TEMS Layer3 Messages Analysis

Layer3 Messages

What is Layer3? In the protocol stack of GSM signaling, composed of 3 layer, L1, L2 and L3. In L3 there are 3 sub-layers, Radio Resource (RR), Mobility Management (MM) and Connection Management (CM).

Radio Network Planning and Optimization

Layer1

LAPDm

RR

MM

CM

Layer1

LAPDm

RR BTSM

Layer1

LAPDm

BTSM SCCP

BSSAP

Layer1

MTPSCCP

MM

CM

BSSAPRR

Layer1

MTP

MS BTS BSC MSC

Um Interface Abis Interface A Interface

What is Layer3?Layer3 Messages

From the diagram, we can imply that all the information which MS would like to talk with the network are done in the Layer 3. The flow of the message is so-called Message Flow Chart or Signaling Flow Chart.


Note: Actual TA for the connection and MS Power level are send in Layer1 on SACCH.

MS Network

What is Layer3?Layer3 Messages


Hierarchy of 3 sub-layers

RR sub-layer provides services to the MM sub-layer and utilizes the services of signaling layer 2.

MM sub-layer provides common services to the entities of the Connection Management (CM) sub-layer.

- the CM sub-layer includes, among others, the CC, SS, and SMS entities, which are independent entities.

Layer3 Messages

Radio Resource Management General Purpose

Example messages


Establish, Maintain and Release the RR connection. Cell selection/Reselection and Handover Procedure. Provide service for the upper layer.

RR will related to the following procedure (CS) Idle mode procedures. RR Connection establishment.

Initiate by MS Paging from network

Dedicated mode procedure.

System Information Type1-8. Handover command. Assignment Command. Immediate Assignment Command.

Layer3 Messages

Radio Resource Management (Cont.)1. Idle mode Procedure


Mobile SidesMobile Sides Listen to the BCCH and Paging SubListen to the BCCH and Paging Sub--channel of serving cell.channel of serving cell. Measure the radio propagation and decode BCCH of Measure the radio propagation and decode BCCH of surrounding cells.surrounding cells. Calculate C1/C2 in order to perform Cell Selection/ ReselectionCalculate C1/C2 in order to perform Cell Selection/ Reselection..

Network Sides Broadcast the system information on BCCH. Paging on CCCH (PCH).

Mobile Turn on Comment : SS=Signal Strength

PLMN Selection

Scan RF Carrier3-5 second average windows

Selected Strongest average SS

Is it BCCH?

No

By Search for FCCH

Yes

Tuned to SCHfor decode BSIC

and decode System Info

Calculate Cell SelectionCriteria (C1)

Suitable CellExist?

No

Try at least 30 StrongestRF channel for GSM900,or 40 for GSM1800or 40 for GSM 1900

Camp on Suitable Cell

Yes

Layer3 Messages

Radio Resource Management (Cont.)

PCCHMAXMSPWRBMINACCESSRXLEVRxlevA

BMaxAC

==

=

____

)0,(1

From specification 3GPP 44.018


CBQ CB Cell Selection Cell ReselectionHigh(1) NO (0) Normal NormalHigh(1) YES(1) Barred BarredLow(0) NO (0) Low NormalLow(0) YES(1) Low Normal

Cell SelectionCell Selection

Radio tower

SS DL

Allow MS Access to N/W Not Allow MS Accessdue to ACCMIN .

Not Allow MS Access due toMobile Class can't transmissMaximum Power that N/W allow.

Layer3 Messages


Radio Resource Management (Cont.)Cell SelectionCell Selection

Mobile Turn on

PLMN Selection

Cell Selection

MS Measuring Signal andDecode System Info from

Serving Cell

MS Measuring Signal, BSIC andDecode System Info from

Neighboring Cell

Ms Update SS of Serving Cell every5 to Max(5, 5 consecutive paging block)

Ms Update SS of Neighboring Cells every5 to Max(5, [(5*N+6)div7]*MFRM/4)N=BCCH in the BA ListMFRM=Multiframe for paging group

fullfil CellReselection

Criteria?

NO

YES

MS Select the new Cell

Layer3 Messages


11111,1211111),(*12

==+=

PTCROCCPTtPTHTOCROCC


0,1)(0,0)(

= C2 of 15 seconds C2 of Neighbor > C2 of Serving Serving 5 dB for 5 Seconds5 dB for 5 Seconds ..

3.MS detects a downlink signaling 3.MS detects a downlink signaling failure.failure.

Criteria :Criteria :


Cell ReCell Re--selectionselection

Radio Resource Management (Cont.)Layer3 Messages

System Information In idle mode, we can find the following system information broadcast on BCCH.

System Information Type 1System Information Type 1 OptionalRACH control parameter and Cell channel allocation.

System Information Type 2System Information Type 2 MandatoryRACH control parameter and BCCH Allocation of neighbor cells.

System Information Type 2bisSystem Information Type 2bis OptionalRACH control parameter and extension of BCCH Allocation of neighbor cells.

System Information Type 2terSystem Information Type 2ter OptionalRACH control parameter and extension of BCCH Allocation of neighbor cells.

System Information Type 3System Information Type 3 MandatoryRACH control parameter, LAI, CI and other cell parameter for idle mode.

System Information Type 4System Information Type 4 MandatoryRACH control parameter, LAI, CI and other cell parameter for idle mode.

System Information Type 7System Information Type 7 Optional Cell Reselection parameter.

System Information Type 8System Information Type 8 Optional Cell Reselection parameter.

System Information Type 13System Information Type 13 Optional GPRS information in cell.


Layer3 Messages


Radio Resource Management (Cont.) Paging

Mobile will listen to the PCH channel which carried Paging request message. There are 3 type of Paging Request.

Paging request type 1Paging request type 1 Identify up to 2 mobiles with TMSI or IMSI

Paging request type 2Paging request type 2 Identify up to 3 mobiles with TMSI or IMSI

Paging request type 3Paging request type 3 Identify up to 4 mobiles with TMSI

RACH Control ParametersExist in all mandatory system information in idle because it is allowed MS to access the network any time (Random Access).

MAX Retransmission number of Maximum retransmission on RACH. Tx-Integer Spreading time for the next retransmission. Cell Bar Access Allow MS to camp in Idle mode. Call Re-establishment Allow MS to re-connect to network after call drop.

Layer3 Messages


Radio Resource Management (Cont.) Message flow in idle mode

MS Network

System Information Type 1




System Information Type 2ter

Paging Request Type 1



Send on BCCH

Synch Channel Information

Send on BCCH

Send on BCCH

Send on BCCH

Send on BCCH

Send on SCH

Send on CCCH (PCH)

Send on CCCH (PCH)

Send on CCCH (PCH)

Layer3 Messages


Radio Resource Management (Cont.)2. RR Connection Establishment Mobile Initiate connectionMobile Initiate connection

Permission to access the network.Permission to access the network. Initiate of Immediate Assignment procedure.Initiate of Immediate Assignment procedure. Answer from the network.Answer from the network. Assignment Completion.Assignment Completion.

Paging procedure for RR connectionPaging procedure for RR connection Paging initiation by the network.Paging initiation by the network. Paging ResponsePaging Response

Layer3 Messages


Radio Resource Management (Cont.) Message flow in RR Connection Establishment

MS Network

Paging Request Type 1, 2, 3

Channel Request

Immediate Assignment

Paging Response (CM Service Request)

GPRS Suspension Request

Classmark Change

Send on CCCH

Send on RACH

Send on AGCH

Send on SDCCH

Send on SDCCH

Send on SDCCH

3. Dedicated mode Procedures

Layer3 Messages


SACCH ProcedureSACCH Procedure Network send System Information to MS on SACCH/DL.Network send System Information to MS on SACCH/DL. MS report the radio condition to network by Measurement Report MS report the radio condition to network by Measurement Report on SACCH/UL.on SACCH/UL.

Channel Assignment ProcedureChannel Assignment Procedure Network initiate channel assignment by sending ASSIGNMENT COMMANNetwork initiate channel assignment by sending ASSIGNMENT COMMAND.D. If successful, MS send ASSIGNMENT COMPLETE to network.If successful, MS send ASSIGNMENT COMPLETE to network.

Handover ProcedureHandover Procedure After Network prepared the target channel, network initiate HandAfter Network prepared the target channel, network initiate Handover by sending over by sending HANDOVER COMMAND to the MS.HANDOVER COMMAND to the MS. Mobile send HANDOVER ACCESS in order to try to establish the phMobile send HANDOVER ACCESS in order to try to establish the physical ysical channel at target cell.channel at target cell. If MS successful to establish the connection in lower layer, HAIf MS successful to establish the connection in lower layer, HANDOVER NDOVER COMPLETE message will send to network.COMPLETE message will send to network.


Ciphering mode settingCiphering mode setting Network send CIPHERING MODE COMMAND.Network send CIPHERING MODE COMMAND. MS will do the ciphering and reply CIPHERING MODE COMPLETE.MS will do the ciphering and reply CIPHERING MODE COMPLETE.

Layer3 MessagesRadio Resource Management (Cont.)


MS Network

Ciphering Mode Command

Ciphering Mode Complete

Setup

Assignment Command

Assignment Complete

Send on SDCCH

Send on SDCCH

Send on SDCCH

Send on SDCCH

Send on SDCCH

Send on FACCH

Send on FACCH

Message flow in Assignment and Ciphering

Call Proceeding/Call Confirmed

Alerting

Layer3 MessagesRadio Resource Management (Cont.)


Message flow in SACCH and Handover

MS Network

System Information Type5 (5ter)

Measurement Report

Handover Command

Handover Access

System Information Type6

Physical Information

Handover Complete

Send on SACCH

Send on SACCH

Send on SACCH

Send on FACCH

Send on FACCH

Send on FACCH

Send on FACCH

Layer3 Messages

Mobility Management


General Purpose Support the mobility of users, e.g. the location of users, and provide the confidential of the users. Provide connection management services to the upper sub-layer.

MM will related to the following procedure (CS) MM common procedures

TMSI Reallocation. Authentication. Identification. IMSI detach.

MM specific proceduresLocation updating. Periodic updating. IMSI attach.

Connection Management sub-layer service provision MM connection Establishment.

Mobility Management (cont.)Layer3 Messages


1. MM Common Procedures TMSI reallocation procedureTMSI reallocation procedure

Protection of IMSI to transmit in the radio interface signaling.Protection of IMSI to transmit in the radio interface signaling. TMSI is unique with in LAI, so usually TMSI reallocation is perTMSI is unique with in LAI, so usually TMSI reallocation is performed at least formed at least when changing the location area.when changing the location area. However, The TMSI reallocation can be initiated by the network However, The TMSI reallocation can be initiated by the network at any time while at any time while a RR connection exists between the network and the MS (usually ia RR connection exists between the network and the MS (usually in location n location update, call setup).update, call setup).

AuthenticationAuthentication permit the network to check the identity of the MS.permit the network to check the identity of the MS. provide parameters for MS to calculate ciphering key.provide parameters for MS to calculate ciphering key.

Identification Identification Network request MS to provide the specific identification paramNetwork request MS to provide the specific identification parameters to the eters to the network, e.g. IMEI.network, e.g. IMEI.

IMSI Detach IMSI Detach MS inform the network when switch off in order to change the stMS inform the network when switch off in order to change the status of this MS atus of this MS in the VLR.in the VLR. This procedure are required when ATT flag, broadcasted in SysteThis procedure are required when ATT flag, broadcasted in System Information m Information is set.is set. MS initiate IMSI detach procedure by send IMSI DETACH INDICATIOMS initiate IMSI detach procedure by send IMSI DETACH INDICATION message.N message.



2. MM Specific Procedures Location UpdateLocation Update

There are 3 types of location updateThere are 3 types of location update Normal location update use for update the actual LAI of MS, wheNormal location update use for update the actual LAI of MS, when the LAI is n the LAI is changed.changed. If the MS cross the location area in dedicated mode, location uIf the MS cross the location area in dedicated mode, location update is pdate is performed after MS leave dedicated mode to MM idle state.performed after MS leave dedicated mode to MM idle state. Location update is always initiated by MS. Location update is always initiated by MS.

Periodic updatingPeriodic updating Controlled by T3212 in the mobile.Controlled by T3212 in the mobile. The timer is stopped and reset to the initial value whenThe timer is stopped and reset to the initial value when

LOCATION UPDATE ACCEPT or LOCATION UPDATE REJECT is receivedLOCATION UPDATE ACCEPT or LOCATION UPDATE REJECT is received AUTHENTICATION REJECT is received.AUTHENTICATION REJECT is received. The first MM message is received.The first MM message is received. MS is deactivated (switch off).MS is deactivated (switch off).

when the timer expired, location update is started.when the timer expired, location update is started. IMSI AttachIMSI Attach

IMSI Attach is a compliment of IMSI detach, to inform the netwoIMSI Attach is a compliment of IMSI detach, to inform the network that MS once rk that MS once again activate.again activate. It is also controlled by ATT flag in System Information.It is also controlled by ATT flag in System Information.



Message flow in MM

MS Network

TMSI Reallocation Command

TMSI Reallocation Complete

Authentication Request

Authentication Response

Identity Request

Identity Response

Location Update Request

Location Update Accept

IMSI Detach Indication

Send on SDCCH

Send on SDCCH

Send on SDCCH

Send on SDCCH

Send on SDCCH

Send on SDCCH

Send on SDCCH

Send on SDCCH

Send on SDCCH

Circuit-switch Call Control (CC)Layer3 Messages


General Purpose CC is one of Connection Management (CM) sub-layer (others are SS and SMS). Use to establish, maintain and release the call.

MM will related to the following procedure (CS) Call Establishment procedures

Mobile originating call. Mobile Terminating call.

Call Clearing Clear initiate by mobile station. Clearing initiate by network.

Example messages Setup. Alerting. Call Proceeding. Connect.

Circuit-switch Call Control (Cont.)Layer3 Messages


Message flow in CC (mobile originating call)

MS Network

Setup

Call Proceeding

Alerting

Connect

Connect Acknowledge

Send on SDCCH

Send on SDCCH

Send on FACCH

Send on FACCH

Send on FACCH

Circuit-switch Call Control (Cont.)Layer3 Messages


Message flow in CC (mobile originating call)

MS Network

Setup

Call Confirmed

Alerting

Connect

Connect Acknowledge

Send on SDCCH

Send on SDCCH

Send on FACCH

Send on FACCH

Send on FACCH

Layer3 Messages


System Information Type1RACH Control ParameterMS can send maximum Channel Request

= Max retransmission+1. The interval between retransmission is a random value uniformly select form the following set {S,S+1,S+Tx-integer-1}.

Cell barred Access prevent MS to camp on this cell in Idle mode (cell selection/Re-selection). Call reestablishment allow MS send RACH to resume the connection after call dropped.

TX-integernon-combined CCCH

combined CCCH/SDCCH

3,8,14,50 55 41

4,9,16 76 52

5,10,20 109 58

6,11,25 163 86

7,12,32 217 115

Layer3 Messages


System Information Type2BCCH Allocation ListMS will get the ARFCH of BCCH of

surrounding cell it has to measure and decode in idle mode from this messages. MS will not scan, synch or decode any frequencies that are not in this list in Type 2 it will send the list of the same band of the serving cell, BCCH allocation list of different band will be sent in Type 2ter. In type 2ter also contain the information about how many neighbors from different band mobiles have to add in the measurement report.

NCC permittedMS will use this value when it first enter to

dedicated mode before it get new in formation on SACCH.

Layer3 Messages


System Information Type3Control channel ATT IMSI attach/detach flag BS-AG-BLKS-RES number of block reserve for access grant, use in the calculation of paging group. CCCH-CONF indicate whether CCCH is combined with SDCCH. BS-PA-MFRMS Multiframe for paging group calculation. T3212 periodic registration timer.

Cell Option DTX indicator whether mobile shall use DTX or not. RADIO-LINK-TIMEOUT the radio link timeout for DL connection that mobile will use for this cell.

PAGING_GROUP= {(IMSI mod 1000) mod

(BS_CC_CHANS x N)} mod N

N = number of paging block= (number of paging blocks "available"

in a 51- multiframe on one CCCH) x BS_PA_MFRMS.

Layer3 Messages

System Information Type4


Broadcast as similar information as System Information Type3 but less detail.

Layer3 Messages

Synch Channel Information


Synchronization data BSIC base station Identity Code, determine the cell (6 bits). T1, T2, T3 is the reduced frame number (19 bits).


The T1, T2, T3 was derived from the actual frame number.

T1 (11 bits) = FN div (26x51) T2 (5 bits) = FN mod 26 T3 (3 bits) = (T3-1) div 10Where T3 = FN mod 51

Layer3 Messages

Paging Request Type1


Mobile Identity Can contain maximum 2 mobile identity with TMSI or IMSI.

Paging Request Type2Layer3 Messages


Mobile Identity Can contain maximum 3 mobile identity with TMSI or IMSI.

Paging Request Type3Layer3 Messages


Mobile Identity Can contain maximum 4 mobiles identity with TMSI only.

Channel RequestLayer3 Messages


Random Access Information Establishment cause contain the reason for requesting the establishment of the connection. Random reference random value as a reference to the network when channel is assigned.

Immediate AssignmentLayer3 Messages


Channel Description The details of target physical channel of SDCCH which MS have to camp on in dedicated mode.

Request Reference Include the Establishment cause and random reference value from the channel request.

Timing Advance The initial timing advance values, which BSC calculate from the delay of random access.

Access burst

Classmark ChangeLayer3 Messages


Encryption algorithm support mobile will declare all Encryption algorithm it support.

MS power capability mobile power class

MS Power MS Power ClassClass

Output Output power [power [dBmdBm]]

Sensitivity Sensitivity [[dBmdBm]]

2 39 -106

3 37 -106

4 33 -104

5 29 -104

GSM900

MS Power MS Power ClassClass

Output Output power [power [dBmdBm]]

Sensitivity Sensitivity [[dBmdBm]]

1 30 -104

2 24 -104

GSM1800

Ciphering Mode CommandLayer3 Messages


Cipher mode setting It will inform mobile that in which ciphering algorithm will be used in this connection.

A5 A5data

Kc Kc

data

A8 KcRAND

Ki

datadata

Assignment CommandLayer3 Messages


Description of the channel Channel Type indicate the target channel (TCHF/TCHH). TN target TCH timeslot number. TSC training sequence code. Hopping RF channel whether target channel is HOPPING. MAIO start MAI for hopping. HSN hopping sequence number.

Power Command Power level the initial power use in this connection.

Mobile allocation Mobile allocation array the frequency which will use when hopping.

Cell channel description Channels the frequency available in this cells.

System Information Type5Layer3 Messages


BCCH Allocation List As same as System Information Type2 in idle mode, System Information Type5 contain the BA List which mobile have to monitor in dedicated mode. in Type 5 it will send the list of the same band of the serving cell, BCCH allocation list of different band will be sent in Type 5ter. In type 5ter also contain the information about how many neighbors from different band mobiles have to add in the measurement report.

System Information Type6Layer3 Messages


Cell options PWRC indicated. DTX indicator whether DTX is used. Radio Link Timeout The counter of radio link failure and release the channel.

NCC permitted MS will not report the signal level of the cell which NCC are not belong or exist in this list.

SACCH

RLT (max)

0Drop Call

Radio link timeout work in following manner, when MS fail to decode SACCH block it will decrease by one, but if the SACCH block can be decode again its increment is 2.

Measurement ReportLayer3 Messages


Serving Cell measurement RxLev Full rxlevel of serving cell average for full set. Rxlev Sub rxlevel of serving cell average for sub set RxQual full rxqual of serving cell average for full set. RxQual Sub rxqual of serving average for sub set.

Six strongest neighbor RxLev rxlevel on BCCH of neighboring cell . BSIC BSIC of the neighbor. BCCH-INDEX the index of BCCH on BA List in system information type5.

Handover CommandLayer3 Messages


Cell Description BCCH and BSIC of the target cell.Channel Description allocated channel at target cell, in case of Hopping it will inform MAIO and HSN.

Handover Reference reference value use to identify the Handover Access from the mobile.

Synchronization indicate the handover is synchronous or asynchronous. Synchronous handover case after MS send Handover Access, it will tune the transceiver to the target channel without waiting for Physical Information message.

Handover AccessLayer3 Messages


Handover Reference Refer that this Handover Access belong to which Handover Command.

Handover Access is a very short message (1 octet), which using Access Burst as same as Channel Request.

In some case , it is possible that this Handover Access will trigger the allocation of SDCCH of surrounding cells because they think it is the channel request message.

This phenomena can cause the problem on immediate assignment success rate.

Physical InformationLayer3 Messages


Timing Advance This timing advance tell the mobile about the timing advance which will use in the target cell.

The mechanism of detect the timing advance is as same as in immediate assignment procedure because the burst structure using for channel request (Random Access) and handover access is the same.

Access Burst

Location Update RequestLayer3 Messages


Location Update Type Indicate the type of location update.

Location Area Identity the information of current LAI stored in SIM card (old LAI).Mobile Station Classmark contain MS capability.

Mobile Identity Identity of the MS can be either TMSI or IMSI.

Location Update AcceptLayer3 Messages


Location Area Identity the information of new LAI which will replace the current LAI in SIM card.

Mobile Identity New TMSI which MS will use in the new LAI, in this case MS have to send TMSI REALLOCATION COMPLETE in order to confirm the use of new TMSI to the network and there are no TMSI REALLOCATION COMAND sent in this case.

Authentication RequestLayer3 Messages


Authentication parameter From the Triplet, MSC send RAND to the MS in Authentication Request Message. MS will use this RAND value to calculate SRES and answer the value in Authentication Response.

Authentication ResponseLayer3 Messages


Authentication Response MS use RAND as input of A3 algorithm together with Ki stored in the SIM card. The output of the operation is SRES. MS return SRES to MSC via AUTHENTICATION RESPONSE message. MSC will check compare the SRES with the one that calculated in MSC.

A3 SRESRAND

Ki

Setup (MOC)Layer3 Messages


Bearer Capability MS send the bearer capability to MSC in order to assign the TCH channel.

Called party BCD number target MSISDN for this call.

Setup (MTC)Layer3 Messages


Bearer Capability This case MSC ask for the bearer capability of the MS. MS answer its capability and prefer channel type to MSC on CALL CONFIRMED in order to get TCH channel.

Calling party BCD number MSISDN who call this MS.

TEMS Layer3 Messages Analysis

Documents

Transcript of TEMS Layer3 Messages Analysis