Table of Contents

Chapter 1 Signaling Fundamentals.............................................................................................1-1 1.1 Interface Overview.............................................................................................................1-1 1.2 A-Interface.........................................................................................................................1-2 1.2.1 Overview.................................................................................................................1-2 1.2.2 Protocols on the A-Interface....................................................................................1-3 1.3 Abis interface...................................................................................................................1-11 1.3.1 Overview...............................................................................................................1-11 1.3.2 Protocols on the Abis Interface.............................................................................1-14 1.4 Um Interface....................................................................................................................1-21 1.4.1 Overview...............................................................................................................1-21 1.4.2 Layer 1 - Physical Layer........................................................................................1-22 1.4.3 Layer 2 - Data Link Layer......................................................................................1-23 1.4.4 L3..........................................................................................................................1-25 Chapter 2 Signaling Trace Guide.................................................................................................2-1 2.1 Overview............................................................................................................................2-1 2.2 Um Interface Trace............................................................................................................2-2 2.2.1 Functions.................................................................................................................2-2 2.2.2 Operations...............................................................................................................2-2 2.2.3 Options....................................................................................................................2-4 2.2.4 Examples.................................................................................................................2-4 2.3 Abis Interface Trace...........................................................................................................2-5 2.3.1 Functions.................................................................................................................2-5 2.3.2 Operations...............................................................................................................2-5 2.3.3 Options....................................................................................................................2-7 2.3.4 Examples.................................................................................................................2-8 2.4 A Interface Trace.............................................................................................................2-10 2.4.1 Functions...............................................................................................................2-10 2.4.2 Operations.............................................................................................................2-10 2.4.3 Options..................................................................................................................2-15 2.4.4 Examples...............................................................................................................2-15 2.5 SS7 Trace........................................................................................................................2-17 2.5.1 Functions...............................................................................................................2-17 2.5.2 Operation and Options..........................................................................................2-19 2.5.3 Examples...............................................................................................................2-23 2.6 SCCP Signaling Trace.....................................................................................................2-25 2.6.1 Functions...............................................................................................................2-25 2.6.2 Operations.............................................................................................................2-26 2.6.3 Options..................................................................................................................2-29 2.6.4 Examples...............................................................................................................2-29 Chapter 3 System Information.....................................................................................................3-1 3.1 Overview............................................................................................................................3-1 3.2 Detailed Description of System Information......................................................................3-2 3.2.1 SYSTEM INFORMATION TYPE 1..........................................................................3-2 3.2.2 SYSTEM INFORMATION TYPE 2, 2bis and 2ter...................................................3-5 3.2.3 SYSTEM INFORMATION TYPE 3..........................................................................3-8 3.2.4 SYSTEM INFORMATION TYPE 4........................................................................3-11 3.2.5 System Information type 5, 5bis & 5ter.................................................................3-13 3.2.6 SYSTEM INFORMATION TYPE 6........................................................................3-13 3.2.7 SYSTEM INFORMATION TYPE 7........................................................................3-14 3.2.8 SYSTEM INFORMATION TYPE 8........................................................................3-14 3.3 Internal Handling of BSC.................................................................................................3-15 Chapter 4 Location Update Procedure........................................................................................4-1 4.1 Overview............................................................................................................................4-1 4.2 Location Updating Procedure............................................................................................4-2 4.2.1 Periodic Updating....................................................................................................4-3

4.2.2 IMSI Attach Procedure............................................................................................4-4 4.2.3 Generic Location Updating Procedure....................................................................4-4 4.3 Internal Handling of BSC...................................................................................................4-9 Chapter 5 Authentication Procedure...........................................................................................5-1 5.1 Overview............................................................................................................................5-1 5.2 Authentication Procedure..................................................................................................5-1 5.2.1 Successful Authentication.......................................................................................5-2 5.2.2 Unsuccessful Authentication...................................................................................5-2 5.3 Internal Handling of BSC...................................................................................................5-3 5.4 Abnormal Cases................................................................................................................5-4 5.4.1 RR Connection Failure............................................................................................5-4 5.4.2 Expiry of Timer T3260.............................................................................................5-4 5.4.3 SIM Unregistered....................................................................................................5-4 Chapter 6 Release Procedure......................................................................................................6-1 6.1 Overview............................................................................................................................6-1 6.2 Normal Release Procedure...............................................................................................6-1 6.3 BSC Local Release Procedure..........................................................................................6-3 6.4 Internal Handling of BSC...................................................................................................6-3 Chapter 7 Mobile Originating Call Establishment Procedure...................................................7-1 7.1 Overview............................................................................................................................7-1 7.2 Normal Procedure..............................................................................................................7-1 7.2.1 Mobile Originating Call Establishment without OACSU (Early Assignment)..........7-1 7.2.2 Mobile Originating Call Establishment with OACSU (Late Assignment).................7-6 7.2.3 Mobile Originating Call Establishment with OACSU (Very Early Assignment).......7-8 7.3 Internal Handling of BSC...................................................................................................7-9 7.4 Abnormal Cases..............................................................................................................7-10 7.4.1 Abnormal Random Access/Immediate Assignment Procedure............................7-10 7.4.2 MSC Directly Delivers DISCONNECT to Clear the Call, Instead of Delivering the Assignment Request......................................................................................................7-11 7.4.3 Abnormal Assignment Procedure.........................................................................7-11 7.4.4 Abnormal Procedure Cause by Call Interruption..................................................7-12 7.4.5 Abnormal Procedure Caused by Hangup.............................................................7-13 7.4.6 Abnormal Procedure Caused by MSC Clearing...................................................7-13 Chapter 8 Mobile Terminating Call Establishment Procedure.................................................8-1 8.1 Overview............................................................................................................................8-1 8.2 Normal Procedure..............................................................................................................8-2 8.3 Internal Handling of BSC...................................................................................................8-3 8.4 Abnormal Cases................................................................................................................8-3 8.4.1 No PAGING COMMAND on Interface A.................................................................8-4 8.4.2 No PAGING COMMAND on Interface Abis............................................................8-5 8.4.3 No PAGING RESPONSE on Interface Abis...........................................................8-6 8.4.4 No PAGING RESPONSE on Interface A................................................................8-7 Chapter 9 Handover Procedure...................................................................................................9-1 9.1 Overview............................................................................................................................9-1 9.2 Normal Procedure..............................................................................................................9-1 9.2.1 Intra-BSC Handover Procedure..............................................................................9-1 9.2.2 Inter-BSC Handover Procedure..............................................................................9-4 9.2.3 Inter-MSC Handover Procedure..............................................................................9-6 9.3 Abnormal Cases................................................................................................................9-7 9.3.1 Handover Failure Due to CIC Exception.................................................................9-7 9.3.2 Handover Failure Due to MS Access Failure..........................................................9-7 9.3.3 Handover Procedure Initiation Failure....................................................................9-8 Chapter 10 Ciphering Mode Setting Procedure.......................................................................10-1 10.1 Overview........................................................................................................................10-1 10.2 Normal Procedure..........................................................................................................10-1 10.3 Internal Handling of BSC...............................................................................................10-3 10.4 Abnormal Cases............................................................................................................10-3 10.4.1 Ciphering Rejected..............................................................................................10-3 10.4.2 MS Not Ciphered.................................................................................................10-3 Chapter 11 Call Re-establishment Procedure..........................................................................11-1 11.1 Overview........................................................................................................................11-1

11.2 Normal Procedure..........................................................................................................11-1 11.3 Abnormal Cases............................................................................................................11-3 11.3.1 CM Service Rejected..........................................................................................11-3 11.3.2 Re-establishment Not Allowed or Re-establishment Failure..............................11-4 11.3.3 RR Connection Failure........................................................................................11-4 Chapter 12 Directed Retry Procedure.......................................................................................12-1 12.1 Overview........................................................................................................................12-1 12.2 Normal Procedure..........................................................................................................12-1 12.2.1 Directed Retry Intra-BSC Handover Procedure..................................................12-2 12.2.2 Directed Retry Inter-BSC Handover Procedure..................................................12-5 12.2.3 Directed Retry Inter-MSC Handover Procedure.................................................12-7 12.3 Abnormal Cases............................................................................................................12-8 Chapter 13 Short Message Procedure......................................................................................13-1 13.1 Overview........................................................................................................................13-1 13.2 Normal Procedure..........................................................................................................13-2 13.2.1 Short Message Procedure on SDCCH When MS Is Calling...............................13-2 13.2.2 Short Message Procedure on SDCCH When MS Is Called...............................13-4 13.2.3 Short Message Procedure on SACCH When MS Is Calling...............................13-6 13.3 Short Message Procedure on SACCH when MS Is Called...........................................13-7 13.4 Internal Handling of BSC...............................................................................................13-7 13.5 Abnormal Cases............................................................................................................13-8 Chapter 14 Cell Broadcast Message Procedure......................................................................14-1 14.1 Overview........................................................................................................................14-1 14.2 CBC-BSC Interface Message Procedure......................................................................14-1 14.3 Messages and Service Functions over the Interface between BSC and BTS..............14-5 14.4 Internal Handling of BSC...............................................................................................14-5 14.5 Abnormal Cases............................................................................................................14-6 Chapter 15 VGCS Call Flow........................................................................................................15-1 15.1 Overview........................................................................................................................15-1 15.2 Normal Flow...................................................................................................................15-1 15.2.1 VGCS Setup........................................................................................................15-1 15.2.2 Uplink Occupation...............................................................................................15-2 15.2.3 Uplink Release....................................................................................................15-3 15.2.4 VGCS Release....................................................................................................15-4 15.2.5 VGCS Call Handover..........................................................................................15-5 15.2.6 Listener Detection...............................................................................................15-6 15.3 Abnormal Flow and Faults Location..............................................................................15-8 Appendix A Message Interpretation............................................................................................A-1 A.1 A-Interface Key Messages................................................................................................A-1 A.1.1 Message Contents..................................................................................................A-2 A.1.2 Signaling element coding......................................................................................A-16 A.1.3 Message Type......................................................................................................A-19 A.2 Abis-Interface Key Messages..........................................................................................A-63 A.2.1 Message Contents................................................................................................A-64 A.2.2 Signaling element coding......................................................................................A-71 Appendix B Difference between Phase1- Phase2- Phase2+.....................................................B-1 B.1 Difference between Messages over A-interface in Different Phases................................B-1 B.2 Difference Analysis............................................................................................................B-1 Appendix C Glossary....................................................................................................................C-1 Appendix D Abbreviation.............................................................................................................D-1 Appendix E Reference for GSM Protocols..................................................................................E-1

Table of Contents

Chapter 1 Signaling Fundamentals.............................................................................................1-1 1.1 Interface Overview.............................................................................................................1-1 1.2 A-Interface.........................................................................................................................1-2 1.2.1 Overview.................................................................................................................1-2 1.2.2 Protocols on the A-Interface....................................................................................1-3 1.3 Abis interface...................................................................................................................1-11 1.3.1 Overview...............................................................................................................1-11 1.3.2 Protocols on the Abis Interface.............................................................................1-14 1.4 Um Interface....................................................................................................................1-21 1.4.1 Overview...............................................................................................................1-21 1.4.2 Layer 1 - Physical Layer........................................................................................1-22 1.4.3 Layer 2 - Data Link Layer......................................................................................1-23 1.4.4 L3..........................................................................................................................1-25

Chapter 1 Signaling Fundamentals

1.1 Interface Overview
GSM BSS offers standard external interfaces including Um interface between MS and BSS, A interface between BSS and MSC. The interface protocols and interface procedures strictly follow the ETSI specifications. The interfaces between each BTS and BSC and those between BSS and OMC are internal interfaces, and are related to specific equipment from different manufacturers. There are many regulations drafted by ETSI for the Abis interface between BTS and BSC, but the regulations are still incomplete. Figure 1-1 shows the GSM protocol stack. The following is an overall introduction to each interface.

MS: Mobile Station BSC: Base Station Controller BTS: Base Transceiver Station MTP: Message Transfer Part (MTP) RR: Radio Resource Management

CM: Connection Management MM: Mobility Management MSC: Mobile services Switching Centre, Mobile Switching Centre BTSM: Base Transceiver Station Site Management BSSMAP: Base Station Subsystem Management Application Part

SCCP: Signaling Connection Control Part LAPDm: Link Access Procedure on the Dm channel

LAPD: Link Access Procedure on the D channel

Figure 1-1 GSM protocol stac

I. A interface
A interface is the standard interface between BSS and MSC. The information transferred on this interface includes MS management, BTS management, mobility management, connection management, etc.

II. Abis interface

Abis interface defines the standard of communication between BSC and BTS in BSS, and is used in remote interconnection mode. This interface supports all MS-oriented services, and supports the control of BTS radio equipment and the allocation of radio frequencies.

III. Um interface
Um interface is defined as the communication interface between MS and BTS, and is used for the interworking between MS and the fixed part of the GSM system. The physical link is a radio link. The information transferred on this interface includes the information of radio resource management, mobility management, connection management, etc.

1.2 A-Interface
1.2.1 Overview
A interface is the interface between BSC and MSC. It is a standard interface in GSM specifications, as it may involve the interworking between the equipment from different manufactures. In the GSM system, SS7 is adopted on A interface. Physically, A interface is the trunk circuit and trunk interface between BSC and MSC. See Figure 1-2 for the A interface signaling protocol reference model.

DTAP: Direct Transfer Application Part MTP: Message Transfer Part (MTP) SCCP: Signaling Connection Control Part BSSAP: Base Station Subsystem Application Part BSSMAP: Base Station Subsystem Management Application Part

Figure 1-2 A-interface signaling protocol reference mode

1.2.2 Protocols on the A-Interface

I. Physical layer
The physical layer of the A-interface is 120-ohm symmetrical twisted pair or 75-ohm coaxial cable whose rate is 2 Mbit/s. The physical layer of A-interface has the following features: The 2 Mbit/s transfer rate complies with G.703. Frame structure, synchronization and timing comply with G.705. Fault management complies with G.732. CRC4 complies with G.704.

II. Message Transfer Part (MTP)

The main function of MTP is to ensure reliable signaling message transfer in the signaling network. In case of system and signaling network faults, it takes measures to avoid or reduce the loss of messages, repeated messages and out-of-sequence packets. MTP protocols are defined in ITU-T Q.701~710 Recommendations. MTP comprises three functional levels: signaling data link function, signaling link function and signaling network function. 1) Signaling data link function Signaling data link (layer 1) is the channel used for signaling transmission. It comprises two data channels of the same data rate but two opposite working directions. The data rate is 64kbit/s. Generally, the signaling data link occupies timeslot 16 of a trunk cable. The specific timeslot is to be determined by negotiation between BSC and MSC. By data configuration, the timeslot can be used to establish a semi-permanent connection. The signaling data link is the information bearer of SS7. One of its important features is that the signaling link is transparent, i.e. the data transferred on it cannot be changed. Therefore, equipment such as echo canceller, digital attenuator, A/u rate converter, cannot be connected to this link. 2) Signaling link function Signaling link function (layer 2) regulates the functions and procedures to send the signaling to the data link, and together with layer 1, it implements reliable signaling message transfer between two directly-connected signaling points. Due to long-distance transmission, a certain rate of bit errors may be caused on the data link between two adjacent signaling points. However, no error is allowed in CCS7 signaling message codes. The purpose of layer 2 is to guarantee error-free transmission of message codes in the case that there exist bit errors on layer 1. Functions of layer 2 include: signaling unit delimitation, signaling unit alignment, error detection, error correction, initial alignment, processor fault, level-2 flow control, and signaling link error rate monitoring. 3) Signaling network function By controlling the route and performance of the signaling network, signaling network function (level 3) guarantees that signaling information can be reliably transferred to the user part, whether the signaling network is in normal state or not.. Signaling network functions include signaling message processing and signaling network management. a) Signaling message processing Signaling message processing function sends signaling messages to the corresponding signaling links or user parts. The user part in BSS only contains SCCP. Signaling message processing functions comprise three parts: message routing (MRT), message discrimination (MDC) and message distribution (MDT), as shown in Figure 1-3.

Figure 1-3 Signaling message processing procedur Message Routing MRT (Message Routing) function is used at each signaling point to determine the signaling link group and the signaling link to destination signaling point. The MRT part implements the selection of message routes. In other words, by using the information (DPC and SLS) contained in the route mark, it selects a signaling link for signaling messages, so that the messages can be transferred to the DPC. Message Discrimination (MDC) Message Discrimination (MDC) part is designed to receive the messages from Layer 2 to ascertain whether the destination of the messages is the local signaling point. If the destination is the local signaling point, the MDC part will send the messages to the Message Distribution (MDT) part. If the destination is not the local signaling point, the MDC part will send the messages to the Message Routing (MRT) part. Message Distribution (MDT) Message Distribution (MDT) part is designed to allocate the messages from the MDC part to the user part and the signaling network management and test & maintenance part accordingly. b) Signaling network management Signaling network management is to re-construct the signaling network and to keep and recover the normal transfer ability of the signaling unit when the signaling network fails. Signaling network management includes three parts: signaling traffic management, signaling link management and signaling route management. Signaling Traffic Management (STM) Signaling Traffic Management (STM) is to transfer the signaling data from one link/route to another or multiple available links/routes when the signaling network fails. It is also used to temporarily reduce signaling traffic in case of congestion at the signaling point. Signaling link management Signaling link management (SLM) is to recover or enable the signaling link in the signaling network or to disconnect the signaling link. It ensures the provision of certain pre-determined link groups. The connection between the signaling data link and the signaling terminal is normally established by the man-machine commands. Operations in the signaling system can not automatically change the above connection relationship. Signaling route management Signaling route management (SRM) is used to ensure the reliable exchange of signaling route availability information between signaling points so as to block or unblock signaling routes when necessary. It mainly comprises such procedures as transfer prohibited, transfer allowed, controlled transfer and restricted transfer, signaling route group test, and signaling route group congestion test.

III. Signaling Connection & Control Part (SCCP)

The purpose of SCCP is to provide complete network layer functions with the help of MTP. Network layer provides connectionless services and connection-oriented services. The network layer services provided by SCCP can be classified into connectionless services and connection-oriented services. The connectionless service means that MS does not establish a signaling connection in advance, and uses the routing functions of SCCP and MTP to directly transfer data information in the signaling network. It is applicable to the transfer of a small quantity of data. The connection-oriented service means that a signaling connection is established in advance, and data are directly transferred on the signaling link, instead of using the route selection function of SCCP. It is applicable to the transfer of large quantities of data, and effectively shortens the transmission delay of batch data. SCCP has routing and network management functions. The routing function of SCCP is to perform addressing as per the address information such as DPC, SSN, GT, etc. DPC refers to the destination signaling point code adopted by MTP, and SSN refers to the subsystem No., which is used to identify the different users (such as ISUP, MAP, TCAP and BSSAP) of SCCP in the same node, so as to compensate the insufficiency of users of MTP and to enlarge the addressing scope. GT addressing mode is not introduced as BSS does not adopt this addressing mode. The network management function of SCCP is to implement management of signaling point state and subsystem state, switchover of active/standby subsystem, broadcasting of status messages and testing of subsystem state. SCMG (SCCP management) is to maintain the network functions by reselecting a route or adjusting the traffic volume when network fault or congestion occurs. MTP protocols are defined in ITUT Q.711~716 Recommendations

IV. BSSAP
1) Protocol overview The BSSAP protocol, which serves as A-interface specification, describes two kinds of messages, BSSMAP and DTAP message. BSSMAP messages are used for traffic flow control, and are to be processed by the internal functional module of the corresponding A interface. For DTAP messages, A interface is merely equivalent to a transport channel, On BSS side, DTAP messages are directly transferred to radio channels. On MSC subsystem side, DTAP messages are transferred to the corresponding functional processing unit. BSSAP protocols are defined in ETSI GSM 08.08 and ETSI GSM 04.08 specifications. 2) Typical message contents a) DTAP messages The DTAP messages can be divided into Mobile Management (MM) messages and Call Control (CC) messages. The MM messages consist of messages related to authentication, CM service request, identification request, IMSI detach, location update, MM state, TMSI re-allocation, etc. The call control messages consist of alerting, call proceeding, connection, setup, modification, release, disconnection, notification, state query, DTMF startup messages, etc. b) BSSMAP messages The BSSMAP messages can be divided into connectionless and connection-oriented messages. The connectionless messages consist of Block/Unblock, Handover, Resource, Reset, Paging messages, etc. The Block/Unblock messages include Block & Block ACK messages and Unblock & Unblock ACK messages. The Circuit Group Block/Unblock messages include Circuit Group Block message, Circuit Group Block ACK message, Circuit Group Unblock and Circuit Group Unblock messages. Handover messages include Handover Candidate Enquire and Handover Candidate Enquire Response. The resources messages include Resources Request and Resource Indication messages.

The Reset messages include Reset and Reset ACK messages. The connection-oriented messages include Assignment, Handover, Clear and Cipher messages. The Assignment messages include Assignment Request, Assignment Complete and Assignment Error messages. The Handover messages include Handover Request, Handover Request ACK, Handover Command, Handover Complete and Handover Error messages. The Clear messages include Clear Request and Clear Complete messages. The Cipher messages include Cipher Mode Command and Cipher Mode Complete messages. c) BSSAP protocol functionality The BSSAP protocol can deliver its own functions in connection-oriented mode and connectionless mode of SCCP. When MS needs to exchange service-related messages over radio resources with the network side while there is no MS-related SCCP connection between MSC and BSS, a new connection will be established. A new connection shall also be set up for external handover. There are two kinds of connection setup: While MS sends the Access Request message on the RACH, BSS allocates a dedicated radio resource (DCCH or TCH) to MS. After the L2 connection is set up on the SDCCH (or FACCH) where resources are allocated, BSS starts the connection setup. When MSC decides to execute an external handover (the target BSS might be the original BSS), it must reserve a new DCCH or TCH from the target BSS. In this scenario, MSC starts the connection setup. The BSSAP protocol implements the functional flow as shown in Table 1-1 using the connection and connectionless messages. Table 1-1 Major functions of BSSAP Serial number 1 Function Assign Description Assign is to ensure the dedicated radio resources are allocated or re-allocated properly to the MS. The initial MS random access and immediate assignment to a DCCH is processed automatically by BSS but not controlled by MSC. During circuit assignment, MSC selects an available terrestrial channel. If this channel is no longer available then BSS notifies it to MSC. The Block/Unblock procedure can carry out this function. Resource indication serves to notify MSC: Amount of the radio resource available for TCH in BSS, Amount of all available radio resource (i.e. able to provide service or have been specified) It is not easy to get this information from the MSC-controlled services. These must be considered when MSC decides an external handover.

Block/Unblock

Resource Indication

Reset

Reset is to initialize the BSS or MSC. For instance, if BSS goes faulty or loses all the reference messages about processing, BSS sends a Reset message to MSC, which releases the affected calls, deletes the affected reference messages and sets all the circuits related to the BSS to idle. If MSC or BSS is only locally faulty, the affected parts can be cleared using the Clear procedure.

Handover Request

BSS may send a handover request to MSC requesting to perform handover of the MS, to which dedicated resources have been allocated, for the reasons as listed below: a) BSS detects a radio cause for handover. b) MSC starts the Handover Candidate Enquirer procedure. The MS is waiting for the handover. Due to congestion, the serving cell needs to be changed during the call setup such as directed retry. The Handover Request messages should be re-sent once in a while till one of the following situations occurs: Receive the "Handover Command" message from MSC Reset message is received All communications with MS will be interrupted and the processing is aborted Processing is over, such as call clearing.

Handover Resource Allocation

Handover Resources Allocation enables MSC to request for resources from BSS based on the handover request. The target BSS will reserve resources and wait for an MS to access this channel. This is the procedure in which MSC instructs MS to access the radio resources of another cell. When handover is carried out, the original dedicated radio resources and terrestrial resources are maintained all the time until MSC sends a Clear Command message or Reset occurs.

Handover Procedure

Release of Radio Resources and Terrestrial Resources

When processing is done, MSC sends a Clear Command to BSS to release radio resources. On receiving the command, BSS starts the Clear procedure at the radio interface, then sets the configured terrestrial circuit to idle and returns a Clearing Complete message to MSC, which in turn releases the terrestrial resources of the local end. If resources need to be released by BSS, BSS will send a Clear Request to notify MSC to start the release procedure to release the terrestrial and radio resources concerning MSC and BSS.

Paging

The paging to MS is transported with the SCCP connectionless service via BSSMAP. If BSS receives the Paging Response message at the radio channel interface, it will establish an SCCP connection to MSC. The paging response message, which is loaded in the BSSMAP Full L3 Message, is transported on the signaling connection to MSC. Flow control can prevent the entities from receiving too much traffic. Flow control on the A-interface is implemented by controlling the traffic at the traffic source. Two levels of flow control are available. Flow control can be implemented based on subscriber classes. Classmark Update serves to notify the class messages received from MS to the receiving entities. Generally, BSS notifies MSC after receiving the class messages from MS. It is also likely that when handover is complete, MSC sends the corresponding MS Classmark messages to the new BSS via the A-interface. The Cipher Mode Control procedure allows MSC to transport the cipher mode control messages to BSS and start the subscriber equipment and signaling cipher equipment with a correct Kc. This procedure is designed to notify MSC that BSS wants to delay the allocation of necessary radio resources. This procedure is valid only when the queuing function is introduced for traffic channel assignment and traffic channel handover in the BSS. Load indication serves to notify the traffic state of a cell to all the adjacent BSSs so that an overall control over the handover services in an MSC can be exercised. In a certain valid period, the traffic state of the adjacent cells will be taken into account by the adjacent BSS during handover.

10

Flow Control

11

Classmark Update

12

Cipher Mode Control

13

Queuing Indication

14

Load Indication

1.3 Abis interface

1.3.1 Overview
The Abis interface is the interface between Base Station Controller (BSC) and Base Transceiver Station (BTS), and complies with the requirements of 08.5X series of the GSM specifications. It is merely an internal interface of BSS. The interworking between the BSC and BTS equipment of different manufactures has not been realized. The terrestrial traffic channels on the Abis interface and the radio traffic channels on the Um interface are in one-to-one correspondence with one another.

I. Protocol Model
The protocol model of the Abis interface is shown in Figure 1-4.

BTSM: Base Transceiver Station Management LAPD: Link Access Procedure on the D Channel LAPDm: Link Access Procedure on the Dm Channel SCCP: Signaling Connection Control Part MTP: Message Transfer Part BSSAP: Base Station Subsystem Application Part RR: Radio Resource

Figure 1-4 Protocol model of Abis interfac Layer 1 of the Abis interface is a physical link which receives data from and transmits data to the transport layer based on the bottom layer driver of the hardware. The layer 2 protocol of the Abis interface is based on the LAPD. LAPD addresses TRX (or BCF) through TEI, and uses different logical links for message transfer. RSL is to transfer traffic management messages. OML is to transfer network management messages. L2ML is to transfer L2 management messages. RR (Radio Resource Management) messages are mapped onto the BSSAP (BSS Application Part) in BSC. In BTS, most of RR messages are handled as transparent messages. However, some of them have to be interpreted and executed by BTS (for example, cipher, random access, paging and assignment), these messages are processed by the BTSM (BTS Management) entities in BSC and BTS. BSC and BTS do not interpret CM (Connection Management) and MM (Mobility Management) messages. These messages are transferred over the A-interface by DTAP (Direct Transfer Application Part). At the Abis interface, DTAP messages are transferred as transparent messages.

II. Structure of Abis interface

The Abis interface can support three different internal BTS configurations (as illustrated in

Figure 1-5. Single TRX. Multiple TRXs are connected with the BSC via a common physical connection. Multiple TRXs are connected with the BSC via different physical connections.

Figure 1-5 Structure of Abis interfac As shown in Figure 1-5, TRX (Transceiver) is the functional entity that supports 8 physical channels that belong to the same TDMA frame, which is defined in the PLMN. The BCF (Base Control Function) is the functional entity that performs common control functions including BTS initialization, software loading, channel configuration, operation and maintenance. There are two types of channels at the Abis interface, which are: Traffic channels with the rates of 8kbit/s, 16kbit/s and 64kbit/s respectively, carrying speech or data from radio channels. Signaling channels with rates of 16kbit/s, 32kbit/s or 64kbit/s respectively, carrying signaling between BSC and MS, and between BSC and BTS. Different Terminal Equipment Identifiers (TEI) are assigned to get unique addresses of TRXs. Three separate logical links are defined with each TEI (as shown in Figure 1-6). RSL: Radio Signaling Link used to support traffic management procedures, one for each TRX. OML: Operation & Maintenance Link used to support network management procedures, one for each SITE. L2ML, L2 management link, for transferring the management messages at L2.

Figure 1-6 Abis interface layer 2 logical link

1.3.2 Protocols on the Abis Interface

I. Physical layer
Abis interface physical layer adopts the PCM link with the working rate at 2048 kbit/s to provide 32 channels at 64kbit/s. The electro-technicial parameter at the physical layer conforms to the CCITT G.703 recommendations. BSS is the connection point of the radio channel and terrestrial channel. Both kinds of channels have different transfer patterns and coding rates. In the radio channel of BSS, the transfer rate is 16kbit/s while it is 64kbit/s in the terrestrial channel. Therefore transcoding and rate adaptation is needed. To save cost more efficiently, different multiplexing ratio modes are adopted on Abis interface, e.g. 10:1/12:1/15:1 multiplexing mode.

II. Data link layer

1) Overview The data link layer of Abis uses LAPD protocol. It utilizes the service on the physical layer, and provides connection-oriented or connectionless services for layer 3. The data link Service Access Point (SAP) is the point that provides services for layer 3. SAP is identified by Service Access Point Identifier (SAPI). A data link connection endpoint is identified by a data link connection endpoint identifier as seen from layer 3 and by a data link connection identifier (DLCI) as seen from the data link layer. For information exchange between two or more layer 3 entities, an association must be established between the layer 3 entities in the data link layer using a data link layer protocol. The communication between data link layer entities is governed by a peer-to-peer protocol specific to the layer. Messages at the data link layer are transferred between entities at layer 2 through physical layer. Inter-layer service request is implemented with service primitive. 2) Function The purpose of LAPD is to realize reliable end-to-end information transfer between layer 3 entities through the user-network interface by using the D-channel. To be specific, LAPD supports:

Multiple terminal equipment between subscriber and interface, Multiple L3 entities. Functions of LAPD includes: Establishes one or several data links on the D channel. Delimits, locates and transmits transparently frames so that a string of bits transmitted on the D channel in the form of frames can be identified. Implements sequence control to keep the order of the frames that pass the data link connections. Checks the transmission errors, format errors and operation errors in the data link connections. Makes recovery based on the detected transmission errors, format errors and operation errors. Notifies the management layer entities of the unrecoverable errors. Flow control. Data link layer provides the means for information transfer between multiple combinations of data link connection points. The information may be transferred through point-to-point data link connections or via broadcast data link connections.

III. Traffic management of Layer 3

The traffic management part of the Abis interface layer 3 is mainly described in GSM 08.58 specifications. The procedures defined in this specifications has two major functions: Realizing the interworking of the MS and BSS/NSS on the Um interface. Implementing part of the radio resource management functions under the control of BSC. The traffic management message is divided into the transparent and non-transparent messages, The transparent message refers to the messages forwarded without interpretation or being processed by the BTS. The non-transparent message refers to the messages processed and structured by the BTS. The traffic management messages can also be divided into four groups in terms of functions, which are: Radio link layer management message, used for the management of the data link layer on the radio channel. Dedicated channel management message used for the management of dedicated channels (SDCCH and TCH). Common control channel management message used for the management of common control channels. TRX management message used for TRX management. Transparency and group of the message is determined by the message discriminator at the header of the message. 1) Radio link layer management procedures Radio link layer management procedures include: Link establishment indication procedure: BTS uses this procedure to indicate to BSC the success of setting up multi-frame link originated by the subscriber. BSC establishes a link from MSC to SCCP through the indication. Link establishment request procedure: This procedure is used by BSC to request the establishment of a link layer connection in multi-frame mode on the radio channel. Link release indication procedure: This procedure is used by BTS to indicate to BSC that a link layer connection on the radio channel has been released at the initiative of an MS. Link release request procedure: This procedure is used by BSC to request the release of a link layer connection on the radio channel. Transmission of a transparent L3-message on the Um interface in acknowledged mode: This procedure is used by BSC to request the sending of a transparent L3 message to MS on the Um interface in acknowledged mode. Reception of a transparent L3-message on the Um interface in acknowledged mode: This procedure is used by BTS to indicate the reception of a transparent L3 message on the Um interface in acknowledged mode. Transmission of a transparent L3-message on the Um interface in unacknowledged mode: This procedure is used by BSC to request the sending of a transparent L3 message to

MS on the Um interface in unacknowledged mode. Reception of a transparent L3-message on the Um interface in unacknowledged mode: This procedure is used by BTS to indicate the reception of a transparent L3 message in unacknowledged mode. Link error indication procedure: Through this procedure BTS indicates BSC incase of any abnormality in the radio link layer. 2) Dedicated channel management procedures The dedicated channel management principles includes: Channel activation procedure: This procedure is used to activate a channel at BTS for an MS which later will be commanded to this channel by an Immediate Assignment, an Assignment Command, an Additional Assignment or a Handover Command message. Channel mode modification procedure: This procedure is used by BSC to request a change of the channel mode of an active channel. Handover detection procedure: This procedure is used between the target BTS and BSC to detect the accessing of the MS being handed over. Start of encryption procedure: This procedure is used to start encryption according to the procedure defined in Technical Specification GSM 04.08. Measurement report procedure: It includes the necessary basic measurement report procedure and measurement report preprocessing procedure. BTS reports all parameters related to handover decision to the BSC through this procedure. Deactivate SACCH procedure: This procedure is used by BSC to deactivate the SACCH at BTS according to the Channel Release procedure defined in Technical Specification GSM 04.08. Radio channel release procedure: This procedure is used by BSC to release a radio channel that is no longer needed. MS power control procedure: This procedure is used by BSS to set the MS power level or the parameters required by TRX. MS power control decision must be implemented in BSC, and as an optional procedure in BTS. BTS Transmission power control procedure: This procedure used between BSC and BTS to set the TRX transmission power level or the parameters required by TRX. The BTS transmission power control decision should be implemented in BSC, or in BTS. Connection failure procedure: This procedure is used by BTS to indicate to BSC that an active connection has been broken. Physical context request procedure: This is an optional procedure which allows the BSC to obtain information on the "physical context" of a radio channel just prior to a channel change. SACCH information modification procedure: BSC uses this procedure to instruct BTS to change the information (system information) filled in a specific SACCH channel. 3) Common channel management procedures Common channel management regulations include: Channel request by MS procedure: The procedure is initiated by TRX upon detection of a random access from an MS (Channel Request message from MS). Paging principle procedure: It is used to page an MS on the specified paging sub-channel. The paging of an MS is initiated by BSC sending a Paging Command message to BTS. BSC determines the paging group to be used according to the IMSI of the called MS. The value of this paging group together with the identity of the mobile station is sent to BTS. Immediate assignment procedure: When a mobile station accesses BTS, BSC uses this procedure to assign a dedicated channel for the mobile station immediately. Delete indication procedure: This procedure is used by BTS to indicate that due to overload on the AGCH, an Immediate Assign Command has been deleted. CCCH load indication procedure: This procedure is used by BTS to inform BSC the load on a designate CCCH. Indication period is also set by OM. Broadcast information modification procedure: This procedure is used by BSC to indicate to BTS the new information to be broadcast on BCCH. Short message cell broadcast procedure: Short Message Service Cell Broadcast messages are sent to BTS as SMS Broadcast Request messages. 4) TRX management procedures This type of procedure is used for TRX management. There are: SACCH filling information modify procedure: This procedure is used by BSC to indicate to BTS the new information to be used as filling information on SACCHs. Radio resources indication procedure: This procedure is used to inform BSC on the interference levels on idle channels of a TRX.

Flow control procedure: This procedure is defined to give some degree of flow control. It can be used for TRX processor overload, downlink CCCH overload and AGCH overload. Error reporting procedure: This procedure is used by BTS to report detected downlink message errors, which cannot be reported by any other procedure.

IV. Operation and maintenance part of Layer 3

1) Operation and maintenance information model Managed objects There are four types of management objects: site, cell, carrier and channel. The basic structure is illustrated in Figure 1-7.

Figure 1-7 Basic structure of management objec Object addressing Addressing of network management messages is realized by means of managed object types and cases. For each object case in BTS there is a complete L2 connection description. The setup of the first connection uses one (semi-) permanent default TEI. Subsequent connections use the TEIs provided when setting up TEI procedures. Object cases can also use layer 3 addresses. The mixed use of layer 2 and layer 3 addressing enables one BTS site to have one or multiple physical links. Managed object state Management status include management status, operation status and availability status. See Table 1-2, Table 1-3 and Table 1-4. The management state of managed objects is only controlled by BSC, and available state is the specific explanation of operative state. Table 1-2 Management status State Locked Shut down Unlocked Description BSC has disconnected all calls through this managed object, and no new calls can be connected to this object. New services can not be connected to this managed object, but those existing calls will be maintained. New calls can be connected to this managed object.

Table 1-3 Operation status

State Disabled Description Resources are completely unavailable, and can no longer provide services to the users.

Enabled

All or part of resources are available and can be used.

Table 1-4 Availability status

State ln test Failed Power off Off line Dependency Description The resource is being tested. Its operational state is disabled. The source/object is not working due to some internal error. Its operational state is disabled. The resource needs power supply. Its operational state is disabled. The resource needs manual or automatic operations. Its operational state is disabled. Services provided by this resource are degraded in a certain sense, such as rate or operational capacity. Its operational state is disabled. Services provided by this resource are degraded in a certain sense, such as rate or operational capacity. Its operational state is enabled. Hardware or software of the managed objects is not installed. Its operational state is disabled.

Degraded

Not Installed

2) Basic procedures All procedures are based on formatted O&M messages. Most formatted O&M messages initiated by BSC or BTS require the peer layer 3 endpoint to give response or acknowledgment in the form of formatted O&M messages. This pair of formatted O&M messages or a single formatted O&M message that need not be responded to is called a basic procedure. All formatted O&M messages are sent on layer 2 in the form of I frames. A group of procedures, called as structured procedures, are based on the combination of some basic procedures. For a specific object, if a certain basic procedure is not completed, the system will not start its subsequent basic procedures. When there is no response to the formatted operation and maintenance message from the peer layer 3 before L3 timeout, the basic procedure is regarded as not completed. When the previous basic procedure has not received any response (ACK or NACK) before layer 3 timeout, then no subsequent basic procedure is sent to this object case. The default timeout for layer 3 is 10s. If part of an original message is not understood or supported, the whole message is discarded. A ACK message returned by the object indicates affirm response, it is used to notify the message sender that the command has been executed or will be executed. A NACK message returned by the object indicates disaffirm response, it is used to notify the message sender that the command executed unsuccessfully and the corresponding failure cause.

There are mainly the following types of basic procedures:

Software loading management procedure Abis interface management procedure Transmission management procedure Air interface management procedure Test management procedure State management and event reporting procedure Equipment state management procedure Other procedure

1.4 Um Interface
Um interface (air interface or radio interface) is defined as the communication interface between MS and BSS. It is for the communication between MS and the fixed part of GSM. Its physical link is the radio link. The information transmitted via this interface include radio resource management, mobility management and connection management.

1.4.1 Overview
In a GSM network, MS is connected through radio channels to the fixed network so that communication services can be routed to the specific destination. To realize the inter-working between MS and BSS, it is necessary to standardize the transmission of the signals on the radio channel. The norm concerning the signal transmission on the radio channel is the radio interface, or Um interface. The Um interface is specified by the following features: Channel structure and access capability MS-BSS protocols Maintenance and operation characteristics Performance characteristics Service characteristics. The Um interface can be divided into 3 layers, as shown in Figure 1-8.

Figure 1-8 Layered structure of Um interfac The first layer is the physical layer at the bottom. It defines the radio access capabilities of GSM, and provides basic radio channels for information transfer on higher layer. The layer 2 is the data link layer using the LAPDm protocol. It defines various data transmission structures, and controls data transmission. The layer 3 is the highest layer. It includes various messages and programs, and controls services. It includes 3 sub-layers, which are Radio Resources management (RR), Mobility Management (MM), and Connection Management (CM).

1.4.2 Layer 1 - Physical Layer

The physical layer (L1) is the lowest part of the Um interface. It provides the physical links needed for transferring bit streams, and provides various logical channels for the higher layers, including traffic channels and signaling channels. Each logical channel has its own logical access point.

Physical layer interface and services: The interfaces between the physical layer (L1) and data link layer (L2), the physical layer (L1) and radio resources management sublayer (RR) of L3, the physical layer (L1) and other functional unit, are shown in Figure 1-9.

Figure 1-9 Physical layer interfac The physical layer provides the following services: Access capability: the physical layer provides a series of limited logical channels for transmission service. The logical channel is multiplexed on the physical channel. There exist 8 physical channels on each TRX. Through data configuration, logical channels are mapped to physical channels Error code detection: Physical layer provides error protection transmission, including error detection and correction. Ciphering: Use the selected encrypt algorithm to transmit bit sequence encrypted.

1.4.3 Layer 2 - Data Link Layer

The purpose of the data link layer is to establish reliable dedicated data links between MS and BTS. The link layer protocol used by the GSM system at the radio interface is the LAPDm protocol which has evolved from the LAPD protocol. It receives the service from the physical layer and provides service to L3. The data link Service Access Point (SAP) is the node that provides services for layer 3. SAP is identified through SAPI. Each SAP is associated with one or multiple Data Link Connection End Points (DLCEP). Currently, two SAPI values are defined in the LAPDm protocol, 0 (main signaling) and 3 (short messages). LAPDm 1) Function LAPDm transfers information between layer 3 entities through the radio interface on the Dm channel. LAPDm supports multiple layer 3 entities and physical layer entities, and signaling of BCCH, PCH, AGCH and DCCH. Note: The Dm channel is a generic term for all the signaling channels at the Um interface in the GSM system. For instance, the Dm channel can either be PCH or BCCH.

LAPDm includes functions for: The provision of one or more data link connections on a Dm channel. Discrimination between the data link connections is by means of a data link connection identifier (DLCI). Allows for frame type identification. Allows L3 message units to be transmitted transparently between L3s. Exercises sequence control to maintain the order of frames that pass DLC. Check on the format and operation errors on the data links. Flow control. Contention resolution when establishing a data link after an access request has been made on the RACH.

2) Operation types Two types of operation of the data link layer are defined for layer 3 information transfer: unacknowledged operation and acknowledged (multiple frame) operation. They may co-exist on a Dm channel. Unacknowledged mode: In unacknowledged mode, layer 3 information is transmitted in Unnumbered Information (UI) frames. At the data link layer, the UI frames are not acknowledged. Flow control mechanisms and error recovery mechanisms are not defined. Unacknowledged operation is applicable to different types of control channels except for RACH. Acknowledged mode: In acknowledged mode, layer 3 information is transmitted in Unnumbered Information (UI) frames. The data link layer acknowledges the transmitted I frame. Error recovery procedures based on retransmission of unacknowledged frames are specified. In case of errors, which cannot be corrected by the data link layer, a report is issued to the layer 3 entity. Flow control procedures are also defined. Acknowledged operation is applicable to DCCH. 3) Information transfer mode: On different channels, information transfer modes are different. Information transfer on the BCCH: The BCCH exists only in the network to MS direction and is used for broadcasting radio sub-system information to MSs. Only the acknowledged mode can be adopted on the BCCH. Information transfer on the PCH + AGCH: These channels exist only in the network to MS direction. On the PCH + AGCH only unacknowledged operation is possible. Information transfer on the DCCHs: On the DCCHs, either acknowledged or unacknowledged mode may be adopted. The mode required at any time is determined by layer 3. 4) Release of data links: Multiple frame operation may be released in the following ways: Normal release by exchange of commands/responses. Local end release, i.e. without exchange of commands/responses, initiated and controlled by layer 3.

1.4.4 L3
I. Introduction
The signaling layer 3 of the Um interface provides the functions to establish, maintain and terminate circuit-switched connections across a GSM PLMN and other networks to which the GSM PLMN is connected. It provides the necessary supporting functions related to supplementary services control and short messages service control. Furthermore it includes the functions necessary for mobility management and radio resource management. The layer 3 entity consists of many functional program blocks. These program blocks transfer message units carrying various kinds of information among all layer 3 entities and between layer 3 and neighboring layers. The objectives of the layer 3 are to provide the means for: The establishment, operation and release of a dedicated radio channel connection (RR). For location updating, authentication and TMSI reallocation (MM). For establishment, maintaining and termination of circuit-switched calls (CC). Supplementary services support (SS). Short messages service support (SMS). Layer 3 consists of 3 sub-layers including Connection Management (CM), Mobility Management (MM) and Radio Resource management (RR). The CM sub-layer contains multiple call control (CC) units, which are to implement concurrent call handling. It also contains SS units and SMS units, which are respectively used to support supplementary services and short message services. The functions of the signaling layer 3 are performed by means of the signaling layer 3 protocols between two systems which represent the Mobile Station side and the Network side of the radio interface as viewed by the Mobile Station. GSM 04.07 does not consider the distribution of signaling functions among the different network equipment. The functions of layer 3 and its supporting lower layers, therefore, provide the Mobile Network Signaling (MNS)

Service to the upper layers. Interaction between layer 3 and higher layers and between services interfaces of layer 2 as well as that between neighboring sub-layers in layer 3 can be described in primitives and parameters. Exchange of information between two peers of the signaling layer 3 is performed by means of the three sublayer protocols.

II. L3 Structure
As have already introduced, the 3 sub-layers of layer 3 are further discussed here: Among them, The CM sub-layer (the highest sub-layer) is composed of three functional entities: Call Control (CC), Short Message Service support (SMS) and Supplementary Service support (SS). In total, there are five functional entities consisted in the layer 3 radio interface. Below is the brief introduction to these entities: Radio Resources (RR) management handles the establishment, maintenance, and release of physical channels and logical channels, as well as cross-cell transfer on the request of CM sub-layer. Mobility Management (MM) deals with the all necessary functions of mobile features to support mobile subscribers. It notifies the network when the mobile station is activated and deactivated, or the location area is changed. It is also responsible for the security of activated radio channels. CC deals with all necessary functions to establish or release the circuit-switched connections. SS deals with all necessary functions to support GSM supplementary services. SMS performs all necessary functions to support point-to-point short message services. In addition, other functions are contained in layer 3 which are related to the transport of messages, e.g. multiplexing and splitting. Those functions are defined in the Radio Resource Management and Mobility Management. They have the task to route the messages according to the protocol discriminator (PD) and transaction identifier (TI) which are part of the message header. The MM routing function route the messages of the CM entities and the messages of the MM entity of its own sublayer towards the service access point of RR, and multiplex them in case of parallel transactions. The routing function of Radio Resource Management shall distribute the messages to be sent according to their protocol discriminator (PD) and the actual channel configuration. The messages provided at the different service access points of layer 2 are split by the RR routing function according to the protocol discriminator (PD). If PD equals to RR, this message will be transferred to RR at the local sub-layer. Other messages are provided to MM via the access point RR-SAP. The routing function of MM passes the messages according to the protocol discriminator (PD) and the transaction identifier (TI) towards the MM entity or towards the CM entities via the various MM-SAP's. Figure 1-10 illustrates the protocol model of L3 signaling. The RR sub-layer at the bottom receives services provided by layer 2 through various service access points (i.e., various types of channels) of layer 2, and provides services via RR-SAP to the MM sub-layer. The MM sub-layer provides services to the three entities (CC, SS and SMS) on the CM sub-layer through different service access points MMCC-SAP, MMSS-SAP and MMSMS-SAP respectively, provides register services to the higher layer through MMREG-SAP service access points. The 3 independent entities on the CM sub-layer provide services to higher layers through MNCC-SAP, MNSS-SAP and MNSMS-SAP respectively.

Figure 1-10 Um interface L3 protocol mode

III. Service characteristics.

1) Services provided by layer 3 on the MS side Registration services, i.e., IMSI attach and detach operations. Call Control services, including MS originating normal call establishment, MS originating emergency call establishment, call hold, call termination, and call related Supplementary Services Support. Call independent Supplementary Services Support. Short Message Services Support. 2) Services provided by layer 3 on the network side Call Control Services, including call establishment, call maintaining, call termination and call related supplementary service support. Call independent Supplementary Services Support. Short Message Services Support. 3) Inter-layer services between the mobile station and network side Services provided by Radio Resource Management entity (Refer to Figure 1-11). These services are provided to MM via RR-SAP. They are used for establishing control channel connections, establishing traffic channel connections, ciphering mode indication, releasing control channel connections, and control-data transfer. Services provided by mobility management entities (MM) (Refer to Figure 1-12). These services support call control, supplementary services and short messages services of

connection management entities.

Figure 1-11 Communication at RR

Figure 1-12 Communication at MM

Table of Contents

Chapter 2 Signaling Trace Guide.................................................................................................2-1 2.1 Overview............................................................................................................................2-1 2.2 Um Interface Trace............................................................................................................2-2 2.2.1 Functions.................................................................................................................2-2 2.2.2 Operations...............................................................................................................2-2 2.2.3 Options....................................................................................................................2-4 2.2.4 Examples.................................................................................................................2-4 2.3 Abis Interface Trace...........................................................................................................2-5 2.3.1 Functions.................................................................................................................2-5 2.3.2 Operations...............................................................................................................2-5 2.3.3 Options....................................................................................................................2-7 2.3.4 Examples.................................................................................................................2-8 2.4 A Interface Trace.............................................................................................................2-10 2.4.1 Functions...............................................................................................................2-10 2.4.2 Operations.............................................................................................................2-10 2.4.3 Options..................................................................................................................2-14 2.4.4 Examples...............................................................................................................2-14 2.5 SS7 Trace........................................................................................................................2-16 2.5.1 Functions...............................................................................................................2-16 2.5.2 Operation and Options..........................................................................................2-18 2.5.3 Examples...............................................................................................................2-22 2.6 SCCP Signaling Trace.....................................................................................................2-24 2.6.1 Functions...............................................................................................................2-24 2.6.2 Operations.............................................................................................................2-25 2.6.3 Options..................................................................................................................2-28 2.6.4 Examples...............................................................................................................2-28

Chapter 2 Signaling Trace Guide

2.1 Overview
Figure 2-1 shows the GSM protocol stack.

MS: Mobile station BSC: Base Station Controler CM: Connection Management RR: Radio Resource management SCCP: Signaling Connection Control Part

BTS: Base Transceiver Station MSC: Mobile Switching Center MM: Mobility Management MTP: Message Transfer Part LAPD: Link Access Protocol on the D channel

LAPDm: Link Access Protocol on the Dm channel BTSM: BTS Management

BSSMAP: Base Station System Management Application Part

Figure 2-1 GSM protocol stac

The interfaces of BSS include the A interface between BSC and MSC, the Um interface between BTS and MS, and the Abis interface between BSC and BTS. The Base Station System (BSS) of Huawei provides powerful interface trace functions. During equipment interconnection (like the interconnection between the BSC of Huawei and MSC of another company) and equipment maintenance (such as frequent call drop, low handover success rate, MS access-to-network failure, and poor speech), these functions can be used to analyze the signaling procedure online, and locate the faults promptly. BSS interface trace functions include Um interface trace, A interface trace, Abis interface trace, SS7 interface trace and SCCP trace.

2.2 Um Interface Trace

2.2.1 Functions
Um interface trace function is to trace the signaling over the radio interface of the cell in the BSC Maintenance System. In actual application, the Um interface is traced by the test MS and software. The Um interface trace in the maintenance system is not applied that frequently, and will be briefly described in this chapter.

2.2.2 Operations
1) Start the BSC Maintenance System, select the menu item [Trace/Interface Tracing/Startup Interface Tracing], and an interface will pop up, as shown in Figure 2-2:

Figure 2-2 GSM interface trac 2) Select the Um interface trace, module No., click <OK>, and an interface will pop up, as shown in Figure 2-3.

Figure 2-3 Um interface trac 3) Input the cell number, TRX number and channel number, and the traced messages over the Um interface will be listed, as shown in Figure 2-4.

Figure 2-4 Um interface trace messag 4) Query saved messages through GSM Tracing Review The messages traced and saved (note: they can be queried from other maintenance consoles only when the file header is modified with some edit tools) can be queried by selecting [Trace/GSM Tracing/GSM Tracing Review] in the BSC Maintenance System. Select the message file to be queried in the pop-up window, and click <Open>; or copy the saved GMT files to another terminal, and query them through OMC LocalWS.

Figure 2-5 GSM interface tracing review

2.2.3 Options
Cell Number: Number of the cell with the Um interface to be traced, decimal. TRX Number: TRX number to be traced, decimal. Channel Number: In use. RR management procedure: Select the item, and the messages of this type will be listed in the message trace window, like system information. Mobility Management (MM) procedure: Displaying MM related messages, like messages in TMSI reallocation procedure, authentication procedure and identification procedure. Call Control (CC) and call related Supplementary Service (SS) procedure: Displaying the messages related to call procedure and SS. Call-unrelated SS procedure: Such as REGISTER message that is call-unrelated supplementary service message. Short Message procedure: Short message related signaling procedures displayed in the trace window.

2.2.4 Examples
The Um interface trace in the maintenance system is hardly applied, No example is provided

2.3 Abis Interface Trace

2.3.1 Functions
In actual deployment and maintenance process, such faults as call drop, handover failure, MS access-to-network failure and poor quality of speech frequently occur. In these cases, it is necessary to locate the faults through signaling procedure analysis. Therefore, Abis interface trace is an important approach to locate problems in the field.

2.3.2 Operations
1) Start the BSC Maintenance System, select the menu item [Trace/Interface Tracing/Startup Interface Tracing], and an interface will pop up, as shown in Figure 2-6.

Figure 2-6 GSM interface trac 2) Select the module No. and Abis interface, and the interface will pop up, as shown in Figure 2-7.

Figure 2-7 Abis interface trac 3) Select the Cell Number, TRX Number, click <OK>, and the traced messages over the Abis interface will pop up, as shown in Figure 2-8.

Figure 2-8 Abis interface trace message 4) Query saved messages through GSM Tracing Review The messages traced and saved (note: they can be queried from other maintenance consoles only when the file header is modified with some edit tools) can be queried by selecting [Trace/GSM Tracing/GSM Tracing Review] in the BSC Maintenance System. Select the message file to be queried in the pop-up window, and click <Open>; or copy the saved GMT files to another terminal, and query them through OMC LocalWS.

Figure 2-9 GSM interface tracing review

2.3.3 Options
Cell Number: Number of the cell whose Abis interface is to be traced, decimal. TRX Number: TRX Number of the Abis interface to be traced, decimal; if it is not selected, the

Abis signaling of the entire cell will be traced. Channel Number: In use. Measurement report: Select [Test Report], and the measurement report messages will be listed in the trace message window. Radio link layer management procedures: Select [Radio Link Layer Management Message], the messages of this type will be listed in the trace window. They include: Link establishment indication (EST IND), link establishment request (EST REQ and EST CONF), link release indication, (REL IND), link release request (REL REQ and REL CONF), transmission of a transparent L3-Message in acknowledged mode (DATA REQ), reception of a transparent L3Message in acknowledged mode (DATA IND), transmission of a transparent L3-Message in unacknowledged mode (UNIT DATA REQ), reception of a transparent L3-Message in unacknowledged mode (UNIT DATA IND), and link error indication (ERROR IND). Dedicated channel management procedures: Channel activation (CHAN ACTIV and CHAN ACTIV ACK/NACK), channel mode modify (MODE MODIFY and MODE MODIFY ACK/NACK), handover detection (HANDO DET), start of encryption (ENCR CMD), deactivate SACCH (DEACT SACCH), radio channel release (RF CHAN REL and RF CHAN REL ACK), MS power control (MS POWER CONTROL), transmission power control (BS POWER CONTROL), connection failure (CONN FAIL IND), physical context request (PHYS CONTEXT REQ, PHYS CONTEXT CONF) and SACCH information modify (SACCH INFO MODIFY). Common channel management procedures: channel request by MS (CHAN REQ), paging (PAG CMD), deletion indication (DELETE IND), CCCH load indication (CCCH LOAD IND), broadcast information modify (BCCH INFO), short message cell broadcast (SMS BROADCAST REQ, CBCH LOAD IND and SMS BROADCAST CMD), and immediate assignment (IMM ASS CMD). TRX management procedures: radio resource indication (RF RES IND), SACCH filling information modify (SACCH FILL), flow control (OVERLOAD), and error reporting (ERROR REPORT).

2.3.4 Examples
Figure 2-10 illustrates a complete Abis interface message procedure.

Figure 2-10 Abis interface message Double click an Abis interface message in the maintenance system, and the type and the detailed description of this message will be listed. A complete call procedure will be given based on the messages above: 1) CHAN_RQD: This message is sent from MS to BTS to request for channel. Then, BTS transfers it to BSC. Key field in the message: Access Delay (2 bytes), indicating the access location of MS (from the BTS). 2) CHAN_ACTIV: Sent back to BTS from BSC. Key fields: Timing Advance (2 byte), MS Power (2 bytes) and BS Power (2 bytes). 3) CHAN ACTIV_ACK: It is sent from BTS to BSC. No special point in it is to be concerned. 4) IMMEDIATE ASSIGN_COMMAND: It is used for BSC to assign SDCCH to MS. Key fields: Timing Advance. 5) EST_IND: It is sent from BTS to BSC. Double click on the message, and the detailed information about it will be displayed: Key fields: Message Type (like CM Service Request), type of the message; Identity digit (TMSI allocated to this domain), and the encryption domain. 6) DATA_REQ: Transparent L3-Message, generally including authentication request and classmark request messages. 7) DATA_IND: Authentication response, classmark response and SETUP messages (with called number provided). Key field: SETUP message. 8) MEAS_RES: Measurement reporting message, including SDCCH and TCH measurement messages. The detailed content including: Channel TYPE: SDCCH or TCH. Time Slot Number: Timeslot No. Uplink measurement: Uplink measurement report, including uplink Rx quality and Rx level. RXLEV_FULL_UP: When the uplink does not use DTX, the uplink Rx level is the value of this domain. RXLEV_SUB_UP: When the uplink uses DTX, the uplink Rx level is the value of this domain. RXQUAL_FULL_UP: When the uplink does not use DTX, the uplink Rx quality is the value of this domain. RXQUAL_SUB_UP: When the uplink uses DTX, the uplink Rx quality is the value of this

domain. BS POWER: Transmit power of the BTS. Actual Timing Advance: Timing advance. L3 information: Downlink measurement values of the service area and its 6 neighbor cells reported.

2.4 A Interface Trace

2.4.1 Functions
In actual deployment and maintenance process, such faults as the interconnection coordination between the BSC of Huawei and MSC of another manufacturer via the A interface, A interface related MS access-to-network failure, assignment failure, call drop, handover failure, and poor quality of speech frequently occur. In these cases, it is necessary to locate the faults through the trace and analysis of the A interface signaling procedure.

2.4.2 Operations
I. Message trace
Start the BSC Maintenance System, select [Trace/Interface Tracing/Startup Interface Tracing], and an interface will pop up, as shown in Figure 2-11.

Figure 2-11 GSM interface trac Select A Interface and the corresponding module No., click <OK>, and an interface will pop up, as shown in Figure 2-12.

Figure 2-12 Interface trace message filter parameter selectio Generally, select Connectionless Message, DTAP Message and BSSMAP without the input of SCCP No, click <OK>, and a traced message over the A interface will pop up, as shown in Figure 2-13.

Figure 2-13 A interface trace messag

II. Message view

Select the message to be viewed in the Trace Message window, double click and the details of the message will be listed, as shown in Figure 2-14.

Figure 2-14 Details of A interface trace messag

III. Message saving

The A interface messages traced can be saved in the Operations and Maintenance terminal. Right click in the message trace window, and a menu will pop up, as shown in Figure 2-15.

Figure 2-15 A interface trace message savin Select [Save] in the shortcut menu, and an interface will pop up, as shown in Figure 2-16.

Figure 2-16 Input the file name to save the A interface messag Input the file name in the dialog box, click <OK>, and the A interface messages traced will be saved under the directory: C: \OMC\Shell\G3BSC32.10100.04.1120A (file folder with the name of BSC version No.)\trace on the Operations and Maintenance terminal, and the suffix of the file name is "GMT".

IV. View saved messages through GSM Tracing Review

The saved messages can be viewed by clicking [Trace/Interface Tracing/Tracing Review]. Select the message file to be view and click <Open>, as shown in Figure 2-17.

Figure 2-17 A interface tracing review

2.4.3 Options
Connectionless messages: Paging and circuit management messages.

DTAP messages: Transparently transmitted messages in the CC layer and MM layer. BSSMAP: A interface messages specified under the GSM 0808 protocol. SCCP No.: connection No. of SCCP in the connection message, generally not required.

2.4.4 Examples
Figure 2-18 illustrates a complete A interface PAGING message.

Figure 2-18 Details of the PAGING message over the A interfac 1) Displayed in SCCP Message Type. It is a N_UNIDATA_INDICATION message. 2) Displayed in the BSSMAP Message Type, it is a PAGING message. 3) The paging IMSI included in the IMSI code of this message is 460005050907827. 4) The location area code of the paging message displayed in LAC is 8506 (hexadecimal).

2.5 SS7 Trace

2.5.1 Functions
SS7 is divided into different modules based on its functions. Each module completes relatively independent functions, and transmits service information and network management information through primitives. The architecture is shown in Figure 2-19

Figure 2-19 Architecture of SS The function of each part in this architecture is briefly described as follows: 1) Message Transfer Part (MTP), including 3 functional levels: signaling data link (physical layer, MTP L1), signaling link function (link layer, MTP L2), and signaling network function (network layer, MTP L3). 2) Signaling Connection Control Part (SCCP): Enforcing the function of the MTP part, and providing the function equal to the OSI network layer.. 3) Telephone User Part (TUP): Stipulating call establishment and release related functions and programs, and supporting some SS. 4) ISDN User Part (ISUP): Providing functions for speech and non-speech switching in ISDN, so as to support basic bearer services and SS. 5) Transaction Capability Application Part (TCAP): Providing a group of procedures and functions for the communications of a series of application services. 6) Operation and Maintenance Application Part (OMAP): Providing such functions as SS7 monitoring, measurement and management, as well as protocol test and monitoring online. The architecture of SS7 is described through primitives as follows: 1) MTP service primitives MTP_TRANSFER request: Used for SCCP to transfer signals and messages to MTP. MTP_TRANSFER indication: Used for MTP to transfer signals and messages to SCCP. MTP_PAUSE indication: Used for MTP to notify TUP that it cannot transfer the message to the destination. MTP_RESUME indication: Used for MTP to notify TUP that it is capable to provide MTP services to the destination. MTP_STATUS indication: Used for MTP to notify TUP that it can partially (congestion) provide MPT services to the destination. It is also used to notify MS the cause whether the remote MS is available or not. MTP_RESTART indication: Upon the completion of MTP restart, it informs the local MTP users of the end of the MTP restart, and indicates whether a signaling point is available nor not. 2) Network service primitives Connectionless service primitives:

N_UNITDATA request: A SCCP user requests the SCCP to transmit data to another SCCP. N_UNITDATA indication: SCCP notifies users that the user data are sent to the destination. N_NOTICE indication: SCCP notifies the originating user that the message cannot be sent to the destination. Connection-oriented service primitives: N_CONNECT request: The message from the calling SCCP User to SCCP is used to start the connection establishment procedure to establish a signaling connection. N_CONNECT indication: It is sent from SCCP to request the called SCCP User to establish signaling connection with the calling MS. N_CONNECT response: It is sent from SCCP to notify the called SCCP User that it agrees to establish signaling connection. N_CONNECT acknowledgement: The calling SCCP notifies the calling MS to confirm the establishment of the signaling connection. N_DATA request: SCCP User requests SCCP to transfer data. N_DATA indication: SCCP notifies the SCCP User that the user data have been sent to the destination. N_DISCONNECT request: SCCP User requests SCCP to reject or terminate the signaling connection. N_DISCONNECT indication: SCCP notifies the SCCP User that the signaling connection has been rejected or terminated.

2.5.2 Operation and Options

I. Overview
Trace messages based on a certain signaling link, capture and save all or part messages through the signaling link. It provides functions to open and display the files traced and saved for the SS7 messages. Log in the BSC Maintenance System, select the menu item [SS7 Maintenance/SS7 Message Trace/SS7 Message Tracing], and an interface will pop up, as shown in Figure 2-20.

Figure 2-20 SS7 message trac The functions of the submenus under [SS7 Message Trace] are listed in Table 2-1. Table 2-1 Submenus under the menu item [SS7 Message Trace]

Menu item SS7 Message Tracing SS7 Message Review Trace a certain SS7

Function

Open a SS7 message trace file in the saving media

II. Functions
This function is used to trace messages based on a certain signaling link, capture all or part of the messages through this link. It can also be used to view whether the signaling coordination between offices is correct in case of problems in signaling coordination between different systems.

III. Operations
Select the menu item [SS7 Maintenance/SS7 Message Trace/SS7 Message Traced], and an interface will pop up, as shown in Figure 2-21.

Figure 2-21 Setting for SS7 message tracin

IV. Interface description

Module No.:No. of the module where the SS7 link is located. Link No.:No. of the link to be traced. Message Type: Message type to be observed. The messages with the type to be selected will be listed in the trace results. Table 2-2 shows the descriptions of the message types. Table 2-2 Meanings of message types Message type SNM SLT SCCP TUP Meaning Signaling network management message, MPT L3message. Signaling link test message, MTP L3-message. Signaling connection and control part message. TUP message, not used by BSC.

ISUP MT UNKNOWN L2_CHANGE

ISDN user part message, not used by BSC. Maintenance test message. Unknown message. MTP L2-message.

Filter: It is used to filter messages of the specified type. For instance, you can observe a message sent to a signaling point by setting the value of DPC_Filter. Once a filter is selected, the corresponding box in [Parameter] will become valid, and you can input the specified value. Table 2-3 shows the details of the filters. Table 2-3 Meanings of filters
Filter NI_Filter OPC_Filter DPC_Filter H1_Filter H0_Filter SLS_Filter CIC_Filter Direction_Filter Meaning Network indicator (NI) filter: International-0, international reserved-1, national 2 and national reserved-3. Original signaling point code (OPC) filter: The OPC value is required. Destination signaling point code (DPC) filter: The DPC value is required. H1 filter in MSU. H0 filter in MSU (the specified messages can be filtered by setting both filters H1 and H0). Signaling link selection (SLS) code filter: SLS value is required. Circuit identification code filter: CIC value is required. Signaling direction filter: 0 for Tx; 1 for Rx.

If the user selects the check box "Save to file (No Extension Name)", and inputs the file name (without suffix) in the text box, the system will trace the information and save it for future review and analysis. After setting all the trace items, click the <OK> button to start tracing. If an item is not set correctly, e.g., to trace a link actually not installed, the system will prompt "Sorry. Tracing MSU failed". If the trace item is correctly set, a window shown in Figure 2-23 will pop up, indicating the start of trace.

Figure 2-22 SS7 trace window

The title of the window shows the No. of the module where the link being traced is located and the link ID. Once a message conformable to the trace requirement is traced, it will be listed in the trace window. When the number of messages exceeds the display range in the window, you can use the scrollbar for browse. The items in the message list are described as follows: [Service]: Service type of the messages. Figure 2-22 lists TEST messages. The symbols on the left of the window refer to the directions in which the messages are sent. "<" for message sending, and ">" for message receiving. At the same time, the messages in blue are that sent, and the messages in black are that received. [SubSer]: Sub service-type of the message. "INT" for national reserved network. [Time]: Time the message is generated. It is a value relative to the start of trace. [H1H0]: Name of the message. [CIC/SLC]: CIC/SLC value in the message, indicating different meanings based on different message structures. [SLS]: Value of the signaling link selection code. [OPC]: OPC value in the message structure. [DPC]: DPC value in the message structure. [Signal Message]: Parameters in the message, denoted by hexadecimal numerals. To pause message trace, press <Space> and the window will display the message in "Pause" state and the number of "Pause" times and time. Press <Space> again, and the window will display to "Continue" the message, and the number of "Resume" times and time, and the message trace will be

resumed. When the personnel have some knowledge about the SS7 message structure, they can get the message Tx/Rx and contents by analyzing the trace results.
Service SCCP SubSer INT Time 471 H1H0 CIC/SLC SLS 009

OPC 0B51

DPC 0B5A

Signal Message 06 01 00 41 00 01 06 01 00 03 05 04 11

The message is a location update reject message. The OPC is 0B51, and DPC is 0B5A. "06" in the message parameter refers to the SCCP DT1 message. "01 00 41" is the destination local reference. "00" is the segmentation/reassembly mark, indicating there is no more data. "01" is user data offset, and "06" is user data length. "01 00 03" refers to the DTAP message, and the message length "03" is DTAP. "05 04 11" refers to MM (05) sublayer location update rejected (04), and the cause is system fault (11). Close the window, and the trace will be stopped. 2.5.3 Examples
Messages traced through the SS7 trace function provided by the BSC Maintenance System:

Figure 2-23 SS7 message tracing window Descriptions of the messages in Figure 2-23.

Select a message, press <Enter> or double click on it to view the details of the message content. The message with ">" before, i.e., the message in black, indicates that the formal message signal units (MSU) are received from this link. The message with "<" before, i.e., the message in blue, indicates that the formal message signal units (MSU) are sent from this link. The messages with ">" or "<" are messages in L2 and L3 of MTP. Generally, they are generated in case of link broken or link locating procedure or signaling link measurement. They are important for the analyzing link broken cause and locating failure cause. Contents of MTP L2-message: TIME: time (unit: 10ms). It is relative time, i.e., the time interval from the start of the signaling link tracing to the generation of the message. The maximum value is 65535. It is counted from 0 upon the reach to the maximum value. TYPE: message type. MTP L2-command (MTP_L2_CMD) or MTP L2-response (MTP_L2_REPORT) MTP L2-command is sent from the CPU to a board, and MTP L2response is reported from the board to the CPU. PARA: Command or response parameter. It refers to a board type. 00 is for the LPN7 board, and 01 for SS7 board. The parameters followed are commands or command responses, please refer to the details of the messages.

Note: Only the content following PARA is used in the examples for the messages of this type.

The first message in the "SS7 Message Tracing window" can be briefly described as follows: In the 19.7th second since the opening of the message tracing window, MTP delivers a STOP command to this signaling link. MSU transmitted in the link: Service: Service indication of the message. Test refers to signaling link test messages, MPT refers to the signaling network management messages in MTP, and TUP, ISUP and SCCP refer to the messages in TUP, ISUP and SCCP respectively. SubSer: Sub service field, i.e., NI. NAT is for national network, and INT for international network. Time: time (unit: 10ms), it is a relative time, i.e., the time interval from the start of the signaling link trace to the generation of the message. The maximum value is 65535. It is counted from 0 upon the reach to the maximum value. H1H0: Message header code, used to identify a specific message. CIC/SLC: CIC for the TUP and ISUP messages, SLC for the MTP messages, and SLS for the SCCP messages. SLS: Signaling link selection code. It is displayed for the ISUP messages only. OPC: Originating signaling point code in the message. DPC: Destination signaling point code in the message. Signal Message: Contents of the message.

2.6 SCCP Signaling Trace

2.6.1 Functions
SCCP, signaling connection control part in SS7, is an important approach to locate and solve problems in deployment, maintenance and debugging. The OMC of Huawei provides the

following functions for SCCP maintenance: Message Trace, Management Options and Status Query. The message trace function can be used to trace a SCCP message to be analyzed conveniently, and improve the efficiency in problem solution. Select the menu item [SS7 Maintenance/SCCP Maintenance], and an interface will pop up, as shown in Figure 2-24.

Figure 2-24 SCCP maintenance window

2.6.2 Operations
SCCP signaling message trace function is an important approach to locate problems and provides reference for operation verification in deployment, maintenance and debugging. It is the most commonly used function in SCCP maintenance.

I. Trace parameter setting

Select the menu item [SS7 Maintenance/SCCP Maintenance/SCCP Message Trace] in the BSC Maintenance System, and an interface will pop up, as shown in Figure 2-25.

Figure 2-25 SCCP message trac

II. Start tracing

Start tracing after setting all the trace items. If an item is not correctly set, e.g., the digits of

signaling point code is not enough, the system will prompt "Please input 3 digits of signaling point code".

If the item is correctly set, a window indicating the start of trace will pop up, as shown in Figure 2-26.

Figure 2-26 SCCP DPC message trac The title bar of the window displays the NI and SPC of the message being traced. "START TRACE NO.7 SUCCESS !" means the trace is successful. The message once traced to be conformable to the trace requirement will be added to the window. When the number of messages exceeds the display range, you can use a scroll bar for browse. The meanings of the items in the message list are given as follows: [MsgType]: Type of the message. [Signal Message...]: Content of the message, denoted by hexadecimal numerals.

III. Pause/Resume Tracing

To pause message trace, press <Space> and the window will display the message in "Pause" state and the number of "Pause" times, and time. Press <Space> again, the window will prompt to "Continue" the message, and the number of "Resume" times, and time. The message trace will be resumed.

2.6.3 Options

Figure 2-27 SCCP message trac [Module No.]: Fixed as 1 for BSC. [NI]: Indicating the signaling network where the remote signaling point is located. It includes "International active", "International standby", "National active" and "National standby". Generally [SPC]: 6-digit hexadecimal code, queried from the data management console. It refers to the peer MSC SPC. Whether [NI] and [SPC] are valid is independent on the trace object selected. Select the message type to be observed, and the messages of the type will be listed in the trace results. Trace message to far-end signaling point: Message sent to the far-end signaling point. Trace message from far-end signaling point: Message sent from the far-end signaling point. Trace MPT messages addressed by GT: SCCP provides several addressing modes. Select this item, and only the messages addressed by GT will be displayed. Trace subscriber messages: Messages of SCCP subscribers, like TCAP message.

2.6.4 Examples
The following figure show the SCCP messages traced when MS initiates a call.

Analysis for the bytes in the CR messages ("X" for the BITS to be analyzed, and "?" for those not to be analyzed for the moment) Standard message format Message content Byte

????XXXX

SI

????0011

Service indicator

0xC3

??XX???? ??XXXXXX XXXXXXXX ??XXXXXX NI DPC

??00???? 11?????? 10100010 ??000000

Invalid field Network indicator Destination signaling Point Code 00B2 0x50 0x34 0x0A 0XC0

XX?????? XXXXXXXX ????XXXX XXXX????

OPC

01?????? 00110000 ????0000

Original signaling Point Code 00C1 Signaling link selection code 0E

SLS

1110????

XXXXXXXX 3 bytes

Message type Source Local Reference

00000001 010041h

CR message

0x01 0x01

Originating local code ????0010 0000???? Services of Class 2 Invalid field Called address pointer Pointing to calling address Length of called address SPC included

0x00 0x41 0x02

????XXXX XXXX???? 1 byte

Protocol type

Size variable mandatory pointer Any part start pointer Size indicator

00000010

0x02

1 byte

00000110

0x06

1 byte

04h

0x04

???????X

Signaling point indicator

???????1

0x43

??????X? ??XXXX?? ?X??????

Subsystem indicator GT indicator Routing indicator

??????1? ??0000?? ?1??????

SSN included GT not included DPC and SSN routing National reserved OPC A interface subsystem Calling address Format same as the called address SCCP user data SCCP user data size (followed by BSSAP messages) 0x5034 0xFE 0x04

X??????? 2 bytes 1 byte 1 byte SPC SSN

0??????? 0X5034 0xfe 0x04

Any parameter name Any parameter name

5 bytes

04 43 28 10 FE

04 43 28 10 FEh 0x0F

1 byte

Any parameter name Any parameter size

0x0F

1 byte

0x1c

0x1c

Table of Contents

Chapter 3 System Information.....................................................................................................3-1 3.1 Overview............................................................................................................................3-1 3.2 Detailed Description of System Information......................................................................3-2 3.2.1 SYSTEM INFORMATION TYPE 1..........................................................................3-2 3.2.2 SYSTEM INFORMATION TYPE 2, 2bis and 2ter...................................................3-5 3.2.3 SYSTEM INFORMATION TYPE 3..........................................................................3-7 3.2.4 SYSTEM INFORMATION TYPE 4........................................................................3-10 3.2.5 System Information type 5, 5bis & 5ter.................................................................3-12 3.2.6 SYSTEM INFORMATION TYPE 6........................................................................3-13 3.2.7 SYSTEM INFORMATION TYPE 7........................................................................3-14 3.2.8 SYSTEM INFORMATION TYPE 8........................................................................3-14 3.3 Internal Handling of BSC.................................................................................................3-14

Chapter 3 System Information

3.1 Overview
System information includes the major radio network parameters on Um interface. Specifically, it includes network identification parameter, cell selection parameter, system control parameter and network function parameter. By receiving system information, MS can properly access the network, perform network selection, fully utilize the various services provided by the network and communicate with the network normally. Common System information can be classified into two parts, the system information transmitted on BCCH and the system information transmitted on SACCH. The former includes SYSTEM INFORMATION TYPE 1, 2, 2bis, 2ter, 3 and 4. The latter includes SYSTEM INFORMATION TYPE 5, 5bis, 5ter, 6, 7 and 8. SYSTEM INFORMATION TYPE 9 includes the control information for BCCH. If SYSTEM INFORMATION TYPE 9 is used, the receiving location of it is indicated in SYSTEM INFORMATION TYPE 3. Generally, it is not used. If the system supports GPRS, SYSTEM INFORMATION TYPE 13 should be used. The following describes common system information in detail.

Note: The system information transmitted on BCCH belongs to common channel information. The system information transmitted on SACCH belongs to TRX management information. When interface tracing is to be performed through BSC Maintenance System, the options of common channel information and TRX management information must be selected. Only in this way can all system information be observed. SYSTEM INFORMATION TYPE 1, 2, 2ter, 3, 4, 5, 5ter and 6 can be delivered to cells by default. 2bis and 5bis are mainly transmitted over DCS1800 cells conditionally.

3.2 Detailed Description of System Information

3.2.1 SYSTEM INFORMATION TYPE 1
I. Purpose

SYSTEM INFORMATION TYPE 1 mainly describes RACH control information and CA (Cell Allocation table). It is transmitted on BCCH.

II. Information content

SYS INFO 1 - - Cell Channel Desc. -- RACH Control Para. 1) CA BSC supports the configuration of up to 64 cell frequencies. Due to the restriction of cell channel description formats, actually, cell frequencies cannot be configured randomly. BSC selects different cell channel description formats according to the actual frequency configuration. There are five channel description formats with the format ID of bit128, bit127, bit124, bit123 and bit122, which are respectively determined by the second byte in the cell channel description, as shown in Table 3-1, Table 3-2. Table 3-1 Cell Channel Description Formats 8 7 6 5 4 3 2 1 octet 1 Bit 124 Bit 004 Bit 123 Bit 003 Bit 122 Bit 002 Bit 121 Bit 001 octet 17 octet 2

Cell Channel Description IEI Bit 128 Bit 008 Bit 127 Bit 007 0 Spare Bit 006 0 Spare Bit 005

Table 3-2 Cell channel description formats

Bit128 0 1 1 1 1 1 Bit127 0 0 0 0 0 0 Bit124 X 0 1 1 1 1 Bit123 X X 0 0 1 1 Bit122 X X 0 1 0 1 Format notation Bit map 0 1024 range 512 range 256 range 128 range Variable bit map

The corresponding number of the cell configurable absolute frequencies of each cell channel description format is not the same. The number of configurable absolute frequencies in one cell (the same frequencies and illegal frequencies excluded), and ARFCN (i) (i=1,...,n) denotes the corresponding radio frequency, the number of configurable frequencies of each channel description format will be as follows.

Bit map 0 Bit map 0 can be used for 900M frequency. The actual number of cell configurable frequencies can reach 64. Moreover, the frequencies can be configured randomly, so long as they satisfy "1 ARFCN (i) 124". 1024 range format When this format is adopted, the actual number of cell configurable frequencies is less than or equal to 16 (n16), but the frequencies can be freely configured. For 900M, 1 ARFCN (i) 124. For 1800M, 512 ARFCN (i) 885. 512 range format When this format is adopted, the actual number of cell configurable frequencies is less than or equal to 18 (n 18), but the following condition should also be satisfied. Assuming that m denotes the maximum interval between two configured frequencies, "m < 512" should be satisfied. 256 range format When this format is adopted, the actual number of cell configurable frequencies is less than or equal to 22 (n22), but the following condition should also be satisfied. Assuming that m denotes the maximum interval between two configured frequencies, "m<256" should be satisfied. For example, when this format is adopted, frequency 512 and frequency 812 cannot be configured at the same time. 128 range format When this format is adopted, the actual number of cell configurable frequencies is less than or equal to 29 (n29), but the following condition should also be satisfied. Assuming that m denotes the maximum interval between two configured frequencies, "m<128" should be satisfied. For example, when this format is adopted, frequency 512 and frequency 712 cannot be configured at the same time. Variable bit map When this format is adopted, the actual number of cell configurable frequencies can also reach 64, but the following condition should also be satisfied. Assuming that m denotes the maximum interval between two configured frequencies, "1m111" should be satisfied. For example, it is feasible to configure the frequencies 512, 513, 514, , 575 (increased by 1, total 64 frequencies), but it is unfeasible to configure the frequencies 512, 514, 516, ..., 638 (increased by 2, total 64 frequencies). 2) RACH control information RACH control information includes the following parameters. MAX retrans indicates the maximum number of retransmissions of the Channel Request message before MS receives an Immediate Assignment message, i.e. the number of channel requests that can be sent by MS is "M + 1". It is a 2-bit code. The maximum number of retransmissions that corresponds to 0~3 is 1, 2, 4 and 7 respectively. Tx_integer (Extended transmit TS number) indicates the number of timeslots between two successive retransmissions when MS continuously

sends multiple Channel Request messages CBA (CELL_BAR_ACCESS) indicates whether MS is allowed to access the current cell. It is a 1-bit code. "0" indicates cell access is allowed, and "1" indicates that cell access is barred. This parameter has no impact upon handover access. AC denotes access restricted user level. AC can be classified into AC 0~AC 9 and AC 11~AC 15. Generally, each MS is allocated with an AC. Each AC is indicated by one bit. "1" indicates that the MS of the corresponding AC is not allowed to access the current cell, and "0" indicates the MS is allowed to access the current cell. Compared with the MSs of AC 0 ~AC 9, the MSs of AC 11~AC15 have higher access priorities. However, between the ACs within 0~ 9, or the ACs within 11~15, different ACs do not denote different access priorities. RE (bit allowed for call reestablishment) indicates whether the network allows connection reestablishment after MS initiates the call reestablishment procedure. It is a 1-bit code. "0" indicates that the current cell allows call reestablishment, and "1" indicates that the current cell does not allow call reestablishment. EC (bit allowed for emergency call) indicates whether MS is allowed to initiate an emergency call in the case that the MS has no SIM card or its AC is disabled by the current cell. It is a 1-bit code. "0" indicates that emergency call is allowed, and "1" indicates that emergency call is not allowed (except the MSs of AC 11~ AC 15).

Note: The extend transmit TS number is a random value, and belongs to the collection of {S, S+1,....S+T-1}. The measurement unit is TDMA frame. Of the collection, S depends on common channel configuration, and T denotes the extend transmit TS number (Tx_integer). See Table 3-3 for the values of S.

Table 3-3 S and T Parallelism

Tx_integer 3, 8, 14, 50 49. 16 5, 10, 20 6, 11, 25 7, 12, 32 CCCH uncombined 55 76 109 163 217 CCCH combined 41 52 58 86 115

Note: When satellite transmission is adopted, to lessen the impact of satellite Tx delay, it is recommended that MAX retrans is set as "4" and Tx_integer is set as "32".

3.2.2 SYSTEM INFORMATION TYPE 2, 2bis and 2ter

I. Purpose
SYSTEM INFORMATION TYPE 2 mainly describes RACH control information, NCC permission and CA of the neighbor cells (namely, BA1 table). It is transmitted on BCCH. Generally, SYSTEM INFORMATION TYPE 2, 2bis and 2ter respectively describe different parts of BA1. By reading and decoding BA1 table, MS can implement cell reselection in idle mode. The GSM900 MS in Phase 1 only recognizes the neighbor cell frequencies described in SYSTEM INFORMATION TYPE 2 and skips those contained in 2bis and 5ter. Type 2bis mainly describes RACH control information and the extended frequency allocation table of neighbor cells (part of BA1 table). It is optional, and is transmitted on BCCH. Generally, because the number of frequencies described in the frequency allocation table in SYSTEM INFORMATION TYPE 2 is limited, SYSTEM INFORMATION TYPE 2bis contains the information of other frequencies in BA1 which are in the same frequency band as SYSTEM INFORMATION TYPE 2. Type 2ter mainly describes the extended frequency allocation table of neighbor cells (part of BA1 table). It is transmitted on BCCH. Only the multi-band MS can read this information. The single-band GSM 900 or GSM 1800 MS will skip this information. Because the frequencies contained in this information are in a frequency band which is different from that of the current cell, such information is not needed by the single-band MS.

II. Information content

SYS INFO 2 - - Neighbor Cell Desc. - - NCC permitted - - RACH Control Para. SYS INFO 2 BIS - - Neighbor Cell Desc. - - RACH Control Para. SYS INFO 2TER - - Neighbor Cell Desc. 1) BA1 BA1 (neighbor cell description) mainly describes the absolute frequency No. of the BCCH TRX of the neighbor cell. Currently, the maximum number of neighbor cells supported by Huawei is 32. Except the 5th bit (BA-IND) and 6th bit (EXT-IND) of the second byte in BA1, the coding mode of other information is the same as that of the cell channel description table (Refer to subsection 1) of 3.2.1 II. . EXT_IND (Extension Indication) is transmitted in SYSTEM INFORMATION TYPE 2 and 5, indicating whether there are other extended neighbor cell frequencies to be transmitted in SYSTEM INFORMATION TYPE 2bis and 5bis. It is a 1-bit code. "0" indicates that SYSTEM INFORMATION TYPE 2 and 5 already contain the complete BA table, and "1" indicates that type 2 and type 5 only contain part of BA table. BA Indication (BA_IND) is transmitted in SYSTEM INFORMATION TYPE 2 and 5. It is a 1-bit code, and is used by MS to select the data in BA1 and BA 2 before or after modification. In other words, if the neighbor cell relation of the current cell and the BA2 table is changed during a session, BA_IND in SYSTEM INFORMATION TYPE 5 will be 1 instead of 0. This indicates that MS should perform decoding for the neighbor cell frequencies indicated in the SYSTEM INFORMATION TYPE 5 again. 2) NCC Permitted NCC Permitted is transmitted in SYSTEM INFORMATION TYPE 2 and type 5. It is an 8bit code, and contains the collection of the NCCs to be measured by MS. In other words, if 0N7 (N denotes the number of bits), MS will not measure the cell level that satisfies "NCC=N", i.e. MS will not be handed over to the network that satisfies "NCC=N". This parameter is mostly used in handover.

3) RACH control information Refer to subsection 2) of 3.2.1 II for relevant description. 4) Extended neighbor cell description It is mainly transmitted in SYSTEM INFORMATION TYPE 2ter and 5ter. Except the 5 bit (BA-IND) and the 6 ~7 bit (Multiband Reporting), the codes of other information are the same as those in cell channel description (Refer to subsection 1) of 3.2.1 II for relevant description). Multiband Reporting (MBR) is transmitted in SYSTEM INFORMATION TYPE 2ter and 5ter. It is a 2-bit code, indicating whether MS reports neighbor cell information on multiple frequency bands. It is applicable to multiband MS only. The details are listed below. Table 3-4 Meaning of multiband indication Contents of multiband indication (2 bits) 00 Meaning
th th th

MS should report the measurement result of 6 neighbor cells with the strongest signal strength, no matter which frequency band it is allocated with. MS should report the measurement result of 1 neighbor cell (if it exists and is permitted) which is allocated with a frequency band different from that of the current cell, and report the measurement result of 5 neighbor cells which are allocated with the same frequency band as the current cell. MS should report the measurement result of 2 neighbor cells (if they exist and are permitted) which are allocated with a frequency band different from that of the current cell, and report the measurement result of 4 neighbor cells which are allocated with the same frequency band as the current cell. MS should report the measurement result of 3 neighbor cells (if they exist and are permitted) which are allocated with a frequency band different from that of the current cell, and report the measurement result of 3 neighbor cells which are allocated with the same frequency band as the current cell.

01

10

11

3.2.3 SYSTEM INFORMATION TYPE 3

I. Purpose
SYSTEM INFORMATION TYPE 3 mainly describes LAI, cell ID, RACH control information and the parameters related to cell selection. It is mandatory, and is transmitted on BCCH.

II. Information content

SYS INFO 3 - - Cell Identity - - LAI - - Control Channel Desc. - - Cell Option (BCCH)

- - Cell Selection Para. - - RACH Control Para. 1) CGI CGI (Cell Global Identity) is composed of LAI and CI, of which, LAI includes MCC, MNC and LAC. SYSTEM INFORMATION TYPE 3, type 6 and type 4 contain all or part of CGI information. Based on the received system information, MS decodes CGI and decides whether to access the network in this cell according to the MCC and MNC indicated by the CGI. CGI is also used to check whether the current location area has changed, so that MS can determine whether the location updating procedure need be initiated. MCC, consisting of 3 decimal digits, is allocated worldwide in unified way. For example, the MCC of China is 460. MNC, consisting of two decimal digits, is allocated by the country in unified way. For example, the MNC of China Mobile is "00", and the MNC of China Unicom is "01". LAC and CI, both consisting of 2 bytes, are arranged by each GSM operator in unified way. Note that the value range of CI is 0X0001~0XFFFE, while 0X0000 and 0XFFFF are reserved. 2) Control channel description Control channel description includes the following parameters. IMSI attach and detach allowed (ATT) is used to notify MS whether the local cell allows IMSI attach/detach procedure. ATT is a 1-bit code. "0" indicates that MS is not allowed to initiate IMSI attach/detach procedure, and "1" indicates that MS must initiate the IMSI attach/detach procedure. CCCH CONF decides the integration mode of the CCCH in the cell. CCCH CONF is a 3-bit code. See Table 3-5 for detailed description. Table 3-5 CCCH CONF code meaning CCCH CONF (3 bits) 000 Meaning Number of CCCH information blocks per BCCH multiframe 9

CCCH uses a basic physical channel which is not shared with SDCCH. CCCH uses a basic physical channel which is shared with SDCCH. CCCH uses two basic physical channels which are not shared with SDCCH. CCCH uses three basic physical channels which are not shared with SDCCH. CCCH uses four basic physical channels which are not shared with SDCCH. Reserved

001

010

18

100

27

110

36

Others

BS_AG_BLKS_RES is used together with CCCH CONF to decide the number of CCCH information blocks in each BCCH mutiframe of the current cell. After CCCH CONF is set, BS AG BLKS RES will actually be used to arrange the occupancy ratio between AGCH and PCH on CCCH. By adjusting this parameter, the bearing status of AGCH and PCH can be balanced.

BS PA MFRAMS defines how many multi-frames make up a cycle of a paging sub-channel. This parameter actually defines how many sub-channels the PCH of a cell will be divided into. BS PA MFRAMS is a 3-bit code. The value range is 0~7, indicating that the number of multi-frames of a paging group cycled on the PCH is 2~9 respectively. Periodic location updating timer (T3212) defines the frequency of periodic location updating. It is an 8-bit code. The value range is 0~255, each unit of which denotes the duration of six minutes. "0" indicates no location updating. 3) Cell option Cell option includes the following parameters. PWRC is used to notify MS whether the Rx level value obtained from the timeslots of BCCH TRX should be subtracted when it measures the Rx level in the frequency hopping procedure. It is a 1-bit code. the Rx level value obtained from the timeslots of BCCH TRX should not be subtracted, and "1" indicates that the Rx level value obtained from the timeslots of BCCH TRX should be subtracted. DTX indicates whether MS can use the DTX function. In SYSTEM INFORMATION TYPE 3, it is a 2-bit code. In SYSTEM INFORMATION TYPE 6, it is a 3-bit code. Radio_Link_Timeout is a 4-bit code. The value range is 0~15, and the corresponding decimal value range is of 4~64. Every time MS receives a correct SACCH message, 2 is added to this value. At the moment when MS should receive an SAACH message, if it cannot correctly decode the SAACH message, 1 will be subtracted from this value. If this value is 0, MS will report a radio link fault to BTS. 4) Cell selection parameters Cell selection parameters have impact upon the behaviors of MS after it is powered on. The major parameters are as follows. Cell Reselection Hysteresis is used for cell reselection. MS cannot implement cell reselection unless the level of the neighbor cell (Here, the neighbor cell and the current cell do not belong to the same location area) minus the C2 of the current cell is greater than the specified value of cell selection hysteresis. It is a 3-bit code. The value range is 0~7, denoting 0dB ~14dB respectively. MS_TXPWR_MAX_CCH indicates the Tx power used by MS before it receives a power control command. It is a 5-bit code. The valid value range is 0~31, which respectively correspond to an MS output power. RXLEV_ACCESS_MIN indicates the min. Rx level allowed for MS to access the network. It is a 6-bit code. The value range is 0~63, denoting -110dBm~47dBm respectively. ACS is used to notify MS whether to adopt C2 in the cell reselection procedure. It is a 1-bit code and is meaningless in SYSTEM INFORMATION TYPE 3. In SYSTEM INFORMATION TYPE 4, if the value is 0, it indicates that MS adopts SI4 REST of SYSTEM INFORMATION TYPE 4 to calculate C2related parameters, or else, MS adopts REST of SYSTEM INFORMATION TYPE 7 or type 8 to calculate c2-related parameters.

NECI is used to notify MS whether the current cell supports half-rate services. It is a 1-bit code. "0" indicates that the current cell does not support half-rate services, and "1" indicates the current cell supports half-rate services. 5) RACH control parameters Refer to subsection 2) of 3.2.1 II for relevant description. 3.2.4 SYSTEM INFORMATION TYPE 4
I. Purpose
SYSTEM INFORMATION TYPE 4 mainly describes LAI, RACH control information, cell selection parameters and optional CBCH information. It is mandatory, and is transmitted on BCCH. When the system supports cell broadcast, the optional IE CBCH description and MA will be used, and will describe CBCH configuration and the corresponding frequency information

II. Information content

SYS INFO 4 - - LAI - - Cell Selection Para. - - RACH Control Para. - - CBCH Channel Desc.(optional) - - CBCH Mobile Allocation (optional) - SI4 Rest Oct. 1) LAI Refer to subsection 1) of 3.2.3 2 II for relevant description. 2) Cell selection parameters Refer to subsection 4) of 3.2.3 II for relevant description. 3) RACH control information Refer to subsection 2) of 3.2.1 II for relevant description. 4) CBCH description and CBCH MA The two parameters are optional. When the system supports cell broadcast, CBCH description contains the formation about CBCH configuration. When CBCH description is in frequency hopping mode, CBCH MA is mandatory. 5) SI4 Rest Oct. When ACS of the cell selection parameters is set as "No", the relevant parameters in SI4 Rest Oct. will be used to calculate the value of the cell reselection parameter C2. Cell reselection criteria: When PENALTY_TIME = 31, C2=C1-CELL_RESELECT_OFFSET When PENALTY_TIME31, C2=C1+CELL_RESELECT_OFFSETTEMPORARY_OFFSET*H(PENALTY_TIME-T) Where, For the non-serving cell: When x<0, H(x)=0; when x>=0, H(x)=1 For the serving cell, H(x)=0 SI4 Rest Oct. contains the following parameters.

PI (Cell Reselection Parameter Indication) indicates whether MS adopts C2 as the cell reselection parameter, and whether the parameters used for calculating C2 exist. It is a 1-bit code. "0" indicates that C1 substitutes C2 and serves as the cell reselection criteria. "1" indicates that parameters are extracted from system information for calculating C2, which will serve as the cell reselection criteria. CBQ (Cell Bar Qualify) is a 1-bit code. CBQ and CBA (CELL_BAR_ACCESS) jointly form cell priority status. For details, refer to Table 3-6. Table 3-6 Cell selection or reselection priority decided by CBQ and CBA CBQ 0 0 1 1 CBA 0 1 0 1 Cell selection priority Normal Barred Low Low Cell reselection status Normal Barred Normal Normal

CRO (CELL_RESELECT_OFFSET) is used to manually correct C2. It is a 6bit code and each bit stands for 0~126dB respectively. CRO, TO and PT are jointly used form the manual correction value of C2. TO (TEMPORARY_OFFSET): The value range is 0~7. Each level denotes 10dB. 0->0dB, 1->10dB6->60dB, 7-> infinite. PT (PENALTY_TIME): The value range is 0~31. Each level denotes 20s. 0>20s,, 30->620s. When the value is 31, TO will be disregarded, and CRO will offset C2 with a negative value. 3.2.5 System Information type 5, 5bis & 5ter
I. Purpose
SYSTEM INFORMATION TYPE 5 mainly describes the frequency information of neighbor cells (namely, BA2). It is mandatory, and is transmitted on SACCH. The difference between SYSTEM INFORMATION TYPE 2 and type 5 is that the MS in session state can read the frequencies described in SYSTEM INFORMATION TYPE 5 and report the relevant information of neighbor cells in the measurement report, which will serve as the reference for handover. Likewise, the GSM900 MS in Phase 1 only recognizes the neighbor cell frequencies described in SYSTEM INFORMATION TYPE 5 and skips those contained in 5bis and 5ter. Type 5bis mainly describes the frequency information of neighbor cells (part of BA2). It is optional, and is transmitted on SACCH. Generally, the number of frequencies described in the frequency allocation table in SYSTEM INFORMATION TYPE 5 is limited. Therefore, system information 5bis contains the information of other frequencies in BA2 which are in the same frequency band as system information 5. Type 5ter mainly describes the frequency information of neighbor cells (part of BA2), and is transmitted on SACCH. Likewise, only the multiband MS can read this information. The singleband GSM 900 or GSM 1800 MS will skip this information.

II. Information content

SYS INFO 5- - Neighbor Cell Desc. SYS INFO 5 BIS - - Neighbor Cell Desc.

SYS INFO 5TER - - Neighbor Cell Desc. 1) Neighbor cell description For relevant description, please Refer to subsection 1) of 3.2.2 II 2) Extended neighbor cell description For relevant description, please Refer to subsection 4) of 3.2.2 II

3.2.6 SYSTEM INFORMATION TYPE 6

I. Purpose
SYSTEM INFORMATION TYPE 6 mainly describes LAI, cell ID and the parameters used for describing cell functions. It is mandatory, and is transmitted on SACCH.

II. Information content

SYS INFO 6 - - Cell Identity - - LAI - - Cell Option (SACCH) - NCC Permitted 1) CGI Refer to subsection 1) of 3.2.3 II 2) Cell option Refer to subsection 3) of 3.2.3 II 3) NCC permitted Refer to subsection 2) of 3.2.2 II

3.2.7 SYSTEM INFORMATION TYPE 7

I. Purpose
SYSTEM INFORMATION TYPE 7 is mandatory, and is transmitted on BCCH. It contains cell reselection information.

II. Information content

SYS INFO 7---- SI 7 Rest Octets SI 7 Rest Octets contains the parameters used by MS for cell reselection. It can also contain the information of the parameter POWER OFFSET used by DCS1800 Class 3 MS. The coding format of SI 7 Rest Octets is the same with SI 4 Rest Octets. See the related description in "5) SI 4 Rest Oct" of 3.2.4.

3.2.8 SYSTEM INFORMATION TYPE 8

I. Purpose
This system information is mandatory, and is transmitted on BCCH. It contains cell reselection information.

II. Information content

SYS INFO 8 ---- SI 8 Rest Octets SI 8 Rest Octets contains the parameters used by MS for cell reselection. It can also contain

the information of the parameter POWER OFFSET used by DCS1800 Class 3 MS. The coding format of SI 8 Rest Octets is the same with SI 4 Rest Octets. See the related description in "5) SI 4 Rest Oct" of 3.2.4.

3.3 Internal Handling of BSC

The internal handling of the BSC is given below: 1) The BSC retrieves cell frequencies in SYSTEM INFORMATION TYPE 1 from the [Cell Allocation Table]. Table 3-7 shows the correspondence between the RACH control parameters in SYSTEM INFORMATION TYPE 1 and the [System information table]. Table 3-7 Correspondence between RACH control parameters and the [System information table] RACH control parameters in SYSTEM INFORMATION TYPE 1 Maximum number of retransmissions (MAX retrans) Number of slots to spread transmission (Tx_integer) Cell Barred for Access (CELL_BAR_ACCESS) Access Control Class (AC) System information table MS MAX retrans Tx_integer CBA Controlled by common access control class and Special access control class Call re-establishment allowed EC allowed

Call reestablishment allowed (RE) Emergency Call allowed (EC)

Note: MAX retrans and Tx_integer vary with the current traffic class of the cell if the BSC enables the cell flow control function. 2) The BSC retrieves neighbor cell frequencies in SYSTEM INFORMATION TYPEs 2, 2bis and 2ter from the [BA1 Table]. Specifically, it retrieves NCC Permitted in SYSTEM INFORMATION TYPE 2 from the NCC permitted field in the [System information Table]. The RACH control parameters in SYSTEM INFORMATION TYPEs 2 and 2bis are the same as that in SYSTEM INFORMATION TYPE 1, as listed in Table 3-7. 3) The BSC retrieves CGI in SYSTEM INFORMATION TYPE 3 from the [BSC Cell Table]. Table 3-8 shows the correspondence between the control channel parameters in SYSTEM INFORMATION TYPE 3 and the [System information table]. Table 3-8 Correspondence between the control channel parameters in SYSTEM INFORMATION TYPE 3 and the [System information table]
Control channel parameters in SYSTEM System information

INFORMATION TYPE 3 Attach-Detach allowed (ATT) CCCH-CONF BS_AG_BLKS_RES BS-PA-MFRAMS T3212 ATT

table

CCCH-CONF BS_AG_BLKS_RES BS-PA-MFRAMS T3212

Table 3-9 shows the correspondence between the cell options in SYSTEM INFORMATION TYPE 3 and the [System information table]. Table 3-9 Correspondence between the cell options in SYSTEM INFORMATION TYPE 3 and the [System information table]
Cell options in SYSTEM INFORMATION TYPE 3 Power control indicator (PWRC) DTX indicator (DTX) Radio_Link_Timeout System information table PWRC DTX Radio Link Timeout

Table 3-10 shows the correspondence between the cell selection parameters in SYSTEM INFORMATION TYPE 3 and the [System information table]. Table 3-10 Correspondence between the cell selection parameters in SYSTEM INFORMATION TYPE 3 and the [System information table]
Cell selection parameters in SYSTEM INFORMATION TYPE 3 Cell Reselection Hysteresis MS_TXPWR_MAX_CCH RXLEV_ACCESS_MIN ADDITIONAL RESELECT PARAM IND (ACS) HALF RATE SUPPORT (NECI) System information table CRH MS_TXPWR_MAX_CCH RXLEV_ACCESS_MIN ACS Half rate supported

The RACH control parameters in SYSTEM INFORMATION TYPE 3 are the same as that in SYSTEM INFORMATION TYPE 1, as listed in Table 3-7. 4) The BSC retrieves Location Area Identification in SYSTEM INFORMATION TYPE 4 from the [BSC Cell Table]. The cell selection parameters in type 4 are the same as that in type 3, as listed . The RACH control parameters in type 4 are the same as that in type 1, as listed in .

The BSC receives CBCH Channel from the [Carrier Configuration Table] and CBCH Mobile Allocation from the [Frequency Hopping Table]. Table 3-10Table 3-7Table 3-11 shows the correspondence between SI 4 Rest Octets and the [System information table]. Table 3-11 Correspondence between SI 4 Rest Octets and the [System information table]
SI 4 Rest Octets Cell Reselection Parameter Indicator (PI) CELL_BAR_QUALIFY (CBQ) CELL_RESELECT_OFFSET (CRO) TEMPORARY_OFFSET (TO) PENALTY_TIME (PT) System information table PI CBQ CRO TO PT

5) The BSC retrieves neighbor cell frequencies in SYSTEM INFORMATION TYPEs 5, 5bis and 5ter from the [BA2 (SACCH) Table]. 6) The BSC retrieves CGI in SYSTEM INFORMATION TYPE 6 from the [BSC Cell Table]. The cell options in this type are the same as that in type 3, as listed in Table 3-9. The BSC retrieves NCC Permitted from the NCC permitted field in the [System information table]. 7) SI 7 Rest Octets are the same as SI 4 Rest Octets, as listed in Table 311. 8) SI 8 Rest Octets are the same as SI 4 Rest Octets, as listed in Table 311.

Table of Contents

Chapter 4 Location Update Procedure........................................................................................4-1 4.1 Overview............................................................................................................................4-1 4.2 Location Updating Procedure............................................................................................4-2 4.2.1 Periodic Updating....................................................................................................4-3 4.2.2 IMSI Attach Procedure............................................................................................4-4 4.2.3 Generic Location Updating Procedure....................................................................4-4 4.3 Internal Handling of BSC...................................................................................................4-9

Chapter 4 Location Update Procedure

4.1 Overview
In GSM system, MS location information need be known by HLR, VLR and MS, When the location information changes, it is required that the relevant information in HLR, VLR and MS should be consistent, which can be realized through the location updating procedure. As the major procedure of location management, the location updating procedure is always initiated on MS side. The location updating procedure is a general procedure, and is used for 3 purposes, i.e. normal location updating, periodic updating and IMSI attach. The normal location updating procedure is used to update the registration of the actual location area of MS in the network. The location updating type information element in the LOCATION UPDATING REQUEST message shall indicate normal location updating. When the network indicates that MS is unknown in VLR, the normal location updating procedure will be started, as a response to the MM connection establishment request. In case that location updating is unsuccessful, to limit the number of location updating attempts, an attempt counter need be used. The attempt counter is reset when MS is switched on or a SIM card is inserted. MS contains a list of "forbidden location areas for roaming", as well as a list of "forbidden location areas for regional provision of service". These lists shall be erased when an MS is switched off or when SIM is removed. Whenever a LOCATION UPDATING REJECT message is received with the cause "Roaming not allowed in this location area" or with the cause "Location area not allowed", the LAI received on BCCH that triggered the location updating request shall be added to the relevant list. The two lists shall accommodate 10 or more entries. When the list is full and a new entry has to be inserted, the oldest entry shall be deleted. Upon successful location updating, MS sets the update status to "UPDATED" in SIM (UPDATED status indicates the last location updating request is successful) , and save LAI, TMSI, Cipher Key and Cipher Sequence Number in SIM, and stores the received new location area information in SIM.

4.2 Location Updating Procedure

The normal location updating procedure, periodic location updating procedure and IMSI attach procedure are basically the same (The difference are described in details in relevant subsections below). See Figure 4-1 for the location updating procedure.

Figure 4-1 Location updating procedure 1) MS sends a CHANNEL REQUEST message to BTS on the access channel of Um interface (The message contains the access cause value "Location update"). 2) BTS sends a CHANNEL REQUEST message to BSC. 3) Upon receipt of the CHANNEL REQUEST message, BSC allocates signaling channels, and sends a CHANNEL ACTIVATION message to BTS. 4) If the channel type is correct, upon receipt of the CHANNEL ACTIVATION message, BTS opens the power amplifier on the specified channel, and sends a CHANNEL ACTIVATION ACKNOWLEDGE message to BSC. 5) BSC sends an IMMEDIATE ASSIGNMENT COMMAND message to MS via BTS. 6) MS sends an SABM frame for establishing link with BTS 7) BTS returns a UA frame for acknowledgement. 8) BTS sends an ESTABLISHMENT INDICATION message to BSC, which contains the content of the LOCATION UPDATE REQUEST message. 9) BSC establishes SCCP link connection on A interface, and sends a LOCATION UPDATE REQUEST message to MSC. The parameter including the CGI of the current cell. 10) MSC returns a link acknowledge message to BSC. 11) MSC sends a LOCATION UPDATING ACCEPT message to BSC, indicating that location updating has succeeded. 12) The network shall deliver a LOCATION UPDATING REJECT message to MS if it rejects the location updating request. 13) If "Allocate TMSI upon location updating" is set to "No" in MSC, MS shall not report the TMSI REALLOCATION COMPLETE message in the location updating procedure. 14) The network shall initiate the channel release procedure if no further transactions are scheduled.

4.2.1 Periodic Updating

Periodic updating is used to notify periodically the availability of MS to the network. It is performed by using the location updating procedure. The location updating type information element in the LOCATION UPDATING REQUEST message shall indicate periodic updating. The procedure is controlled by timer T3212 in MS. If the timer has not been started, the timer shall be started each time MS enters the "NORMAL SERVICE" or "ATTEMPTING TO UPDATE" sub-state of the "MM IDLE" state. When MS leaves the "MM Idle" state (MM IDLE state indicates MS in inactivation state, namely, it doesn't process any call procedure, only in interception state. For example, in MOC or MOT procedure, MS will leave MM_IDLE state), timer T3212 shall continue running until it is overtime. In the following cases, the timer shall be stopped (MS shall set the timer to its initial value for the next location update). A LOCATION UPDATING ACCEPT or LOCATION UPDATING REJECT message is

received. An AUTHENTICATION REJECT message is received. The first MM message (Such as LOCATION ACCEPT, CM SERVICE ACCEPT etc.) is received, or ciphering mode setting is completed in the case of MM connection establishment, except when the most recent service state is "LIMITED SERVICE". MS has responded to paging and thereafter has received the first correct layer 3 message except RR message. Timer T3212 expires. MS is deactivated (i.e. MS switched off or SIM removed). When timer T3212 expires, the location updating procedure shall be started. When MS is in the service state of "NO CELL AVAILABLE", "LIMITED SERVICE", "PLMN SEARCH" or "PLMN SEARCH-NORMAL SERVICE", if the T3212 timer expires, the location updating procedure shall be delayed until the MS leaves this service state. The (periodic) location updating procedure is not be started if the system information at the time the T3212 timer expires indicates that periodic location update shall not be used. The timeout value is contained in control channel description IE of the SYSTEM INFORMATION TYPE 3 message. The T3212 timeout value shall not be changed when MS is in the state of "NO CELL AVAILABLE", "LIMITED SERVICE", "PLMN SEARCH or PLMN SEARCH-NORMAL" etc. When a change of the T3212 timeout value has to be taken into account and the timer is running (at change of the serving cell or, the broadcast of T3212 timeout value), MS shall take the mod that the current T3212 value to the new T3212 timeout value as the new initial value. When MS is activated, or when a change of the T3212 timeout value has to be taken into account and the timer is not running, the new timer shall be started at a value randomly, uniformly drawn between 1 and the new initial value.

4.2.2 IMSI Attach Procedure

The IMSI attach procedure is the complement of the IMSI detach procedure. It is used to indicate the IMSI as active in the network. There is a flag (ATT) in the SYSTEM INFORMATION TYPE 3 message, which indicates whether the attach and detach procedures are required to be used or not. The IMSI attach procedure is invoked when the IMSI is activated by MS, if the detach/attach procedures are required by the network. When IMSI is activated by MS within the network coverage area, or if MS is moved from outside the coverage area to the coverage area. The IMSI attach procedure is used only if the update status is "UPDATED" and if the stored LAI is the same as the one which is actually broadcasted on the BCCH of the current serving cell. Otherwise a normal location updating procedure shall be invoked, which is independent of the ATT flag indication. IMSI attach is performed by using the location updating procedure. The location updating type information element in the LOCATION UPDATING REQUEST message must in this case indicate IMSI attach.

4.2.3 Generic Location Updating Procedure

Any timer used for triggering the location updating procedure (e.g. T3211 and T3212) is stopped if running. As no RR connection exists at the time when the location updating procedure has to be started, the MM sublayer within MS will request the RR sublayer to establish a RR connection and enter the state of "WAIT FOR RR CONNECTION (LOCATION UPDATE)". MS initiates the location updating procedure by sending a LOCATION UPDATING REQUEST message to the network, starts the timer T3210 and enters the state of "LOCATION UPDATING INITIATED". The location updating type information element shall indicate what kind of updating is requested.

I. Network requests for additional MS capability information

The network may initiate the classmark interrogation procedure, for example, to obtain further information on MS's encryption capabilities.

II. Identification request

The network may initiate the identification procedure, e.g. if the network is unable to get the IMSI based on the TMSI and LAI used as identification by MS

III. Authentication procedure

The authentication procedure may be initiated by the network upon receipt of the LOCATION UPDATING REQUEST message from MS.

IV. Ciphering mode setting procedure

The ciphering mode setting procedure may be initiated by the network, if a new TMSI has to be allocated.

V. Attempt counter
When location updating is unsuccessful, to limit the number of location updating attempts, an attempt counter is used. It counts the number of consecutive unsuccessful location update attempts. The attempt counter is incremented by 1 each time a location update procedure fails. In the following cases, the attempt counter shall be reset. MS is powered on A SIM card is inserted Location update is successfully completed Location update is completed with cause 11/12/13 Service state changes from "ATTEMPTING" into "UPDATE" A new location area is entered Timer T3212 expires Location update is triggered by a CM sublayer request The attempt counter is used when MS decides whether to re-attempt a location update after timeout of timer T3211.

VI. Location updating accepted

If the location updating is accepted by the network, a LOCATION UPDATING ACCEPT message shall be transferred to MS. In case the identity confidentiality service is active, the TMSI reallocation may be part of the location updating procedure. The TMSI allocated is then contained in the LOCATION UPDATING ACCEPT message together with LAI. The network shall in this case start the supervision timer T3250. Upon receipt of a LOCATION UPDATING ACCEPT message, MS stores the received LAI, stops timer T3210, resets the attempt counter and sets the update status in SIM to "UPDATED". If the message contains an IMSI, MS is not allocated any TMSI, and shall delete any TMSI from SIM accordingly. If the message contains a TMSI, the MS is allocated this TMSI, and shall store this TMSI in SIM and send a TMSI REALLOCATION COMPLETE to the network. If neither IMSI nor TMSI is received in the LOCATION UPDATING ACCEPT message, the old TMSI if any available shall be kept. If the LAI or PLMN identity contained in the LOCATION UPDATING ACCEPT message is a member of any of the "forbidden lists", the relevant entries shall be deleted.

VII. Location updating rejected

If the location updating cannot be accepted, the network sends a LOCATION UPDATING REJECT message to the MS. After receipt of the LOCATION UPDATING REJECT message, MS shall stop timer T3210, store the reject cause, start T3240, enter the state of "LOCATION UPDATING REJECTED" and await the release of the RR connection triggered by the

network. Upon the release of the RR connection, MS shall take the following actions depending on the stored reject cause. Cause 2: IMSI unknown in HLR Cause 3: illegal MS Cause 6: illegal ME For cause 2/3/6, the MS shall set the update status to "ROAMING NOT ALLOWED", and delete any TMSI, stored LAI and ciphering key sequence number and shall consider IMSI invalid until switch-off. Cause 11: PLMN not allowed Cause 12: location area not allowed Cause 13: roaming not allowed in this location area For cause 11/12/13, MS shall delete any LAI, TMSI and ciphering key sequence number stored in from SIM, reset the attempt counter, and set the update status to "ROAMING NOT ALLOWED". MS shall store the LAI or the PLMN identity in the relevant forbidden list, i.e. in the "forbidden PLMN list" for cause 11, in the list of "forbidden location areas for regional provision of service" for cause 12, and in the list of "forbidden location areas for roaming" for cause 13. In addition, MS will memorize if cause 13 is received, so to perform PLMN selection instead of cell selection when it is back to the "MM IDLE" state. Other cause values are considered as abnormal cases.

VIII. Release of RR connection after location updating

When the location updating procedure is completed, MS shall (except in the case that MS has a follow-on CM application request pending and has received the follow-on proceed indication) set timer T3240 and enter the state of "WAIT FOR NETWORK COMMAND", expecting the release of RR connection. The network may decide to keep the RR connection for network-initiated establishment of a new MM connection, or to allow for MS-initiated MM connection establishment. Any release of RR connection shall be initiated by the network. If the RR connection is not released within a given time controlled by timer T3240, MS shall abort the RR connection. In both cases, either after a RR connection release triggered from the network side or after a RR connection abort requested by MS side, MS shall return to the state of "MM IDLE". At transition to the state "MM IDLE", sub-state "NORMAL SERVICE" or "ATTEMPTING TO UPDATE", either timer T3212 or timer T3211 is started.

IX. Abnormal cases on MS side

There are the following abnormal cases on MS side. 1) Access barred because of access class control MS stays in the current serving cell and initiates the normal cell reselection procedure. The procedure is started as soon as the access is allowed. 2) The answer to random access is an IMMEDIATE ASSIGNMENT REJECT message MS stays in the chosen cell and applies the normal cell selection procedure. Timer T3122 is reset when a cell change occurs. The procedure is started as soon as timer T3122 expires. 3) Random access failure If random access failure occur, Timer T3213 is started. When it expires, the random access procedure is attempted again. The location updating procedure is aborted if random access fails twice successively. 4) RR connection failure The procedure is aborted. 5) T3210 timeout The procedure is aborted, and the RR connection is terminated. 6) RR released before the normal end of procedure The procedure is aborted. 7) Location updating rejected, due to cause except 2/3/6/11/12/13 MS waits for release of the RR connection. In cases 4~7 and for repeated failures as

defined in case 3, MS proceeds as follows. Timer T3210 is stopped if still running. The RR connection is released if timer T3210 expires. The attempt counter is incremented by 1. The next actions depend on LAI and the value of the attempt counter. Case 1: The update status is "UPDATED", and the stored LAI is equal to the one received on the BCCH from the current serving cell. The attempt counter is smaller than 4. In case 1, MS shall keep the update status to "UPDATED". The MM IDLE sub-state after RR connection release is "NORMAL SERVICE". MS shall memorize the location updating type used in the location updating procedure. It shall start timer T3211 when the RR connection is released. When timer T3211 expires, the location updating procedure is triggered again with the memorized location updating type. Case 2: Either the update status is different from "UPDATED", or the stored LAI is different from the one received on the BCCH from the current serving cell, or the attempt counter is greater or equal to 4. In case 2, MS shall delete any LAI, TMSI and ciphering key sequence number stored in SIM, set the update status to "NOT UPDATED" and enter the MM IDLE sub-state "ATTEMPTING TO UPDATE" when the RR connection is released. If the attempt counter is smaller than 4, MS shall start timer T3211. Otherwise, it starts timer T3212.

X. Abnormal cases on network side

1) RR connection failure If a RR connection failure occurs during a common procedure which is integrated with the location updating procedure, the behavior of the network should be according to the description of that common procedure. If there is no other common procedure integrated, the location updating procedure towards MS shall be aborted. 2) Protocol error If the LOCATION UPDATING REQUEST message is received with a protocol error, the network shall, if possible, return a LOCATION UPDATING REJECT message with one of the following causes. Cause 96: Mandatory IE error Cause 99: IE non-existent or not implemented Cause 100: Conditional IE error Cause 111: Protocol error, unspecified After sending the response message, the network will start the channel release procedure.

4.3 Internal Handling of BSC

The location updating procedure is a general procedure for three purposes: normal location updating, periodic updating and IMSI attach. The BSC retrieves the periodic location updating period from the T3212 field in the [System information table] and sends it to the MS through the SYSTEM INFORMATION TYPE 3 message. The BSC sends a LOCATION UPDATING REQUEST message to the MSC to set up an SCCP connection over interface A. This message includes the CGI of the serving cell. See [BSC Cell Table] for the CGI.

Table of Contents

Chapter 5 Authentication Procedure...........................................................................................5-1 5.1 Overview............................................................................................................................5-1 5.2 Authentication Procedure..................................................................................................5-1 5.2.1 Successful Authentication.......................................................................................5-2 5.2.2 Unsuccessful Authentication...................................................................................5-2 5.3 Internal Handling of BSC...................................................................................................5-3 5.4 Abnormal Cases................................................................................................................5-4 5.4.1 RR Connection Failure............................................................................................5-4 5.4.2 Expiry of Timer T3260.............................................................................................5-4 5.4.3 SIM Unregistered....................................................................................................5-4

Chapter 5 Authentication Procedure

5.1 Overview
Authentication refers to the procedure of authenticating the validity of the IMSI and TMSI of MS initiated by the GSM network. The purpose of the authentication procedure is to prevent illegal MS from accessing the network, and in the meantime, to protect the private information of legal MS from leakage. On the following conditions, the network may initiate the authentication procedure. MS requests modification of its relevant information in VLR or HLR. Service access is initiated (MS originates a call. MS is called. MS is activated/deactivated. Supplementary service is initiated) MS accesses the network for the first time after MSC/VLR is restarted The ciphering key sequence number Kc is not matched. The purpose of the authentication procedure is twofold. To permit the network to check whether the identity provided by MS is acceptable or not To provide parameters enabling MS to calculate a new ciphering key The authentication procedure is always initiated and controlled by the network.

5.2 Authentication Procedure

The network initiates the authentication procedure by transferring an AUTHENTICATION REQUEST message to MS and starts timer T3260. The AUTHENTICATION REQUEST message contains the parameters used to calculate the response parameters, and also contains the CKSN (Ciphering Key Sequence Number) allocated to the key which may be computed from the given parameters. Upon receipt of the AUTHENTICATION REQUEST message, MS processes the challenge information and sends back an AUTHENTICATION RESPONSE message to the network. The new ciphering key Kc calculated from the challenge information shall overwrite the previous one and be stored in SIM before the AUTHENTICATION RESPONSE message is transmitted. The CKSN shall be stored together with the calculated Kc. Upon receipt of the AUTHENTICATION RESPONSE message, the network stops timer T3260 and checks the validity of the response.

5.2.1 Successful Authentication

Figure 5-1 shows the procedure of successful authentication.

Figure 5-1 Procedure of successful authenticatio 1) The AUTHENTICATION REQUEST message contains a RAND (Random Number) and a CKSN. There are total 128 bits in the RAND. 2) The AUTHENTICATION RESPONSE message contains a response number (SRES), which is obtained based on calculation of RAND and Ki through the A3 algorithm. The network compares the SRES stored in itself with the one contained in the AUTHENTICATION RESPONSE message. If the two are consistent, authentication shall be passed, and the subsequent sub-procedures (such as the encryption procedure) shall be entered.

5.2.2 Unsuccessful Authentication

If authentication fails, i.e. if the response is not valid, the network may distinguish between the two different modes of identification adopted by MS: 1) If TMSI identification mode has been adopted, the network shall initiate the identification procedure. If the IMSI given by MS differs from the one the network has associated with the TMSI, the network shall restart the authentication procedure. If the IMSI provided by MS is correct, the network shall return an AUTHENTICATION REJECT message. 2) If IMSI identification mode has been adopted, the network shall directly return an AUTHENTICATION REJECT message. Figure 5-2 shows the AUTHENTICATION REJECTion procedure.

Figure 5-2 AUTHENTICATION REJECTion procedure After the network sends the AUTHENTICATION REJECT message, all MM connections in progress are released, and the network restarts the RR connection release procedure. Upon receipt of the AUTHENTICATION REJECT message, MS sets the update status in SIM to "U2 ROAMING NOT ALLOWED", deletes from SIM the stored TMSI, LAI and CKSN. If the AUTHENTICATION REJECT message is received in the state "IMSI DETACH INITIATED", timer T3220 shall be stopped when the RR connection is released. If possible, MS should initiate the local release procedure after the normal release procedure is completed, or after T3220 expires. If this is not possible (e.g. detach at power-off), the MSRR sublayer shall be aborted. If the AUTHENTICATION REJECT message is received in any other state, MS shall abort any MM connection establishment or call re-establishment procedure, stop any of the timers T3210 or T3230 (if running), release all MM connections, reset and start timer T3240, and enter the state "WAIT FOR NETWORK COMMAND", expecting the release of the RR connection. If the

RR connection is not released within a given time controlled by the timer T3240, MS shall abort the RR connection. In both cases, either after a RR connection release triggered from the network side or after a RR connection abort requested by the MS side, MS shall enter the substate "NO IMSI" of "MM IDLE".

5.3 Internal Handling of BSC

The network initiates and controls the authentication procedure. No special processing is required from the BSC.

5.4 Abnormal Cases

5.4.1 RR Connection Failure
Upon detection of a RR connection failure before the AUTHENTICATION RESPONSE message is received, the network shall release all MM connections (if any) and abort any ongoing MM-specific procedure.

5.4.2 Expiry of Timer T3260

Before receipt of the AUTHENTICATION RESPONSE message, if timer T3260 expires, the network shall release the RR connection, abort the authentication procedure and any ongoing MM-specific procedure, release all MM connections, and initiate the RR connection release procedure.

5.4.3 SIM Unregistered

If the SIM of an MS has not been registered on the network side, the network will directly return an AUTHENTICATION REJECT message to the MS.

Table of Contents

Chapter 6 Release Procedure......................................................................................................6-1 6.1 Overview............................................................................................................................6-1 6.2 Normal Release Procedure...............................................................................................6-1 6.3 BSC Local Release Procedure..........................................................................................6-3 6.4 Internal Handling of BSC...................................................................................................6-3

Chapter 6 Release Procedure

6.1 Overview
Common release procedure is classified into normal release procedure and local release procedure. Normal release means that the release procedure is initiated by MS or MSC. Local release means that the release procedure is initiated by BSC.

6.2 Normal Release Procedure

I. Signalling procedure
After being normally accessed to the network, MS can initiate the release procedure, for the purpose of service requirements, such as hangup. Figure 6-1 shows the release procedure.

Figure 6-1 Release procedure initiated by MS 1) After a call is completed, the caller hangs up, and the calling MS sends a DISCONNECT message to MSC. 2) MSC returns a RELEASE message to MS. In the meantime, it sends a DISCONNECT message to another calling MS. 3) MS releases MM connections, and sends a RELEASE COMPLETE message to MSC. 4) Upon receipt of the RELEASE COMPLETE message, MSC releases MM connections, and sends a CLEAR COMMAND to BSC, notifying it to release the occupied A interface

resources and the logical channels on Um interface. 5) BSC delivers the channel RELEASE message to MS, requesting that MS and BTS release the logical channels on Um interface. 6) MS sends a DISC frame to BTS, indicating that the logical channels have been released. 7) BTS sends a UA frame to MS for acknowledgement. Upon receipt of the UA frame, MS returns to the idle mode. 8) BSC sends a DEACTIVATE SACCH message to BTS, requesting that SACCH be deactivated. 9) After BTS receives the DISC frame from MS, BTS returns a RELEASE INDICATION message to BSC to indicate that MS has released the logic channel on radio interface. 10) BSC sends a RF CHANNEL RELEASE message to BTS, requesting that the physical channels on Um interface be released. 11) BTS returns a CHANNEL RELEASE ACKNOWLEDGE message to BSC, indicating that the physical channels on Um interface have been released. 12) BSC sends a CLEAR COMPLETE message to MSC. 13) MSC sends a RLSD message to BSC, requesting the release of SCCP link connection. 14) BSC returns a RLSD COMPLETE message to MSC, indicating that the SCCP link connection has been released.

II. Procedure explanation

1) In Figure 6-1, 1~3 are to release call connections.

Note: The procedure described in Figure 5-1 is a release procedure initiated by MS. For the release procedure initiated by the network, except these 3 messages, which are transparently transmitted in reverse directions, all the messages are the same as those in Figure 6-1. 2) 4~14 are to release radio resources. After the connections of CC layer and MM layer are released, the network will send a CLEAR COMMAND message to BSC, requesting the release of SCCP signalling links. This message contains the call clearance cause values, such as "Handover completed" or "Location update completed". If the release is caused by Um interface message failure, radio link failure or equipment fault, BSC shall send the CLEAR REQUEST message to MSC, and then MSC shall deliver the CLEAR COMMAND message.

6.3 BSC Local Release Procedure

In the normal calling procedure, after assignment is completed, BSC shall initiate the local release procedure for signalling channels. Likewise, after handover is completed, BSC shall also initiate the local release procedure for the old channels. Figure 6-2 shows the release procedure.

Figure 6-2 BSC local release procedure

1) BSC sends a DEACTIVATE SACCH message to BTS, requesting that SACCH to be deactivated. 2) BSC delivers a RELEASE REQUEST message to BTS, with the cause value "Local end released". Here, the release procedure is irrelated to MS. 3) Upon receipt of the RELEASE REQUEST message, BTS returns a RELEASE ACKNOWLEDGE message to BSC. If the RELEASE REQUEST message delivered by BSC contains other cause values, BTS should deliver a DISC frame to MS, and shall not report the RELEASE ACKNOWLEDGE message to BSC until it receives the UA (or DM) frame sent by MS.

6.4 Internal Handling of BSC

Refer to 6.2 Normal Release Procedure.

Table of Contents

Chapter 7 Mobile Originating Call Establishment Procedure...................................................7-1 7.1 Overview............................................................................................................................7-1 7.2 Normal Procedure..............................................................................................................7-1 7.2.1 Mobile Originating Call Establishment without OACSU (Early Assignment)..........7-1 7.2.2 Mobile Originating Call Establishment with OACSU (Late Assignment).................7-6 7.2.3 Mobile Originating Call Establishment with OACSU (Very Early Assignment).......7-8 7.3 Internal Handling of BSC...................................................................................................7-9 7.4 Abnormal Cases................................................................................................................7-9 7.4.1 Abnormal Random Access/Immediate Assignment Procedure............................7-10 7.4.2 MSC Directly Delivers DISCONNECT to Clear the Call, Instead of Delivering the Assignment Request......................................................................................................7-11 7.4.3 Abnormal Assignment Procedure.........................................................................7-11 7.4.4 Abnormal Procedure Cause by Call Interruption..................................................7-12 7.4.5 Abnormal Procedure Caused by Hangup.............................................................7-12 7.4.6 Abnormal Procedure Caused by MSC Clearing...................................................7-13

Chapter 7 Mobile Originating Call Establishment Procedure

7.1 Overview
Mobile originating call services include (not including mobile-originated SMS) MS calls MS MS calls fixed telephone

7.2 Normal Procedure

As per assignment type, the mobile originating call establishment procedure can be classified into 3 types, early assignment, late assignment and very early assignment. The selection of early assignment and late assignment is determined by MSC. The selection of very early assignment is determined by BSS as per the status of radio resources.

7.2.1 Mobile Originating Call Establishment without OACSU (Early Assignment)

Note: OACSU denotes "Off-Air-Call-Set-Up".

I. Signaling procedure

Figure 7-1 Mobile originating call establishment without OACSU (early assignmen 1) MS sends a CHANNEL REQUEST message to BTS on the access channel (RACH) of Um interface. The message contains the cause value "MOC", but that value is not completely accurate, because it is indicated both in the mobile originating call establishment procedure and IMSI detach procedure. 2) BTS sends a CHANNEL REQUIRED message to BSC. 3) Upon receipt of the CHANNEL REQUIRED message, BSC allocates a signaling channel and sends a CHANNEL ACTIVATION message to BTS. 4) If the channel type is correct, upon receipt of the CHANNEL ACTIVATION message, BTS opens the power amplifier on the specified channel, and sends a CHANNEL ACTIVATION ACKNOWLEDGE message to BSC. 5) BSC sends an IMMEDIATE ASSIGNMENT COMMAND message to MS via BTS. The message is sent on AGCH on Um interface. 6) MS sends an SABM frame on SDCCH to BTS to access the network. 7) BTS returns a UA frame on SDCCH for acknowledgement.

8) BTS sends an ESTABLISHMENT INDICATION message to BSC (This message contains the accurate causes for MS's access. For example, different cause values are indicated in the mobile originating call establishment procedure and IMSI detach procedure). This message contains the contents of the CM SERVICE REQUEST message. 9) BSC establishes the SCCP link connection on A interface, and sends a CM SERVICE REQUEST message to MSC. 10) MSC returns a message to BSC to acknowledge the link connection. 11) MSC sends a CM SERVICE ACCEPTED message to MS. The message is sent on SDCCH on Um interface. 12) The calling MS sends a SETUP message on SDCCH. 13) MSC sends a CALL PROCEEDING message to the calling MS. The message is sent on SDCCH on Um interface. 14) MSC sends an ASSIGNMENT REQUEST message to BSC, which contains the CIC allocated to A interface. 15) BSC allocates a TCH, and sends a CHANNEL ACTIVATION message to BTS. 16) If the channel type is correct, upon receipt of the CHANNEL ACTIVATION message, BTS opens the power amplifier on the specified channel, starts to receive the uplink information and sends a CHANNEL ACTIVATION ACKNOWLEDGE message to BSC. 17) BSC sends an ASSIGNMENT COMMAND message to MS via BTS on SDCCH. 18) MS sends an SABM frame to BTS, to access the network on FACCH indicated in the ASSIGNMENT COMMAND message. 19) BTS sends a UA frame for acknowledgement on FACCH. 20) BTS sends an ESTABLISHMENT INDICATION message to BSC. 21) After accessing the TCH, MS sends an ASSIGNMENT COMPLETE message to BSC on FACCH. 22) After the radio traffic channel and terrestrial circuit are both successfully connected, BSC sends an ASSIGNMENT COMPLETE message to MSC, and regards this call in session state. 23) MSC sends an ALTERING message to the calling MS. The calling MS will hear the ringback. The message is sent on FACCH on Um interface. 24) MSC sends a CONNECT message to MS. The message is sent on FACCH on Um interface. 25) The calling MS returns a CONNECT ACKNOWLEDGE message on FACCH to MSC. 26) The calling MS and called MS enters the session state. 27) After the conversation is over, the calling MS hangs up and sends a DISCONNECT message on FACCH. 28) MSC sends a RELEASE message to MS. The message is sent on FACCH on Um interface. 29) MS returns a RELEASE COMPLETE message. The message is sent on FACCH on Um interface. 30) MSC sends a CLEAR COMMAND message to BSC. Upon receipt of the message, BSC initiates the release procedure. See Chapter 5 for the description of the subsequent release procedure. 31) BSC sends a CHANNEL RELEASE message to MS through BTS, The message is sent on FACCH on Um interface. 32) MS sends DISC frame on FACCH. 33) BTS returns UA frame on FACCH.

II. Procedure explanation

1) In Figure 7-1, 1~8 refer to the random access procedure and immediate assignment procedure. In the two procedures, BSS allocates signaling channels to MS. 2) Between 10~11, there may exist an authentication procedure, ciphering mode setting procedure and classmark interrogation procedure (updating procedure). 3) As per different data configuration of MSC, after the link connection is established on A interface, MSC may not immediately deliver the CM SERVICE ACCEPTED message. Instead, it may proceed as follows. 4) Initiate the ciphering mode setting procedure by delivering a Cipher Mode Command (In that case, MSC shall not deliver the CM Service Accepted message again). 5) Initiate the authentication procedure by delivering an AUTHENTICATION REQUEST message. 6) Initiate the classmark updating procedure by delivering a CLASSMARK UPDATE message. 7) In addition, if [ECSC] in BSC data configuration is set to "Yes", the dual-band MS shall

report a CLASSMARK CHANGE message after it reports an ESTABLISHMENT INDICATION message. 8) 14~22 refer to the TCH assignment procedure. In this procedure, BSS allocates the resources such as TCHs, A interface circuit, etc. to MS. 9) 30~40 refer to the release procedure. The procedure shown in Figure 7-1 is a release procedure in which the calling MS first hangs up. The logical channels on Um interface are released prior to the physical channels.

7.2.2 Mobile Originating Call Establishment with OACSU (Late Assignment)

I. Signaling procedure

Figure 7-2 Mobile originating call establishment with OACSU (late assignmen 1) The difference between Figure 7-1 and Figure 7-2 is that late assignment takes place

after the Alerting indication is sent. 2) The advantage of late assignment lies in that it can save the seizure time of TCHs. 3) The disadvantage of late assignment is that if the subsequent assignment is unsuccessful, the called MS can only hear the ring but cannot establish a connection, thus leading to user complaints. Therefore, in actual application, this procedure is generally not adopted. Instead, the procedure in Figure 7-1 is adopted.

II. Procedure explanation

For relevant explanation, please refer to 7.2.1 Mobile Originating Call Establishment without OACSU (Early Assignment). The procedure in Figure 7-2 is a procedure in which the calling MS first hangs up.

7.2.3 Mobile Originating Call Establishment with OACSU (Very Early Assignment)
I. Signaling procedure

Figure 7-3 Mobile originating call establishment with OACSU (very early assignment

1) The difference between Figure 7-1 and Figure 7-3 is that the TCH allocated during the immediate assignment in Figure 7-3 serves as a signaling channel. Therefore, no TCH need be reallocated during the assignment procedure. Instead, the TCH allocated in the immediate assignment procedure is adjusted as a TCH by using the MODE MODIFY message. 2) Very early assignment generally takes place if there is no free SDCCH for allocation during immediate assignment, but there are free TCHs and immediate assignment of TCHs is allowed in BSC data configuration.

II. Procedure explanation

For relevant explanation, refer to 7.2.1 Mobile Originating Call Establishment without OACSU (Early Assignment). The procedure in Figure 7-3 is a procedure in which the calling MS first hangs up.

7.3 Internal Handling of BSC

The internal handling of the BSC is given below: 1) Upon receipt of the CHANNEL REQUIRED message from the BTS, the BSC allocates a signaling channel based on the channel type and channel allocation algorithm required by the [Radio channel management control table], [HW II Channel Allocation table] and the TCH immediate assignment field in the [Cell call control table]. 2) Upon receipt of the ESTABLISHMENT INDICATION message in the random access procedure, the BSC adds the CGI of the current cell to the CM SERVICE REQUEST message based on the [BSC Cell Table] and sends the message to the MSC. 3) Upon receipt of the ASSIGNMENT REQUEST message from the MSC, the BSC checks the channel type. Then it checks whether the data service is supported based on the Data Service allowed field in the [Cell Configuration Table]. It returns an ASSIGNMENT FAILURE message if the data service is not supported. 4) The BSC checks the [Trunk Circuit Table] based on the CIC in the ASSIGNMENT REQUEST message for whether the CIC exists. Then it checks whether the circuit pool, the channel type in the ASSIGNMENT REQUEST message and the supporting capability of the FTC board conflict. It returns an ASSIGNMENT FAILURE message to the MSC upon conflict. 5) Upon receipt of the ASSIGNMENT COMPLETE message from the MS, the BSC fills in the ASSIGNMENT COMPLETE message over interface A interface based on the Ainterface Phase flag field in the [Local Office Information Table]. Then it sends the message to the MSC.

7.4 Abnormal Cases

In the cases of loss of messages on Um interface, call interruption, hangup, abnormal operation of transport/NSS/BSS equipment, the procedure may not be performed normally. In addition, if MS resends multiple CHANNEL REQUEST messages during an access attempt, BSS shall activate multiple signaling channels correspondingly. Actually, MS shall only seize 1 signaling channel. Because no ESTABLISH INDICATION message can be received from MS by other channels, other channels shall be released upon timeout. Because there are various causes for abnormal procedures, here, merely the common cases are described.

7.4.1 Abnormal Random Access/Immediate Assignment Procedure

I. ESTABLISH INDICATION message cannot be received after a channel has been activated
Generally, there are the following causes for this problem. 1) Due to defect design that does not comply with the protocols, MS resends multiple CHANNEL REQUEST messages. As a result, BSS allocates and activates too many signaling channels.

Even if BSS runs normally, during an access attempt, MS may resend multiple CHANNEL REQUEST messages. As a result, BSS activates multiple signaling channels. Actually, MS shall only seize 1 signaling channel. Because no ESTABLISH INDICATION message can be received from MS by other channels, other channels shall be released when the T3101 timer expires. 2) On Um interface, uplink signals can be received normally, whereas, downlink signals cannot be properly received by MS. By tracing the Um interface on MS side, it may be found that MS cannot receive the relevant information from BTS after it sends a CHANNEL REQUEST message. In that case, the user should check whether the uplink/downlink Rx level and Rx quality are normal. If MS is not far from BTS, but the signals are of low Rx level and poor Rx quality, the user should check whether the antenna & feeder of BTS, the antenna of MS, battery, etc. work normally. 3) Tx-integer and CCCH are improperly configured in BSC data configuration. The configuration mode of Tx-integer and CCCH has impact upon the retransmission interval of MS's CHANNEL REQUEST message.

II. BSC sends an IMMEDIATE ASSIGNMENT REJECT message

If BSC sends an IMMEDIATE ASSIGNMENT REJECT message to MS upon receipt of a CHANNEL REQUEST message, generally, the causes may be as follows. 1) BSC cannot find an appropriate signaling channel (Generally, the signaling channel is SDCCH, but it can also be TCH) to allocate to the MS, generally, because no signaling channel is available, e.g. all signaling channels are in busy state or the channels have been blocked. 2) BTS returns CHANNEL ACTIVATION NEGATIVE ACKNOWLEDGE messages to BSC after it delivers a CHANNEL ACTIVATION message to MS. If BTS returns many CHANNEL ACTIVATION NEGATIVE ACKNOWLEDGE messages to BSC, the problem generally lies in that the unstable transmission on Abis interface has lead to the inconsistency between the channel states of BSC and BTS, or abnormality has occurred to a board in BTS.

7.4.2 MSC Directly Delivers DISCONNECT to Clear the Call, Instead of Delivering the Assignment Request
In the MS call procedure, after the immediate assignment procedure is finished, the following procedure is assignment. Sometimes MSC doesn't send ASSIGNMENT REQUEST message, but send DISCONNECT message to MS, and then disconnect the call. After this problem occurs, usually, a large quantity of MSs shall complain that calls cannot be put through. In that case, the following points should mainly be checked. 1) The state of A interface circuit on MSC side. 2) The consistency between A interface data of MSC and A interface data of BSC, especially circuit pool data.

7.4.3 Abnormal Assignment Procedure

I. ASSIGNMENT FAILURE
Upon receipt of an ASSIGNMENT REQUEST message, BSC returns an ASSIGNMENT FAILURE message, instead of an ASSIGNMENT COMPLETE message. The common causes are as follows. 1) There is no appropriate TCH for allocation in BSC. There is no appropriate TCH for allocation in BSC, possibly because all TCHs are in busy state or have been blocked. The ASSIGNMENT FAILURE message returned by BSC contains the cause value "No radio resource". In that case, the user can solve the problem by BTS expansion (adding TRX), modifying the

access threshold and open the direct re-attempt permit switch. 2) MS fails to access the TCH, and sends an ASSIGNMENT FAILURE message on the signaling channel. Due to the particularity of the transmission on Um interface, this problem is actually the most common problem in the network, and cannot be solved completely. If this problem occurs frequently, it may lead to user complaints. The major points to be checked are the antenna & feeder, the relevant boards in BTS, and access-related parameters in BSC data configuration. 3) On BSC side, A interface circuit is found abnormal, e.g. The CIC contained in the ASSIGNMENT REQUEST message is not available. In that case, the user should check the A interfaces. 4) Abnormality occurs to the relevant equipment in BSC. The ASSIGNMENT FAILURE message returned by BSC generally contains the cause value "Equipment failure". In that case, the major points to be checked are as follows. The boards and their respective backplanes and optical fiber that are related to the intermodule communication in BSC, such as GMC2, GMCC, GSNT, GOPT and GFBI. The boards related to A interface, such as E3Ms, TCSMs and their backplanes 5) Abnormality occurs to the transmission on interface A.

II. Directed Retry

Because there is no appropriate TCH for allocation, and the directed re-attempt permit switch is set to "On" in BSC data configuration, upon receipt of an ASSIGNMENT REQUEST message from MSC, BSC shall initiate a directed retry handover procedure as per the actual situation, so that MS can directly attempt to access other cells.

7.4.4 Abnormal Procedure Cause by Call Interruption

Call interruption might occur in any procedure to the calling/called MS, and as a result, the subsequent procedures cannot be completed normally. For example, after BSC receives an ASSIGNMENT REQUEST message from MSC, call interruption occurs to MS on signaling channel. In that case, the assignment procedure probably is not be finished (For example, the channel is just assigned and the Assignment Command is not sent) BSC probably shall not return an ASSIGNMENT COMPLETE or ASSIGNMENT FAILURE message to MSC. Instead, it shall send a CLEAR REQUEST message.

7.4.5 Abnormal Procedure Caused by Hangup

The calling/called MS may hang up in any procedure, and as a result, the subsequent procedures cannot be completed normally. For example, after BSC receives an ASSIGNMENT REQUEST message from MSC, MS suddenly hangs up. In that case, the call establishment may be already terminated before BSC returns an ASSIGNMENT COMPLETE or ASSIGNMENT FAILURE message to MSC. As a result, the procedure is neither a successful assignment procedure (BSC sends an ASSIGNMENT COMPLETE message), nor an unsuccessful assignment procedure (BSC sends an ASSIGNMENT FAILURE message).

7.4.6 Abnormal Procedure Caused by MSC Clearing

After the link connection on A interface is established, due to some causes, MSC may send a CLEAR COMMAND or DISCONNECT message to BSC, and as a result, the subsequent procedures cannot be completed normally. For example, after BSC receives an ASSIGNMENT REQUEST message from MSC, MS suddenly hangs up. In that case, the call establishment may be already terminated before BSC returns an ASSIGNMENT COMPLETE or ASSIGNMENT FAILURE message to MSC. As a result, the procedure is neither a successful assignment procedure (BSC sends an ASSIGNMENT COMPLETE message), nor an assignment failure procedure (BSC sends an ASSIGNMENT FAILURE message). If this problem frequently occurs, the following points should be analyzed specially. 1) The cause value contained in the CLEAR COMMAND message

If a call terminates normally, the CLEAR COMMAND message generally contains the cause value "Call control". Otherwise, it may contain the cause value of "Protocol Error", or "Equipment failure", etc. 2) The time difference between the previous message and the CLEAR COMMAND or DISCONNECT message in the procedure The user can analyze the time difference between the two successive messages, to see whether there is possibility that the abnormal procedure has been triggered by timeout.

Table of Contents

Chapter 8 Mobile Terminating Call Establishment Procedure.................................................8-1 8.1 Overview............................................................................................................................8-1 8.2 Normal Procedure..............................................................................................................8-2 8.3 Internal Handling of BSC...................................................................................................8-3 8.4 Abnormal Cases................................................................................................................8-3 8.4.1 No PAGING COMMAND on Interface A.................................................................8-4 8.4.2 No PAGING COMMAND on Interface Abis............................................................8-4 8.4.3 No PAGING RESPONSE on Interface Abis...........................................................8-5 8.4.4 No PAGING RESPONSE on Interface A................................................................8-7

Chapter 8 Mobile Terminating Call Establishment Procedure

8.1 Overview
Mobile terminating calls include the calls initiated by MS and those initiated by fixed telephones.

8.2 Normal Procedure

I. Signaling procedure

Figure 8-1 Normal procedure of mobile terminating call establishmen 1) When the paged MS is located in the serving area of MSC, MSC sends a PAGING message to BSC, which contains a paged cell list, TMSI and IMSI. 2) BSC sends a PAGING COMMAND message to the paged cells, which contains the relevant paging subchannel Nos. and the occupied timeslot Nos. 3) Upon receipt of the PAGING COMMAND message from BSC, BTS sends a PAGING REQUEST message on the paging subchannel (PCH subchannel) that belongs to the paging group. This message contains the IMSI or TMSI of the paged MS. 4) MS sends a CHANNEL REQUEST message on RACH if it finds itself paged after decoding the paging message. 5) For other messages, please refer to Chapter 7 Mobile Originating Call Establishment Procedure.

II. Procedure explanation

1) Paging signaling procedure In Figure 8-1, 1~11 refer to the paging signaling procedure, in which, BSS initiates paging and allocates signaling channels to MS. 2) Classification of assignment procedure As per assignment type, the assignment procedure can be classified into 3 types, early assignment, late assignment and very early assignment. Except the late assignment procedure,

in which, the ASSIGNMENT REQUEST message is delivered after MSC has received a CONNECT message from MS, the other procedures are basically the same as the mobile originating call establishment procedure. For details, please refer to Chapter 7 Mobile Originating Call Establishment Procedure.

8.3 Internal Handling of BSC

The internal handling of the BSC is given below: 1) Upon receipt of the PAGING message over interface A, the BSC checks whether to enable flow control based on the [Flow Control Parameter Table]. 2) The BSC transfers the PAGING message to the relevant BM module after checking the [Cell module information table]. 3) The BM module computes a paging group and sends it out. 4) The BM module computes the paging group based on the TMSI or IMSI in the PAGING message and on the following parameters in the [System information table]: BS_AG_BLKS_RES, CCCH-CONF and BS_PA_MFRMS.

8.4 Abnormal Cases

This section only analyzes the common abnormal procedures. For the other abnormal procedures, refer to Chapter 7 Mobile Originating Call Establishment Procedure. Upon paging failure, the MSC prompts voice information to the calling party, indicating that the called MS is outside the serving area or cannot be connected. In this case, trace the signaling on interfaces A and Abis to check whether the paging failure is caused by: no PAGING COMMAND on interface A no PAGING COMMAND on interface Abis no PAGING RESPONSE on interface Abis no PAGING RESPONSE on interface A

8.4.1 No PAGING COMMAND on Interface A

Through signaling tracing over interface A, the MSC is detected that it has not sent a PAGING message to the BSC. In this case, check the data configuration and MS information in the MSC/VLR and HLR on the NSS side. Additionally, power off the called MS, power it on and make a test call to check whether the MS is normal.

I. Check user data in VLR

When an MS is paged, MSC judges the current state of the MS as per the user data (including MS active state, registered LA, cell information, etc.), and thus decides whether to send the PAGING message or how to send the PAGING message. If the MS state has changed (e.g. the MS is switched off, or has entered a different LA), but due to various reasons, the MS has not performed registration in the network normally, and has not updated the user data in VLR, the MS may probably be unable to be paged. In that case, the MS is required to initiate a location updating procedure, so that the user data in VLR can be ensured correct. The period of periodic location update is indicated for MS by BSC in the system information. On MSC side, there is also a location update period. Refer to Chapter 4 Location Update Procedure. The two parameters of BSC and MSC must satisfy a certain relationship, which requires that MS must initiate a location update procedure within the period specified in MSC. Generally, the location update period configured in BSC is shorter than that in MSC.

II. Check RA- or cell-related parameter settings in MSC

If a routing area or cell related parameter is incorrectly set in the MSC, the transmission of the PAGING message might fail. For example, if a wrong target BSC is selected, the PAGING message that should have been sent to the local BSC will be sent to another BSC.

8.4.2 No PAGING COMMAND on Interface Abis

Upon receipt of the PAGING message from the MSC, the BSC detects that the MSC has not sent PAGING COMMAND to the BTS over interface Abis. In this case, check the operations and data configuration in the BSC.

I. Check whether flow control is enabled

Check whether the system load suddenly increases due to centralized transmission of short messages or mass access bursts Query the traffic statistics about Number of immediate assignment requests and Number of CS service paging requests in the BSC overall performance measurement. Compare the query results before and after the failure in paging the called MS and check whether the flow control function is enabled. Check whether the flow control parameter is correctly set

II. Check relevant data configuration

Check whether the CGI information in BSC data configuration is consistent with the LAC information in the PAGING message over interface A Log in to the BSC Data Management System. Click [BSC/Cell/Cell Module Information Table] to check whether the parameters in the table are correctly set. Additionally, if a RA- or cell-related parameter is not correctly set in the MSC, for example, a wrong target BSC is selected, the PAGING COMMAND message cannot be successfully sent over interface Abis. Check whether the settings for the BSC parameters that will affect paging groups are correct Check whether the following parameters in the [System information table] are correctly set: BS_AG_BLKS_RES, CCCH-CONF and BS_PA_MFRMS.

III. Check inter-module communications in BSC

Because Huawei BSC adopts multi-module structure, upon receipt of a PAGING message from MSC, BSC performs paging as per the LA cell information in the PAGING message. In that case, the PAGING COMMAND message to be delivered to BTS may be transferred between the modules in BSC. If an exception occurs to the inter-module communications, no PAGING COMMAND message can be transferred between the modules or sent o interface Abis. Abnormal inter inter-module communications can be verified through relevant BSC alarms.

8.4.3 No PAGING RESPONSE on Interface Abis

Through signaling tracing over interface Abis, the BSC is detected that it has not received the Establishment Indication (PAGING RESPONSE) after sending PAGING COMMAND to the BTS. In this case, check the relevant data configuration and radio signal coverage.

I. PCH or AGCH overloaded due to centralized short message transmission or mass access bursts
Query the traffic statistics about Number of immediate assignment requests and Number of CS service paging requests in the cell overall performance measurement. Compare the query results before and after the failure in paging the called MS and check whether the PCH or AGCH is overloaded due to centralized short message transmission or mass access bursts.

II. Check the called MS or SIM in it

If an MS of a certain model or lot cannot provide the required processing capability or if the SIM card in the MS is unavailable, the sending of the PAGING message might fail. In this case, perform the following: Insert a different (normal) SIM into the called MS to check whether the original SIM in the MS is functional

Insert the SIM in the called MS into an MS from a different manufacturer to check whether the MS is normal

III. Check BTS by making test calls in a different cell

Make a test call in a different cell under the same BTS Make a test call under a different BTS of the same type Make a test call under a BTS of a different type Make a test call under a BTS from a different manufacturer

IV. Check data configuration in BSC

Check the settings for the parameters that will affect paging groups Check whether the following parameters in the [System information table] are correctly configured: BS_AG_BLKS_RES, CCCH-CONF, BS_PA_MFRMS, Tx-integer and MS MAX retrans. Check the setting for location updating period in BSC and that in MSC Check the [System information table] for the configuration of T3212. The value of "T3212" in the MSC must be greater than that in the BSC. Refer to Chapter 4 Location Update Procedure.

V. Check radio signal coverage

Due to the problem of radio signal coverage, there might be some blind coverage areas. The MS that has entered a blind coverage area cannot receive the PAGING REQUEST message. In that case, the MS cannot be paged. Such cases, if any, only exist in partial areas.

8.4.4 No PAGING RESPONSE on Interface A

Through signaling tracing on interface Abis, the BSC is detected that it has received an Establishment Indication (PAGING RESPONSE) message from the BTS but this message is not reported over interface A. Such case hardly occurs and is omitted here.

Table of Contents

Chapter 9 Handover Procedure...................................................................................................9-1 9.1 Overview............................................................................................................................9-1 9.2 Normal Procedure..............................................................................................................9-1 9.2.1 Intra-BSC Handover Procedure..............................................................................9-1 9.2.2 Inter-BSC Handover Procedure..............................................................................9-4 9.2.3 Inter-MSC Handover Procedure..............................................................................9-6 9.3 Abnormal Cases................................................................................................................9-7 9.3.1 Handover Failure Due to CIC Exception.................................................................9-7 9.3.2 Handover Failure Due to MS Access Failure..........................................................9-7 9.3.3 Handover Procedure Initiation Failure....................................................................9-8

Chapter 9 Handover Procedure

9.1 Overview
Handover procedure includes intra-BSC handover procedure, inter-BSC handover procedure and inter-MSC handover procedure.

9.2 Normal Procedure

A handover procedure can be divided into 3 types according to different ranges involved in handover: intra-BSC handover procedure, inter-BSC handover procedure and inter-MSC handover procedure.

9.2.1 Intra-BSC Handover Procedure

I. Signaling procedure

Figure 9-1 Intra-BSC handover procedur

II. Procedure explanation

1) MS sends Measurement Report to BTS1 on SACCH on interface Um, and BTS1 will transfer the message to BSC. 2) BSC receives the Measurement Report. If it judges that the MS should be handed over to another cell, it will send CHANNEL ACTIVATION to BTS2 of the target cell to activate the channel. 3) BTS2 receives the CHANNEL ACTIVATION. If the channel type is correct, it will turn on the power amplifier on the specified channel to receive information in the uplink direction and send CHANNEL ACTIVATION ACKNOWLEDGE to BSC. 4) BSC receives the CHANNEL ACTIVATION ACKNOWLEDGE from BTS2 and sends HANDOVER COMMAND to BTS1, which will transfer the command to MS. The message is sent on FACCH on the Um interface. 5) MS receives the HANDOVER COMMAND and sends HANDOVER ACCESS on FACCH to BTS2 for access attempt. 6) BTS2 receives the HANDOVER ACCESS from MS and sends HANDOVER DETECT to BSC notifying that the HANDOVER ACCESS message bas been received. 7) In case of asynchronous handover, i.e., when BTS1 and BTS2 are located in different BTSs, BTS2 will send PHY INFO on FACCH to MS while sending HANDOVER DETECT to BSC. The PHY INFO includes such contents as the synchronous information for correct access of MS. In case of synchronous handover, i.e., when BTS1 and BTS2 are located in the same BTS, the PHY INFO message will not be delivered. 8) For the asynchronous handover, MS receives the PHY INFO, and sends SABM on FACCH to BTS2. While for the synchronous handover, MS will send SABM soon after sending HANDOVER ACCESS. 9) BTS2 receives the first SABM, and sends EST IND to BSC, notifying it that the radio link has been established. 10) At the same time, BTS2 sends UA frames on FACCH to MS, notifying that the radio link layer has been established. 11) Then, MS sends HANDOVER COMPLETE on FACCH to BTS2, which transfers the command to BSC notifying handover completion. 12) BSC sends HANDOVER PERFORMED to MSC, notifying that the handover has been completed. At the same time, BSC initiates a local release procedure to BTS1 to release the old channel occupied.

III. Internal handling of BSC

The internal handling of the BSC in an internal handover procedure is given below: 1) Huawei BSC performs handover decision at GLAP. Upon detecting that a call complies with the handover initiation conditions, the GLAP sends a handover request that carries a CGI list of the neighbor cells to the GMPU. The GMPU then selects a neighbor cell from the list based on the cell priority (from high to low). If the selected neighbor cell is under management of the same BSC based on the CGI of the cell and that in the [Cell module information table] but there is no channel available, the GMPU shall select the next neighbor cell. If the selected neighbor cell is under management of another BSC based on the CGI of the cell and that in the [Cell module information table], the GMPU shall initiate an inter-BSC handover procedure that is omitted here. If the selected neighbor cell with the highest priority is under management of the same BSC and there is a channel available, the GMPU shall initiate an intra-BSC handover procedure and this neighbor cell is the target cell. In this case, the source cell sends an internal handover request to the target cell and starts the 2-second timer to await the handover preparation completion. 2) Upon receipt of the internal handover request, the target cell allocates a channel and sends a CHANNEL ACTIVATION message to BTS2 to activate the allocated channel. 3) Upon completion of the channel activation, the target cell sends a CHANNEL ACTIVATION ACKNOWLEDGE message to the source cell, informing the source cell that the channel is available. Then it starts timer T3103B1 (see [Cell Call Control Parameter Table]) to await the HANDOVER DETECT message. 4) Upon receipt of the CHANNEL ACTIVATION ACKNOWLEDGE message, the source cell sends a HANDOVER COMMAND message to BTS1, stops the 2-second timer and starts timer T3103A (see [Cell Call Control Parameter Table]).

5) Upon receipt of the HANDOVER DETECT message, the target cell stops timer T3103B1 and starts timer T3103B2 (see [Cell Call Control Parameter Table]) to await the HANDOVER COMPLETE message. 6) Upon receipt of the HANDOVER COMPLETE message from the MS, the target cell stops timer T3103B2 and notifies such relevant modules as AIE and AIR to update the RR connection number. At the same time, it sends an Internal Handover Success message to the source cell. 7) Upon receipt of the Internal Handover Success message, the source cell initiates a local release procedure to release the old channel. 8) The target cell sends a HANDOVER PERFORMED message to the MSC, informing the MSC that an intra-BSC handover procedure has been completed.

9.2.2 Inter-BSC Handover Procedure

I. Signaling procedure

Figure 9-2 Normal inter-BSC handover procedure

II. Procedure explanation

Compared with the intra-BSC handover procedure, more A interface signaling are added to the inter-BSC handover procedure. The added A interface signaling will be described here. For the descriptions of other signaling, please see 9.2.1 Intra-BSC Handover Procedure. 1) When an MS needs to be handed over to the cell under management of the target BSC (BSC2), the source BSC (BSC1) sends a HANDOVER REQUIRED message to the MSC to request outgoing BSC handover. 2) Upon receipt of the HANDOVER REQUIRED message, the MS sends a HANDOVER

REQUEST message to BSC2. 3) BSC2 activates a new channel and sends HANDOVER REQUEST ACKNOWLEDGE to MSC, notifying MSC the channel is now available. 4) Upon receipt of the HANDOVER REQUEST ACKNOWLEDGE message, the MSC sends a HANDOVER COMMAND message to BSC1, which will transfer the message to MS, notifying MS to access in the new channel. 5) Upon receipt of the HANDOVER COMPLETE message from BSC2, the MSC sends a CLEAR COMMAND message to BSC1, which will initiate a local release procedure. Then BSC1 responds to MSC with CLEAR COMPLETE, indicating the clearance has been completed.

III. Internal handling of BSC

The internal handling of the BSC in an inter-BSC handover procedure is given below: 1) Huawei BSC performs handover decision at GLAP. Upon detecting that a call complies with the handover initiation conditions, the GLAP sends a HANDOVER REQUEST message that contains a CGI list of neighbor cells to the GMPU. The GMPU then selects a neighbor cell from the list based on the cell priority (from high to low). If the selected neighbor cell is under management of the same BSC based on the CGI of the cell and that in the [Cell module information table], but there is no channel available, the GMPU shall select the next neighbor cell. If the selected neighbor cell is under management of another BSC, the GMPU shall initiate an inter-BSC handover procedure. For the source cell in this case, the cell under management of another BSC is the target cell and the BSC that manages the target cell is the target BSC. 2) Upon initiation of the intra-BSC handover procedure, the source cell sends a HANDOVER REQUIRED message to the MSC and starts the 10-second timer (T7) to await the HANDOVER COMMAND message. 3) Upon receipt of the HANDOVER REQUEST message from the MSC, BSC2 allocates a channel based on the target cell identify in this message and activates the allocated channel. After the activation, the target cell sends the MSC a HANDOVER REQUEST ACKNOWLEDGE message that carries the HANDOVER COMMAND message. In this case, the target cell starts timer T3103B1 (see [Cell Call Control Parameter Table]) to await the HANDOVER DETECT message. 4) When BSC1 receives the HANDOVER COMMAND message from the MSC, the source cell sends the HANDOVER COMMAND to BTS1, which shall transfer this message to the MS. At the same time, the source cell starts timer T3103A (see [Cell Call Control Parameter Table]) to await handover completion. If the source cell receives the CLEAR COMMAND message with cause Handover Success before expiry of timer T3103A, BSC1 shall consider the handover procedure as successful. If the MS returns to the old channel before expiry of this timer, BSC1 stops this timer and sends a HANDOVER FAILURE message to the MSC. If this timer times out before reception of the CLEAR COMMAND message, BSC1 shall consider the call in the handover procedure as dropped and send a CLEAR REQUEST message to the MSC to release the call. 5) Upon receipt of the HANDOVER DETECT message, the target cell stops timer T3103B1, sends a HANDOVER DETECT message to the MSC and starts timer T3103B2 to await the HANDOVER COMPLETE message. 6) Upon receipt of the HANDOVER COMPLETE message from the MS, the target cell stops timer T3103B2 and transfers this message to the MSC, informing the MSC that an intra-BSC handover has been completed. 7) Upon receiving the CLEAR COMMAND message from the MSC before expiry of timer T3103A, the source cell locally releases the radio resources and sends back a MSC CLEAR COMMAND message.

9.2.3 Inter-MSC Handover Procedure

I. Signaling procedure

Figure 9-3 Normal inter-MSC handover procedure

II. Procedure explanation

For the descriptions of this procedure, refer to 9.2.1 Intra-BSC Handover Procedure and 9.2.2 Inter-BSC Handover Procedure. Here introduces briefly the messages on the E interface: 1) Perform Handover is the message on MAP layer. It contains the CGI of source cell and target cell and the required channel type. It informs MSC2 that a handover will be initiated. 2) RADIO CHANNEL ACK is the message on MAP layer. It contains the information of the new channel in the target cell and handover number. 3) INITIAL ADDRESS MESSAGE (IAM) is a TUP/ISUP message. 4) ADDRESS COMPLETE MESSAGE (ACM) is a TUP/ISUP message. 5) Send End Signal is a MAP message.

III. Internal handling of BSC

Refer to 9.2.2 III. Internal handling of BSC.

9.3 Abnormal Cases

In case of such exceptions as radio interface message loss, call drop, user hangup, transmission failure, NSS or even BSS equipment failure, the handover procedure might be incapable to run normally. There are many reasons resulting in abnormal handover procedure. Only the common cases will be described here.

9.3.1 Handover Failure Due to CIC Exception

Suppose the CIC allocated in the Handover REQ received by BSC is marked as BLOCK, BSC

will respond to MSC with HANDOVER FAILURE due to "requested terrestrial resource unavailable".

9.3.2 Handover Failure Due to MS Access Failure

When a MS accesses the new channel, BTS cannot decode the HANDOVER ACCESS or HANDOVER COMPLETE message correctly, and the handover will fail. The MS returns to the old channel and responds with a HANDOVER FAILURE message. In the intra-BSC handover, if the BSC has not received the HANDOVER COMPLETE message on the new channel or HANDOVER FAILURE message on the old channel at expiry of timer T3103A, it shall consider the call as dropped and send a CLEAR REQUEST message to the MSC on the old channel. Upon receiving the CLEAR COMMAND message from the MSC, the BSC releases the old channel and notifies the target cell to release the new channel. If timer T3103B1 or T3103B2 times out, the target cell shall release the new channel. In the inter-BSC handover procedure, if BSC1 has not received the HANDOVER COMPLETE message at expiry of timer T3103B2, it shall send a CLEAR REQUEST message to the MSC to release the call. If BSC2 has not received the HANDOVER DETECT or HANDOVER COMPLETE message, it shall send a CLEAR REQUEST message to the MSC for the same purpose.

9.3.3 Handover Procedure Initiation Failure

In case of handover procedure initiation failure, perform the following steps: 1) Check whether the call complies with the handover initiation conditions 2) Check whether there is a CGI list of neighbor cells in the measurement report 3) Check whether there is any channel available for the selected neighbor cell 4) Check whether the data about the selected neighbor cell is correct, for example, whether the CGI of the neighbor cell is consistent with that in the [Cell module information table]. 5) Log in to the BSC maintenance system. Click [Trace/GSM Trace/GSM Interface Trace] to display the [Interface Trace] dialog box. Check whether the LAPD has sent the GMPU a LAPD_GMPU_HO_IND message on the interface between the GMPU and LAPD. If yes, the call complies with the handover initiation conditions. If a neighbor cell with correct data already exists but there is still no HANDOVER COMMAND message on interface Um, check whether the handover procedure initiation failure is due to no channel available or another reason.

Table of Contents

Chapter 10 Ciphering Mode Setting Procedure.......................................................................10-1 10.1 Overview........................................................................................................................10-1 10.2 Normal Procedure..........................................................................................................10-1 10.3 Internal Handling of BSC...............................................................................................10-2 10.4 Abnormal Cases............................................................................................................10-3 10.4.1 Ciphering Rejected..............................................................................................10-3 10.4.2 MS Not Ciphered.................................................................................................10-3

Chapter 10 Ciphering Mode Setting Procedure

10.1 Overview
The ciphering mode setting procedure is generally used in service requests such as location update, service access, inter-office handover, etc. It requires the support from GSM network equipment, especially BTS, and also depends on the encryption support capabilities of MS.

10.2 Normal Procedure

I. Signaling procedure

Figure 10-1 Normal ciphering mode setting procedure 1) MSC sends a CIPHER MODE COMMAND message to BSC, indicating whether ciphering shall be used or not, which algorithm and Kc to use, and whether MSC requests MS to include its IMEI in the CIPHER MODE COMPLETE message. 2) BSC decides which algorithm it shall adopt according to the encryption algorithm contained in the CIPHER MODE COMMAND message, the one allowed by BSC, and the one supported by MS, and then notifies BTS. 3) BSC sends the command CIPHER MODE COMMAND to MS, notifying it about the selected encryption algorithm. 4) Upon receipt of the command CIPHER MODE COMMAND, MS initiates the transmission in ciphered mode, and returns a CIPHER MODE COMPLETE message to BSC. 5) Upon receipt of the CIPHER MODE COMPLETE message, BSC forwards the message to MSC.

II. Procedure explanation

1) Encryption algorithm A5

As specified in the GSM protocols, there are total 8 encryption algorithms, i.e. A5/0~A5/7. A5/0 indicates "Not ciphered". The ciphering mode setting procedure is always initiated by the network. The required encryption algorithm is specified in the encryption IE of the CIPHER MODE COMMAND message. 2) Encryption algorithm selection When an MS initiates a call request, classmark 2 and classmark 3 may be contained in the CM SERVICE REQUEST message. In system information, when ECSC is equal to 1, the MS shall report classmark 3 in the CM SERVICE REQUEST message. When ECSC is equal to 0, the MS can report classmark 3 only by changing the classmark or through the classmark updating procedure. Therefore, it is recommended that ECSC be configured as "1", which contains the information about the encryption algorithm supported by MS. According to the ciphering data configuration, MSC delivers CIPHER MODE COMMAND to BSC. BSC comprehensively considers the encryption algorithm indicated in the command which is allowed by MSC, the encryption algorithm allowed in BSC data configuration and the one supported by MS which is indicated in the CM SERV REQ message, and selects the intersection. Then BSC selects an appropriate algorithm from the intersection by adopting the method of reverse order. In other words, algorithm selection priorities decline in the order of A5/7 > A5/6 > A5/5 > A5/4 > A5/4 > A5/3 > A5/2 > A5/1 > A5/0. 3) Encryption in the handover procedure In the handover procedure, the HANDOVER REQUEST message contains an encryption IE, which indicates the to-be-used encryption algorithm and Kc. If either of the A interfaces of two BSSs is in Phase 1, due to the defect of the ETSI GSM Phase I protocol (There is no ciphering mode setting IE in the handover command), inter-BSC handover can be performed normally only when the two BSCs select the same algorithm (e.g. merely select A5/0, or A5/2). Otherwise, special processing is required in the destination MSC/BSC, or the originating MSC/BSC (e.g. modify the inter-BSC handover command). Therefore, in the interconnection of A interfaces under ciphered mode, the user should learn the difference of data configuration for the encryption function between different manufacturers. Unsuccessful interconnection has ever occurred during a to-BSC handover.

10.3 Internal Handling of BSC

The internal handling of the BSC in the ciphering mode setting procedure is given below: 1) Upon receipt of the CIPHER MODE COMMAND message from the MSC, the BSC checks the classmark of the MS and setting for the Encryption algorithm field in the [Cell configuration table]. 2) The BSC takes an intersection from the encryption algorithms supported in the CIPHER MODE COMMAND message from the MSC, that defined in the [Cell configuration table] and that specified in the CM SERVICE REQUEST message from the MS. 3) The BSC selects an appropriate algorithm from the intersection in the reverse order of algorithm priority. Note that the normal algorithm priority order (from high to low) is described as A5/7 > A5/6 > A5/5 > A5/4 > A5/4 > A5/3 > A5/2 > A5/1 > A5/0. Then the BSC sends a CIPHER MODE COMMAND message to the BTS.

10.4 Abnormal Cases

10.4.1 Ciphering Rejected
BSS shall return a CIPHER MODE REJECT message to MSC, indicating that the encryption algorithm is not supported, if it does not support the encryption algorithm specified in the CIPHER MODE COMMAND message. A CIPHER MODE REJECT message shall also be returned if the MSC requests a change of ciphering algorithm when BSS ciphering is already active.

10.4.2 MS Not Ciphered

In the following cases, the CIPHER MODE COMMAND messages shall be considered valid:

MS in "not ciphered" mode receives a CIPHER MODE COMMAND message, indicating "start ciphering". MS in "not ciphered" mode receives a CIPHER MODE COMMAND message, indicating "no ciphering". MS in "ciphered" mode receives a CIPHER MODE COMMAND message, indicating "no ciphering". In other cases, for example, MS in "ciphered" mode receives a CIPHER MODE COMMAND message, indicating "ciphering", it shall regard the CIPHER MODE COMMAND messages as erroneous, return an RR Status message with cause "Protocol error unspecified" and take no further action.

Table of Contents

Chapter 11 Call Re-establishment Procedure..........................................................................11-1 11.1 Overview........................................................................................................................11-1 11.2 Normal Procedure..........................................................................................................11-1 11.3 Abnormal Cases............................................................................................................11-3 11.3.1 CM Service Rejected..........................................................................................11-3 11.3.2 Re-establishment Not Allowed or Re-establishment Failure..............................11-4 11.3.3 RR Connection Failure........................................................................................11-4

Chapter 11 Call Re-establishment Procedure

11.1 Overview
The re-establishment procedure allows MS to resume a connection in progress after a radio link failure, possibly in a new cell or in a new location area. Whether call re-establishment can be attempted depends on the call control state, and whether a cell allowing call reestablishment has been found or not. During the re-establishment procedure, the called end doesn't know the re-establishment procedure, just can't hear voice for a short time. Call reestablishment cannot be performed for short message service and call independent supplementary services.

11.2 Normal Procedure

I. Signaling procedure

Figure 11-1 Call re-establishment procedur 1) After a radio link failure is detected, BTS sends a CONNECTION FAILURE INDICATION message to BSC, with the cause value "Radio link failure".

2) BSC sends a CLEAR REQUEST message to MSC, which contains the cause for the abnormal release. 3) Upon receipt of the message, MSC sends a CLEAR COMMAND to BSC, requesting the release of radio resources. 4) BSC initiates the release procedure, releases the physical channel resources on Um interface, and returns a CLEAR COMPLETE message to MSC. 5) MS sends a CHANNEL REQUEST message (with the cause value of "Call reestablishment") to BTS, and initiates the immediate assignment procedure (to seize signaling channels). 6) MS initiates the call re-establishment procedure, by sending a CM REESTABLISHMENT REQUEST message to MSC. The MM sublayer of MS starts timer T3230, gives an indication to all CM entities that are being re-established, and remains in the MM sublayer state "WAIT FOR REESTABLISH". The CM RE-ESTABLISHMENT REQUEST message contains IMSI/TMSI, classmark 2 and CKSM. 7) MSC initiates the ciphering mode setting procedure by delivering a CIPHER MODE COMMAND message to MS. For the specific signaling processing procedure, please refer to Chapter 9 Ciphering Mode Setting Procedure. After the ciphering mode setting procedure is completed, or after MS receives a CM SERVICE ACCEPT message, timer T3230 is stopped, and MS enters the MM sublayer state "MM CONNECTION ACTIVE". 8) BSC returns a CIPHER MODE COMPLETE message to MSC. 9) MSC sends an ASSIGNMENT REQUEST message to BSC, and initiates the signaling processing procedure. Refer to "Assignment Procedure" of Chapter 6 Mobile Originating Call Establishment Procedure. 10) BSC returns an ASSIGNMENT COMPLETE message to MSC. 11) MSC initiates status query by sending a STATUS ENQUIRY message to MS, to check whether the call state or MM substate is consistent. 12) MS sends a STATUS message to MSC, reporting its calling status or MM substate.

II. Procedure explanation

1) In Figure 11-1, 1~4 are to release radio channel resources, are the same with normal release procedure. 2) 5~6 refer to the immediate assignment procedure, i.e. signaling channel seizure procedure. 3) 7~8 refer to the ciphering mode setting procedure. 4) 9~10 refer to the assignment procedure. 5) Initiating of the call re-establishment procedure If a cell is required to support call re-establishment, the call re-establishment parameter of the cell must be set to "Allowed", and the cell cannot be in barred state. MS shall send a call re-establishment request in the selected cell (possibly the previous cell, or a new cell), when it first detects a radio link failure. The previous channel resources shall be released by BSC after the timer on BTS side expires. After detecting the radio link failure, BTS shall send a CONNECTION FAILURE message to BSC, indicating that radio link failure has occurred. Accordingly, BSC shall release the corresponding radio resources, and await MS's initiating call re-establishment. 6) MS's mode in the call re-establishment procedure During a call re-establishment attempt, MS does not return to idle mode. Therefore, no location updating shall be performed even if MS is not updated in the location area of the selected cell.

III. Internal handling of BSC

None.

11.3 Abnormal Cases

11.3.1 CM Service Rejected
After receipt of a CM RE-ESTABLISHMENT REQUEST, if the RR sublayer sends an indication that the ciphering mode setting procedure is completed, or if a CM SERVICE

ACCEPT message is received, MS shall treat the indication or receipt as a service acceptance indication, and re-enter the MM sublayer state "MM CONNECTION ACTIVE". If the network cannot associate the re-establishment request with any existing call for the MS, a CM SERVICE REJECT message shall be returned with cause "Call cannot be identified". If call re-establishment cannot be performed for other reasons, a CM SERVICE REJECT message shall be returned. The appropriate reject cause value may be ""IMSI unknown in VLR", "illegal ME", "network failure", "congestion", "service option not supported", or "service option temporarily out of order". Whatever the reject cause may be, upon receipt of the CM SERVICE REJECT message, the MS shall stop timer T3230 and release all MM connections and relevant RR connections.

11.3.2 Re-establishment Not Allowed or Re-establishment Failure

When MM connection is established, the MM layer may send an indication to the CC layer. If the MM layer is disconnected, the connection may be re-established through CC request. If the re-establishment is not allowed, and the call is initiated within the establishment or clearing period, the CC layer shall release MM connections. If re-establishment is unsuccessful, MM connections shall be released, and a release indication shall be sent to the CC layer..

11.3.3 RR Connection Failure

If random access failure or RR CONNECTION FAILURE is detected by MS, MS shall stop timer T3230, abort the call re-establishment procedure and release all MM connections. If RR CONNECTION FAILURE is detected by MSC, MSC shall abort the call re-establishment procedure and release all MM connections.

Table of Contents

Chapter 12 Directed Retry Procedure.......................................................................................12-1 12.1 Overview........................................................................................................................12-1 12.2 Normal Procedure..........................................................................................................12-1 12.2.1 Directed Retry Intra-BSC Handover Procedure..................................................12-2 12.2.2 Directed Retry Inter-BSC Handover Procedure..................................................12-5 12.2.3 Directed Retry Inter-MSC Handover Procedure.................................................12-7 12.3 Abnormal Cases............................................................................................................12-8

Chapter 12 Directed Retry Procedure

12.1 Overview
A directed retry procedure is actually a type of special handover procedure. In the assignment procedure, if there is no available radio resource in the new cell, the MS shall be handed over to the neighbor cell. It is a type of handover from a signaling channel to a traffic channel.

12.2 Normal Procedure

Based on the BSC and MSC that manage the serving cell and target cell, a directed retry handover procedure can be classified into three types: directed retry intra-BSC handover procedure, directed retry inter-BSC handover procedure and directed retry inter-MSC handover procedure.

12.2.1 Directed Retry Intra-BSC Handover Procedure

I. Signaling procedure

Figure 12-1 Directed retry intra-BSC handover procedur 1) MS sends CHANNEL REQUEST to BTS on the access channel of the Um interface, and then BTS will transfer the message to BSC. 2) BSC receives the CHANNEL REQUIRED, allocates a signaling channel, and sends CHANNEL ACTIVATION back to BTS. 3) BTS receives the CHANNEL ACTIVATION, turns on the power amplifier on the specified channel to receive information in the uplink direction if the channel type is correct, and sends CHANNEL ACTIVATION ACKNOWLEDGE to BSC. 4) BSC receives the CHANNEL ACTIVATION ACKNOWLEDGE and sends IMM ASSIGNMENT COMMAND to MS informing MS of the access. 5) When MS has been accessed successfully, MSC sends ASSIGNMENT REQUEST to BSC to request for allocation of the TCH resource. If a land circuit is needed between MSC and BSC, the ASSIGNMENT REQUEST message will contain the related land circuit information. If there is no TCH satisfying the requirement allocated to the serving cell at this moment, BSC will retry a handover to hand MS over to the neighbor cell, which will provide speech service. If the target cell is in the same BSC with the serving cell, this handover is a directed retry intra-BSC handover.

II. Procedure explanation

1) (1) ~ (8) in Figure 12-1 illustrates a random access and immediate assignment procedure, in which BSS allocates signaling channel to MS. 2) (14) ~ (24) in Figure 12-1 illustrates a TCH directed retry procedure, in which BSS allocates such resources as speech channel and A interface circuit for MS through handover.

III. Internal handling of BSC

Upon receiving the ASSIGNMENT REQUEST message from the MSC, if there is no TCH available in the cell where the MS is located and if the Direct retry field in the [Cell call control table] is set to Yes, the BSC shall initiate a directed retry handover procedure. The GMPU in the BSC first start the 8-second timer to await the HANDOVER INDICATION message from the LAPD and then initiate a forced handover procedure, as described below: 1) The GMPU sends a Forced HANDOVER COMMAND to the LAPD to initiate a forced handover procedure.

2) The LAPD sends a HANDOVER INDICATION message that contains a CGI list of the neighbor cells to the BSC. Upon receipt of this message, the BSC stops the 8-second timer. 3) The BSC selects a neighbor cell from the CGI list based on the cell priority (from high to low). If the selected neighbor cell is under management of the same BSC but there is no channel available, the BSC shall select the next neighbor cell. If the selected neighbor cell is under management of another BSC based on the CGI of the cell and that in the [Cell module information table], the BSC shall initiate a directed retry inter-BSC handover procedure (see the next section). If the selected neighbor cell with the highest priority is under management of the same BSC based on the CGI of the cell and that in the [Cell module information table] and there is a channel available, the BSC shall initiate a directed retry intra-BSC handover procedure. In this case, the selected neighbor cell is the target cell for the directed retry handover. The source cell where the call is initiated sends an Internal HANDOVER REQUEST to the target cell and starts the 2-second timer to await the handover preparation completion. 4) Upon receipt of the Internal HANDOVER REQUEST, the target cell allocates a channel and notifies the target BTS (BTS2) to activate the allocated channel. 5) Upon completion of channel activation, the target cell sends a CHANNEL ACTIVATION ACKNOWLEDGE message to the source cell, informing the source cell that the channel is available. Then it starts timer T3103B1 (see [Cell Call Control Parameter Table]) to await the HANDOVER DETECT message. 6) Upon receipt of the CHANNEL ACTIVATION ACKNOWLEDGE message, the source cell sends a HANDOVER COMMAND message to BTS1, stops the 2-second timer and starts timer T3103A (see [Cell Call Control Parameter Table]. 7) Upon receipt of the HANDOVER DETECT message, the target cell stops timer T3103B1 and starts timer T3103B2 (see [Cell Call Control Parameter Table]) to await the HANDOVER COMPLETE message. 8) Upon receipt of the HANDOVER COMPLETE message from the MS, the target cell stops timer T3103B2 and notifies the relevant modules such as AIE and AIR to update the RR connection number. At the same time, it sends an Internal Handover Success message to the source cell. 9) The target cell sends the MSC an ASSIGNMENT COMPLETE message that contains target cell information, informing the MSC that the assignment has been completed. 10) Upon receipt of the Internal Handover Success message, the source cell initiates a local release procedure to release the relevant resources.

12.2.2 Directed Retry Inter-BSC Handover Procedure

I. Signaling procedure

Figure 12-2 Directed retry inter-BSC handover procedur

II. Procedure explanation

Compared to the directed retry intra-BSC handover procedure, more A interface signaling is added to the inter-BSC handover procedure. The added A interface signaling will be described here. For the descriptions of other signaling, see 12.2.1 Directed Retry Intra-BSC Handover Procedure. 1) If an MS needs to be handed over to a cell under management of BSC2, BSC1 shall send a HANDOVER REQUIRED message to the MSC to request an inter-BSC handover procedure. 2) Upon receipt of the HANDOVER REQUIRED message, the MSC sends a HANDOVER REQUEST message to BSC2. 3) Upon completion of channel activation, BSC2 sends a HANDOVER REQUEST ACKNOWLEDGE message to the MSC, informing the MSC that the channel is available. 4) Upon receipt of the HANDOVER REQUEST ACKNOWLEDGE message, the MSC sends a HANDOVER COMMAND message to BSC1. BSC1 then transfers this message to the MS, notifying the MS to access in the new channel. 5) Upon receipt of the HANDOVER COMPLETE message, the MSC sends a CLEAR COMMAND message to BSC1. Upon receiving the CLEAR COMMAND message BSC1 initiates a local release procedure to release the old channel and sends back a CLEAR COMPLETE message to the MSC.

III. Internal handling of BSC

Upon receiving the ASSIGNMENT REQUEST message from the MSC, if there is no TCH available in the cell where the MS is located and if the Direct retry field in the [Cell Call Control Table] is set to Yes, the BSC shall initiate a directed retry handover procedure. The GMPU in the BSC first starts the 8-second timer to await the HANDOVER INDICATION message from the LAPD and then initiates a forced handover procedure, as described below: 1) The GMPU sends a Forced HANDOVER COMMAND to the LAPD to initiate a forced handover procedure. 2) The LAPD sends a HANDOVER INDICATION message that contains a CGI list of the neighbor cells to the BSC. Upon receipt of this message, the BSC stops the 8-second timer. 3) The BSC selects a neighbor cell from the CGI list based on the cell priority (from high to

low). If the selected neighbor cell is under management of the same BSC but there is no channel available, the BSC shall select the next neighbor cell. If the selected neighbor cell is under management of a different BSC based on the CGI of the cell and that in the [Cell module information table], the BSC shall initiate a directed retry inter-BSC handover procedure. Upon initiation of this procedure, the source cell sends a HANDOVER REQUIRED message to the MSC and starts the 10-second timer (T17) to await the HANDOVER COMMAND message. 4) Upon receipt of the HANDOVER REQUEST message from the MSC, BSC2 allocates a channel to the target cell based on the target cell identity in this message and activates the allocated channel. When the channel has been activated, the source cell sends the MSC a HANDOVER REQUEST ACKNOWLEDGE message that contains the HANDOVER COMMAND message. In this case, the target cell starts timer T3103B1 (see [Cell Call Control Parameter Table] to await the HANDOVER DETECT message. 5) When BSC1 receives the HANDOVER COMMAND message from the MSC, the source cell sends the HANDOVER COMMAND message BTS1, which will transfer it to the MS. At the same time, the source cell starts timer T3103A. BSC1 considers the handover procedure as successful upon receiving the CLEAR COMMAND message with cause Handover Success or Call Control before expiry of timer T3103A. If the MS returns to the old channel before expiry of this timer, BSC1 stops this timer and sends a HANDOVER FAILURE message to the MSC. If timer T3103A times out, BSC1 shall consider the call in the handover procedure as dropped and send a Clear Request to the MSC to release the call. 6) Upon receipt of the HANDOVER DETECT message, the target cell stops timer T3103B1, transfers this message to the MSC and starts timer T3103B2 to await the HANDOVER COMPLETE message. 7) Upon receipt of the HANDOVER COMPLETE from the MS, the target cell stops timer T3103B2 and transfers this message to the MSC, informing the MSC that the handover has been completed. 8) Upon receiving the CLEAR COMMAND message from the MSC before expiry of timer T3103A, the source cell locally releases the old channel and sends back a MSC CLEAR COMMAND message to the MSC.

12.2.3 Directed Retry Inter-MSC Handover Procedure

I. Signaling procedure

Figure 12-3 Directed retry inter-MSC handover procedure

II. Procedure explanation

Refer to 12.2.2 Directed Retry Inter-BSC Handover Procedure.

12.3 Abnormal Cases

The directed retry handover procedure might be incapable to work normally due to radio interface message loss, call interruption, user on-hook, transmission failure or NSS/BSS operation failure. There are many causes for the abnormal cases. Only the typical cases will be described here.

I. Directed retry inter-BSC handover failure due to no available channel in the target cell
When there is no available channel in the target cell, this cell will respond with a HANDOVER FAILURE message and the source cell will respond to MSC with ASSIGNMENT FAILURE.

II. Directed retry intra-BSC handover failure due to CHANNEL ACTIVATION failure
In case of CHANNEL ACTIVATION failure in the target cell, BSC responds to MSC with ASSIGNMENT FAILURE.

Table of Contents

Chapter 13 Short Message Procedure......................................................................................13-1 13.1 Overview........................................................................................................................13-1 13.2 Normal Procedure..........................................................................................................13-2 13.2.1 Short Message Procedure on SDCCH When MS Is Calling...............................13-2 13.2.2 Short Message Procedure on SDCCH When MS Is Called...............................13-4 13.2.3 Short Message Procedure on SACCH When MS Is Calling...............................13-5 13.3 Short Message Procedure on SACCH when MS Is Called...........................................13-6 13.4 Internal Handling of BSC...............................................................................................13-7 13.5 Abnormal Cases............................................................................................................13-7

Chapter 13 Short Message Procedure

13.1 Overview
Short messages can be transmitted either on SDCCH or SACCH. A short message procedure can be classified into short message calling procedure and called procedure.

13.2 Normal Procedure

13.2.1 Short Message Procedure on SDCCH When MS Is Calling
I. Signaling procedure

Figure 13-1 Short message procedure on SDCCH when MS is callin

II. Procedure explanation

1) (1) ~ (8) in Figure 13-1 illustrates a random access and immediate assignment procedure, in which BSS allocates signaling channel to MS. 2) (15) ~ (21) is a short message transmission procedure. MS sends SABM again, notifying the network side that this user needs short message service (SMS). Then, BSC provides a transparent-transmission channel for MS to exchange short message information with MSC. In this procedure, the MSCs of some manufacturers are capable to send ASS REQ to BSC, requesting it to assign channel for short message transmission. The time for sending ASS REQ is the same as that for a common call. BSC can provide SMS either by allocating other channels or by using the original SDCCH. Point to Point short message protocol is divided into connection management layer (CM), relay layer (RL), transport layer (TL) and application layer (AL). CP_DATA and CP_ACK are the messages on CM layer, CP_DATA is used to transmit the content of RL and AL message and CP_ACK is the acknowledgement message of CP_DATA. 3) (22) ~ (35) is a release procedure.

MSC initiates a release procedure upon the completion of short message transmission.

13.2.2 Short Message Procedure on SDCCH When MS Is Called

I. Signaling procedure

Figure 13-2 Short message procedure on SDCCH when MS is calle

II. Procedure explanation

1) (1) ~ (10) is a paging response and immediate assignment procedure. MSC sends Paging CMD to page the called subscriber. MS requests for SDCCH, and responds with Paging Response. 2) (17) ~ (25) is a short message setup and transmission procedure. For the short message procedure when MS is called, BSC sends EST REQ to MS to establish short message connection. When EST CNF is received from MS, the connection is

successfully established. BSC transparently transmits the short message till the end of the transmission. (13), (14), (15) and (16) are optional signaling procedures. 3) (26) ~ (36) is a release procedure.

13.2.3 Short Message Procedure on SACCH When MS Is Calling

I. Signaling procedure

Figure 13-3 Short message procedure on SACCH when an MS is callin

II. Procedure explanation

MS sends CM SERV REQ through FACCH. MSC responds with the CM SERV ACC message, and establishes CC layer connection. Then, it establishes RR layer connection on SACCH, and sends the short message

13.3 Short Message Procedure on SACCH when MS Is Called

I. Signaling procedure

Figure 13-4 Short message procedure on SACCH when an MS is calle

II. Procedure explanation

BSC receives the CP DATA message from MSC and establishes a RR layer connection for SMS. Upon receipt of CP ACK from the MS, MSC sends the short message.

13.4 Internal Handling of BSC

The internal handling of the BSC includes: 1) The BSC detects whether the MS supports short message services according to the classmark in the message reported from the MS. 2) Upon receipt of the short message from the MS, the BSC checks the [Cell Call Control Table] for the configuration of the Short message uplink disabled field. If the field is set to yes, the short message cannot be sent. 3) Upon receipt of the short message from the MSC, the BSC checks the [Cell Call Control Table] for the configuration of the Short message downlink disabled field. If the field is set to yes, the short message cannot be sent.

13.5 Abnormal Cases

In case of short message procedure failure, perform the following: 1) Check whether the MS supports short message services 2) Check the [Cell Call Control Table] for the configuration of the Short message uplink disabled or Short message uplink disabled field. If a field is set to Yes, modify the value to No. 3) Perform signaling tracing to check the equipment on the network side, for example, the short message service center (SMSC). In case of short message transmission failure, the MS receives CP DATA and responds to the MSC with CP NACK, informing the MSC of short message transmission failure.

Table of Contents

Chapter 14 Cell Broadcast Message Procedure......................................................................14-1 14.1 Overview........................................................................................................................14-1 14.2 CBC-BSC Interface Message Procedure......................................................................14-1 14.3 Messages and Service Functions over the Interface between BSC and BTS..............14-5 14.4 Internal Handling of BSC...............................................................................................14-5 14.5 Abnormal Cases............................................................................................................14-6

Chapter 14 Cell Broadcast Message Procedure

14.1 Overview
A Cell Broadcast message procedure includes the message interaction on the CBC-BSC interface and on the BSC-BTS interface in Cell Broadcast service.

14.2 CBC-BSC Interface Message Procedure

There are 13 messages over the interface between the CBC and BSC. They provide the following service functions:

I. Send a new message or replace the existing one

Figure 14-1 Send a new message or replace the existing on After receiving WRITE-REPLACE REQUEST, BSC will save it in the message library if it is a new one. If it is a replace-message, BSC will delete the old one from the message library and save the replace one in the message library. After handling the WRITE-REPLACE REQUEST message, BSC will send REPORT RESPONSE to CBC.

II. Delete the existing message

Figure 14-2 Delete an existing messag

When receiving a KILL REQUEST message, BSC will delete the existing message from the message library, and send REPORT RESPONSE to CBC.

III. CBCH status query

Figure 14-3 CBCH status query When the received message is STATUS CBCH QUERY Request, BSC will query the data in the CBCH send queue, and send STATUS CBCH QUERY RESPONSE back to CBC.

IV. Message status query

Figure 14-4 Message status quer When receiving STATUS MESSAGE QUERY REQUEST, BSC will query the message library for the status information of the related message, and send STATUS MESSAGE QUERY RESPONSE back to CBC.

V. Cell reset request

Figure 14-5 Cell reset request in case the specified cell is norma

Figure 14-6 Cell reset request in case the specified cell is abnorma CBC sends RESET REQUEST to BSC when initiating reset operation to the specified cell. When BSC receives the message, if it is not correct, BSC will not process it; if it is correct, BSC will stop sending any message to the related cell, and clear the corresponding information from the message library and the cell broadcast table. If the Cell Broadcast Channel of the specified cell (CBCH) is normal before the reset operation, BSC will return RESTART INDICATION REQUEST to CBC. If the CBCH is abnormal (due to cell fault, CBCH not configured or CBCH blocking), BSC will send FAILURE INDICATION REQUEST back to CBC.

VI. DRX setting request

Figure 14-7 DRX setting request When receiving the SET DRX REQUEST message, BSC should set the schedule message to be transmitted next time based on the parameters provided in the message, and send SET DRX REPORT RESPONSE to CBC.

VII. Send reject response

Figure 14-8 Send reject respons When the message received by BSC is not understandable or the parameter value is illegal, BSC will send REJECT RESPONSE to CBC to report the failure cause or brief descriptions.

14.3 Messages and Service Functions over the Interface between BSC and BTS
I. BSC sends the CBS message to the relevant BTS through a SMS Broadcast CMD message and indicates the channel to be used.

Figure 14-9 BSC sends a CBS message to the relevant BTS through a SMS Broadcast CMD

II. BTS reports the current load of CBCH to BSC through the message CBCH Loading Indication and requests BSC to implement flow control.

Figure 14-10 BTS reports CBCH Loading Indication to BS

14.4 Internal Handling of BSC

The internal handling of the BSC includes: When the BSC supports cell broadcast service, the Support cell broadcast flag field in the [Local Office Information Table] is set to Yes. A GMEM board in the BSC has been configured.

14.5 Abnormal Cases

The cell broadcast procedure generally does not involve abnormal signaling procedure. Once the relevant parameters are correctly set to support normal communications, the basic cell broadcast message services can be available.

Table of Contents

Chapter 15 VGCS Call Flow........................................................................................................15-1 15.1 Overview........................................................................................................................15-1 15.2 Normal Flow...................................................................................................................15-1 15.2.1 VGCS Setup........................................................................................................15-1 15.2.2 Uplink Occupation...............................................................................................15-2 15.2.3 Uplink Release....................................................................................................15-3 15.2.4 VGCS Release....................................................................................................15-4 15.2.5 VGCS Call Handover..........................................................................................15-5 15.2.6 Listener Detection...............................................................................................15-6 15.3 Abnormal Flow and Faults Location..............................................................................15-7

Chapter 15 VGCS Call Flow

15.1 Overview
The normal flow of the VGCS call includes: VGCS setup Uplink occupation Uplink release VGCS release VGCS handover Listener detection

15.2 Normal Flow

15.2.1 VGCS Setup
The VGCS setup flow is shown in Figure 15-1.

Figure 15-1 VGCS setup flow cha

1) MS sends the message CHAN_REQ to BSS through RACH. After receive the message Channel Required, BSC assigns signaling channel and sends the message Channel Activation to BTS. After receive the message Channel Activation, BTS activates the power amplifier on the specified channel if the channel type is correct and sends the message Channel Activation Acknowledge to BSC. The uplink begins to receive information. 2) BSS sends the message Immediate Assignment Command to MS through the AGCH channel in the Um interface. 3) MS sends the access message SABM frame through SDCCH channel. BTS sends the message Establishment Indication (the message exactly reflects the access reason of MS) to BSC. The message Establishment Indication contains the message CM Service Request. 4) BSS establishes SCCP link in A interface and sends the message CM Service Request MSC. 5) BSS returns the acknowledge message UA frame through SDCCH channel. 6) The calling MS sends the message Setup through SDCCH channel. 7) MSC sends the message Call Proceeding to the calling MS through the SDCCH channel in the Um interface. 8) MSC sends the message VGCS/VBS SETUP to BSC to set up the VGCS/VBS call control connection. The uplink procedure management message is sent through this connection. This connection lasts till the end of the call. 9) BSC sends the message VGCS_SETUP_ACK to MSC to acknowledge the setup of the VGCS/VBS call control connection. 10) MSC sends the message VGCS_ASS_REQ to each cell within the VGCS call area. The message contains the VGCS reference content. 11) 15) If the channel setup method specified in the message VGCS_ASS_REQ is immediate setup of VGCS channel, BSC assigns one TCH channel as VGCS channel. Then, BSC sends the notification message with VGCS channel description information through the NCH channel and the FACCH channel. After detect the message, MS automatically switches to the VGCS channel to monitor. If the channel setup method specified in the message VGCS_ASS_REQ is delayed setup of VGCS channel, BSC directly returns the message VGCS_ASS_COMP to MSC. Then, BSC sends the notification message without VGCS channel description information through the NCH channel and the FACCH channel. After detect the message, MS initiates the response flow.

15.2.2 Uplink Occupation

After the VGCS call is initiated, subscriber can press the PTT key to occupy the uplink of the VGCS channel to talk. The uplink occupation flow is shown in Figure 15-2.

Figure 15-2 Uplink occupation flow cha 1) BSS sends the message UPLINK_FREE to indicate that the uplink of current VGCS is idle. 2) After subscriber presses the PTT key, MS reports the message UPLINK_ACCESS

to occupy the uplink. 3) BSS sends the uplink occupation request message to MSC. 4) BSS sends the message VGCS_UPLINK_GRANT to MS. Then MS can occupy the uplink. 5) If BSS sends the message UPLINK_BUSY, it means that the uplink of the current VGCS is occupied. MS cannot send the uplink occupation request. 6) MS sends the access message SABM frame through SDCCH channel. 7) BTS returns the acknowledge message UA frame through SDCCH channel. 8) If MSC sends the message UPLINK_REQ_ACK, the MS is allowed to occupy the uplink. If MSC sends the message UPLINK REJECT COMMAND, the MS is forbidden to occupy the uplink. 9) BSS sends the message UPLINK_REQ_CONF to MSC to confirm the uplink occupation. 10) Conversation begins.

15.2.3 Uplink Release

Uplink release can be initiated either by network side or by MS. Figure 15-3 shows the uplink release flow initiated by the network side.

Figure 15-3 Uplink release flow initiated by network side 1) Conversation proceeds 2) MSC sends the message UPLINK_REL_CMD to relevant BSC. 3) After receive the message UPLINK_REL_CMD, BSS sends the message UPLINK_RELEASE to the MS which occupies the uplink to release the uplink by force. 4) BSS broadcasts the message UPLINK_FREE to cells and the subscribers within the cells can try occupying the uplink. Figure 15-4 shows the uplink release flow initiated by the MS.

Figure 15-4 Uplink release flow initiated by MS 1) Conversation proceeds 2) After the PTT key is loosened, MS reports the message UPLINK_RELEASE to BSS. 3) BSS sends the message UPLINK_REL_IND to MSC. 4) BSS sends the message UPLINK_FREE to MS. The subscribers within the cells can try occupying the uplink.

15.2.4 VGCS Release

Figure 15-5 shows the VGCS release flow initiated by MS.

Figure 15-5 VGCS release flow initiated by M 1) MS sends the message TERMINATION REQUEST to MSC. 2) MSC sends the message TERMINATION to MS. 3) MSC sends the message CLEAR CMD to BSS to release the SCCP connection between BSS and MSC. 4) BSS sends the message Release to MS to request the MS release the logic channel. 5) BSS returns the message Clear Complete to MSC to release the logic channel resources.

15.2.5 VGCS Call Handover

Figure 15-6 shows the inter-cell handover flow within BSC.

Figure 15-6 Inter-cell handover flow within BSC 1) BSC sends the message Channel Active to BTS. 2) After receive the message Channel Activation, BTS activates the power amplifier in the specified channel if the channel type is correct and sends the message Channel Activation Acknowledge to BSC. The uplink begins to receive information. 3) BSC sends the message HO CMD UM to activate the uplink of the VGCS channel of the target cell. 4) After receive the message HO CMD UM, the MS within the cell reports the message RANDOM ACCESS to BTS. 5) BTS sends the message HO DETECT to BSC. 6) MS sends the access message SABM frame through SDCCH channel. 7) BTS sends the message Establishment Indication to BSC. The message Establishment Indication contains the message CM Service Request. 8) BTS returns the acknowledge message UA frame through SDCCH. 9) MS sends the handover complete message HO CMP to BSC. 10) After receive the message HO CMP, BSC reports the message HANDOVER PERFORM to MSC to indicate that a handover occurs within BSC.

Note: VGCS call handover only occurs between the cells within the VGCS area. If the target cell does not belong to the VGCS area, the MS is handed over to the TCH channel of the target cell. But after receive the message HANDOVER PERFORM, MSC clears the uplink of the VGCS channel by force if find the target cell does not belong to the VGCS area.

15.2.6 Listener Detection

Figure 15-7 shows the Listener detection when there are subscribers in the cell.

Figure 15-7 Listener detection flow when there are subscribers in the ce 1) BSC sends the message UPLINK_FREE regularly. The message requires MS return a response message after receive it. 2) After the MSs within the cell receive the message, they report the message RANDOM ACCESS to BTS. 3) BTS only reports one LISTENER_DET message to BSC after filter the messages RANDOM ACCESS. BSC sends the message UPLINK_FREE regularly according to Listener detection time interval specified in the data configuration to check the existence of subscribers Figure 15-8 shows the Listener detection when there is no subscriber in the cell.

Figure 15-8 Listener detection flow when there are no subscriber in the ce 1) BSC sends the message UPLINK_FREE regularly. The message requires MS return a response message after receive it. 2) BTS sends the message NO_LISTENER_DETECT if no MS responses. 3) 8) BSC sends the notification message without channel description information to request BTS release the channel resources.

Note: The time interval to send the UPLINK_FREE message is configurable. The continuous times that the BSC does not receive the message LISTENER_DET before release the VGCS channel is configurable.

15.3 Abnormal Flow and Faults Location

When detect the current radio link breaks, BTS sends the message Connection Failure Indication to BSC, which includes the reason. The handling of relevant situations is as follows:

I. Radio Link Failure

After the radio link between MS and TRX is set up, if TRX does not receive the SACCH message continuous for N times, the current link is considered as being broken. BTS sends the message CONN FAIL IND to BSC to indicate the radio link failure and requests BSC to release the channel. The flow is shown in Figure 15-9.

N: radio link failure counter specified in the cell configuration table Figure 15-9 Radio link failur

II. Handover Access Failure

Figure 15-10 shows the handover access failure flow.

Figure 15-10 Handover access failure 1) MS sends the message HANDO ACCESS to BTS to request the handover. 2) BTS sends the message HANDO DET to BSC. 3) BTS sends the message PHYSical INFormation through the current channel in the form of UI frame to MS and starts the T3105 timer at the same time. If BTS does not receive the access frame from MS within the set period, BTS resends the physical information. If does not receive the access frame correctly for NY1 times, BTS considers the current MS fails to access. 4) BTS sends the message CONN FAIL IND to notify BSC the radio link failure. The reason value is 2.

III. Talker Access Failure

Figure 15-11 shows the talker access failure flow in the VGCS channel.

Figure 15-11 Talker access failur 1) MS sends the message UPLINK ACCESS to request to access to the VGCS channel whose uplink is idle. 2) BTS sends the message TALKER DET to BSC. 3) When the VGCS channel whose uplink is idle receives the access request from MS, BTS sends the message VGCS UPLINK GRANT in the current channel in the form of UI frame to MS to notify MS to set up link in the channel and then starts the T3115 timer at the same time. If BTS does not receive the access frame from MS within the set period, BTS resends the grant message. If does not receive the access frame correctly for NY2 times, BTS considers the current MS fails to access. 4) BTS sends the message CONN FAIL IND to notify BSC the radio link failure. The reason value is 3.

Table of Contents
Appendix A Message Interpretation............................................................................................A-1 A.1 A-Interface Key Messages................................................................................................A-1 A.1.1 Message Contents..................................................................................................A-2 A.1.2 Signaling element coding......................................................................................A-16 A.1.3 Message Type ......................................................................................................A-19 A.2 Abis-Interface Key Messages..........................................................................................A-62 A.2.1 Message Contents................................................................................................A-63 A.2.2 Signaling element coding......................................................................................A-70

Appendix A Message Interpretation

Here will give message contents of some key interface messages, these include: A-interface key messages, Abis-interface key messages.

A.1 A-Interface Key Messages

There is no general rule for the order of signaling elements: it happens that the same elements appear in various orders depending on the message. The messages of A-interface described here are based on Phase 2+ GSM 0808 version 7.6.0 Release 1998. The key BSSMAP messages are listed in the following table: Message ASSIGNMENT REQUEST ASSIGNMENT COMPLETE ASSIGNMENT FAILURE HANDOVER REQUEST HANDOVER REQUEST ACKNOWLEDGE HANDOVER REQUIRED HANDOVER REQUIRED REJECT HANDOVER COMMAND HANDOVER COMPLETE HANDOVER FAILURE HANDOVER PERFORMED Reference 1.1.1 1.1.2 1.1.3 1.1.4 1.1.5 1.1.6 1.1.7 1.1.8 1.1.9 1.1.10 1.1.11

PAGING CLEAR REQUEST CLEAR COMMAND CLASSMARK REQUEST CLASSMARK UPDATE CIPHER MODE COMMAND CIPHER MODE COMPLETE CIPHER MODE REJECT

1.1.12 1.1.13 1.1.14 1.1.15 1.1.16 1.1.17 1.1.18 1.1.19

INFORMATION ELEMENT Message Type Channel Type Layer 3 Header Information Priority Circuit Identity Code Downlink DTX Flag Interference Band To Be Used Classmark Information 2 Group Call Reference Talker Flag LSA Access Control Suppression

REFERENCE 1.2.1 1.2.2 1.2.3 1.2.4 1.2.5 1.2.6 1.2.7 1.2.8 1.2.9 1.2.10 1.2.11

DIRECTION MSC-BSS MSC-BSS MSC-BSS MSC-BSS MSC-BSS MSC-BSS MSC-BSS MSC-BSS MSC-BSS MSC-BSS MSC-BSS

TYPE M M O (3) O O (1) O (2) O O (4) O (5) O (6) O (8) 1 5-10 4 3 3 2 2 4-5 3-8 1 2

1)

This element is included when the MSC allocates the A-interface circuits and the channel type Information Element indicates speech or data, and only in those cases. This element may be included in the case of a speech TCH, and only in this case. If not included, this has no impact on the DTX function in the BSS. This information element does not serve any useful purpose. MSCs should not send the information element unless it is required by the recipients (due to the need to interwork with older versions of the protocol). It is expected that in future versions of 08.08, this information element will be deleted from this message.

2) 3)

4) These elements may be included if the information is known by the MSC. 5) This may be included by the MSC for either a talking or listening subscriber in a group call. 6) This information element is included for group calls, when this is included it indicates that the mobile is a talker in the call else the mobile is a listener. 7) The information is indicated by the MSC if known. 8) This information element is included if LSA access control function shall be suppressed in the BSS.
II. ASSIGNMENT COMPLETE
The ASSIGNMENT COMPLETE message is sent from the BSS to the MSC and indicates that the requested assignment has been completed correctly. The message is sent via the BSSAP SCCP connection associated with the dedicated resource(s). INFORMATION ELEMENT Message Type RR Cause Circuit Identity Code Cell Identifier Chosen Channel Chosen Encryption Algorithm Circuit Pool Speech Version (Chosen) LSA Identifier 1) 2) REFERENCE 1.2.1 1.2.12 1.2.5 1.2.13 1.2.14 1.2.15 1.2.16 1.2.17 1.2.18 DIRECTION BSS-MSC BSS-MSC BSS-MSC BSS-MSC BSS-MSC BSS-MSC BSS-MSC BSS-MSC BSS-MSC TYPE M O O (4) O (1) O (3) O (5) O (2) O (6) O (7) LEN 1 2 3 3-10 2 2 2 2 5

The cell identifier is used to indicate a new cell, if during the assignment the serving cell has changed. Shall be included when several circuit pools are present on the BSS MSC interface and a circuit was allocated by the ASSIGNMENT REQUEST message. Included at least when the channel rate/type choice was done by the BSS.

3)

4)

5) 6) 7)

The Circuit Identity Code information element is included mandatory by the BSS if the BSS allocates the A-interface circuits and a circuit is needed. Included at least when the encryption algorithm has been changed by the BSS. Included at least when the speech version choice was done by the BSS. Shall be included if current LSA in the serving cell has been identified (see GSM 03.73). Not included means that there is no current LSA in the serving cell.

III. ASSIGNMENT FAILURE

The ASSIGNMENT FAILURE message is sent from the BSS to the MSC via the relevant SCCP connection. It indicates that there has been a failure in the assignment process at the BSS and that the assignment procedure has been aborted. INFORMATION ELEMENT Message Type Cause RR Cause Circuit Pool Circuit Pool List REFERENCE 1.2.1 1.2.19 1.2.12 1.2.16 1.2.20 DIRECTION BSS-MSC BSS-MSC BSS-MSC BSS-MSC BSS-MSC TYPE M M O O (1) O (2) LEN 1 3-4 2 2 V

1) Shall be included when several circuit pools are present on the BSS MSC interface. 2) May be included when cause is "circuit pool mismatch" or "switch circuit pool" to indicate circuit pool preferences. Typical Cause values are: -radio interface message failure, -O and M intervention, - equipment failure, -no radio resource available, -requested terrestrial resource unavailable, -requested transcoding/rate adaption unavailable, -terrestrial resource already allocated, -invalid message contents, -radio interface failure - reversion to old channel, - directed retry, -circuit pool mismatch, -switch circuit pool. requested speech version unavailable.
IV. HANDOVER REQUEST

This message is sent from the MSC to the BSS via the relevant SCCP connection to indicate that the MS is to be handed over to that BSS. INFORMATION ELEMENT Message Type Channel Type Encryption Information Classmark Information 1 Or Classmark Information 2 Cell Identifier (Serving) Priority Circuit Identity Code Downlink DTX Flag Cell Identifier (Target) Interference Band To Be Used Cause Classmark Information 3 Current Channel type 1 Speech Version (Used) Group Call Reference Talker Flag Configuration Evolution Indication Chosen Encryption Algorithm (Serving) Old BSS to New BSS Information LSA Information LSA Access Control Suppression REFERENCE 1.2.1 1.2.2 1.2.21 1.2.22 1.2.8 1.2.13 1.2.4 1.2.5 1.2.6 1.2.13 1.2.7 1.2.19 1.2.23 1.2.24 1.2.17 1.2.9 1.2.10 1.2.27 1.2.15 1.2.26 1.2.25 1.2.11 DIRECTION MSC-BSS MSC-BSS MSC-BSS MSC-BSS MSC-BSS MSC-BSS MSC-BSS MSC-BSS MSC-BSS MSC-BSS MSC-BSS MSC-BSS MSC-BSS MSC-BSS MSC-BSS MSC-BSS MSC-BSS MSC-BSS MSC-BSS MSC-BSS MSC-BSS MSC-BSS TYPE M M M (1) M# M (6) M O O (7) O (3) M O O (9) O (4) O (8) O (10) O (5) O (11) O (12) O (2) O(13) O(14) O (15) LEN 1 5-10 3-n 2 4-5 5-10 3 3 2 3-10 2 3-4 3-14 2 2 3-8 1 2 2 2-n 3+4n 2

1) If the MSC has not sent a CIPHER MODE COMMAND for this RR connection (or has had all such CIPHER MODE COMMANDs rejected with CIPHER MODE REJECT messages) then the MSC shall indicate that the only permitted algorithm is no encryption.

Huawei Technologies Proprietary A-5

2) 3)

If this information element is included, it shall be equal to the last received Chosen Encryption Algorithm information element. This element may be included in the case of a speech TCH, and only in this case. If not included, this

has no impact on the DTX function in the BSS. 4) 5) 6) 7) 8) This element is included if the MSC has received such information. This element is included if the MS is in a voice broadcast or voice group call. One of these two elements is sent. This element is included when the channel type Information Element indicates speech or data, and only in those cases. This element is included at least when the message is sent as a reaction to reception of a HANDOVER REQUIRED message containing a Current channel type 1 information element. In this case it shall be equal to the received element. 9) This information element should always be included. Its cause value should be the same as indicated in the corresponding HANDOVER REQUIRED message. 10) This element is included at least when the message is sent as a reaction to reception of a HANDOVER REQUIRED message containing a Speech version (used) information element. In this case it shall be equal to the received element. 11) This information element is included for voice group call, when this is included it indicates that the mobile is a talker in the call else the mobile is a listener. 12) The information is indicated by the MSC if known 13) This element is included if and only if the message is sent as a reaction to the reception of a HANDOVER REQUIRED message containing an old BSS to new BSS information information element. Its contents shall be equal to the received element. 14) This information element is included when the subscriber has localized service area support. 15) This information element is included if LSA access control function shall be suppressed in the BSS. Typical cause values are: - uplink quality, - uplink strength, - downlink quality, - downlink strength - distance, - better cell, -response to MSC invocation -O and M intervention, - directed retry, -switch circuit pool, - traffic, - preemption.

V. HANDOVER REQUEST ACKNOWLEDGE

This message is sent from the BSS to the MSC and indicates that the request to support a handover at the target BSS can be supported by the BSS, and also to which radio channel(s) the MS should be directed. The message is sent via the BSSAP SCCP connection associated with the dedicated resource. INFORMATION ELEMENT Message Type REFERENCE 12.1 DIRECTION BSS-MSC TYPE M LEN 1

Layer 3 Information Chosen Channel Chosen Encryption Algorithm Circuit Pool Speech Version (Chosen) Circuit Identity Code LSA Identifier

1.2.3 1.2.14 1.2.15 1.2.16 1.2.17 1.2.5 1.2.18

BSS-MSC BSS-MSC BSS-MSC BSS-MSC BSS-MSC BSS-MSC BSS-MSC

M (1) O (4) O (5) O (2) O (6) O (3) O (7)

11-n 2 2 2 2 3 5

1) This information field carries a radio interface HANDOVER COMMAND message. 2) Shall be included when several circuit pools are present on the BSS MSC interface and a circuit was allocated by the HANDOVER REQUEST message. 3) The Circuit identity code information element is included mandatory by the BSS if the BSS allocates the A-interface circuits and a circuit is needed. 4) Included at least when the channel rate/type choice was done by the BSS. 5) Included at least when the encryption algorithm has been selected by the BSS. 6) Included at least when the speech version choice was done by the BSS. 7) Shall be included if a new potential current LSA in the target cell has been identified (see GSM 03.73). Not included means that there is no potential current LSA in the target cell.
VI. HANDOVER REQUIRED
This message is sent from the BSS to the MSC to indicate that for a given MS which already has dedicated radio resource(s) assigned, a handover is required for the reason given by the cause element. The message is sent via the BSSAP SCCP connection associated with the dedicated resource(s). INFORMATION ELEMENT Message Type Cause Response Request Cell Identifier List (Preferred) REFERENCE 1.2.1 1.2.19 1.2.28 1.2.29 DIRECTION BSS-MSC BSS-MSC BSS-MSC BSS-MSC TYPE M M O M LEN 1 3-4 1 2n+3 to 7n+3 Circuit Pool List Current Channel Type 1 Speech Version (Used) Queuing Indicator Old BSS to New BSS Information 1.2.20 1.2.24 1.2.17 1.2.30 1.2.26 BSS-MSC BSS-MSC BSS-MSC BSS-MSC BSS-MSC O (1) O (2) O (3) O O V 2 2 2 2-n

1) Shall be included when cause "switch circuit pool" and the MSC allocates the A-interface circuit. 2) This information element should always be included. 3) This

information element should always be included when the channel mode is speech, and only in this case. Typical Cause values are: - uplink quality, - uplink strength, - downlink quality, - downlink strength, - distance, - better cell, -response to MSC invocation, - O&M intervention, - directed retry, -switch circuit pool, - traffic, - preemption.
VII. HANDOVER REQUIRED REJECT
This message is sent from the MSC to the BSS via the relevant SCCP connection. It indicates to the BSS that the HANDOVER REQUIRED message has not resulted in handover. INFORMATION ELEMENT Message Type Cause REFERENCE 1.2.1 1.2.19 DIRECTION MSC-BSS MSC-BSS TYPE M M LEN 1 3-4

Typical Cause values are: - equipment failure, -no radio resource available, -requested terrestrial resource unavailable, -invalid message contents, -requested transcoding/rate adaptation unavailable, -O and M intervention.
VIII. HANDOVER COMMAND
This message is sent from the MSC to the BSS via the relevant SCCP connection and contains the target channel to which the MS should retune. INFORMATION ELEMENT Message Type REFERENCE 1.2.1 DIRECTION MSC-BSS TYPE M LEN 1

Layer 3 Information Cell Identifier

1.2.31 1.2.13

MSC-BSS MSC-BSS

M (1) O

11-n 3-10

This information field carries a radio interface HANDOVER COMMAND message.

IX. HANDOVER COMPLETE
This message is sent from the BSS to the MSC via the relevant SCCP connection. It indicates that the correct MS has successfully accessed the target cell. INFORMATION ELEMENT Message Type RR Cause REFERENCE 1.2.1 1.2.12 DIRECTION BSS-MSC BSS-MSC TYPE M O LEN 1 2

X. HANDOVER FAILURE
This message is sent from the BSS to the MSC via the relevant SCCP connection. It indicates to the MSC that there has been a failure in the resource allocation process on handover, and that the handover has been aborted. INFORMATION ELEMENT Message Type Cause RR Cause Circuit Pool Circuit Pool List REFERENCE 1.2.1 1.2.19 1.2.12 1.2.16 1.2.20 DIRECTION BSS-MSC BSS-MSC BSS-MSC BSS-MSC BSS-MSC TYPE M M O O (1) O (2) LEN 1 3-4 2 2 V

1) Shall be included when several circuit pools are present on the BSS MSC interface. 2) May be included when cause is "circuit pool mismatch" or "switch circuit pool" to indicate circuit pool preferences. Typical Cause values are: -radio interface message failure; -O and M intervention; - Equipment failure; -no radio resource available; -requested terrestrial resource unavailable; -requested transcoding/rate adaption unavailable; -terrestrial resource already allocated; -invalid message contents;

-radio interface failure - reversion to old channel; -ciphering algorithm not supported; -circuit pool mismatch; -switch circuit pool; -requested speech version unavailable.
XI. HANDOVER PERFORMED
This message is sent from the BSS to the MSC in order to indicate that the BSS has performed an internal handover. The cell identifier and (if required for O and M reasons) optionally the new channel identity is included. The message is sent via the BSSAP SCCP connection associated with the dedicated resource(s). INFORMATION ELEMENT Message Type Cause Cell Identifier Chosen Channel Chosen Encryption Algorithm Speech Version (Chosen) LSA Identifier REFERENCE 1.2.1 1.2.19 1.2.13 1.2.14 1.2.15 1.2.17 1.2.18 DIRECTION BSS-MSC BSS-MSC BSS-MSC BSS-MSC BSS-MSC BSS-MSC BSS-MSC TYPE M M M O (1) O (2) O (3) O (4) LEN 1 3-4 3-10 2 2 2 5

1) Included at least when the channel rate/type has changed during the handover. 2) Included at least when the encryption algorithm has been changed by the BSS. 3) Included at least when the speech version has been changed by the BSS. 4) Shall be included if current LSA in the new serving cell has been identified (see GSM 03.73). Not included means that there is no current LSA in the new serving cell. Typical Cause values: as for the handover required message, except response to MSC invocation.
XII. PAGING
This message is sent from the MSC to the BSS and contains sufficient information to allow the paging message to be transmitted by the correct cells at the correct time. This message is sent as a connectionless SCCP message. INFORMATION ELEMENT Message Type IMSI REFERENCE 1.2.1 1.2.32 DIRECTION MSC-BSS MSC-BSS TYPE M M LEN 1 3-10

INFORMATION ELEMENT TMSI Cell Identifier List Channel Needed eMLPP Priority

REFERENCE 1.2.33 1.2.29 1.2.34 1.2.35

DIRECTION MSC-BSS MSC-BSS MSC-BSS MSC-BSS

TYPE O (1) M O (2) O (3)

LEN 6 3 to 3+7n 2 2

1) This element is omitted in the exceptional case where the IMSI is used instead of the TMSI as a paging address at the radio interface. 2) If the channel needed element is not present, the default value is assumed to be 00 (any channel). 3) If the BSS implements the eMLPP feature it should use this information element to build the radio interface Paging request messages, otherwise the information may be considered as an unrecognisable information element.
XIII. CLEAR REQUEST
This message is sent from the BSS to the MSC to indicate to the MSC that the BSS wishes to release the associated dedicated resource(s). The message is sent via the BSSAP SCCP connection associated with the dedicated resource(s). INFORMATION ELEMENT Message Type Cause REFERENCE 1.2.1 1.2.19 DIRECTION BSS-MSC BSS-MSC TYPE M M LEN 1 3-4

Typical Cause values are: -radio interface message failure, -O and M intervention, - equipment failure, -Joined group call channel, -protocol error between BSS and MSC, - preemption.
XIV. CLEAR COMMAND
This message is sent from the MSC to the BSS to instruct the BSS to release the associated dedicated resource(s). The message is sent via the BSSAP SCCP connection associated with the dedicated resource(s). INFORMATION ELEMENT Message Type REFERENCE 1.2.1 DIRECTION MSC-BSS TYPE M LEN 1

Layer 3 Header Information Cause

1.2.3 1.2.19

MSC-BSS MSC-BSS

O (1) M

4 3-4

This information element doesnt serve any useful purpose. MSCs should not send the information element unless it is required by the recipients (due to the need to interwork with older versions of the protocol). It is expected that in future versions of 08.08, this information element will be deleted from this message. Typical Cause values are: - call control, -O and M intervention, - equipment failure, - handover successful, -protocol error between BSS and MSC.
XV. CLASSMARK REQUEST
This message is sent from the MSC to the BSS via the relevant SCCP connection associated with that MS transaction. It requests an update of the classmark parameters for the concerned MS. INFORMATION ELEMENT Message Type REFERENCE 1.2.1 DIRECTION MSC-BSS TYPE M LEN 1

XVI. CLASSMARK UPDATE

This message is sent from the BSS to the MSC or from the MSC to the BSS via the relevant SCCP connection associated with that MS transaction. It updates the classmark parameters for the concerned MS.

Huawei Technologies Proprietary A-13

INFORMATION ELEMENT Message Type Classmark Information Type 2 Classmark Information Type 3

REFERENCE 1.2.1 1.2.8 1.2.23

DIRECTION Both Both Both

TYPE M M O (1)

LEN 1 4-5 3-14

This element shall be included by the BSS if it was received from the MS. It shall be included by the MSC if this information element has previously been received by the MSC.
XVII. CIPHER MODE COMMAND
This message is sent from the MSC to the BSS via the relevant SCCP connection associated with that MS transaction. It updates the encryption parameters for the concerned MS.

INFORMATION ELEMENT Message Type Layer 3 Header Information Encryption Information Cipher Response Mode

REFERENCE

DIRECTION

TYPE

LEN

1.2.1 1.2.3

MSC-BSS MSC-BSS

M O (1)

1 4

1.2.21 1.2.36

MSC-BSS MSC-BSS

M O

3-n 2

This information element doesnt serve any useful purpose. MSCs should not send the information element unless it is required by the recipients (due to the need to interwork with older versions of the protocol). It is expected that in future versions of 08.08, this information element will be deleted from this message.
XVIII. CIPHER MODE COMPLETE
This message is sent from the BSS to the MSC via the relevant SCCP connection. It indicates that a successful cipher synchronisation has been achieved across the radio interface. INFORMATION ELEMENT Message Type Layer 3 Message Contents Chosen Encryption Algorithm REFERENCE 1.2.1 1.2.37 1.2.15 DIRECTION BSS-MSC BSS-MSC BSS-MSC TYPE M O O (1) LEN 1 2-n 2

Included at least when the encryption algorithm has been selected by the BSS.
XIX. CIPHER MODE REJECT
This message is sent from the BSS to the MSC via the relevant SCCP connection associated with that MS transaction. It indicates that the BSS is unable to perform the requested ciphering. INFORMATION ELEMENT Message Type Cause REFERENCE 1.2.1 1.2.19 DIRECTION BSS-MSC BSS-MSC TYPE M M LEN 1 3-4

Typical Cause values are: -Ciphering algorithm not supported, -Invalid message contents
XX. COMPLETE LAYER 3 INFORMATION
The message is sent from the BSS to the MSC via the BSSAP SCCP connection established for the associated dedicated resource(s). INFORMATION ELEMENT REFERENCE DIRECTION TYPE LEN

Message Type Cell Identifier Layer 3 Information Chosen Channel LSA Identifier List APDU

1.2.1 1.2.13 1.2.31 1.2.14 1.2.38 3.2.2.68

BSS-MSC BSS-MSC BSS-MSC BSS-MSC BSS-MSC BSS-MSC

M M M O (1) O (2) O (3)

1 3-10 3-n 2 3+3n 3-n

This element is optionally used by the BSS to give the MSC a description of the channel rate/type on which the initial layer 3 message was received. This element shall be included at least when the current cell belongs to one or more LSAs. This element is optionally used by the BSS to provide Location Services related information to MSC. A.1.2 Signaling element coding
This paragraph contains the CODING of the signaling elements used. The following conventions are assumed for the sequence of transmission of bits and bytes: Each bit position is marked as 1 to 8. Bit 1 is the least significant bit and is transmitted first. In an element octets are identified by number, octet 1 is transmitted first, then octet 2 etc. When a field extends over more than one octet, the order of bit values progressively decreases as the octet number increases. The least significant bit of the field is represented by the lowest numbered bit of the highest numbered octet of the field. For variable length elements a length indicator is included, this indicates the number of octets following in the element. All fields within Information Elements are mandatory unless otherwise specified. The Information Element Identifier shall always be included. All spare bits are set to 0. The elements used and their CODING are: Element Identifier Coding 0000 0001 0000 0010 0000 0011 0000 0100 0000 0101 0000 0110 0000 0111 0000 1000 0000 1001 0000 1010 0000 1011 0000 1100 Element name

Circuit Identity Code Reserved Resource Available Cause Cell Identifier Priority Layer 3 Header Information IMSI TMSI Encryption Information Channel Type Periodicity

0000 1101 0000 1110 0000 1111 0001 0000

Extended Resource Indicator Number Of MSs Reserved Reserved Element name

Element Identifier Coding 0001 0001 0001 0010 0001 0011 0001 0100 0001 0101 0001 0110 0001 0111 0001 1000 0001 1001 0001 1010 0001 1011 0001 1100 0001 1101 0001 1110 0001 1111 0010 0000 0010 0001 0010 0010 0010 0011 0010 0100 0010 0101 0010 0110 0010 0111 0010 1000 0010 1001 0010 1010 0010 1011 0010 1100 0010 1101

Reserved Classmark Information Type 2 Classmark Information Type 3 Interference Band To Be Used RR Cause Reserved Layer 3 Information DLCI Downlink DTX Flag Cell Identifier List Response Request Resource Indication Method Classmark Information Type 1 Circuit Identity Code List Diagnostic Layer 3 Message Contents Chosen Channel Total Resource Accessible Cipher Response Mode Channel Needed Trace Type Trigger id Trace Reference Transaction id Mobile Identity OMC Id Forward Indicator Chosen Encryption Algorithm Circuit Pool

0010 1110 0010 1111

Circuit Pool List Time Indication Element name

Element Identifier Coding 0011 0000 0011 0001 0011 0010 0100 0000 0011 0011 0011 0101 0011 0110 0011 0111 0011 1000 0011 1001 0011 1010 0011 1011 0011 1100 0011 1101 0011 1110 0011 1111 0100 0011 0100 0100 0100 0101 0100 0110 0100 0111 0100 1000 0100 1001 0100 1010 0100 1011 0100 1100 0100 1101 0100 1110 0100 1111

Resource Situation Current Channel type 1 Queuing Indicator Speech Version Assignment Requirement Talker Flag Connection Release Requested Group Call Reference eMLPP Priority Configuration Evolution Indication Old BSS to New BSS Information LSA Identifier LSA Identifier List LSA Information LCS QoS LSA access control suppression LCS Priority Location Type Location Estimate Positioning Data LCS Cause LCS Client Type APDU Network Element Identity GPS Assistance Data Deciphering Keys Return Error Request Return Error Cause Segmentation

A.1.3 Message Type

Message Type uniquely identifies the message being sent. It is a single octet element,

mandatory in all messages. Bit 8 is reserved for future extension of the code set. All unassigned codes are spare. 87654321 00000000 ASSIGNMENT MESSAGES 00000001 00000010 00000011 HANDOVER MESSAGES 00010000 00010001 00010010 00010011 00010100 00010101 00010110 00010111 00011000 00011001 00011010 00011011 RELEASE MESSAGES 00100000 00100001 00100010 00100011 00100100 00100101 00100110 CLEAR COMMAND CLEAR COMPLETE CLEAR REQUEST RESERVED RESERVED SAPI N REJECT CONFUSION HANDOVER REQUEST HANDOVER REQUIRED HANDOVER REQUEST ACKNOWLEDGE HANDOVER COMMAND HANDOVER COMPLETE HANDOVER SUCCEEDED HANDOVER FAILURE HANDOVER PERFORMED HANDOVER CANDIDATE ENQUIRE HANDOVER CANDIDATE RESPONSE HANDOVER REQUIRED REJECT HANDOVER DETECT ASSIGNMENT REQUEST ASSIGNMENT COMPLETE ASSIGNMENT FAILURE Reserved.

OTHER CONNECTION RELATED MESSAGES

87654321 00101000 00101001 00101010 SUSPEND RESUME CONNECTION ORIENTED INFORMATION

00101011 00101100 00101101 00101110 GENERAL MESSAGES 00110000 00110001 00110010 00110011 00110100 00110101 00110110 00110111 00111010

PERFORM LOCATION REQUEST LSA INFORMATION PERFORM LOCATION RESPONSE PERFORM LOCATION ABORT

RESET RESET ACKNOWLEDGE OVERLOAD RESERVED RESET CIRCUIT RESET CIRCUIT ACKNOWLEDGE MSC INVOKE TRACE BSS INVOKE TRACE CONNECTIONLESS INFORMATION

TERRESTRIAL RESOURCE MESSAGES 01000000 01000001 01000010 01000011 01000100 01000101 01000110 01000111 01001000 01001110 01001111 BLOCK BLOCKING ACKNOWLEDGE UNBLOCK UNBLOCKING ACKNOWLEDGE CIRCUIT GROUP BLOCK CIRCUIT GROUP BLOCKING ACKNOWLEDGE CIRCUIT GROUP UNBLOCK CIRCUIT GROUP UNBLOCKING ACKNOWLEDGE UNEQUIPPED CIRCUIT CHANGE CIRCUIT CHANGE CIRCUIT ACKNOWLEDGE

RADIO RESOURCE MESSAGES 01010000 RESOURCE REQUEST

87654321 01010001 01010010 01010011 01010100 01010101 RESOURCE INDICATION PAGING CIPHER MODE COMMAND CLASSMARK UPDATE CIPHER MODE COMPLETE

01010110 01010111 01011000 01011001 01011010 VGCS/ VBS 00000100 00000101 00000110 00000111 00011100 00011101 00011110 00011111 00100111 01001001 01001010 01001011 01001100 01001101

QUEUING INDICATION COMPLETE LAYER 3 INFORMATION CLASSMARK REQUEST CIPHER MODE REJECT LOAD INDICATION

VGCS/VBS SETUP VGCS/VBS SETUP ACK VGCS/VBS SETUP REFUSE VGCS/VBS ASSIGNMENT REQUEST VGCS/VBS ASSIGNMENT RESULT VGCS/VBS ASSIGNMENT FAILURE VGCS/VBS QUEUING INDICATION UPLINK REQUEST UPLINK REQUEST ACKNOWLEDGE UPLINK REQUEST CONFIRMATION UPLINK RELEASE INDICATION UPLINK REJECT COMMAND UPLINK RELEASE COMMAND UPLINK SEIZED COMMAND

I. Channel Type
This element contains all of the information that the BSS requires to determine the required radio resource(s). The channel type information element has a minimum length of 5 octets and a maximum length of 10 octets. It is coded as follows:

Huawei Technologies Proprietary A-21

1 octet 1 octet 2

Element identifier Length Spare Channel rate and type Permitted speech version indication / data rate + transparency indicator Speech/data indicator

octet 3 octet 4 octet 5 or octet 5 with extension*

* If the speech / data indicator (octet 3) indicates "speech" or

data, octet 5 may optionally be extended. Otherwise octet 5 shall not be extended. The "speech / data indicator" field is coded as follows: 0001 Speech 0010 Data 0011 Signaling All other values are reserved. For values 0001 and 0010 a dedicated terrestrial resource is also required. The "channel rate and type" is coded as follows: If octet 3 indicates data then octet 4 shall be coded as: 0000 1000 Full rate TCH channel Bm 0000 1001 Half rate TCH channel Lm 0000 1010 Full or Half rate TCH channel, Full rate preferred, changes allowed also after first channel allocation as a result of the request. 0000 1011 Full or Half rate TCH channel, Half rate preferred, changes allowed also after first channel allocation as a result of the request. 0001 1010 Full or Half rate TCH channel, Full rate preferred, changes not allowed after first channel allocation as a result of the request. 0001 1011 Full or Half rate TCH channel. Half rate preferred, changes not allowed after first channel allocation as a result of the request. 0010 0xxx Full rate TCH channels in a multislot configuration, changes by the BSS of the number of TCHs and if applicable the used radio interface rate per channel allowed after first channel allocation as a result of the request. 0011 0xxx Full rate TCH channels in a multislot configuration, changes by the BSS of the number of TCHs or the used radio interface rate per channel not allowed after first channel allocation as a result of the request. xxx (bits 3-1) indicates maximum number of traffic channels; 321 000 1 TCHs 001 2 TCHs 010 3 TCHs 011 4 TCHs 100 5 TCHs 101 6 TCHs 110 7 TCHs 111 8 TCHs All other values are reserved. If octet 3 indicates speech then octet 4 shall be coded as: 0000 1000 Full rate TCH channel Bm. Preference between the permitted speech versions for full rate TCH as indicated in octet 5, 5a etc.. 0000 1001 Half rate TCH channel Lm. Preference between the permitted speech versions for half rate TCH as indicated in octet 5, 5a etc. 0000 1010 Full or Half rate TCH channel, Full rate preferred, changes between full rate and half rate allowed also after first channel allocation as a result of the request. Preference between the permitted speech versions for the respective channel rates as indicated in octet 5, 5a etc. 0000 1011 Full or Half rate TCH channel, Half rate preferred, changes

between full rate and half rate allowed also after first channel allocation as a result of the request. Preference between the permitted speech versions for the respective channel rates as indicated in octet 5, 5a etc. 0001 1010 Full or Half rate TCH channel, Full rate preferred, changes between full rate and half rate not allowed after first channel allocation as a result of the request. Preference between the permitted speech versions for the respective channel rates as indicated in octet 5, 5a etc. 0001 1011 Full or Half rate TCH channel. Half rate preferred, changes between full rate and half rate not allowed after first channel allocation as a result of the request. Preference between the permitted speech versions for the respective channel rates as indicated in octet 5, 5a etc. 0000 1111 Full or Half rate TCH channel. Preference between the permitted speech versions as indicated in octet 5, 5a etc., changes between full and half rate allowed also after first channel allocation as a result of the request 0001 1111 Full or Half rate TCH channel. Preference between the permitted speech versions as indicated in octet 5, 5a etc., changes between full and half rate not allowed after first channel allocation as a result of the request All other values are reserved. If octet 3 indicates signaling then octet 4 shall be coded as: 0000 0000 SDCCH or Full rate TCH channel Bm or Half rate TCH channel Lm 0000 0001 SDCCH 0000 0010 SDCCH or Full rate TCH channel Bm 0000 0011 SDCCH or Half rate TCH channel Lm 0000 1000 Full rate TCH channel Bm 0000 1001 Half rate TCH channel Lm 0000 1010 Full or Half rate TCH channel, Full rate preferred, changes allowed also after first channel allocation as a result of the request. 0000 1011 Full or Half rate TCH channel, Half rate preferred, changes allowed also after first channel allocation as a result of the request. 0001 1010 Full or Half rate TCH channel, Full rate preferred, changes not allowed after first channel allocation as a result of the request. 0001 1011 Full or Half rate TCH channel. Half rate preferred, changes not allowed after first channel allocation as a result of the request. All other values are reserved. The "permitted speech version indication / data rate + transparency indicator" octet is coded as follows: If

octet 3 indicates speech then octet 5 shall be coded as follows: 8 ext ext ext ext ext 0 7 6 5 4 3 2 1 octet 5 octet 5a octet 5b octet 5c octet 5d octet 5e

permitted speech version identifier permitted speech version identifier permitted speech version identifier permitted speech version identifier permitted speech version identifier permitted speech version identifier

Bit 8 indicates extension of octet 5. 0 no extension, i.e. value "0" indicates that this octet is the last octet. 1 extension, i.e. value "1" indicates that at least one additional octet is included. If more than one permitted speech version is indicated by octet 5 (with extension), then the speech version choice is left to the BSS. Bits 7-1 indicate the permitted speech version identifier; 765 4321 000 0001 GSM speech full rate version 1 001 0001 GSM speech full rate version 2 010 0001 GSM speech full rate version 3 000 0101 GSM speech half rate version 1 001 0101 GSM speech half rate version 2 010 0101 GSM speech half rate version 3 NOTE:Bits 7-1 indicate six speech versions. The GSM speech full rate version 3 is also referred as the adaptive multi-rate full rate speech version 1 The GSM speech half rate version 3 is also referred as the adaptive multi-rate half rate speech version 1 All other values of permitted speech version identifiers are for future use. If an unknown value is received and more than one octet 5 is received the sender expects the receiver to behave as if it has made a choice of speech version. The rules for coding preferences in octet 5, 5a - 5e are the following: -In those cases when one specific channel rate is indicated in octet 4, the non-

empty set of permitted speech versions is included. Within this set the permitted speech versions are included in order of speech version preferences. -In those cases when a preference for a channel rate is indicated in octet 4, the non-empty sets of permitted speech versions for the respective channel rate are included in order of the channel rate preferences indicated in octet 4. Within a set of permitted speech versions for a channel rate, the permitted speech versions are included in order of speech version preferences. -In those cases when no preference or specific channel rate is indicated in octet 4, the permitted speech versions are included in order of speech version preferences. Always octet 5 has the highest preference followed by octet 5a and so on. For each channel rate allowed by octet 4 at least one speech version shall be present. If octet 5 indicates no extension and bits 7-1 is coded "000 0001", then the preference is interpreted based upon the octet 4 value as follows: -in those cases when octet 4 indicates one specific channel rate, then speech version 1 for the indicated channel rate is permitted. -in those cases when octet 4 indicates a preference for a channel rate, then speech version 1 for any of the allowed channel rates is permitted. -in those cases when octet 4 does neither indicate a preference for a channel rate nor a specific channel rate, then speech version 1 for any of the allowed channel rates is permitted and speech full rate version 1 is preferred. If octet 3 indicates data, and octet 4 does not indicate multislot configuration, then octet 5 shall be coded as follows:
8 ext ext 7 T/NT spare 6 Rate allowed radio interface rates 5 4 3 2 1 octet 5 octet 5a

Bit 8 indicates extension of octet 5. 0 no extension, i.e. value "0" indicates that this octet is the last octet. 1 extension, i.e. value "1" indicates that at least one additional octet is included. Bit 7: 0 Transparent service 1 Non-transparent service. For non-transparent service bits 6-1 indicate the radio interface data rate; 65 4321 00 0000 12 kbit/s if the channel is a full rate TCH, or 6 kbit/s if the channel is a half rate TCH 01 1000 14.5 kbit/s 01 0000 12 kbit/s 01 0001 6 kbit/s If bit 7 in octet 5 indicates non-transparent service and octet 5a is included the rate in octet 5 indicates the wanted air interface data rate and the allowed r i/f rates indicates the other possible data rates allowed. All other values are reserved. For transparent service bits 6-1 indicate the data rate; 65 4321 01 1000 14.4 kbit/s 01 0000 9.6 kbit/s 01 0001 4.8 kbit/s 01 0010 2.4

kbit/s 01 0011 1.2 kbit/s 01 0100 600 bit/s 01 0101 1200/75 bit/s (1200 network-to-MS / 75 MS-to-network) If bit 7 in octet 5 indicates transparent service octet 5 shall not be extended. All other values are reserved. Octet 5a shall be coded as follows: Bit 8 reserved for extension. A coding of 0 indicates no extension Bits 4 to 1 indicate allowed radio interface data rate, per channel: Bit 4: 0 14.5 kbit/s (TCH/F14.4) not allowed 1 14.5 kbit/s (TCH/F14.4) allowed Bit 3: Spare Bit 2: 0 12.0 kbit/s (TCH/F9.6) not allowed 1 12.0 kbit/s (TCH/F9.6) allowed Bit 1: 0 6.0 kbit/s (TCH/F4.8) not allowed 1 6.0 kbit/s (TCH/F4.8) allowed If octet 3 indicates data and octet 4 indicates Full rate TCH channels in a multislot configuration, octet 5 and 5a shall be coded as follows;
8 ext ext 7 T/NT spare 6 Rate allowed radio interface rates 5 4 3 2 1 octet 5 octet 5a

Octet 5 shall be coded as follows; Bit 8: extension bit 0 indicates no extension 1 indicates that at least one additional octet is included Bit 7: 0 Transparent service 1 Non-transparent service. For non-transparent service bits 6-1 indicates wanted total radio interface data rate; 65 4321 01 0110 58 kbit/s (4x14.5 kbit/s) 01 0100 48.0 / 43.5 kbit/s (4x12 kbit/s or 3x14.5 kbit/s) 01 0011 36.0 / 29.0 kbit/s (3x12 kbit/s or 2x14.5 kbit/s) 01 0010 24.0 / 24.0 (4x6 kbit/s or 2x12 kbit/s) 01 0001 18.0 / 14.5 kbit/s (3x6 kbit/s or 1x14.5 kbit/s) 01 0000 12.0 / 12.0 kbit/s (2x6 kbit/s or 1x12 kbit/s) All other values are reserved. For transparent service bits 6-1 indicates requested air interface user rate; 65 4321 01 1111 64 kbit/s, bit transparent 01 1110 56 kbit/s, bit transparent 01 1101 56 kbit/s

01 1100 48 kbit/s 01 1011 38.4 kbit/s 01 1010 28.8 kbit/s 01 1001 19.2 kbit/s 01 1000 14.4 kbit/s 01 0000 9.6 kbit/s All other values are reserved. Octet 5a shall be coded as follows; Bit 8 reserved for extension. A coding of 0 indicates no extension Bits 4 to 1 indicates allowed radio interface data rate, per channel; Bit 4: 0 14.5/14.4 kbit/s (TCH/F14.4) not allowed 1 14.5/14.4 kbit/s (TCH/F14.4) allowed Bit 3: Spare Bit 2: 0 12.0/9.6 kbit/s (TCH F/9.6) not allowed 1 12.0/9.6 kbit/s (TCH F/9.6) allowed Bit 1: 0 6.0/4.8 kbit/s (TCH F/4.8) not allowed 1 6.0/4.8 kbit/s (TCH F/4.8) allowed If octet 5a is not included, allowance of radio interface data rates of 12.0 and 6.0 shall be presumed. NOTE: For data services, the information in the channel type Information Element is used to set the "E-bits" and map the "D-bits" (as described in GSM 04.21 and 08.20) and to select the correct channel coding. If octet 3 indicates signaling then octet 5 is spare.
II. Layer 3 Header Information
This element is used to supply the BSS with information that needs to be included in the header of layer 3 messages over the radio interface. 8 7 6 5 4 3 2 1 octet 1 octet 2 octet 3 octet 4

Element identifier Length Protocol discriminator Transaction identifier

The length indicator is a binary indication of the number of octets following in the element.

The transaction identifier and protocol discriminator fields are coded as defined in GSM 04.08. The protocol discriminator occupies bit 1 to 4 in octet 3 of Layer 3 header information, the Transaction identifier occupies bit 1 to 4 in octet 4 of the Layer 3 header information.
III. Priority
This element indicates the priority of the request. It is coded as follows: 8 7 6 5 4 3 2 1 octet 1 octet 2 octet 3

Element identifier Length Priority

Octet 2 is a binary indication of the length of the rest of the element. Octet 3 is coded as follows:
8 spare 7 pci 6 5 4 3 2 qa 1 pvi octet 1

priority level

Bit 8 is spare, set to 0 pci = Preemption Capability indicator (see note) 0 this allocation request shall not preempt an existing connection 1 this allocation request may preempt an existing connection priority level:
6543 0000 0001 0010 1110 1111 spare priority level 1 = highest priority priority level 2 = second highest priority priority level 14 = lowest priority priority not used

qa = queuing allowed indicator 0 queuing not allowed 1 queuing allowed pvi = Preemption Vulnerability indicator (see note) 0 this connection shall not be preempted by another allocation request 1 this connection might be preempted by another allocation request NOTE:Preemption Capability indicator applies to the allocation of resources for an event and as such it provides the trigger to the preemption procedures/processes of the BSS. Preemption Vulnerability indicator applies for the entire duration of a connection and as such indicates whether the connection is a target of the preemption procedures/processes of the BSS.

IV. Circuit Identity Code

This element defines the terrestrial channel over which the call will pass. If a 2048Kbits/s digital path is used then the circuit identification code contains in the 5 least significant bits a binary representation of the actual number of the timeslot which is assigned to the circuit. The remaining bits in the CIC are used where necessary, to identify one among several systems interconnecting an originating and destination point. The element is 2 octets in length: 8 7 6 5 4 3 2 1 octet 1 f X g X h X octet 2 octet 3

Element identifier a i b j c k d X e X

a-k defines the PCM multiplex in use. XXXXX define the actual timeslot in use. The circuit identity code defines the PCM multiplex and timeslot in use at the MSC. In cases where remultiplexing takes place between the MSC and BSS a translation may

be necessary at the BSS.If a 1544 kbit/s digital path is used, then the format of the circuit identity code (CIC) shallbe as shown below: The element is 2 octets in length:

1 octet 1 octet 2 octet 3

Element identifier CIC (least significant bits) CIC (most significant bits)

V. Downlink DTX Flag

A fixed length element indicating whether the DTX function in the BSS is to be disabled on a particular radio channel. 8 7 6 5 4 3 2 1 octet 1 octet 2

Element identifier Downlink DTX flag

The Downlink DTX Flag is coded as follows: -bits 8 to 2 are spare; -bit 1 is set to one if the MSC forbids the BSS to activate DTX in the downlink direction; it

is set to 0 otherwise.
VI. Interference Band To Be Used
This fixed length element is coded as follows: Octet 2 is coded as: Bits 876 Spare Bits 54321 A bit map indicating which interference bands are acceptable, the LSB 8 7 6 5 4 3 2 1 octet 1 octet 2

Element identifier Band to be used

represents the least level of interference.

VII. Classmark Information Type 2
The classmark information type 2 defines certain attributes of the mobile station equipment in use on a particular transaction. It is coded as follows: 8 7 6 5 4 3 2 1 octet 1 octet 2 octet 3 -5

Element identifier Length Classmark

Octet 2 is a binary indication of the length of the remainder of the element in octets. The length shall be determined by the length of the Mobile Station Classmark 2 element of GSM 04.08. The classmark octets 3, 4 and 5 are coded in the same way as the equivalent octets in the Mobile station classmark 2 element of GSM 04.08.
VIII. Group Call Reference
It is coded as follows: 8 7 6 5 4 3 2 1 octet 1 octet 2 octet 3 -8

Element identifier Length Descriptive group or broadcast call reference

Octet 2 is a binary indication of the length of the remainder of the element in octets. The octets 3 to 8 are coded in the same way as the octets 2-6 in the Descriptive group or broadcast call reference information element as defined in GSM 04.08.
IX. Talker Flag

X. LSA Access Control Suppression

8 Element identifier 7 6 5 4 3 2 1 octet 1

This information element is included if LSA access control function shall be suppressed in the BSS. It is coded as follows:
8 7 6 5 4 3 2 1 octet 1 EM octet 2

Element identifier spare

If the connection is an emergency call the MSC shall set the emergency field (bit 1 of octet 2) to 1. If the emergency field is set to 1, the BSS shall suppress exclusive access, LSA only access and preferential access functionality.
XI. RR Cause
This fixed length element is passed from the radio interface to the MSC transparently, when received in a GSM 04.08 message. 8 Element identifier RR cause 7 6 5 4 3 2 1 octet 1 octet 2

Octet 2 is coded as the equivalent field from GSM 04.08.

XII. Cell Identifier
This element uniquely identifies a cell within a BSS and is of variable length containing the following fields: 8 Element identifier 8 Length Spare Cell identification Cell identification discriminator 7 6 5 4 3 2 1 octet 2 octet 3 octet 4 n 7 6 5 4 3 2 1 octet 1

The coding of octet 2 is a binary number indicating the length of the remaining element. The length depends on the Cell identification discriminator (octet 3). The coding of "Cell identification discriminator" (bits 1 to 4 of octet 3) is a binary number

indicating if the whole or a part of Cell Global Identification, CGI, according to GSM 03.03 is used for cell identification in octet 4-n. The "Cell identification discriminator" iscoded as follows: 0000 The whole Cell Global Identification, CGI, is used to identify the cell. 0001 Location Area Code, LAC, and Cell Identity, CI, is used to identify the cell. 0010 Cell Identity, CI, is used to identify the cell. 0011 No cell is associated with the transaction. All other values are reserved. The coding of octet 4-n depends on the Cell identification discriminator (octet 3). Below the coding is shown for each Cell identification discriminator: Note that no coding is specified for a Cell identification discriminator value of "0011" asno additional information is required. Coding of Cell Identification for Cell identification discriminator = 0000 For GSM 900 and DCS 1800:
8 7 6 5 4 MCC dig 1 1 1 MCC dig 3 MNC dig 1 3 2 1 octet 4 octet 5 octet 6 octet 7 octet 8 octet 9 octet 10

MCC dig 2 1 1

MNC dig 2 LAC LAC cont. CI value CI value cont

The octets 4-8 are coded as shown in GSM 04.08, Table Location Area Identification information element . The octets 9-10 are coded as shown in GSM 04.08, Table Cell Identity information element. For PCS 1900 for NA:
8 7 6 5 4 MCC dig 1 MCC dig 3 MNC dig 1 3 2 1 octet 4 octet 5 octet 6 octet 7 octet 8 octet 9 octet 10

MCC dig 2 MNC dig 3 MNC dig 2 LAC LAC cont. CI value CI value cont

The octets 4-8 are coded as shown in GSM 04.08, Table Location Area Identification information element.

The octets 9-10 are coded as shown in GSM 04.08, Table Cell Identity information element. Coding of Cell Identification for Cell identification discriminator = 0001
8 LAC LAC cont. CI value CI value cont 7 6 5 4 3 2 1 octet 4 octet 5 octet 6 octet 7

Coding of Cell Identification for Cell identification discriminator = 0010

8 CI value CI value cont 7 6 5 4 3 2 1 octet 4 octet 5

The octets 4-5 are coded as shown in GSM 04.08, Table Cell Identity information element

Huawei Technologies Proprietary A-36

XIII. Chosen Channel

This Information Element contains a description of the channel allocated to the MS.

For VGCS/VBS calls this Information Element contains a description of the channelallocated for the call in the cell. It is coded as follows: 8 7 6 5 4 3 2 1 octet 1 octet 2

Element identifier Channel mode Channel

The channel mode field is coded as follows: Bit 8765 0000 no channel mode indication 1001 speech (full rate or half rate) 1110data, 14.5 kbit/s radio interface rate
1011 1100 1101 1000 data, 12.0 kbit/s radio interface rate data, 6.0 kbit/s radio interface rate data, 3.6 kbit/s radio interface rate signaling only

All other values are reserved. The channel field is coded as follows: Bit 4321 0000 None (Note *) 0001 SDCCH 1000 1 Full rate TCH 1001 1 Half rate TCH 1010 2 Full Rate TCHs 1011 3 Full Rate TCHs 1100 4 Full Rate TCHs 1101 5 Full Rate TCHs
Signaling Analysis Manual M900/M1800 Base Station Controller Appendix A Message Interpretation

11106 Full Rate TCHs 11117 Full Rate TCHs0100 8 Full Rate TCHs All other values are reserved. NOTE *: This value may be returned in the chosen channel information for VGCS/VBS calls in the case where the BSS has decided to de-allocate resources or allocate no resources for the call.

XIV. Chosen Encryption Algorithm

This element indicates the encryption algorithm being used by the BSS. It is coded as follows: 8 7 6 5 4 3 2 1 octet 1 octet 2

Element identifier Algorithm identifier

The algorithm identifier caters for the possible future introduction of different user data encryption algorithms. It is coded as; 0000 0001 No encryption used 0000 0010 GSM user data encryption version 1(A5/1). 0000 0011 GSM A5/2 0000 0100 GSM A5/3 0000 0101 GSM A5/4 0000 0110 GSM A5/5 0000 0111 GSM A5/6 0000 1000 GSM A5/7 All other values are Reserved for future international use.
XV. Circuit Pool
This element indicates the circuit pool of a circuit or group of circuits. It is coded as follows: 8 7 6 5 4 3 2 1 octet 1 octet 2

Element identifier Circuit pool number

Predefined circuit pools are currently Circuit pool number 1 to Circuit pool number 32. The circuit pool element is coded as follows (along with the definition of the predefined circuit pools):
Coding 0000 0001 Pool Circuit pool number 1 Circuit pool number 2 Circuit pool number 3 Supported channels and speech coding algorithms FR speech version 1 FR data (12, 6, 3.6 kbit/s)

0000 0010

HR speech version 1 HR data (6, 3.6 kbit/s) FR speech version 1 FR data (12, 6, 3.6 kbit/s) HR speech version 1 HR data (6, 3.6 kbit/s)

0000 0011

0000 0100

Circuit pool number 4 Circuit pool number 5

FR speech version 2 FR data (12, 6, 3.6 kbit/s) FR speech version 1 FR speech version 2 FR data (12, 6, 3.6 kbit/s)

0000 0101

0000 0110

Circuit pool number 6

FR speech version 2 FR data (12, 6, 3.6 kbit/s) HR speech version 1 HR data (6, 3.6 kbit/s)

0000 0111

Circuit pool number 7

FR speech version 1 FR speech version 2 FR data (12, 6, 3.6 kbit/s) HR speech version 1 HR data (6, 3.6 kbit/s)

0000 1000

Circuit pool number 8 Circuit pool Pool number 9

HSCSD max 2 x FR data (12, 6 kbit/s)

0000 1001 Coding

FR data (12, 6, 3.6 kbit/s)

Supported channels and speech coding algorithms HR data (6, 3.6 kbit/s) HSCSD max 2 x FR data (12, 6 kbit/s)

0000 1010

Circuit pool number 10

FR speech version 1 FR speech version 2 FR data (12, 6, 3.6 kbit/s) HR speech version 1 HR data (6, 3.6 kbit/s) HSCSD max 2 x FR data (12, 6 kbit/s)

0000 1011 0000 1100

Circuit pool number 11 Circuit pool number 12

HSCSD max 4 x FR data (12, 6 kbit/s) FR data (12, 6, 3.6 kbit/s) HR data (6, 3.6 kbit/s) HSCSD max 4 x FR data (12, 6 kbit/s)

0000 1101

Circuit pool number 13

FR speech version 1 FR speech version 2 FR data (12, 6, 3.6 kbit/s) HR speech version 1 HR data (6, 3.6 kbit/s) HSCSD max 4 x FR data (12, 6 kbit/s)

0000 1110 0000 1111 0001 0000 0001 0001 0001 0010

Circuit pool number 14 Circuit pool number 15 Circuit pool number 16 Circuit pool number 17 Circuit pool number 18

HSCSD max 6 x FR data (12, 6 kbit/s) FR data (14.5 kbit/s) HSCSD max 2 x FR data (14.5 kbit/s) HSCSD max 4 x FR data (14.5 kbit/s) FR data (14.5, 12, 6, 3.6 kbit/s) HR data (6, 3.6 kbit/s) HSCSD max 2 x FR data (14.5, 12, 6 kbit/s)

0001 0011

Circuit pool number 19

FR data (14.5, 12, 6, 3.6 kbit/s) HR data (6, 3.6 kbit/s) HSCSD max 4 x FR data (14.5, 12, 6 kbit/s)

0001 0100 Coding

Circuit pool Pool number 20

FR speech version 1

Supported channels and speech coding algorithms FR speech version 2 FR data (14.5, 12, 6, 3.6 kbit/s) HR speech version 1 HR data (6, 3.6 kbit/s)

0001 0101

Circuit pool number 21

FR speech version 1 FR speech version 2 FR data (14.5, 12, 6, 3.6 kbit/s) HR speech version 1 HR data (6, 3.6 kbit/s) HSCSD max 2 x FR data (14.5, 12, 6 kbit/s)

0001 0110

Circuit pool number 22

FR speech version 1 FR speech version 2 FR data (14.5, 12, 6, 3.6 kbit/s) HR speech version 1 HR data (6, 3.6 kbit/s) HSCSD max 4 x FR data (14.5, 12, 6 kbit/s)

0001 0111

Circuit pool number 23 Circuit pool number 24

FR speech version 3 HR speech version 3 FR speech version 3 FR data (12, 6, 3.6 kbit/s) HR speech version 3

0001 1000

0001 1001

Circuit pool number 25

FR speech version 1 FR speech version 2 FR speech version 3 FR data (12, 6, 3.6 kbit/s) HR speech version 3

0001 1010

Circuit pool number 26

FR speech version 1 FR speech version 2 FR speech version 3 FR data (14.5, 12, 6, 3.6 kbit/s) HR speech version 3

0001 1011 Coding

Circuit pool Pool number 27

FR speech version 1

Supported channels and speech coding algorithms FR speech version 2 FR speech version 3 FR data (12, 6, 3.6 kbit/s) HR speech version 1 HR speech version 3 HR data (6, 3.6 kbit/s)

0001 1100

Circuit pool number 28

FR speech version 1 FR speech version 2 FR speech version 3 FR data (14.5, 12, 6, 3.6 kbit/s) HR speech version 1 HR speech version 3 HR data (6, 3.6 kbit/s)

0001 1101

Circuit pool number 29

FR speech version 1 FR speech version 2 FR speech version 3 FR data (12, 6, 3.6 kbit/s) HR speech version 1 HR speech version 3 HR data (6, 3.6 kbit/s) HSCSD max 2 x FR data (12, 6 kbit/s)

0001 1110

Circuit pool number 30

FR speech version 1 FR speech version 2 FR speech version 3 FR data (14.5, 12, 6, 3.6 kbit/s) HR speech version 1 HR speech version 3 HR data (6, 3.6 kbit/s) HSCSD max 2 x FR data (14.5, 12, 6 kbit/s)

0001 1111

Circuit pool number 31

FR speech version 1 FR speech version 2 FR speech version 3

Coding

Pool

Supported channels and speech coding algorithms FR data (12, 6, 3.6 kbit/s) HR speech version 1 HR speech version 3 HR data (6, 3.6 kbit/s) HSCSD max 4 x FR data (12, 6 kbit/s)

0010 0000

Circuit pool number 32

FR speech version 1 FR speech version 2 FR speech version 3 FR data (14.5, 12, 6, 3.6 kbit/s) HR speech version 1 HR speech version 3 HR data (6, 3.6 kbit/s) HSCSD max 4 x FR data (14.5, 12, 6 kbit/s)

1000 xxxx

For national/local use All other values are Reserved for future international use

XVI. Speech Version

This element indicates the speech version being used by the BSS. It is coded as follows: 8 7 6 5 4 3 2 1 octet 1 octet 2

Element identifier spare Circuit pool number

The bits 7-1 of octet 2 are coded in the same way as the permitted speech version identifier in the Channel type information element.
XVII. LSA Identifier
This element uniquely identifies a LSA and is of fixed length containing the following fields: 8 7 6 5 4 3 2 1 octet 1 octet 2 octet 3 octet 4 octet 5

Element identifier Length LSA ID LSA ID cont. LSA ID cont.

The octets 3-5 are coded as specified in GSM 03.03, Identification of Localized Service Area. Bit 8 of octet 3 is the MSB.
XVIII. Cause
The cause element is used to indicate the reason for a particular event to have occurred and is coded as shown below. The cause value is a single octet element if the extension bit (bit 8) is set to 0. If it is set to 1 then the

cause value is a 2 octet field. If the value of the first octet of the cause field is 1XXX 0000 then the second octet is reserved for national applications, (XXX will still indicate the class). 8 7 6 5 4 3 2 1 octet 1 octet 2 octet 3 (octet 4)

Element identifier

Length

0/1 ext

Cause Value

The length indicator is a binary representation of the length of the following element.
Cause Value: Class (000): Class (001): Class (010): Class (011): Normal event Normal event Resource unavailable Service or option not available

Signaling Analysis Manual M900/M1800 Base Station Controller Appendix A Message Interpretation

Class (100): Service or option not implemented Class (101): invalid message (eg parameter out of range) Class (110): protocol error Class (111): interworking In the following table, "reserved for international use" means that this code point should not be used until a meaning has been assigned to it following the process of international standardisation. "Reserved for national use" indicates code points that may be used by operators without the need for international standardisation. Cause value Class 765 000 0000 Radio interface message failure Radio interface failure Uplink quality Uplink strength Downlink quality Downlink strength Distance Cause Number Value 4321

000 000 000 000 000 000

0001 0010 0011 0100 0101 0110

000 000 000 000

0111 1000 1001 1010

O and M intervention Response to MSC invocation Call control Radio interface failure, reversion to old channel Handover successful Better Cell Directed Retry Joined group call channel Traffic } } Reserved for international use } } Cause Number Value 4321

000 000 000 000 000 001 :::

1011 1100 1101 1110 1111 0000 ::::

001 001

0111 1000

Cause value Class 765 ::: 001 010 010 010 :::: 1111 0000 0001 0010

} Reserved for national use } Equipment failure No radio resource available Requested terrestrial resource unavailable CCCH overload Processor overload BSS not equipped MS not equipped Invalid cell Traffic Load Preemption } } Reserved for national use } Requested transcoding/rate adaption unavailable

010 010 010 010 010 010 010 010 ::: 010 011

0011 0100 0101 0110 0111 1000 1001 1010 :::: 1111 0000

011 011 011

0001 0010 0011

Circuit pool mismatch Switch circuit pool Requested speech version unavailable LSA not allowed } } Reserved for international use } Ciphering algorithm not supported } } Reserved for international use Cause Number Value 4321

011 011 011

0100 0101 ::::

011 100

1111 0000

100 100

0001 ::::

Cause value Class 765 100 100 100 100 101 0111 1000 :::: 1111 0000

} } } Reserved for national use } Terrestrial circuit already allocated Invalid message contents Information element or field missing Incorrect value Unknown Message type Unknown Information Element } } Reserved for international use } }Reserved for national use } Protocol Error between BSS and MSC

101 101

0001 0010

101 101 101

0011 0100 0101

101 101

0110 0111

101 101 101 110

1000 :::: 1111 0000

110 110 110

0001 0010 ::::

VGCS/VBS call non existent } } Reserved for international use } } } Reserved for national use } } } Reserved for international use } Cause Number Value 4321

110 110 110 110 111 111

0111 1000 :::: 1111 0000 ::::

111

0111

Cause value Class 765 111 111 111 1000 :::: 1111

} } Reserved for national use }

XIX. Circuit Pool List

This element defines a list of BSS preferred circuit pools in order of preference. It is coded as follows: 8 7 6 5 4 3 2 1 octet 1 octet 2 octet 3

Element identifier Length Circuit pool number (1st preferred) : Circuit pool number (nth preferred)

octet n+2

The Circuit pool number is coded as specified in 1.2.16.

XX. Encryption Information
This element contains the user data encryption information used to control any encryption equipment at the BSS. It is a variable length element. It is coded as follows: 8 7 6 5 4 3 2 1 octet 1

Element identifier

Length Permitted algorithms Key

octet 2 octet 3 octet 4-n

The length indicator (octet 2) is a binary number indicating the absolute length of the contents after the length indicator octet. The permitted algorithms octet is a bit map indicating the A5 encryption algorithms andno encryption. From this bit map the BSS may select an A5 algorithm or no encryption to be used. Bit No 1 No encryption2 GSM A5/1 3 GSM A5/2 4 GSM A5/3 5 GSM A5/4 6 GSM A5/5 7 GSM A5/6 8 GSM A5/7 A bit position encoded as 1 indicates that the BSS may use the option represented by that bit position. A bit position encoded as 0 indicates that the BSS shall not use theoption represented by that bit position. A permitted algorithms octet containing all bitsencoded as 0 shall not be used. The key shall be present if at least one of the A5 encryption algorithms is permitted. When present, the key shall be 8 octets long.
XXI. Classmark Information Type 1
The classmark information type 1 defines certain attributes of the mobile station equipment in use on a particular transaction. It is coded as follows: 8 Element identifier Classmark 7 6 5 4 3 2 1 octet 1 octet 2

The classmark octet 2 is coded in the same way as the equivalent octet in the classmark 1 element of 04.08.

Huawei Technologies Proprietary A-49

XXII. Classmark Information Type 3

The classmark information type 3 defines certain attributes of the mobile station equipment in use on a particular transaction. It is coded as follows: 8 7 6 5 4 3 2 1

Element identifier Length Classmark

octet 1 octet 2 octet 314

Octet 2 is a binary indication of the length of the remainder of the element in octets. The length octet has a minimum value of 1 and a maximum of 12. The length shall be determined by the length of the Mobile Station Classmark 3 element of GSM 04.08. The classmark octets 3 to 14 are coded in the same way as the equivalent octets in the Mobile station classmark 3 element of GSM 04.08.
XXIII. Current Channel Type 1
This Information Element contains a description of the channel allocated to the MS. It is coded as follows: 8 Element identifier Channel mode Channel 7 6 5 4 3 2 1 octet 1 octet 2

The channel mode field is coded as follows: Bit 8765 0000 signaling only 0001 speech (full rate or half rate) 0110 data, 14.5 kbit/s radio interface rate 0011 data, 12.0 kbit/s radio interface rate 0100 data, 6.0 kbit/s radio interface rate 0101 data, 3.6 kbit/s radio interface rate 1111 is reserved All other values are for future use. If the receiver receives an unknown channel mode it shall not be rejected but the receiver shall assume that the channel mode is to be changed. The channel field is coded as follows:
Bit 0001 SDCCH 1000 1 1001 1 1010 2 1011 3 1100 4 1101 5 1110 6 1111 70100 8 Full Rate TCHs FullHalfFullFullFullFullFull Full rate rate Rate Rate Rate Rate Rate Rate TCH TCH TCHs TCHs TCHs TCHs TCHs TCHs 4321

0000 is reserved

All other values are for future use. If the receiver receives a unknown channel field it shall not be rejected but the receiver shall assume that the channel is to be changed. Consistencies between channel fields and channel modes shall not be checked.
XXIV. LSA Information
This element uniquely identifies LSAs, the priority, the preferential access indicator and the active mode support indicator of each LSA. The access right outside these LSAs is also defined. The element is of variable length containing the following fields: 8 7 6 5 4 3 2 1 octet 1 octet 2 LSA only octet 3 octet 4-7

Element identifier Length spare LSA identification and attributes 1 : LSA identification and attributes n

to 3+4n

The coding of octet 2 is a binary number indicating the length of the remaining element. The length depends on the number of LSAs to be identified.

Huawei Technologies Proprietary A-51

If the LSA only access indicator (bit 1 of octet 3) is set to 1 the subscriber has only access to the LSAs that are defined by the LSA Information element. The LSA only access indicator is set to 0 for allowing an emergency call. Coding of the i-th LSA identification with attributes: 8 spare LSA ID LSA ID cont. LSA ID cont. 7 6 act 5 pref 4 priority 3 2 1 octet x+1 octet x+2 octet x+3 octet x+4

Where x = 3 + 4(i-1)Bits 1 to 4 of octet (x+1) define the priority of the LSA identification.Bit 4321 0000 priority 1 = lowest priority 0001 priority 2 = second lowest priority : : : : priority 16 = highest priority If the preferential access indicator (bit 5 of octet (x+1)) is set to 1 the subscriber has preferential access in the LSA. If the active mode support indicator (bit 6 of octet (x+1))

is set to 1 the subscriber has active mode support in the LSA. The octets (x+2)-(x+4) are coded as specified in GSM 03.03, Identification of LocalizedService Area. Bit 8 of octet (x+2) is the MSB.
XXV. Old BSS to New BSS information
This information element is defined as a general container for passing Field Elements transparently between BSSs via the MSC. These Field Elements are passed in the Old BSS to New BSS information elements octets field. 8 7 6 5 4 3 2 1 octet 1 octet 2 octet 3-n

Element identifier Length

Old BSS to New BSS information elements

The length indicator (octet 2) is a binary number indicating the absolute length of the contents after the length indicator octet and may be set to zero. The Old BSS to New BSS information elements field is made up of 0 or more Field Elements listed in the table shown below. Field elements may occur in any order in the Old BSS to New BSS information elements field. The construction of the Field Elements allows the receiver to ignore unknown Field Elements. Due to backward compatibility issues Field Elements in the Old BSS to New BSS information may duplicate Information Elements in the HANDOVER REQUEST, when this occurs and the new BSS detects an inconsistency between this information then the information contained in the Old BSS to New BSS information shall take precedence as long as the coding is understood by the new BSS. Reception of an erroneous Old BSS to New BSS information shall not cause a rejection of the HANDOVER REQUEST message; the Old BSS to New BSS information information element shall be discarded and the handover resource allocation procedure shall continue.
FIELD ELEMENT Extra information Current Channel Type 2 Target cell radio information GPRS Suspend information MultiRate configuration information REFERENCE 3.2.3.1 3.2.3.2 3.2.3.3 3.2.3.4 3.2.3.5 LEN 3 4 3 19 3-8

XXVI. Configuration Evolution Indication

This information element indicates whether subsequent assignment requests should be expected and the limitation for these subsequent assignments. 8 7 6 5 4 3 2 1 octet 1 SMI octet 2

Element identifier spare

SMI: Subsequent Modification Indication. This indicates the maximum number of TCH/F that could be requested in subsequent assignments. The SMI field is coded as follows:
Huawei Technologies Proprietary A-53 Signaling Analysis Manual M900/M1800 Base Station Controller Appendix A Message Interpretation

Bit 4321 0000 No Modification is allowed 0001 Modification is allowed and maximum number of TCH/F is 1 0010 Modification is allowed and maximum number of TCH/F is 2 0011 Modification is allowed and maximum number of TCH/F is 3 0100 Modification is allowed and maximum number of TCH/F is 4 All other values are reserved.

XXVII. Response Request

The presence of this element indicates that a HANDOVER REQUIRED REJECT message is required by the BSS, if the HANDOVER REQUIRED message does not result in a handover. The element has a fixed length of one octet: 8 Element identifier 7 6 5 4 3 2 1 octet 1

XXVIII. Cell Identifier List

This element uniquely identifies cells and is of variable length containing the following fields: 8 7 6 5 4 3 2 1 octet 1 octet 2 Cell identification discriminator octet 3 octet 44+m

Element identifier Length spare Cell identification 1

Cell identification n

to 4+nm

The coding of octet 2 is a binary number indicating the Length of the remaining element.

The Length depends on the Cell identification discriminator (bits 1 to 4 of octet 3) as well as the number of cells to be identified.

Huawei Technologies Proprietary A-54

The coding of the Cell identification discriminator is a binary number indicating if the whole or a part of Cell Global identification, CGI, according to GSM 03.03 is used for cell identification of the cells in the list. The Cell identification discriminator is coded as follows: 0000 The whole Cell Global Identification, CGI, is used to identify the cells. 0001 Location Area Code, LAC, and Cell Identify, CI, is used to identify the cells. 0010 Cell Identity, CI, is used to identify the cells. 0011 No cell is associated with the transaction. 0100 Location Area Identification, LAI, is used to identify all cells within a Location Area. 0101 Location Area Code, LAC, is used to identify all cells within a location area. 0110 All cells on the BSS are identified. All other values are reserved. Values 0100, 0101 and 0110 are only applicable for page message.The coding of the Cell Identifications 1 to n (octets 4 to 4+nm) depends on the Cell identification discriminator (octet 3). Below the coding of the i-th Cell Identification is

shown for each Cell identification discriminator (with "i" in the range 1 to n): Note that no coding is specified for Cell identification discriminator values of "0011" and"0110" as no additional information is required. Coding of the i-th Cell Identification for Cell identification discriminator = 0000 For GSM 900 and DCS 1800: 8 7 6 5 4 MCC dig 1 1 1 MCC dig 3 MNC dig 1 3 2 1 octet 4 octet 5 octet 6 octet 7 octet 8 octet 9 octet 10

MCC dig 2 1 1

MNC dig 2 LAC LAC cont. CI value CI value cont

Where x = 3 + 7(i-1).

Huawei Technologies Proprietary A-55

The octets (x+1)-(x+5) are coded as shown in GSM 04.08, Table Location Area Identification information element. The octets (x+6)-(x+7) are coded as shown in GSM 04.08, Table Cell Identity information element. For PCS 1900 for NA: 8 MCC dig 2 MNC dig 3 MNC dig 2 LAC LAC cont. CI value CI value cont 7 6 5 4 MCC dig 1 MCC dig 3 MNC dig 1 3 2 1 octet x+1 octet x+2 octet x+3 octet x+4 octet x+5 octet x+6 octet x+7

Where x = 3 + 7(i-1). The octets (x+1)-(x+5) are coded as shown in GSM 04.08, Table Location Area Identification information element. The octets (x+6)-(x+7) are coded as shown in GSM 04.08, Table Cell Identity information element . Coding of i-th Cell Identification for Cell identification discriminator = 0001
8 LAC LAC cont. CI value CI value cont 7 6 5 4 3 2 1 octet x+1 octet x+2 octet x+3 octet x+4

Where x = 3 + 4(i-1) The octets (x+1)-(x+2) are coded as shown in GSM 04.08, Table Location Area Identification information element. The octets (x+3)-(x+4) are coded as shown in GSM 04.08, Table Cell Identity information element. Coding of i-th Cell Identification for Cell identification discriminator = 0010

8 CI value

1 octet x+1 octet x+2

CI value cont

Where x = 3 + 2(i-1)

The octets (x+1)-(x+2) are coded as shown in GSM 04.08, Table Cell Identityinformation element . Coding of i-th Cell Identification for Cell identification discriminator = 0100 For GSM 900 and DCS 1800:
8 7 6 5 4 MCC dig 1 1 1 MCC dig 3 MNC dig 1 3 2 1 octet x+1 octet x+2 octet x+3 octet x+4 octet x+5 octet x+6 octet x+7

MCC dig 2 1 1

MNC dig 2 LAC LAC cont. CI value CI value cont

Where x = 3 + 5(i-1)

The octets (x+1)-(x+5) are coded as shown in GSM 04.08, Table Location Area Identification information element. For PCS 1900 for NA:
8 7 6 5 4 MCC dig 1 MCC dig 3 MNC dig 1 3 2 1 octet x+1 octet x+2 octet x+3 octet x+4 octet x+5

MCC dig 2 MNC dig 3 MNC dig 2 LAC LAC cont.

Where x = 3 + 5(i-1)The octets (x+1)-(x+5) are coded as shown in GSM 04.08, Table Location Area Identification information element.
Huawei Technologies Proprietary A-57

Coding of i-th Cell Identification for Cell identification discriminator = 0101

8 LAC LAC cont.

1 octet x+1 octet x+2

Where x = 3 + 2(i-1) The octets (x+1)-(x+2) are coded as shown in GSM 04.08, Table Location Area Identification information element . The appropriate coding for not identified cells is "0" for all bits of LAC and CI for all possible Cell Identification Discriminator values.
XXIX. Queuing Indicator
This element contains a recommendation of the BSS concerning application of queuing. The element has a fixed length of two octets. 8 Element identifier spare qri spare 7 6 5 4 3 2 1 octet 1 octet 2

Octet 2 is coded as follows: qri = queuing recommendation indicator 0 it is recommended not to allow queuing1 it is recommended to allow queuing
XXX. Layer 3 Information
This is a variable length element used to pass radio interface messages from one network entity to another. 8 7 6 5 4 3 2 1 octet 1 octet 2 octet 3-n

Element identifier Length Layer 3 information

Octet 1 identifies the element. Octet 2 gives the length of the following layer 3 information.
Huawei Technologies Proprietary A-58

Octet j (j = 3, 4, ..., n) is the unchanged octet j-2 of a radio interface layer 3 message as defined in GSM 04.08, n-2 is equal to the length of that radio interface layer 3 message.

XXXI. IMSI
The IMSI is coded as a sequence of BCD digits, compressed two into each octet. This is a variable length element, and includes a length indicator. The remainder of this element is coded as defined in GSM 04.08.

The element coding is: 8 7 6 5 4 3 2 1 octet 1 octet 2 octet 3-n

Element identifier Length Rest of element coded as in GSM 04.08, not including GSM 04.08 element identifier or GSM 04.08 octet length value

XXXII. TMSI
The TMSI is a fixed length element. The TMSI is an unstructured number of 4 octets in length. The coding is: 8 Element identifier Length TMSI 7 6 5 4 3 2 1 octet 1 octet 2 octet 3-n

The TMSI field is unstructured.

XXXIII. Channel Needed
This information element contains an indication for the mobile station of which channel is needed for the transaction linked to the paging procedure. It is coded as follows: 8 Element identifier spare Channel 7 6 5 4 3 2 1 octet 1 octet 2

Signaling Analysis Manual M900/M1800 Base Station Controller Appendix A Message Interpretation

The Channel field is coded as follows: Bit 2 10 0 Any channel 0 1 SDCCH 1 0 TCH/F (Full rate) 1 1 TCH/H or TCH/F (Dual rate)

XXXIV. eMLPP Priority

This Information Element contains the eMLPP priority of the call. It is coded as follows: 8 Element identifier spare Call priority 7 6 5 4 3 2 1 octet 1 octet 2

The call priority field (bit 3 to 1 of octet 2) is coded in the same way as the call priority field (bit 3 to 1 of octet 5) in the Descriptive group or broadcast call reference information element as defined in GSM 04.08.
XXXV. Cipher Response Mode
This information element is used by the MSC to indicate whether the IMEI is to be included in the CIPHERING MODE COMPLETE message to be sent by the Mobile Station. 8 7 6 5 4 3 2 1 octet 1 octet 2

Element identifier Cipher response mode

Octet 2 is coded as:-Bits 8,7,6,5,4,3,2 -Spare Bit 1 = 0 -IMEISV must not be included by the Mobile Station Bit 1 = 1 -IMEISV must be included by the Mobile Station
XXXVI. Layer 3 Message Contents
This is a variable length element used to pass the contents (from octet 3 up to the last octet) of radio interface messages from one network entity to another. 8 7 6 5 4 3 2 1 octet 1 octet 2 octet 3-n

Element identifier Length Layer 3 message contents

The length indicator (octet 2) is a binary number indicating the absolute length of the contents after the length indicator octet. Octet j (j = 3, 4, ..., n) is the unchanged octet j of a radio interface layer 3 message as defined in GSM 04.08, n is equal to the length of that radio interface layer 3 message.
XXXVII. LSA Identifier List
This element uniquely identifies LSAs and is of variable length containing the following fields: 8 7 6 5 4 3 2 1 octet 1 octet 2 EP octet 3 octet 46 : to 3+3n

Element identifier Length spare LSA identification 1 : LSA identification 2

The coding of octet 2 is a binary number indicating the length of the remaining element.

The length depends on the number of LSAs to be identified. If the escape PLMN (see GSM 03.73) is broadcast the EP bit (bit 1 of octet 3) is set to 1, otherwise it is set to 0.
8 LSA ID LSA ID cont. LSA ID cont. 7 6 5 4 3 2 1 octet x+1 octet x+2 octet x+3

Where x = 3 + 3(i-1)
Huawei Technologies Proprietary A-61

The octets (x+1)-(x+3) are coded as shown in GSM 03.03, Identification of Localized Service Area. Bit 8 of octet (x+1) is the MSB.

XXXVIII. APDU
This information element is defined as a general container for passing information transparently between BSSs or between BSS and SMLC via the MSC. It is coded as follows: 8 Element identifier Length APDU 7 6 5 4 3 2 1 octet 1 octet 23 octet 4n

The length indicator is a binary indication of the number of octets following in the element. The APDU octets 4 to n are coded in the same way as the equivalent octet in the APDU element of GSM 09.31.

A.2 Abis-Interface Key Messages

There is no general rule for the order of signaling elements: it happens that the same elements appear in various orders depending on the message. The key BSSMAP messages are listed in the following table: Message name CHANNEL REQUIRED PAGING COMMAND CHANNEL ACTIVATION CHANNEL ACTIVATION ACKNOWLEDGE Reference 2.1.1 2.1.2 2.1.3 2.1.4

CHANNEL ACTIVATION NEGATIVE ACKNOWLEDGE IMMEDIATE ASSIGN COMMAND CONNECTION FAILURE INDICATION ERROR INDICATION
1

2.1.5 2.1.6 2.1.7 2.1.8

The messages of Abis-interface described here are based on Phase 2+ GSM 0858 version 7.4.1 Release 1998. Huawei Technologies Proprietary A-62

Message name ENCRYPTION COMMAND HANDOVER DETECTION MODE MODIFY MODE MODIFY ACKNOWLEDGE MODE MODIFY NEGATIVE ACKNOWLEDGE ESTABLISH INDICATION

Reference 2.1.9 2.1.10 2.1.11 2.1.12 2.1.13 2.1.14

A.2.1 Message Contents

I. CHANNEL REQUIRED
This message is sent from BTS to BSC to indicate the reception of a CHANnel REQuest message (special access burst message) from an MS. INFORMATION ELEMENT Message discriminator Message type Channel number Request Reference Access Delay Physical Context REFERENCE PRESENCE FORMAT LENGTH

2.2.1 2.2.2 2.2.3 2.2.4 2.2.5 2.2.6

M M M M M O 1)

V V TV TV TV TLV

1 1 2 4 2 >=2

Optional element for additional physical channel information. The Request Reference element contains the random access reference value sent by MS in the CHANnel REQuest message and some low order bits of the absolute frame number for the reception of the access burst.
II. PAGING COMMAND
This message is sent from BSC to BTS to request the paging of an MS.

INFORMATION ELEMENT Message discriminator Message type

REFERENCE

PRESENCE

FORMAT

LENGTH

2.2.1 2.2.2 REFERENCE

M M PRESENCE

V V FORMAT

1 1 LENGTH

INFORMATION ELEMENT Channel number Paging Group MS Identity Channel Needed eMLPP Priority

2.2.3 2.2.7 2.2.8 2.2.9 2.2.10

M M M O 1) O 2)

TV TV TLV TV TV

2 2 2-10 2 3

1) If the Channel Needed element is not present, the default value is assumed to be 00 (any channel). 2) If the eMLPP Priority is not present then the BTS does not include the eMLPP priority in the radio interface message. The Paging Group element is used by BTS to calculate the correct DRX paging block to be used for the transmission of the PAGing REQuest message as defined in GSM 05.02.
III. CHANNEL ACTIVATION
This message is sent from BSC to BTS in order to activate a radio channel. The attributes of the channel are defined in the message. INFORMATION ELEMENT Message discriminator Message type Channel number Activation Type Channel Mode Channel Identification Encryption information Handover Reference BS Power MS Power Timing Advance BS Power Parameters MS Power Parameters REFERENCE PRESENCE FORMAT LENGTH

2.2.1 2.2.2 2.2.3 2.2.11 2.2.12 2.2.13 2.2.14 2.2.15 2.2.16 2.2.17 2.2.18 2.2.20 2.2.19

M M M M M O 7) O 1) C 2) O 3) O 3) C 3) 4) O 5) O 5)

V V TV TV TLV TLV TLV TV TV TV TV TLV TLV

1 1 2 2 8-9 8 >=3 2 2 2 2 >=2 >=2

Physical Context

2.2.6 REFERENCE

O 6) PRESENCE

TLV FORMAT

>=2 LENGTH

INFORMATION ELEMENT SACCH Information UIC Main channel reference MultiRate configuration MultiRate Control Supported Code Types

2.2.21 2.2.22 2.2.23 2.2.24 2.2.25 2.2.26

O 8) O 9) O 10) O 11) O 12) O 12)

TLV TLV TV TLV TV TLV

>=3 3 2 >=4 2 >=5

1) The Encryption Information element is only included if ciphering is to be applied. 2) The Handover Reference element is only included if activation type is handover. 3) If BS Power, MS Power and/or Timing Advance elements are present, they are to be used to set the initial transmission power and the initial L1-header. 4) The Timing Advance element must be included if activation type is intra cell channel change. 5) The BS and MS Power Parameters elements are included to indicate that BS and/or MS power control is to be performed by BTS. The maximum power to be used is indicated in the BS and MS Power elements respectively. 6) Optional element for additional physical channel information. 7) Included if compatibility with phase1 is required. 8) Optional element for setting the SACCH filling information individually for this channel. If this element is present, the SACCH filling information as given by this element shall be used for this channel (replacing any SACCH filling information as given by the SACCH FILLING message(s)) until the channel is released or the information is changed by a SACCH INFO MODIFY message. (If this element is not present, the SACCH filling as given by the SACCH FILLING message(s) shall be used.) 9) The UIC element may be included for voice group calls. It is used in the same way as the BSIC for decoding the random access bursts when decoding uplink access bursts. If not included, the BSIC shall be used for decoding uplink access bursts. 10) Optional element for multislot operation, it may be used in case of power control in the BTS. 11) Included if the Channel Mode indicates that a multi-rate speech code is used. 12) Optionally included if the Channel Mode indicates that a multi-rate speech code is used and TFO control is required or to give to the BTS the possibility to change autonomously the multi-rate code configuration.
IV. CHANNEL ACTIVATION ACKNOWLEDGE
This message is sent from BSC to BTS to acknowledge that the requested channel activation has been completed correctly. INFORMATION ELEMENT REFERENCE PRESENCE FORMAT LENGTH

Message discriminator Message type Channel number Frame number

2.2.1 2.2.2 2.2.3 2.2.27

M M M M

V V TV TV

1 1 2 3

The Frame Number element is used by BSC to calculate the Starting Time parameter when required.
V. CHANNEL ACTIVATION NEGATIVE ACKNOWLEDGE
This message is sent from BTS to BSC to indicate that the channel activation could not be performed as requested. INFORMATION ELEMENT Message discriminator Message type Channel number Cause REFERENCE PRESENCE FORMAT LENGTH

2.2.1 2.2.2 2.2.3 2.2.28

M M M M

V V TV TLV

1 1 2 >=3

If the Channel Activation message was received with an erroneous Channel number information element, the Channel Activation Negative Acknowledge message is returned with the Channel Number information element equal to the received (and erroneous) Channel number and the Cause value "Mandatory Information Element Error" with Diagnostics equal to the Channel number element identifier value.
VI. IMMEDIATE ASSIGN COMMAND
This message is sent from BSC to BTS to request the transmission of an immediate assignment message. INFORMATION ELEMENT Message discriminator Message type Channel number Full Imm. Assign Info REFERENCE PRESENCE FORMAT LENGTH

2.2.1 2.2.2 2.2.3 2.2.29

M M M M

V V TV TLV

1 1 2 25

The Full Imm. Assign Info element contains the relevant immediate assignment message as defined in GSM 04.08 (IMMEDIATE ASSIGNMENT or IMMEDIATE ASSIGNMENT EXTENDED or IMMEDIATE ASSIGNMENT REJECT) with the "Page Mode" element set to the value "no change".
VII. CONNECTION FAILURE INDICATION
This message is sent from BTS to BSC to indicate that an active connection has been broken for some reason.

INFORMATION ELEMENT Message discriminator Message type Channel number Cause

REFERENCE

PRESENCE

FORMAT

LENGTH

2.2.1 2.2.2 2.2.3 2.2.28

M M M M

V V TV TLV

1 1 2 >=3

VIII. ERROR INDICATION

This message is sent from BTS to BSC to indicate an abnormal case for a radio link layer connection. INFORMATION ELEMENT Message discriminator Message type Channel number Link Identifier RLM Cause REFERENCE PRESENCE FORMAT LENGTH

2.2.1 2.2.2 2.2.3 2.2.30 2.2.31

M M M M M

V V TV TV TLV

1 1 2 2 2-4

IX. ENCRYPTION COMMAND

This message is sent from BSC to BTS to start ciphering mode operation. INFORMATION ELEMENT Message discriminator Message type Channel number Encryption information REFERENCE PRESENCE FORMAT LENGTH

2.2.1 2.2.2 2.2.3 2.2.14 REFERENCE

M M M M PRESENCE

V V TV TLV FORMAT

1 1 2 >=3 LENGTH

INFORMATION ELEMENT Link Identifier L3 Info (CIPH MOD CMD)

2.2.30 2.2.32

M M

TV TLV

2 6

The L3 Info element contains the complete Ciphering Mode Command message as defined in GSM 04.08.
X. HANDOVER DETECTION
This message is sent from BTS to BSC when BTS correctly receives information from an MS on the handover activated channel.

INFORMATION ELEMENT Message discriminator Message type Channel number Access Delay

REFERENCE

PRESENCE

FORMAT

LENGTH

2.2.1 2.2.2 2.2.3 2.2.5

M M M O 1)

V V TV TV

1 1 2 2

The Access Delay element is included if the sending of the handover detection message was triggered by the reception of a handover access burst with the correct handover reference.
XI. MODE MODIFY
This message is sent from BSC to BTS to request a change of channel mode of an active channel. INFORMATION ELEMENT Message discriminator Message type Channel number Channel Mode Encryption information Main channel reference MultiRate configuration REFERENCE PRESENCE FORMAT LENGTH

2.2.1 2.2.2 2.2.3 2.2.12 2.2.14 2.2.23 2.2.24 REFERENCE

M M M M O 1) O 2) O 3) PRESENCE

V V TV TLV TLV TV TLV FORMAT

1 1 2 8-9 >=3 2 >=3 LENGTH

INFORMATION ELEMENT Multirate Control Supported Code Types

2.2.25 2.2.26

O 4) O 4)

TV TLV

2 >=5

1) The Encryption Information element is only included if ciphering is to be applied. 2) Optional element for multislot operation, it may be used in case of power control in the BTS. 3) Included if the Channel Mode indicates that a multi-rate speech code is used. 4) Optionally included if the Channel Mode indicates that a multi-rate speech code is used and TFO control is required or to give to the BTS the possibility to change autonomously the multi-rate code configuration.
XII. MODE MODIFY ACKNOWLEDGE
This message is sent from BTS to BSC to confirm the change of channel mode of an active channel. INFORMATION ELEMENT Message discriminator REFERENCE PRESENCE FORMAT LENGTH

2.2.1

Message type Channel number

2.2.2 2.2.3

M M

V TV

1 2

XIII. MODE MODIFY NEGATIVE ACKNOWLEDGE

This message is sent from BTS to BSC to indicate that the channel mode modification could not be performed as requested. INFORMATION ELEMENT Message discriminator Message type Channel number Cause REFERENCE PRESENCE FORMAT LENGTH

2.2.1 2.2.2 2.2.3 2.2.28

M M M M

V V TV TLV

1 1 2 >=3

XIV. ESTABLISH INDICATION

This message is sent from BTS to BSC to indicate the establishment of a radio link layer connection in multi-frame mode, initiated by an MS.
Huawei Technologies Proprietary A-69

INFORMATION ELEMENT Message discriminator Message type Channel number Link Identifier L3 Information

REFERENCE

PRESENCE

FORMAT

LENGTH

2.2.1 2.2.2 2.2.3 2.2.30 2.2.32

M M M M O 1)

V V TV TV TLV

1 1 2 2 3-23

The L3 Information field is present only if the SABM frame contained a nonempty information field. NOTE: The "establish mode" parameter appearing in GSM 04.06 is used only on the MS side. A.2.2 Signaling element coding
I. Message discriminator
A 1 octet field is used in all messages to discriminate between Transparent and NonTransparent messages and also between Radio Link Layer Management, Dedicated Channel Management, Common Channel Management and TRX Management messages. 8 G7 7 G6 6 G5 5 G4 4 G3 3 G2 2 G1 1 T

The T-bit is set to 1 to indicate that the message is to be/was considered transparent by BTS. All other messages shall have the T-bit set to 0. The G-bits are used to group the messages as follows:
G7 0 0 0 G6 0 0 0 G5 0 0 0 G4 0 0 0 G3 0 0 1 G2 0 0 0 G1 0 1 0 Message Group reserved Radio Link Layer Management messages Dedicated Channel Management messages Common Channel Management messages TRX Management messages Location Services messages

0 0 0

0 0 0

0 0 1

0 1 0

1 0 0

1 0 0

0 0 0

G7

G6

G5

G4

G3

G2

G1

Message Group

All other values are reserved for future use

II. MESSAGE TYPE

The Message Type uniquely identifies the function of the message being sent. It is a single octet and coded in the following way: 8 7 6 5 4 3 2 1

EM

Message type

Bit 8 is the extension bit and is reserved for future use. The following message types are used (all other values are reserved):
87654321 0 0 0 0- - - - 0001 0010 0011 0100 0101 0110 0111 1000 1001 Message Radio Link Layer Management messages DATA REQuest DATA INDication ERROR INDication ESTablish REQuest ESTablish CONFirm ESTablish INDication RELease REQuest RELease CONFirm RELease INDication

1010 1011 0001

UNIT DATA REQuest UNIT DATA INDication Common Channel Management/TRX Management messages BCCH INFOrmation CCCH LOAD INDication CHANnel ReQuireD DELETE INDication

0001 0010 0011 0100

87654321 0101 0110 0111 1001 1010 1011 1100 1101 1110 1111 001----00001 00010 00011 00100 00101 00110 00111 01000 01001 01010 01011 01100 01101 01110 01111

Message PAGING CoMmanD IMMEDIATE ASSIGN COMMAND SMS BroadCast REQuest RF RESource INDication SACCH FILLing OVERLOAD ERROR REPORT SMS BroadCast CoMmanD CBCH LOAD INDication NOTification CoMmanD Dedicated Channel Management messages CHANnel ACTIVation CHANnel ACTIVation ACKnowledge CHANnel ACTIVation Negative ACK CONNection FAILure DEACTIVATE SACCH ENCRyption CoMmanD HANDOver DETection MEASurement RESult MODE MODIFY REQuest MODE MODIFY ACKnowledge MODE MODIFY Negative ACKnowledge PHYsical CONTEXT REQuest PHYsical CONTEXT CONFirm RF CHANnel RELease MS POWER CONTROL

10000 10001 10010 10011 10100 10101

BS POWER CONTROL PREPROCess CONFIGure PREPROCessed MEASurement RESult RF CHANnel RELease ACKnowledge SACCH INFO MODIFY TALKER DETection

87654321 10110 10111 11000 11001 11010 11011 11100

Message LISTENER DETection REMOTE CODE CONFiguration REPort Round Trip Delay REPort PRE-HANDOver NOTIFication MultiRate CODE MODification REQest MultiRate CODE MOD ACKnowledge MultiRate CODE MOD Negative ACKnowledge MultiRate CODE MOD PERformed TFO REPort TFO MODification REQuest Location Service messages Location Information

11101 11110 11111 01-----000001

III. Channel Number

In the direction BSC to BTS the Channel Number parameter is used to indicate on which physical channel/subchannel the message is to be sent. In the direction BTS to BSC the Channel Number indicates on which physical channel/subchannel the message was received. It is coded in two octets as follows: 8 7 Element identifier C5 C4 C3 C2 C1 TN 6 5 4 3 2 1

The C-bits describe the channel as follows:

C5 C4 C3 C2 C1 00001 0001T 001TT 01TTT 10000 Bm + ACCH's Lm + ACCH's SDCCH/4 + ACCH SDCCH/8 + ACCH BCCH

10001 10010

Uplink CCCH (RACH) Downlink CCCH (PCH + AGCH)

The T-bits indicate, coded in binary, the sub-channel number as specified in GSM 05.02. TN is time slot number, binary represented as in GSM 05.02.

IV. Request Reference

This element carries the Request Reference parameters used for contention resolution on RACH. 8 7 6 5 4 3 2 1 1 2 T3 (high) T2 3 4

Element identifier RA T1' T3 (low)

Octets 2-4 are coded as the corresponding fields of the Request Reference element of GSM 04.08. (Octet 2, RA, is the Random Access Information field set by MS in the CHANnel REQuest message. Octets 3-4 contain the absolute frame number modulo 42432 for the frame number when the access burst was received, see Starting Time information element of GSM 04.08).
V. Access Delay
This element contains the delay of the access burst as measured by BTS at random access or at handover access. 8 7 6 5 4 3 2 1 1 2

Element identifier Access Delay

The Access Delay field contains the delay of the access burst as measured by BTS. The delay is expressed as defined for the Timing Advance TA in GSM 05.10 but with the range extended to 8 bits, i.e. the six least significant bits of the field correspond to the Timing Advance.
VI. Physical Context
This element contains supplementary information on the transmission/reception process. It is a variable

length element. 8 7 6 5 4 3 2 1 1 2 3

Element identifier Length Physical Context Information

The Physical Context Information field is not specified. This information should not be analyzed by BSC, but merely forwarded from one TRX/channel to another.
VII. Paging Group
This element carries the paging population of an MS to be paged. 8 7 6 5 4 3 2 1 1 2

Element identifier Paging Group

The Paging Group field (octet 2) contains the binary representation of the paging group as defined in GSM 05.02.
VIII. MS Identity
This element carries the identity of an MS (TMSI or IMSI). It is a variable length element. 8 7 6 5 4 3 2 1 1 2 3 MS Identity : N

Element identifier Length

The MS Identity field (octets 3-N) is coded as specified for the Mobile Identity information element of GSM 04.08, octets 3-N.

Huawei Technologies Proprietary A-75

IX. Channel Needed

This information element is used to indicate to the mobile station which channel will be needed for the transaction linked to the paging procedure.

1 1

Element identifier Reserved for future use Channel

The Channel Field (bits 1-2 of octet 2) indicates the further combination of channel which will be needed. It is coded as follows:
Value 00 01 10 11 Channel Needed. Any Channel. SDCCH. TCH/F (Full rate). TCH/F or TCH/H (Dual rate).

X. eMLPP Priority
This Information Element contains the eMLPP priority of the call. It is coded as follows: 8 7 6 5 4 3 2 1 1 call priority 2

Element identifier spare

The call priority field (bit 3 to 1 of octet 2) is coded in the same way as the call priority field (bit 3 to 1 of octet 5) in the Descriptive group or broadcast call reference information element as defined in GSM 04.08.
XI. Activation Type
This element is used to indicate the type of activation requested in the CHANnel ACTIVation message. It is coded in two octets as follows: 8 7 6 5 4 3 2 1 1 A3 A2 A1 2

Element identifier R Reserved

The R bit indicates if the procedure is an initial activation or a reactivation. R 0 -Initial activation 1 -Reactivation The A-bits indicate the type of activation, which defines the access procedure and the operation of the data link layer, as follows: A3 A2 A1 0 0 -Activation related to intra-cell channel change 0 - related to immediate assignment procedure 1 - related to normal assignment procedure 0 1 -Activation related to inter-cell channel change (handover) 0

- related to asynchronous handover procedure 1 - related to synchronous handover procedure 1 0 -Activation related to secondary channels 0 - related to additional assignment procedure 1 - related to multislot configuration All other values reserved for future use. NOTE: For the main TCH channel in a Multislot configuration activation types for intra-cell and inter-cell channel change are used.
XII. Channel Mode
This element gives information on the mode of coding/decoding and transcoding/rate adaption of a channel. 8 7 6 5 4 3 2 1 1 2 DTX d DTX u 3 4 5

Element identifier Length Reserved for future use Speech or data indicator Channel rate and type

1 6

Speech coding algor./data rate + transp ind

The DTX bits of octet 3 indicate whether DTX is applied: 1 DTX is applied 0 DTX is not applied. DTXd indicates use of DTX in the downlink direction (BTS to MS) and DTXu indicates use of DTX in the uplink direction (MS to BTS). The "Speech or data indicator" field (octet 4) is coded as follows: 0000 0001 Speech 0000 0010 Data 0000 0011 Signaling All other values are reserved. The "Channel rate and type" field (octet 5) is coded as follows: 0000 0001 SDCCH 0000 1000 Full rate TCH channel Bm0000 1001 Half rate TCH channel Lm0000 1010 Full rate TCH channel bi-directional Bm, Multislot configuration 0001 1010 Full rate TCH channel uni-directional downlink Bm, Multislot configuration 0001 1000 Full rate TCH channel Bm Group call channel 0001 1001 Half rate TCH channel Lm Group call channel 0010 1000 Full rate TCH channel Bm Broadcast call channel 0010 1001 Half rate TCH channel Lm Broadcast call channel All other values are reserved. The "speech

coding algorithm/data rate + transparency indicator" field (octet 6) is coded as follows: If octet 4 indicates speech, then octet 6 is coded as follows: 0000 0001 GSM speech coding algorithm version 10001 0001 GSM speech coding algorithm version 2 0010 0001 GSM speech coding algorithm version 3 All other values are reserved. If octet 4 indicates signaling then octet 6 is coded as follows: 0000 0000 No resources required All other values are reserved. NOTE: GSM speech coding algorithm version 3 is also referred as GSM adaptive multirate speech coding algorithm version 1. If octet 4 indicates data, then octet 6 is coded as follows:
8 ext 7 T/NT 6 Rate 5 4 3 2 1 octet 6

Bit 8: Reserved for extension Bit 7: 0 Transparent service 1 Non-transparent service. For the non-transparent service, bits 6 to 1 indicate the radio interface data rate: 65 4321 01 1000 14.5 kbit/s 01 0000 12 kbit/s 01 0001 6 kbit/s all other values are reserved. For the transparent service, bits 6-1 indicate the data rate: 65 4321 01 1000 14.4 kbit/s 01 0000 9.6 kbit/s 01 0001 4.8 kbit/s 01 0010 2.4 kbit/s 01 0011 1.2 kbit/s

01 0100 600 bit/s 01 0101 1 200/75 bit/s (1 200 network-to-MS, 75 MS-to-network) All other values are reserved.
XIII. Channel Identification
This information element describes some aspects of a channel together with its SACCH. 8 7 6 5 4 3 2 1 1 2 * *

Element identifier Length 04.08 "Channel Description" 04.08 "Mobile Allocation"

A * denotes that the whole of the 04.08 element including the element identifier and length should be included. The 04.08 "Mobile Allocation" shall for compatibility reasons be included but empty, i.e. the length shall be zero.
XIV. Encryption information
This element is a variable length element. It contains necessary information to control encryption devices. 8 7 6 5 4 3 2 1 1 2 3 4

Element identifier Length Algorithm identifier Key

The Algorithm Identifier field (octet 3) indicates the relevant ciphering algorithm. It is coded as: 0000 0000 Reserved 0000 0001 No encryption shall be used. 0000 0010 GSM encryption algorithm version 1 (A5/1) 0000 0011 GSM A5/2 0000 0100 GSM A5/3 0000 0101 GSM A5/4 0000 0110 GSM A5/5 0000 0111 GSM A5/6 0000 1000 GSM A5/7 All other values are reserved The Key field (octets 4-n) indicates the ciphering key. It shall be an integral

number of octets and the length is given as the value of the Length field minus 1.
XV. Handover reference
The information is coded in two octets and contains the handover reference value. 8 7 6 5 4 3 2 1 1 2

Element identifier Handover reference

The Handover Reference octet contains the handover reference value as defined in GSM 04.08.
XVI. BS Power
This information element indicates the TRX transmission power level on a particular channel. 8 7 6 5 4 3 2 1 1 Power Level 2

Element identifier Reserved

The Power Level field (octet 2) indicates the number of 2 dB steps by which the power shall be reduced from its nominal value, Pn, set by the network operator to adjust the coverage. Thus the Power Level values correspond to the following powers (relative to
Pn): Value 0000 0 0000 1 0001 0 Power level Pn Pn - 2 dB Pn - 4 dB

Signaling Analysis Manual M900/M1800 Base Station Controller Appendix A Message Interpretation 0 1 1 1

0 Pn - 28 dB 0 1 1 1 1 Pn - 30 dB All other values are reserved for future use. See also GSM 05.05, subclass 4.1.2 and GSM 05.08, subclass 4.5.

XVII. MS Power
This element carries the power level of MS.

1 1

Element identifier Reserved Power Level

The coding and meaning of the Power Level field is as defined in GSM 05.05 and GSM 05.08. See also GSM 04.04.
XVIII. Timing Advance
This element contains the timing advance to be used by MS in subsequent communications. It is calculated by BTS at the reception of a CHANnel REQuest message (random access burst) or a handover access burst. 8 7 6 5 4 3 2 1 1 2

Element identifier Reserved Timing Advance

The Timing Advance field contains the timing advance TA as specified in GSM 05.10. Bits 7-8 of octet 2 are reserved for future use.
XIX. MS Power Parameters
This element carries the parameters required by TRX for MS power control. 8 7 6 5 4 3 2 1 1 2 3

Element identifier Length MS Power Control Parameters

The MS Power Control Parameters field contains the parameters and limits required when MS power control is to be performed by BTS. The coding is operator dependant. Examples of possible parameters and algorithms can be found in GSM 05.08 (RXLEV, RX-QUAL-FULL, RX-QUAL-SUB, DISTANCE (Timing Advance) etc.).
XX. BS Power Parameters
This element carries the parameters required by TRX for control of its own transmission power. 8 7 6 5 4 3 2 1 1 2

Element identifier Length

BS Power Control Parameters

3 : N

The BS Power Control Parameters field contains the parameters and limits required when TRX transmission power control is to be performed by BTS. The coding is operator dependant. Examples of possible parameters and algorithms can be found in GSM 05.08 (RXLEV, RX-QUAL-FULL, RX-QUAL-SUB, DISTANCE (Timing Advance) etc.).
XXI. SACCH Information
This element is used to carry the SACCH filling information (System Information messages, or EXTENDED MEASUREMENT ORDER message) that is to be used on a specific channel. 8 7 6 5 4 3 2 1 1 2 3 4 5 :j

Element identifier Length Number of messages Type of 1st message Length of 1st message 1st message

1 l l+1 N

Type of n'th message Length of n'th message

n'th message

The Length field (octet 2) indicates in binary the total remaining length of the element (octets 3 - N). The Number of SI messages field (octet 3) indicates in binary the number of messages contained in the element. The coding of each of these messages consists of a type field (Type of nth msg), a length field (Length of nth message) and a message field (nth message). The "Type of nth msg" field indicates the type of SYSTEM INFORMATION, or an EXTENDED MEASUREMENT ORDER message that follows in the "nth message" field. It is coded as follows:
Value Message

00000101 00000110 00001101 00001110 01000111

SYSTEM INFORMATION 5 SYSTEM INFORMATION 6 SYSTEM INFORMATION 5bis SYSTEM INFORMATION 5ter EXTENDED MEASUREMENT ORDER

All other values are reserved. The "Length of nth SI message" field indicates in binary the length of the "nth message" field that follows. The "nth message" field contains a complete SACCH message as defended in GSM 04.08.
XXII. UIC
It is coded as follows: Octet 3 bits 1 to 6 contain the radio interface octet 2 bits 3 to 8 of the UIC information element as defined in GSM 04.08. 8 7 6 5 4 3 2 1 1 2

Element identifier Length

1 3

UIC information

Octet 3 bits 7 and 8 are spare and set to zero.

XXIII. Main channel reference
This element contains the main channel reference of a multislot connection. It is coded in two octets as follows: 8 7 6 5 4 3 2 1 1 TN 2

Element identifier Reserved for future use

TN is time slot number, binary represented as in GSM 05.02.

XXIV. MultiRate configuration
This element gives the description of the multirate speech code configuration to be applied. 8 7 6 5 4 3 2 1 1

Element identifier

Length Rest of element coded as in GSM 04.08 not including GSM 04.08 element identifier or GSM 04.08 octet length value

2 3-n

XXV. MultiRate Control

This element indicates whether TFO is enabled or not and whether the BSC authorises the BTS to perform autonomously multi-rate code changes and whether an handover is to be expected. It is coded in two octets as follows: 8 7 6 5 4 3 2 1 1

Element identifier

8 Spare

4 PRE

3 RAE

1 TFO 3

The TFO field (bit 1 of octet 3) indicates if TFO is enabled or not. It is coded as follows: Value TFO 0 Tandem Free Operation is enabled 1 Tandem Free Operation is disabled The RAE field (bits 2-3, octet 3) defines whether the RATSCCH mechanism is enabled or not. It is coded as follows: Value RAE 0 0 RATSCCH mechanism is generally enabled, the BTS may change the AMR configuration within the given SCS and MACS constraints and within the given radio and Abis channel. 0 1 RATSCCH mechanism will potentially be enabled for one exchange. The BSC will use a MultiRate CODE MOD REQ message for that purpose 1 0 reserved 1 1 RATSCCH mechanism is generally disabled The PRE field (bit 4 of octet 3) indicates if an handover is to be expected soon or not. It is coded as follows: Value PRE 0 Handover is not expected, respectively has failed 1 Handover is expected soon
XXVI. Supported Code Types
This element indicates the code types supported by the BSS or remote BSS. It is coded as follows: 8 7 6 5 4 3 2 1 1 2 3

Element identifier Length Sys-ID

ext

Code List

4-n n+1

Preferred Code Type

The Sys-ID field (octet 3) identifies the system that sends or has sent the configuration. It should be set to 0000 0000 for GSM. The Code List field (octet 4) lists the code types that are supported by the BSS and Transcoder, and are therefore potential candidates for TFO establishment. If thePreferred Code Type is not present (this field is set to 1111.1111), then the Code List belongs to the remote BSS, otherwise it is the list of alternative Preferred Code Types. It is coded as follows: Bit 1: Set to 1 if the GSM FR Speech Code is supported. Bit 2: Set to 1 if the GSM HR Speech Code is supported. Bit 3: Set to 1 if the GSM EFR Speech Code is supported. Bit 4: Set to 1 if the GSM FR AMR Speech Code is supported. Bit 5: Set to 1 if the GSM HR AMR Speech Code is supported Bit 67: Reserved, set to 0. Bit 8: Reserved for extension, set to 0. If bit 4 of the Code List field (octet 4) indicates that FR AMR is supported or if bit 5 of the Code List field (octet 4) indicates that HR AMR is supported, the following two octets (octets 5-6) should be coded as follows:
8 Spare SCS 7 6 5 4 3 2 MACS 1 5 6

TFO_VER

If both FR AMR and HR AMR are supported, the octets 5-6 shall be sent twice. The first occurrence shall correspond to FR AMR configuration, the second one shall correspond to HR AMR configuration. The MACS field (bits 1-2 of octet 5, if present) indicates the Maximum number of AMR Code ModeS the BSS can support in the Active Code Set. It should be coded as follows: 0 0: A maximum of four code modes can be supported in the Active Code Set 0.1: A maximum of one code mode can be supported in the Active Code Set 1.0: A maximum of two code modes can be supported in the Active Code Set 1.1: A maximum of three code modes can be supported in the Active Code Set The TFO_VER field (bits 3-4 of octet 5, if present) indicates the TFO_VERSION. 0 0 : Version 0 of TFO All other values reserved for future used The SCS field (octet 6 if present) indicates the Set of AMR Code modes Supported by

the BSS. It should be coded as follows:Bit 8: Set to 1 if the AMR 12.2 Code Mode is supported. Bit 7: Set to 1 if the AMR 10.2 Code Mode is supported. Bit 6: Set to 1 if the AMR 7.95 Code Mode is supported. Bit 5: Set to 1 if the AMR 7.40 Code Mode is supported. Bit 4: Set to 1 if the AMR 6.70 Code Mode is supported. Bit 3: Set to 1 if the AMR 5.90 Code Mode is supported. Bit 2: Set to 1 if the AMR 5.15 Code Mode is supported. Bit 1: Set to 1 if the AMR 4.75 Code Mode is supported. The Preferred Code Field (bits 1-8, octet n+1) indicates the preferred code type for TFO establishment. It is coded as follows; 0 0 0 0 . 0 0 0 0: Full Rate Code is preferred 0 0 0 0 . 0.0 0 1: Half Rate Code is preferred 0 0 0 0 . 0 0 1.0: Enhanced Full Rate Code is preferred 0 0 0 0 . 0 0 1.1: FR Adaptive Multi-Rate Code is preferred 0 0 0 0 . 0 1 0 0: HR Adaptive Multi-Rate Code is preferred 1 1 1 1 . 1 1 1 1: No preferred code typeAll other values reserved for future used
XXVII. Frame Number
This element contains the absolute frame number (FN) modulo 42432. It is used to carry the current timing in BTS to BSC for calculation of the Starting Time parameter required in some messages. 8 7 6 5 4 3 2 1 1 T3 (high) T2 2 3

Element identifier T1' T3 (low)

Octets 2-3 are coded as defined for octets 2-3 of the Starting Time information element of GSM 04.08.
XXVIII. Cause
The cause element is used to indicate the reason for a particular event to have occurred and is coded as shown below. 8 7 6 5 4 3 2 1 1 2 Cause Value 3 3a 4 Diagnostic(s) if any

Element identifier Length E

Cause Extension

The Length field indicates in binary the remaining length of the element (octets 3-N). The Cause Value is a single octet field (octet 3) if the extension bit E (bit 8) is set to 0. If it is set to 1 then the cause value is a 2 octet field (octets 3 and 3a). The Cause Value is divided into two fields: a class (bits 5-7 of octet 3) and a value within the class (bits 1-4 of octet 3). If the value of the first octet of the cause field is 1XXX 0000 then the second octet is reserved for national applications (XXX will still indicate the class). Diagnostic information is not available for every cause, see the table below. When available, it is coded in the same way as the corresponding information element in clause 9. Inclusion of diagnostics is optional. Classes: Class (000): Normal event Class (001): Normal event Class (010): Resource unavailable Class (011): Service or option not available Class (100): Service or option not implemented
Signaling Analysis Manual M900/M1800 Base Station Controller Appendix A Message Interpretation

Class (101): Invalid message (e.g. parameter out of range) Class (110): Protocol error Class (111): Interworking CAUSE VALUES: Class 000 000 000 000 000 000 000 000 000 000 000 000 000 001 001 Value - - - 0000 0001 0010 0011 0100 0101 0110 0111 1000 1::: 1110 1111 - - - 0000 normal event, unspecified Normal Event reserved for international use Cause Normal Event radio interface failure radio link failure handover access failure talker access failure reserved for international use reserved for international use reserved for international use O&M intervention reserved for international use Channel Number Channel Number Channel Number Channel Number Diagnostics

001 001 001 001 001 010

0::: 0111 1000 1::: 1111 - - - Resource unavailable reserved for national use

010 010 010 010 010

0000 0001 0010 0011 0100

equipment failure radio resource not available terrestrial channel failure CCCH overload ACCH overload Channel Number Channel Number Channel Number Channel Number

Class 010 010 010 010 010 010 010 010 010 010 010 011 011

Value 0101 0110 0111 1000 1001 1010 1011 1100 1101 1110 1111 - - - 0000

Cause processor overload reserved for international use BTS not equipped remote transcoder failure notification overflow reserved for international use reserved for international use reserved for national use reserved for national use reserved for national use resource not available, unspecified Service or Option Not Available requested transcoding/rate adaption not available reserved for international use

Diagnostics

Channel Number Channel Number

Channel Number

011 011 011 011 100

0001 :::: 1110 1111 - - - -

service or option not available, unspecified Service or Option Not Implemented

100

0000

encryption algorithm not implemented reserved for international use

Channel Number

100 100 100 100 100 100 100

0001 0::: 0111 1000 1::: 1110 1111

reserved for national use

service or option not implemented, unspecified Invalid Message

101

- - - -

Class 101

Value 0000

Cause radio channel already activated/allocated reserved for international use

Diagnostics Channel Number

101 101 101 101 101 101 101 110 110 110 110 110 110 110 110 110 110

0001 0::: 0111 1000 1::: 1110 1111 - - - 0000 0001 0010 0011 0100 0101 0110 0111 1000

reserved for national use

invalid message, unspecified Protocol Error message discriminator error message type error message sequence error general information element error mandatory information element error optional information element error information element nonexistent information element length error invalid information element contents reserved for international use reserved for international Element Identif Element Identif Element Identif Element Identif Inform. Element Message Discrim Message Type Message Type

110 110

1001 1010

use 110 110 110 110 110 111 111 111 1011 1100 1101 1110 1111 - - - 0000 0::: reserved for international use reserved for national use reserved for national use reserved for national use protocol error, unspecified Interworking reserved for international use

Class 111 111 111 111 111

Value 0111 1000 1::: 1110 1111

Cause

Diagnostics

reserved for national use

interworking, unspecified

XXIX. Full Immediate Assign Info

This element is used to convey a full L3 immediate assign message (3 types). 8 7 6 5 4 3 2 1 1 2 3

Element identifier Length Indicator Full Immediate Assign Info

25

The Length Indicator field (octet 2) indicates in binary the remaining length of the element (octets 3-25). The Full Immediate Assign Info field (octets 3-25) contains a complete immediate assign message (IMMEDIATE ASSIGN or IMMEDIATE ASSIGN EXTENDED or IMMEDIATE ASSIGN REJECT) as defined in GSM 04.08.
XXX. Link Identifier
This element identifies the signaling channel and SAPI of the radio data link. 8 7 Element identifier 6 5 4 3 2 1 1

C2

C1

NA

priority

SAPI

The NA bit (bit 6 in octet 2) is set to 1 to indicate that the Link Identifier is not applicable for this message. In all other cases it is set to 0. The C-bits indicate the channel type as follows: C2 C1

Huawei Technologies Proprietary A-93 Signaling Analysis Manual M900/M1800 Base Station Controller Appendix A Message Interpretation 0 0

main signaling channel (FACCH or SDCCH) 0 1 SACCH All other values are reserved for future use. The SAPI field contains the SAPI value as defined in GSM 04.05. The priority field contains the message priority for SAPI 0, as defined in GSM 04.06, as follows: 0 0 normal priority 0 1 high priority 1 0 low priority All other values for SAPI 0 and all values for other SAPIs are reserved for future use.

XXXI. RLM Cause

This element is used to indicate the precise protocol error or the reason for a release on the radio link layer. 8 7 6 5 4 3 2 1 1 2 Cause Value 3

Element identifier Length E

The Cause Value is a one octet field if the extension bit is set to 0. If the extension bit is set to 1, the Cause Value is a two octet field. The Cause Value field is coded as follows: 8 7 6 5 4 3 2 1 0 0 0 0 0 0 0 0 reserved 0 0 0 0 0 0 0 1 timer T200 expired (N200+1) times 0 0 0 0 0 0 1 0 re-establishment request 0 0 0 0 0 0 1 1 unsolicited UA response 0 0 0 0 0 1 0 0 unsolicited DM response 0 0 0 0 0 1 0 1 unsolicated DM response, multiple frame established state 0 0 0 0 0 1 1 0 unsolicited supervisory response 0 0 0 0 0 1 1 1 sequence error
Signaling Analysis Manual M900/M1800 Base Station Controller Appendix A Message Interpretation

0 0 0 0 1 0 0 0 U-frame with incorrect parameters 0 0 0 0 1 0 0 1 S-frame with incorrect

parameters 0 0 0 0 1 0 1 0 I-frame with incorrect use of M bit 0 0 0 0 1 0 1 1 I-frame with incorrect length 0 0 0 0 1 1 0 0 frame not implemented 0 0 0 0 1 1 0 1 SABM command, multiple frame established state 0 0 0 0 1 1 1 0 SABM frame with information not allowed in this state All other values are reserved for future use.

XXXII. L3 Information (message name)

This element contains a link layer service data unit (L3 message). It is used to forward a complete L3 message as specified in GSM 04.08 between BTS and BSC. 8 7 6 5 4 3 2 1 1 2 Indicator Link Layer Service Data Unit (i.e. a layer 3 message as defined in GSM 04.08) n 3 4

Element identifier Length

The Length Indicator field (octets 2-3) indicates in binary the remaining length of the element (octets 4-n). The most significant bit is bit 8 of octet 2 and the least significant bit is bit 1 of octet 3. Octets 4-n contain the complete L3 message as defined in GSM 04.08. In the message format section, the 04.08 message name to be included is indicated within brackets.

Table of Contents

Appendix B Difference between Phase1- Phase2- Phase2+.....................................................B-1 B.1 Difference between Messages over A-interface in Different Phases................................B-1 B.2 Difference Analysis............................................................................................................B-1

Appendix B Difference between Phase1- Phase2Phase2+

B.1 Difference between Messages over A-interface in Different Phases
The GSM technical specification is a standard constantly improved and perfected. With the introduction of Phase1, Phase2 and Phase2+, GSM provides different new services for user to satisfy the requirements from the market. Phase1 of the GSM technical specification includes 3.x.x series standard; Phase2 includes 4.x.x series standard, and the subsequent series standards 5.x.x, 6.x.x and 7.x.x belong to Phase2+. This technical specification provides good compatibility in the development. This section gives the development of the A-interface L3 protocol (GSM 08.08) in each phase. To facilitate description, take the typical protocol in each phase for analysis: GSM08.08 version 3.10.1 is for Phase1, GSM08.08 version 4.7.1 for Phase2, and GSM08.08 version 7.6.1 for Phase2+.

B.2 Difference Analysis

I. Message differences in Phase1-Phase2-Phase2+
Table B-1 illustrates the message differences in Phase1/Phase2/Phase2+. Table B-1 message differences in Phase1/Phase2/Phase2+ Message Assignment Request Phase1 Supported Phase2 Layer 3 header information changed as optional IE RADIO CHANNEL IDENTITY cancelled, optional IE CLASSMARK INFORMATION 2Reference newly added, optional IE Phase2+ Group Call Reference newly added, optional IE Talker Flag newly added, optional IE LSA Access Control Suppression newly added, optional IE

Assignment Complete

Supported

Radio channel identity cancelled, Chosen channel Reference newly added, optional IE Chosen encryption algorithm Reference newly added, optional IE

Circuit Identity Code newly added, optional IE Circuit Pool newly added, optional IE Speech Version (Chosen) newly added, optional IE LSA Identifier newly added, optional IE

Assignment Failure

Supported

Basically consistent, with cause value adjusted

Circuit Pool newly added, optional IE Circuit Pool List newly added, optional IE Some cause values added

Block

(BSC to MSC) supported

(BSC to MSC) supported

Changed as bi-directional (MSC-BSC) messages: (MSC to BSC) Connection Release Requested Reference newly added, optional IE

Blocking Acknowledge Unblock

Supported (BSC to MSC) supported Supported

Supported (BSC to MSC) supported

Changed to bi-directional Changed to bi-directional

Unblocking Acknowledge

Supported

Changed to bi-directional

Handover Request

Supported

Radio channel identity cancelled, Cause Reference newly added, optional IE Classmark information Reference newly added, optional IE

Current Channel type 1 newly added, optional IE Speech Version (Used) newly added, optional IE Group Call Reference newly added, optional IE Talker Flag newly added, optional IE Configuration Evolution Indication newly added, optional IE Chosen Encryption Algorithm (Serving) newly added, optional IE Old BSS to New BSS Information newly added, optional IE LSA Information newly added, optional IE LSA Access Control Suppression newly added, optional IE

Handover Required

Supported

Optional IE Cell identifier list (preferred) modified as mandatory Current radio environment cancelled, optional IE Environment of BS "n" cancelled, optional IE

Circuit Pool List newly added, optional IE Current Channel Type 1 newly added, optional IE Speech Version (Used) newly added, optional IE Queuing Indicator newly added, optional IE Old BSS to New BSS Information newly added, optional IE

Handover Request Acknowledge

Supported

Layer 3 Information modified in code Chosen channel Reference newly added, optional IE Chosen encryption algorithm Reference newly added, optional IE

Circuit Pool newly added, optional IE Speech Version (Chosen) newly added, optional IE Circuit Identity Code newly added, optional IE LSA Identifier newly added, optional IE Cell Identifier newly added, optional IE Supported Newly added Supported

Handover Command Handover Complete Handoer Succeeded Handover Candidate Enquire Handover Canidate Response Handover Failure

Supported Supported Not supported Supported

Layer 3 Information modified in code Supported Not supported Optional IE Cell identifier modified as mandatory Optional IE Cell identifier modified as mandatory Supported

Supported

Supported

Supported

Circuit Pool newly added, optional IE Circuit Pool List newly added, optional IE

Resource Request

Supported

Optional IE Cell identifier modified as mandatory Extended Resource Indicator Reference newly added, optional IE

Supported

Resource Indication

Supported

Resource Indication Method newly added, Mandatory IE Mandatory IE Resource available modified as optional Total Resource accessible newly added, optional IE

Supported

Paging

Supported

TMSI code changed Channel Needed newly added, optional IE

eMLPP Priority newly added, optional IE

Clear Request Clear Command

Supported Supported

Supported Mandatory IE Layer 3 header information modified as optional Supported Supported Supported Optional IE Cell identifier modified as mandatory Optional IE Radio channel identity deleted Chosen channel newly added, optional IE Chosen encryption algorithm newly added, optional IE

Supported Supported

Clear Complete Reset Reset Acknowledge handover Performed

Supported Supported supported Supported

Supported Supported Supported Speech Version (Chosen), optional IE LSA Identifier newly added

Overload Trace Invocation

Supported Supported

Supported Modified as 2 messages: MSC INVOKE TRACE ; BSS INVOKE TRACE

Supported Modified as 2 messages: MSC INVOKE TRACE ; BSS INVOKE TRACE Supported Supported

MSC Invoke Trace BSS Invoke Trace

Not supported Not supported

Newly added Newly added

Classmark Update

From BSC to MSC

Modified as bi-directional Change to the optional IE Classmark information type 2 Classmark information type 3 newly added, optional IE

Supported

Cipher Mode Command

Supported

Mandatory IE Layer 3 header information modified as optional Cipher response mode newly added, optional IE

Supported

Cipher Mode Complete

Supported

Layer 3 message contents newly added, optional IE Chosen encryption algorithm newly added, optional IE

Supported

Complete Layer3 Information

Supported

Chosen channel newly added, optional IE

LSA Identifier List newly added, optional IE APDU newly added, optional IE

Queuing Indication SAPI "n" Reject SAPI "n" Clear Command SAPI "n" Clear Complete handover Required Reject Reset Circuit Reset Circuit Acknowledge Handover Detect Circuit Group Block Circuit Group Blocking Acknowledge Circuit Group Unblock Circuit Group Unblock Acknowledge

Supported Supported Supported Supported Supported Supported Supported Supported Not supported Not supported Not supported Not supported

Supported Supported Not supported Not supported Supported Supported Supported Supported Newly added (from BSC to MSC) Newly added (from MSC to BSC) Newly added (from BSC to MSC) Newly added (from MSC to BSC)

Supported Supported Not supported Not supported Supported Supported Supported Supported Supported(bi-directional) Supported (bi-directional)

Supported (bi-directional) Supported (bi-directional)

Confusion

Not supported

Newly added

Supported

Classmark Request Unequipped Circuit Cipher Mode Reject

Not supported Not supported Not supported

Newly added Newly added Newly added

Supported Supported Supported

Load Indication VGCS.CBS Setup VGVS/VBS Setup ACK VGCS/VBS Assignment Request VGCS/VBS Assignment Result VGCS/VBS Assignment Failure VGCS/VBS Assignment Indication Uplink Request Uplink Request Acknowledge Uplink Request Confirmation Uplink Release Indication Uplink Reject Command Uplink Release Command Uplink Seized Command Suspend Resume Change Circuit Change Circuit Acknowledge LSA Information Location Information Command Location Information Report

Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported

Not supported Not supported Not supported Not supported

Newly added Newly added Newly added Newly added

Not supported

Newly added

Not supported

Newly added

Not supported

Newly added

Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported

Newly added Newly added Newly added Newly added Newly added Newly added Newly added Newly added Newly added Newly added Newly added Newly added Newly added

Not supported

Newly added

II. message IE difference in Phase1-Phase2-Phase2+Phase1Phase2Phase2

Table B-2 illustrates the IE differences of messages in Phase1/Phase2/Phase2+.

Table B-2 message IE difference in Phase1-Phase2-Phase2+Phase1Phase2Phase2 ELEMENT Circuit identity code Radio channel identity Resource available Cause Phase1 Supported Supported Supported Supported Phase2 Supported Deleted Supported Directed Retry added Invalid cell added Invalid message contents added Information element or field missing added Incorrect value added Unknown Message type added Unknown Information Element added Phase2+ 1544k/s supported Deleted Supported Joined group call channel added Traffic added Traffic Load added Preemption added Circuit pool mismatch added Switch Circuit pool added Requested speech version unavailable added LSA not allowed added VGCS/VBS call non existent added Cell identifier Priority Layer 3 header information IMSI TMSI Encryption information Supported Supported Supported Supported Supported Supported (only A5/1 not encrypted) Supported PCI domain added Supported Supported Supported Supported (A5/1 A5/2 A5/3 A5/4 A5/5 A5/6 A5/7 not encrypted) Support for PCS1900 newly added Supported Supported Supported Supported Supported A5/1 A5/2 A5/3 A5/4 A5/5 A5/6 A5/7 not encrypted)

Channel type

Supported

Channel rate type newly added Full/half rate preferred, optional Speech version 1 supported Data service rate improved

multi-timeslot assignment supported Multi-speech version like EFR,AMR supported

Periodicity Extended resource indicator Number of MSs Current radio environment Environment of BS "n" Classmark information type 2 Classmark information type 3 Interference band to be used RR Cause Trace number Layer 3 information DLCI Downlink DTX flag Cell identifier list

Supported Not supported

Parameter strictly defined Newly added

Parameter strictly defined SM domain newly added

Supported Supported Supported Supported

Supported Deleted Deleted Code of CLASSMARK 2 modified Newly added

Supported Deleted Deleted Supported

Not supported

Supported

Supported Supported Supported Supported Supported Supported Supported

Supported Supported Deleted Supported Supported Supported Supported

Supported Supported Deleted Supported Supported Supported Newly addedPCS1900 supported Supported Supported Supported

Response Request Resource Indication Method Classmark information type 1 Circuit identity code list Diagnostic Layer 3 message contents

Supported Supported Supported

Supported Supported Supported

Not supported Not supported Not supported

Newly added Newly added Newly added

Supported Supported Supported

Chosen channel

Not supported

Newly added

channel mode domain added Newly added multichannel supported

Total resource accessible Cipher response mode Channel needed

Not supported Not supported Not supported

Newly added Newly added Newly added

Supported Supported Understanding of 11 modified, half/full rate supported Supported Supported Supported Supported Supported Supported Supported Supported

Trace type Trigger Id Trace reference Transaction Id Mobile identity OMC Id Forward indicator Chosen encryption algorithm Circuit Pool Circuit Pool List Time Indication Resource Situation Current Channel type 1 Queuing Indicator Speech Version Assignment Requirement Talker Flag Connection Release Requested Group Call Reference EMLPP Priority Configuration Evolution Indication

Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported

Newly added Newly added Newly added Newly added Newly added Newly added Newly added Newly added

Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported

Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported

Newly added Newly added Newly added Newly added Newly added Newly added Newly added Newly added Newly added Newly added

Not supported Not supported Not supported

Not supported Not supported Not supported

Newly added Newly added Newly added

Old BSS to New BSS Information LSA Identifier LSA Identifier List LSA Information LCS QoS LSA access control suppression LCS Priority Location Type Location Estimate Positioning Data LCS Cause LCS Client Type APDU Network Element Identity GPS Assistance Data Deciphering Keys Return Error Request Return Error Cause Segmentation

Not supported Not supported Not supported Not supported Not supported Not supported

Not supported Not supported Not supported Not supported Not supported Not supported

Newly added Newly added Newly added Newly added Newly added Newly added

Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported

Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported Not supported

Newly added Newly added Newly added Newly added Newly added Newly added Newly added Newly added Newly added Newly added Newly added Newly added Newly added

Table of Contents

Appendix C Glossary....................................................................................................................C-1

Appendix C Glossary
A ABIS AC ACCH ACK ACS AGCH AInterface AMR APDU ARFCN ATT B BA BCCH BCD BCF BS BSC BSIC BSS BSSAP BSSMAP BTSM C CA CBA CBC CBCH CBQ Cell Allocation Cell Bar Access Cell Broadcast Center Cell Broadcast CHannel Cell Bar Qualify BCCH Allocation Broadcast Control CHannel Binary-Coded Data Base Station Control Function Base Station Base Station Controller Base Station Identity Code Base Station Subsystem Base Station Subsystem Application Part Base Station Subsystem Management Application Part Base Transceiver Station Management Abis Interface Access Control Associated Control CHannel ACKnowledgement Additional Reselection Parameters Indication Access Grant Channel A Interface Adaptive Multi-Rate Application Protocol Data Unit Absolute Radio Frequency Channel Number Attach-Detach allowed

CBS CC CCCH CCH CCITT CCS CGI CI CIC CKSN CM CP CR CRC CRO D DCCH DCS DLC DLCEP DLCI DM DPC DRX DTAP DTMF DTX E E3M EC ECSC EFR eMLPP ETSI F FACCH FN FR

Cell Broadcast Service Call Control Common Control Channel Control channel International Telegraph and Telephone Consultative Committee Common Channel Signaling Cell Global Identification Cell Identity Circuit Identification Code Circuit Identification Code Connection Management

Connection Request Cyclic Redundancy Code Cell Reselect Offset

Dedicated Control CHannel Digital Cellular System Data Link Connection Data Link Connection End Point Data Link Connection Identifier Disconnected Mode Destination Point Code Discontinuous Reception Direct Transfer Application Part Dual-Tone Multi-frequency Discontinuous Transmission

E3 Sub-Multiplexer Emergency Call Early Classmark Sending Control Enhanced full rate speech codec Environment Monitoring European Telecommunications Standards Institute

Fast Associated Control Channel Frame Number Full Rate

FUC G GFBI GMC2 GMCC GOPT GPRS GPS GSM GSNT GT H HLR HR HSCSD I ID IE IMEI IMSI ISDN ISUP ITU-T L L2ML LAC LAI LAPD LAPDm LCS LPN7 LSA LSB M MA MACS MAP

Frame Unit Controller

Fiber Interface board Inter-Module Communication board Module Communication and Control board Local Optical Interface Board General Packet Radio Service Global Position System Global System for Mobile Communications GSM Signaling Switching Network Board Global Title

Home Location Register Half Rate High Speed Circuit Switched Data

IDentification/IDentity information element International Mobile Equipment Identity International Mobile Station Identity Integrated Services Digital Network Integrated Services Digital Network User Part/ISDN User Part International Telecommunication Union - Telecommunication Standardization Sector

Layer 2 Management Link Location Area Code Location Area Identity Link Access Procedure on the D channel Link Access Procedure on the Dm channel LoCation Service Common Channel Signaling Processing Board Link State Advertisement Least Significant Bit

Mobile Allocation Maximum number of AMR Codec ModeS Mobile Application Part

MCC MDC MDT ME MM MMCC MMSMS MMSS MNC MNS MOC MRT MS MSB. MSC MSU MT MTP N NA NACK NCC NECI NI NSS O OACSU OM OMAP OMC OML OPC OSI P PCH PCI PCM PCS

Mobile Country Code Message Discrimination Message Distribution Mobile Equipment Mobility Management Mobility Management Call Control Mobility Management Short Message Service Mobility Management Supplement Service Mobile Network Code Mobile Network Signaling Mobile Originated Call Message Routing Mobile Station Most Significant Bit Mobile Switching Center, Mobile Service Switching Center Message Signaling Unit Maintenance and Test console Message Transfer Part

No Acknowledgment Negative ACKnowledgement Network Color Code New Establishment Causes Indication Network Identity Network SubSystem

Off Air Call Set Up Operation & Maintenance Operation and Maintenance Application Part Operation and Maintenance Center Operation & Maintenance Link Originating Point Code Open System(s) Interconnection

Open System(s) Interconnection Protocol Control Information Pulse Code Modulation Personal Communications Services

PD PHY PI PLMN PT PWRC Q QoS R RA RACH RAND RF RIL3 RLM RR RSL RXLEV RXQUAL S SABM SACCH SAP SAPI SCCP SCMG SCS SDCCH SI SIM SLC SLM SLS SLT SM SMI SMLC SMS

Discrimination Physical Sublayer & Physical Layer cell reselection Parameter Indication Public Land Mobile Network Penalty Time Power Control

Quality of Service

Random Access Random Access CHannel RANDom number Radio Frequency Radio Interface Layer 3 Radio Link Management Radio Resource Radio Signaling Link received signal level received Signal Quality

Set Asynchronous Balanced Mode Slow Associated Control CHannel Service Access Point Service Access Point Identification Signaling Connection and Control Part SCCP Management Set of AMR Codec modes Supported Stand-alone Dedicated Control Channel Service Indicator Subscriber Identity Module Signaling Link Code Signaling Link Manager Signaling Link Selection Signaling Link Test Session Management Subsequent Modification Indication Serving Mobile Location Center Short Message Service

SNM SRES SRM SS SS7 SSN STM T TA TCAP TCH TCSM TDMA TEI TFO TI TMSI TN TRX TS TUP U UA UI V VBS VGCS VLR

Signaling Network Management Signed Response Signaling Route Management Supplementary Service Signaling System No.7 Sub-System Number Signaling Traffic Management

Timing Advance Transaction Capabilities Application Part Traffic Channel Transcoder and Sub-Multiplexer Time Division Multiple Access Terminal Endpoint Identification Tandem Free Operation Transaction Identifier Temp Mobile Subscriber Identifier Time slot Number Transceiver technical specification(s) Telephone User Part

Unnumbered Acknowledge Unnumbered Information(frame)

Voice Broadcast Service Voice Group Call Service Visitor Location Register

Table of Contents

Appendix D Abbreviation.............................................................................................................D-1

Appendix D Abbreviation
A ACC ACK ACT ACTIV ASS AUT C CHAN CIPH CMD CMP CNF CONF CONN D DEACT DET DISC E ENCR EST EXT H HANDO I IMM IND INFO L L3 Layer 3 Immediate Indication Information Handover Encryption Establishment Extended Deactivation Detection Disconnect Channel Ciphering Command Complete Confirm Confirm Connection Accept Acknowledgement Activation Activation Assignment Authentication

LOC M MOD P PAG PHY R REJ REL RES REQ RLSD RPS RQD S SERV U UPD

Location

Mode

Paging Physical

Reject Release Resource Request Released Response Required

Service

Updating

Table of Contents

Appendix E Reference for GSM Protocols.................................................................................E-1

Appendix E Reference for GSM Protocols

Number 01 series: for GSM system description 01.00 01.01 01.02 01.04 01.31 01.33 01.48 01.56 01.60 01.61 Working Procedures for SMG GSM Release 1999 Specifications General Description of a GSM Public Land Mobile Network (PLMN) Abbreviations and Acronyms Fraud Information Gathering System (FIGS); Service requirements Stage 0 Lawful Interception requirements for GSM ISDN-based DECT/GSM interworking; Feasibility Study GSM Cordless Telephony System (CTS) (Phase 1); CTS Authentication and Key Generation Algorithms Requirements GPRS requirements General Packet Radio Service (GPRS) Short Title

02 series: GSM services 02.01 02.02 02.03 02.04 02.06 02.07 02.08 02.09 02.11 02.16 02.17 02.19 02.22 Principles of Telecommunication Services Supported by a GSM Public Land Mobile Network(PLMN) Bearer Services (BS) Supported by a GSM Public Land Mobile Network (PLMN) Teleservices Supported by a GSM Public Land Mobile Network (PLMN) General on Supplementary Services Types of Mobile Stations (MS) Mobile Station (MS) Features European digital cellular telecommunication system (Phase2); Quality of service. Security aspects Service Accessibility International Mobile Station Equipment Identities (IMEI) Subscriber Identity Modules, Functional Characteristics Subscriber Identity Module Application Programming Interface (SIM API); Service description-Stage 1 Stage 1 for Personalisation of GSM ME

02.24 02.30 02.31 02.32 02.33 02.34 02.40 02.41 02.42 02.43 02.48 02.53 02.56 02.60 02.63 02.66 02.67 02.68 02.69 02.71 02.72 02.76

Description of Charge Advice Information (CAI) Man-machine Interface (MMI) of the Mobile Station (MS) Fraud Information Gathering System (FIGS) Service description - Stage 1 Immediate Service Termination (IST); Service description - Stage 1 Lawful intercept Stage 1 High Speed Circuit Switched Data (HSCSD) - Stage 1 Procedures for Call Progress Indications Operator Determined Barring Network Identity and Time zone (NITZ); Service Description, Stage 1 Support of Localised Service Area (SoLSA); Service description; Stage 1 Security mechanisms for the SIM Application Tool kit; Stage 1 Tandem Free Operation (TFO); Service description; Stage 1 GSM Cordless Telephony System (CTS), Phase 1; Service description; Stage 1 General Packet Radio Service Stage 1 Description Packet Data on Signalling channels Service (PDS) - Stage 1 Support of Mobile Number Portability (MNP); Service description; Stage 1 Enhanced Multi-Level Precedence and Pre-emption Service (eMLPP) Stage 1 Voice Group Call Service (VGCS); Stage 1(ASCI spec) Voice Broadcast Service (VBS); Stage 1(ASCI spec) Location Services (LCS) - Stage 1 Call Deflection Service description, Stage 1 Noise Suppression for the AMR

02.78

Customized Applications for Mobile network Enhanced Logic (CAMEL); Service definition (Stage 1)

02.79 02.81 02.82 02.83

Support of Optimal Routeing (SOR); Service definition(Stage 1) Line Identification Supplementary Services - Stage 1 Call Forwarding (CF) Supplementary Services - Stage 1 Call Waiting (CW) and Call Hold (HOLD) Supplementary Services - Stage 1

02.84 02.85 02.86 02.87 02.88 02.90 02.91 02.93 02.94 02.95 02.96 02.97

MultiParty (MPTY) Supplementary Services - Stage 1 Closed User Group (CUG) Supplementary Services -Stage 1 Advice of Charge (AoC) Supplementary Services Stage1 User-to-User Signalling (UUS) Service Description, Stage 1 Call Barring (CB) Supplementary Services - Stage 1 Stage 1 Decision of Unstructured Supplementary Service Data (USSD) Explicit Call Transfer (ECT) Completion of Calls to Busy Subscriber (CCBS) Service Description Stage 1 Follow Me Service description - Stage 1 Digital cellular telecommunications system (Phase 2+); Support of Private Numbering Plan (SPNP); Service description, Stage 1 Name Identification Supplementary Services; Stage 1 Multiple Subscriber Profile (MSP) Service description, Stage 1

03 services: GSM network 03.01 03.02 03.03 03.04 03.05 03.07 03.08 03.09 03.10 03.11 03.12 03.13 03.14 03.15 03.16 03.18 03.19 03.20 03.22 03.26 03.30 Network Functions Network Architecture Numbering, Addressing and Identification Signalling requirements relating to routeing of calls to mobile subscribers Technical Performance Objectives Restoration Procedures Organization of Subscriber Data Handover Procedures Public Land Mobile Network (PLMN) Connection Types Technical Realization of Supplementary Services -General Aspects Location Registration Procedures Discontinuous Reception (DRX) in the GSM System Support of Dual Tone Multi-Frequency Signalling(DTMF) via the GSM System Technical Realization of Operator Determined Barring Subscriber Data Management Basic Call Handling GSM API for SIM toolkit stage 2 Security-related Network Functions Functions related to Mobile Station (MS) in idle mode Multiband operation of GSM/DCS 1800 by a single operator Radio Network Planning Aspects

03.31 03.32 03.33 03.34 03.35 03.38 03.39

Fraud Information Gathering System (FIGS); Service description - Stage 2 Universal Geographical Area Description (GAD) Lawful Interception - stage 2 High Speed Circuit Switched Data (HSCSD); Stage 2 Immediate Service Termination (IST); Stage 2 Alphabets and Language Specific Information for GSM Digital Cellular Telecommunications System (Phase 2)Interface Protocols for the Connection of Short Message, Service Centers (SMSCs) to Short Message Entities(SMEs) Technical Realization of the Short Message Service(SMS) Point-to-Point (PP) Technical Realization of Short Message Service Cell Broadcast (SMSCB) SMS Compression Support of Videotext Support of Teletext in a Public Land Mobile Network (PLMN) Technical realization of facsimile Group 3 service- transparent Technical realization of facsimile group 3 service - non-transparent Example Protocol Stacks for Interconnecting Service Centre(s) (SC) and Mobile Services Switching Centre(s) (MSC) Tool Kit Security Stage 2 Example Protocol Stacks for Interconnecting Cell Broadcast Centre (CBC) and Base Station Controller (BSC) Transmission Planning Aspects of the Speech Service in the GSM Public Land Mobile Network (PLMN) System Lower layers of the GSM Cordless Telephony System (CTS) radio interface - Stage 2 Tandem Free Operation (TFO); Service description, Stage 2 Description for the use of a Shared Inter Working Function (SIWF) in a GSM PLMN; Stage 2 GSM Cordless Telephony System (CTS), Phase 1; CTS Architecture Description; Stage 2 Mobile Station Application Execution Environment (MExE); Functional description; Stage 2 Characterization, test methods and quality assessment for handsfree Mobile Stations (MSs) General Packet Radio Service (GPRS) Service description; Stage 2 PDS Stage 2 Overall description of the GPRS radio interface; Stage 2 Support of GSM Mobile Number Portability (MNP);Stage 2 Enhanced Multi-Level Precedence and Preemption Service (EMLPP); Stage 2

03.40 03.41 03.42 03.43 03.44 03.45 03.46 03.47 03.48 03.49 03.50 03.52 03.53 03.54 03.56 03.57 03.58 03.60 03.63 03.64 03.66 03.67

03.68 03.69 03.70 03.71 03.72 03.73 03.78 03.79 03.81 03.82 03.83 03.84 03.85 03.86 03.87 03.88 03.90 03.91 03.93 03.96 03.97

Voice Group Call Service (VGCS) - Stage 2 Voice Broadcast service (VBS) - Stage 2 Routeing of calls to/from Public Data Network (PDN) Location Services (LCS) Stage 2 Call Deflection stage 2 Support of Localised Service Area (SoLSA); Stage 2 CAMEL Phase 2; Stage 2 Support of Optimal Routeing Line Identification Supplementary Services; Stage 2 Call Forwarding (CF) Supplementary Services; Stage 2 Call Waiting (CW) and Call Hold (HOLD) Supplementary Services; Stage 2 Multi Party (MPTY) Supplementary Services; Stage 2 Closed user Group (CUG) Supplementary Services; Stage 2 Advice of Charge (AoC) Supplementary Services; Stage2 User-to-user signalling (UUS); Stage 2 Call Barring (CB) supplementary services - Stage 2 Unstructured Supplementary Service Data (USSD) Explicit Call Transfer (ECT) Supplementary Service; Stage 2 Technical realization of Completion of Calls to Busy Subscriber (CCBS); Stage 2 Name Identification Supplementary Services; Stage 2 Multiple subscriber Profile (MSP); Stage 2

04 series: MS-BSS Interfaces and specifications (L2 and L3 contexts on interface Um) 04.01 04.02 04.03 04.04 04.05 04.06 04.07 04.08 04.10 Mobile Station - Base Station System (MS - BSS) Interface General Aspects and Principles GSM Public Land Mobile Network (PLMN) Access Reference Configuration Mobile Station - Base Station System (MS - BSS) Interface Channel Structures and Access Capabilities Layer 1 - General Requirements Data Link (DL) Layer General Aspects Mobile Station - Base Stations System (MS - BSS) Interface Data Link (DL) Layer Specification Mobile Radio Interface Signalling Layer 3 General Aspects Mobile Radio Interface - Layer 3 Specification Mobile Radio Interface Layer 3 Supplementary Services Specification General Aspects

04.11 04.12 04.13 04.14 04.18 04.21 04.22 04.30 04.31 04.33 04.35

Point-to-Point (PP) Short Message Service (SMS) Support on Mobile Radio Interface Short Message Service Cell Broadcast (SMSCB) Support on the Mobile Radio Interface Performance Requirements on Mobile Radio Interface Individual equipment type requirements and interworking; Special conformance testing functions Mobile Radio Interface Layer 3 specification; Radio Resource Control Protocol Rate Adaption on the Mobile Station - Base Station System (MS-BSS) Interface Radio Link Protocol for Data and Telematic Services on the MS-BSS Interface Location Services (LCS); Mobile radio interface layer 3 supplementary services specification; Mobile Originating Location Request (MO-LR). Location Services (LCS); Mobile Station (MS) - Serving Mobile Location Centre (SMLC); Radio Resource LCS Protocol (RRLP) Lawful intercept Stage 3 Location Services (LCS); Broadcast Network Assistance for Enhanced Observed Time Difference (E-OTD) and Global Positioning System (GPS) Positioning Methods Inband Tandem Free Operation of Speech codecs, Service Description, stage 3 GSM Cordless Telephony System (CTS), (Phase 1) CTS Radio Interface Layer 3 Specification GSM Cordless Telephony System (CTS), (Phase 1) CTS supervising system Layer 3 Specification General Packet Radio Service (GPRS); Mobile Station (MS) - Base Station System (BSS) interface; Radio Link Control/ Medium Access Control (RLC/MAC) protocol Packet Data on Signalling channels Service (PDS) Service Description, Stage 3 Mobile Station - Serving GPRS Support Node (MS-SGSN) Logical Link Control (LLC) Layer Specification

04.53 04.56 04.57 04.60

04.63 04.64

04.65

Mobile Station (MS) - Serving GPRS Support Node (SGSN); Subnetwork Dependent Convergence Protocol (SNDCP)

04.67 04.68 04.69 04.71

Enhanced Multi-Level Precedence and Pre-emption service (eMLPP) Stage 3 Group Call Control (GCC) Protocol Broadcast Call Control (BCC) Protocol - Stage 3 Location Services (LCS) Stage 3

04.72 04.80 04.81 04.82 04.83 04.84 04.85 04.86 04.87 04.88 04.90 04.91 04.93 04.96

Call Deflection (CD) Supplementary Service; Stage 3 Mobile Radio Interface Layer 3 Supplementary Services Specification Formats and Coding Line Identification Supplementary Services - Stage 3 Call Forwarding (CF) Supplementary Services - Stage 3 Call Waiting (CW) and Call Hold (HOLD) Supplementary Services - Stage 3 Multi Party (MPTY) Supplementary Services - Stage 3
Closed User Group (CUG) Supplementary Services - Stage 3

Advice of Charge (AoC) Supplementary Services - Stage3

User-to-User Signalling (UUS) Supplementary Service Stage 3

Call Barring (CB) Supplementary Services - Stage 3 Unstructured Supplementary Service Data (USSD) Explicit Call Transfer (ECT) Supplementary Service -Stage 3 Completion of Calls to Busy Subscriber (CCBS); Stage 3 Name Identification Supplementary Services; Stage 3

05 series: physical layer on the radio path (L1 context on interface Um) 05.01 05.02 05.03 05.04 05.05 05.08 05.09 05.10 05.22 05.50 05.56 Physical Layer on the Radio Path (General Description) Multiplexing and Multiple Access on the Radio Path Channel Coding Modulation Radio Transmission and Reception Radio Subsystem Link Control Link Adaptation Radio Subsystem Synchronization Radio Link management in hierarchical networks Background for RF Requirements CTS-FP Radio Sub-system

06 series: Speech Codec Specifications 06.01 06.02 06.06 06.07 06.08 06.10 Full Rate Speech Processing Functions Half Rate Speech Processing Functions Half Rate Speech - Part 7: ANSI-C Code for GSM Half Rate Speech Codec Half Rate Speech - Part 8: Test Sequence for GSM Half Rate Speech Codec Half Rate Speech; Performance Characterization of the GSM half rate speech codec Full Rate Speech Transcoding

06.11 06.12 06.20 06.21 06.22 06.31 06.32 06.41 06.42 06.51 06.53 06.54 06.55 06.60 06.61 06.62 06.71 06.73 06.74 06.75 06.76 06.77 06.78 06.81 06.82 06.85 06.90 06.91 06.92 06.93 06.94

Substitution and Muting of Lost Frames for Full Rate Speech Channels Comfort Noise Aspects for Full Rate Speech Traffic Channels Half Rate Speech Transcoding Substitution and Muting of Lost Frames for Half Rate Speech Traffic Channels Comfort Noise Aspects for Half Rate Speech Traffic Channels Discontinuous Transmission (DTX) for Full Rate Speech Traffic Channels Voice Activity Detection (VAD) Discontinuous Transmission (DTX) for Half Rate Speech Traffic Channels Voice Activity Detection (VAD) for Half Rate Speech Traffic Channels Enhanced full rate speech processing functions: General description ANSI-C code for the enhanced full rate speech codec Test sequences for the GSM Enhanced Full Rate (EFR) Performance characterization of the GSM EFR Speech Codec Enhanced full rate speech transcoding Substitution and muting of lost frames for enhanced full rate speech traffic channels Comfort noise aspects for Enhanced Full Rate (EFR) speech traffic channels Adaptive Multi-Rate speech processing functions; General description ANSI-C code for the GSM Adaptive Multi Rate (AMR) speech codec Test sequences for the GSM Adaptive Multi Rate (AMR) speech codec AMR performance characterization ANSI-C code of the selected AMR-NS algorithm. Minimum Performance Requirements for Noise Suppresser Application to the AMR Speech Encoder Results of the AMR noise suppression selection phase Discontinuous Transmission (DTX) for enhanced full rate speech traffic channels Voice Activity Detection (VAD) for enhanced full rate speech traffic channels Subjective tests on the interoperability of the HR/FR/EFR speech codecs; single, tandem and tandem free operation Adaptive Multi-Rate speech transcoding Substitution and muting of lost frames for AMR speech traffic channels Comfort noise aspects for Adaptive Multi-Rate speech traffic channels Discontinuous Transmission (DTX) for Adaptive Multi-Rate speech traffic channels Voice Activity Detector (VAD) for Adaptive Multi Rate(AMR) speech traffic channels

07 series: Terminal Adaptation Functions of Mobile Station 07.01 07.02 07.03 07.05 General on Terminal Adaptation Functions (TAF) for Mobile Stations (MS) Terminal Adaptation Functions (TAF) for Services Using Asynchronous Bearer Capabilities Terminal Adaptation Functions (TAF) for Services Using Synchronous Bearer Capabilities Use of Data Terminal Equipment - Data Circuit Terminating Equipment (DTE-DCE) Interface for Short Message Services (SMS) and Cell Broadcast Services(CBS) AT Command set for GSM Mobile Equipment GSM Application Programming Interface Terminal Equipment to Mobile Station (TE-MS) multiplexer protocol General Packet Radio Service (GPRS); Mobile Station(MS) supporting GPRS

07.07 07.08 07.10 07.60

08 series: BTS-MSC interfaces (A and Abis) 08.01 08.02 08.04 08.06 08.08 08.14 08.16 08.18 08.20 08.31 General Aspects on the BSS-MSC Interface Base Station System - Mobile Services Switching Centre(BSS-MSC) Interface - Interface Principles Base Station System - Mobile Services Switching Centre (BSS-MSC) Interface Layer 1 Specification Signalling Transport Mechanism Specification for the Base Station System - Mobile Services Switching Centre (BSS-MSC) Interface Mobile Switching Centre - Base Station system (MSC-BSS) Interface Layer 3 Specification General Packet Radio Service (GPRS); Base Station System (BSS) Serving GPRS Support Node (SGSN) interface; Gb Interface Layer 1 General Packet Radio Service (GPRS); Base Station System (BSS) Serving GPRS Support Node (SGSN) Interface; Network Service General Packet Radio Service (GPRS); Base Station System (BSS) Serving GPRS Support Node (SGSN); BSS GPRS Protocol Rate Adaptation on the BSS-MSC Interface Location Services (LCS); Serving Mobile Location Centre (SMLC) Serving Mobile Location Centre (SMLC); SMLC Peer Protocol (SMLCPP) Location Centre (SMLC); Radio Resource LCS Protocol (RRLP) Base Station Controller - Base Transceiver Station (BSC-BTS) Interface General Aspects Base Station Controller - Base Transceiver Station (BSC-BTS) Interface Interface Principles Base Station Controller - Base Transceiver Station (BSC-BTS) Interface Layer 1 Structure of Physical Circuits Base Station Controller - Base Transceiver Station (BSC-BTS) Interface Layer 2 Specification Base Station Controller - Base Transceiver Station (BCS-BTS) Interface Layer 3 Specification

08.51 08.52 08.54 08.56 08.58

08.59 08.60 08.61 08.62 08.71

BSC-BTS O&M Signalling Transport Inband Control of Remote Transcoders and Rate Adaptors Inband Control of Remote Transcoder and Rate Adaptors;(Half Rate) Inband Tandem Free Operation (TFO) of Speech Codecs; Service Description; Stage 3 Location services (LCS) SMLC-BSS interface L3

09 series: Network interworking 09.01 09.02 09.03 General Network Interworking scenarios Mobile Application Part ( MAP) Specification Signalling Requirements on Interworking between the Integrated Services Digital Network (ISDN), or Public Switched Telephone Network (PSTN) and the Public Land Mobile Network (PLMN) Interworking between the Public Land Mobile Network and the CSPDN Interworking between PLMN and PAD access Interworking between PLMN and a Packet Switched Public Data Network/Integrated Services digital, Network (PSPDN/ISDN) for Support of Packet Switched Data Transmission Services. General Requirements on Interworking between the Public Land Mobile Network (PLMN) and the Intergrated Services Digital Network (ISDN) or Public Switched Telephone Network (PSTN) Application of the Base Station System Application Part (BSSAP) on the E-Interface Detailed Signalling Interworking within the PLMN, with the PSTN/ISDN Information Element Mapping between Mobile Station -Base Station System (MS - BSS) and Base Station System - Mobile-services Switching Centre (BSS - MCS) Signalling Procedures and the Mobile Application Part(MAP) Signalling Interworking for Supplementary Services Application of ISUP Version 2 for the ISDN-PLMN (GSM) signalling Signalling interworking between ISDN supplementary services Application Service Element (ASE) and Mobile Application Part (MAP) protocols Application of ISUP Version 3 for the ISDN-PLMN Signalling General Packet Radio Service (GPRS); Serving GPRS Support Node (SGSN) - Visitors Location Register (VLR); Gs interface network service specification General Packet Radio Service (GPRS); Serving GPRS Support Node (SGSN) - Visitors Location Register(VLR); Gs interface layer 3 specification Location Services (LCS); Base Station System Application Part LCS Extension (BSSAP-LE)
General Packet Radio Service (GPRS); GPRS Tunnelling Protocol (GPT) across the Gn and Gp Interface

09.04 09.05 09.06

09.07

09.08 09.09 09.10

09.11
09.12

09.13 09.14 09.16

09.18

09.31 09.60 09.61

General Packet Radio Service (GPRS); Interworking between the Public Land Mobile Network (PLMN) supporting GPRS and Packet

09.78 09.90 09.91 09.94 10 series 10.00 10.43 10.56 10.57 10.59 10.78

CAMEL Application Part phase 2 (stage 3) Interworking between Phase 1 Infrastructure and Phase 2 Mobile Stations (MS) Interworking Aspects of the SIM/ME Interface Between Phase 1 and Phase 2 Recommended Infrastructure Measures to Overcome Specific Phase 1 Mobile Stations Faults

Digital Cellular Telecommunication System Feature Description Support of Localised Service Area (SoLSA); Work Item Status Project scheduling and open issues: GSM Cordless Telephony System CTS, Phase 1 Project scheduling and open issues: Mobile Station Execution Environment (MExE) Project scheduling and open issues for EDGE Project scheduling and open issues: CAMEL

11 series: specification of equipment and models 11.10-1 11.10-2 11.10-3 11.10-4 11.11 11.14 11.17 11.18 11.19 11.21 11.23 11.24 11.26 11.30 11.31 11.32 Conformance Specification Mobile Station (MS) Conformance Specification, Part 2 ICS Mobile Station (MS) Conformance Specification, Part 3 Abstract Test suites SIM Application Toolkit conformance Specification Specification of the Subscriber Identity Module - Mobile Equipment (SIMME) Interface Phase 2+ SIM Application Tool kit SIM test specification Specification of the 1.8 Volt Subscriber Identity Module - Mobile Equipment (SIM - ME) Interface CTS SIM Fixed Part GSM Radio Aspects Base Station System Equipment Specification GSM Signalling Aspects Base Station System equipment Specification GSM transcoding and rate adaptation: Base station GSM Repeater Equipment Specification Mobile Services Switching Centre Home Location Register specification Visitor Location Register specification

12 series: O&M 12.00 12.01 Objectives and structure of GSM Public Land Mobile Network (PLMN) management Common Aspects of Public Land Mobile Network (PLMN) Management

12.02 12.03 12.04 12.05 12.06 12.07 12.08 12.11 12.15 12.20 12.21 12.22 12.30 12.71

Subscriber, Mobile Equipment (ME) and Services Data Administration Security Management Performance Management and Measurements for a GSM Public Land Mobile Network (PLMN) Subscriber Related Call and Event Data Network Configuration Management and Administration Operations and performance management Subscriber and Equipment trace Fault management of the Base Station System (BSS) General Packet Radio Service (GPRS); GPRS Charging Base Station System (BSS) Management Information Network Management (NM) Procedures and Messages on the Abis Interface Interworking of GSM Network Management (NM) Procedures and Messages at the Base Station Controller (BSC) ETSI Object Identifier Tree; Mobile Domain O&M Location Services (LCS); Location services management

13 series: Attachment requirements for GSM 13.01 13.02 13.11 13.21 13.34 Attachment requirements for Global System for Mobile communications (GSM) mobile stations; Access Attachment requirements for mobile stations in the DCS 1800 band and additional GSM 900 band Access Terminal essential requirements (RTTE) BSS Radio aspects requirements (RTTE) Attachment requirements for Global System for Mobile communications (GSM); High Speed Circuit Switched Data (HSCSD) Multislot Mobile Stations Access Attachment requirements for Cordless Telephony System Fixed Part (CTS-FP) Access Cordless Telephony System Mobile Stations (CTS-MS) Access Attachment requirements for Global System for Mobile communications (GSM); General Packet Radio Service (GPRS); Mobile stations Access Attachment requirements for Global System for Mobile communications (GSM); Railways Band(R-GSM); Mobile Stations; Access Attachment requirements for Global System for Mobile communications (GSM); Advanced Speech Call Items (GSM-ASCI) Mobile Stations; Access

13.55 13.56 13.60 13.67 13.68