub set • RxQual full rxqual of serving cell average for full set. • RxQual Sub rxqual of serving average for sub set.

Six strongest neighbor • RxLev rxlevel on BCCH of neighboring cell . • BSIC BSIC of the neighbor. • BCCH-INDEX the index of BCCH on BA List in system information type5.


Layer3 Messages

Handover Command Cell Description • BCCH and BSIC of the target cell.

Channel Description • allocated channel at target cell, in case of Hopping it will inform MAIO and HSN.

Handover Reference • reference value use to identify the Handover Access from the mobile.

Synchronization • indicate the handover is synchronous or asynchronous. Synchronous handover case after MS send Handover Access, it will tune the transceiver to the target channel without waiting for Physical Information message.


Layer3 Messages

Handover Access Handover Reference • Refer that this Handover Access belong to which Handover Command. Handover Access is a very short message (1 octet), which using Access Burst as same as Channel Request. In some case , it is possible that this Handover Access will trigger the allocation of SDCCH of surrounding cells because they think it is the channel request message. This phenomena can cause the problem on immediate assignment success rate.


Layer3 Messages

Physical Information Timing Advance • This timing advance tell the mobile about the timing advance which will use in the target cell. • The mechanism of detect the timing advance is as same as in immediate assignment procedure because the burst structure using for channel request (Random Access) and handover access is the same.

Access Burst


Layer3 Messages

Location Update Request Location Update Type • Indicate the type of location update.

Location Area Identity • the information of current LAI stored in SIM card (old LAI).

Mobile Station Classmark • contain MS capability.

Mobile Identity • Identity of the MS can be either TMSI or IMSI.


Layer3 Messages

Location Update Accept Location Area Identity • the information of new LAI which will replace the current LAI in SIM card.

Mobile Identity • New TMSI which MS will use in the new LAI, in this case MS have to send TMSI REALLOCATION COMPLETE in order to confirm the use of new TMSI to the network and there are no TMSI REALLOCATION COMAND sent in this case.


Layer3 Messages

Authentication Request Authentication parameter • From the Triplet, MSC send RAND to the MS in Authentication Request Message. • MS will use this RAND value to calculate SRES and answer the value in Authentication Response.


Layer3 Messages

Authentication Response Authentication Response • MS use RAND as input of A3 algorithm together with Ki stored in the SIM card. • The output of the operation is SRES. • MS return SRES to MSC via AUTHENTICATION RESPONSE message. • MSC will check compare the SRES with the one that calculated in MSC.

RAND Ki


A3

SRES

Layer3 Messages

Setup (MOC) Bearer Capability • MS send the bearer capability to MSC in order to assign the TCH channel.

Called party BCD number • target MSISDN for this call.


Layer3 Messages

Setup (MTC) Bearer Capability • This case MSC ask for the bearer capability of the MS. • MS answer its capability and prefer channel type to MSC on CALL CONFIRMED in order to get TCH channel.

Calling party BCD number • MSISDN who call this MS.


TEMS Layer3 Messages Analysis V2

Recommend Documents