Gsmsignaling

GSM Signaling Overview
] GSM signaling defines the communications between the mobile and

the network
] Signaling has to be carried through the network and across the airinterface to the mobile
] Different protocols are used across different interfaces
] All GSM signaling is based on the Open Systems Interconnect (OSI)
model used for computer systems
] The MSC uses ITUs Signaling System No:7, (SS7 or CCS7) for all its
signaling; to the BSC, HLR, VLR and to other networks
] The Air-interface and A-bis signaling is based on ISDN Link Access
Protocol (LAP-D and LAP-Dm)
] Signaling channels are integrated into the air-interface as the BCCH,
PCH, AGCH, SDCCH, SACCH and FACCH
] Signaling across all interfaces is specified in the standards to allow
different equipment manufacturers for each unit
TWS Proprietary - www.tws -inc.com - (770) 752-7033
Mobile Signaling
] When the mobile is first switched on it is under
the control of its own internal algorithms.
] It performs the following sequence:
c
c
c
c
c
c
c
c
Search for GSM frequencies

Find a FCCH and synchronize frequency
Find a SCH and synchronize time
Listen for a BCCH and download information
about the system
Download idle neighbor list and make
measurements
Select a best server and camp on it
If the user wants to make a call, the mobile has to
signal to the network.
It does this by sending a service request to the
network on the RACH.
GSM SIGNALLING
VLR
AC
MAP
VLR
Switching
System
NSS
MAP
MAP
BSSAP
BSC
LAPD
BTS
LAPDm
MS
ISUP
TUP
EIR
MAP
MAP
MSC
MAP
HLR
GMSC
Base Station
System (BSS)
PSTN
PLMN
(GSM)
ISDN
SS7 User Parts:

MAP: SS7, Mobile Application Part
BSSAP: SS7, Base Station Sub-System Application Part
ISUP: SS7, International Subscriber User Part
TUP: SS7, Telephone User Part
LAPD: ISDN, Link Access Protocol Version D

GSM Signaling
Open Systems Interconnect uses layers where only layer 1, the physical
layer is actually physically connected between devices. Messages are sent
between devices by handing them down to lower layers from transmission
across the physical interface.
OSI - Model
7
GSM Equivalent
APPLICATION
USER
TASKS
6 PRESENTATION
5
SESSION
TRANSPORT
NETWORK
NETWORK
DATA
DATALINK
LINK
Framing / Addressing
PHYSICAL
Coding / Modulation
PHYSICAL
Network Messages
GSM
NETWORK
TASKS
OSI Layers
Layer 3
Carries signaling messages, for getting the message to

its destination. Provides connection oriented
(dedicated signaling link) or connectionless services
(packet-type signaling). Example: Radio Resource
message sent from MSC to BSC.
Layer 3
Layer 3
Layer 2
Layer 2
Layer 2
Layer 1
Layer 1
Layer 1
Information Flow
Network Layer :
Data Link Layer :
Transfers frames error free between nodes. Concerned

with error detection, framing, re-transmission Example:
LAPD protocol on A-bis between BSC and BTS.
Physical Layer:
Transmits all information across the physical medium.

Specifies the physical medium used: mechanical,
electrical, functional and procedural characteristics.
Example: GMSK modulation on an RF carrier for the
Air-interface between the BTS and the MS
Signaling Layers for the Air Interface

Layer 1: Functions required to transfer bit steams over physical
TDMA / FDMA channels:
j Ciphering
j Setting of timing advance & TX power
j Channel Coding
j Mapping of logical channels onto physical channels
Layer 2:
Provides a reliable signaling link between MS and the

network. Protocol is based on the LAPDm of ISDN
j Framing
j Addressing
j Error correction
Layer 3:
Takes care of the main control of the MS -network

procedures. It is split into
3 sublayers:
j Radio Resource Management
j Mobility Management
j Connection Management
Speech
Air-interface Layers
Speech
User Data
Signaling
User Data
OSI layer 3 Network Functions
Signaling
OSI layer 2 Data link functions
Builds frames, requests

acknowledgement
Channel coding,
error protection,
interleaving
Reconstruct frames,
acknowledges
Error correction,
deinterleaving
OSI layer 1 Physical layer
Equalization
Transmitter
Receiver
RF
Modulation
RF
Demodulation
Network Layer
] The network layer is split into three sub-layers
c RR - radio resource management:
c routes messages to the correct channels
c establishes and maintains physical
connections for control and traffic channels.
c MM - mobility management:
c controls authentication and security
management.
c provides services for the CM layer.
c CM - connection management:
c CC: call control: responsible for establishing,
maintaining and releasing calls
c SS: supplementary services: data etc
c SMS: short message services
Network Layer
Layer 3
CM
CC
SS
SMS
Mobility Management MM
Radio Resources RR
Data Link Layer
Layer 1: Physical Layer
Signaling Protocol Reference Model

NSS
BSS
To other processes
within the BSS
Other applications,
ie. call control
A - Interface
BSSAP
To air interface
transmission
equip.
DTAP
BSSAP
BSS
MAP
DTAP
BSS
OMAP
Distribution function
BSS
MAP
Distribution function
SCCP
SCCP
MTP
MTP
Physical
Layer
Operation &
maintenance info. to
OA&M center
BSS
OMAP
To other
users
of the SCCP
and MTP
Terminology:
DTAP (direct transfer application part)
BSSMAP (BSS management application part)
BSS OMAP (operation & maintenance application part)
SCCP (signaling connection control part)
MTP (message transfer part)
Note: X.25 can be used

for transferring O & M
information
GSM Network Protocol Model

The MSC and the mobile always control all the network signaling.
MS
BTS
BSC
MSC
CM
Layer 3
Network
CM
MM
MM
RR
Layer 2
Data Link
Layer 1
Physical
LAPDm
Radio
BSSAP
SCCP
SCCP
MTP
MTP
RR
BTSM
BTSM
LAPDm
LAPD
LAPD
Radio
Air - Interface
64 kbit/s
BSSAP
BSSAP
64 kbit/s
A - bis
64 kbit/s
64 kbit/s
A - Interface
Example Page Jim

Mobile recognizes
Layer 3 message
Page Jim and
sends response to
page
Layer 2
decodes
message
MS Layer 1
receives
PCH
Layer 2
frames
message
Layer 3 message
Page Jim
Layer 2
recognizes a
message for
the mobile and
converts to
LAPDm
BTS
Layer 1
sends
message
on PCH
MSC
BSC
BTS Layer 1
receives A-bis
message
Layer 2
selects
BTS
Layer 1 sends
message
across A-bis:
T1 or
microwave
Layer 2
recognizes a
message for the
mobile and
converts to
LAPD
BSC Layer 1
receives 64 kbit
signaling from
MSC
Layer 2
selects
correct BSC
Layer 1 sends
message across
64 kbit signaling
channel
Radio Resource Messages

] Radio resource functions are controlled by the BSC and include:
c SACCH measurement reporting on the uplink
c System Information messages 5&6 transmitted on the downlink
c Immediate assignment (assignment of SDCCH)
c Assignment command (from SDCCH to TCH)
c Control of the mobile during handover
c Intra-BSC handovers
c Frequency hopping
c Channel mode changes
c Ciphering
c Channel release procedures
c Radio link failure
Radio Resource Messages

] Assignment request
] Assignment complete
] Assignment failure
] Block
] Overload
] Unblock
] Clear command
] Clear complete
] Clear request
]
]
]
]
]
]
]
]
Handover Request
Handover candidate inquiry
Handover request acknowledge
Handover required
Handover required reject
Handover command
Handover complete
Handover failure
] Paging
] Cipher Mode Command

] Cipher Mode Complete
] Reset
] Queuing
] Trace Invocation
System Information Messages

] The System Information
Messages are sent to the
mobile from the network on the
BCCH in Idle mode and on the
SACCH in active mode.
] The Physical Information
Messages are very similar and
are sent on the FACCH after a
handover.
] They contain the basic
information that the mobile
needs to gain access to the
network.
] System Information Messages 1 to

4 are sent on the BCCH and rotated
with PCH, AGCH, SCH and FCCH,
and maybe the SDCCH.
] System Information Messages 5 &
6 are transmitted continuously on
the SACCH to active mobiles on the
downlink while the measurement
report is being sent on the uplink.
] The contents of the System
Information Messages are given in
the following slides:

] System Information Type 1:
1) Cell Channel description (CA)
which gives the ARFCNs used in
the cell
2) RACH control parameters which
includes:
c the maximum number of
retransmissions on the RACH
c the number of slots to spread the
transmissions
c the cell barred for access
parameter
c call re - establishment allowed
c emergency call allowed
c control class allowed.

1) Neighbour cells description which
gives the ARFCNs of the
neighbour cells to be monitored
by the mobile. Note that this is an
offset and a bit map listing up to
124 ARFCNs.
2) PLMN permitted which lists: the
network colour codes (NCCs)
which the mobile can use.
3) the RACH control parameters as
System Information Type 1.

1) Cell Identity (CI) to identify any cell
in a given location area
2) Location Area Identification
including:
c the Mobile Country Code (MCC)
c the Mobile Network Code (MNC)
c the location area code (LAC)
3) Control channel description

including:
c the attach / detach parameter (ATT)
c the number of blocks reserved for
access grant (AG)
c the common control channel
configuration, ie whether it is combined
with an SDCCH etc.
4) Cell Options including

c Power Control enabled
c DTX enabled
c the value of the radio link timeout
counter
5) Cell selection parameters

including:
c the Cell Reselect Hysteresis parameter
c the maximum mobile power on the
control channel MsTxPwrMaxCCH
c the minimum access threshold
RXLEVMin.
6) the RACH control parameters as

System Information Type 1.

1) Location area identification as in
System Information Type 3
2) Cell selection parameters as in System 1) Neighbour cells description which
Information Type 3
gives the ARFCNs of the
3) RACH control parameters as in
neighbour cells to be monitored
System Information Type 1
and reported on by the mobile.
Note that this is also an offset
4) Cell Broadcast Control Channel
and a bit map listing up to 124
(CBCH) description which gives the
ARFCNs.
description of the channel used for
cell broadcast
5) Cell Broadcast Control Channel mobile
allocation to give the mobile the
ARFCN used for the CBCH

1) Cell Identity (CI) to identify any cell in
a given location area.
2) Location Area Identification including
c the Mobile Country Code (MCC)
c the Mobile Network Code (MNC)
c the location area code (LAC).
3) Cell Options including

c Power Control enabled
c DTX enabled
c the value of the radio link timeout counter
4) PLMN permitted which lists the

network colour codes (NCCs) which
the mobile can use.
] Physical Information
Message:
1) Contains the timing advance
for the mobile and is sent on
the FACCH after a handover
if the handover is to another
site, ie a non - synchronous
handover. It is not sent for a
intra-site synchronous
handover. (Either between
sectors of the same site or a
timeslot shuffle)
.
Call Control Messages

] Call Establishment Messages
c
c
c
c
c
c
c
c
Alerting
Call confirmed
Call proceeding
Connect
Connect Acknowledge
Emergency Setup
Progress
Setup
] Call Clearing
c Disconnect
c Release
c Release Complete
] Call Information Phase Messages

c
c
c
c
Modify
Modify Complete
Modify Reject
User Information
] Connection Management Messages

c
c
c
c
CM Service Accept
CM Service Reject
CM Service Request
CM Re-establishment Request
] Miscellaneous Messages
c Start / Stop DTMF Tones
c Notify
c Status
Mobility Management Messages

] Registration Messages
c
c
c
c
IMSI Detach
Location Updating Request
Location Updating Accept
Location Updating Reject
LAC 1
] Security Messages
c
c
c
c
c
c
c
Authentication Request
Authentication Response
Authentication Reject
Identity Request
Identity Response
TMSI Reallocation Command
TMSI Reallocation Complete
LAC 2
GSM Cause Codes Rec 2:10

Cause
1
3
6
16
17
18
19
21
22
27
28
30
31
34
38
41
42
43
44
Unassigned number
No Route to Destination
Channel Unacceptable
Normal Clearing
User Busy
No User Responding
User Alerting, No Answer
Call Rejected
Number Changed
Destination out of order
Invalid Number Format
Response to STATUS ENQUIRY
Normal, unspecified
No circuit/channel available
Network out of order
Temporary Failure
Switching Equipment Congestion
Access Information Discarded
Requested circuit/channel not available
Tone
(see Table 1)
6
6
6
1
2
6
6
6
6
6
3
6
3
3
6
3
47
49
50
57
58
63
65
69
79
81
88
91
95
96
97
98
99
100
101
102
111
127
Resources unavailable, unspecified

Quality of Service Unavailable
Requested facility not subscribed
Bearer Capability not authorised
Bearer Capability not available
Service or option not available, unspecified
Bearer Service not implemented
Requested Facility not implemented
Service or option not implemented, unspecified
Invalid Call Reference Value
Incompatible Destination
Invalid Transit Network Selection
Invalid Message, unspecified
Mandatory Information Element error
Message Type non-existent or not implemented
Message not compatible with calls state or
Message Type non-existent or not implemented
Information Element non-existent or not implemented
Invalid Information Element contents
Message not compatible with call state
Recovery on timer expiry
Protocol error, unspecified
Interworking, unspecified
6
3
6
6
3
6
6
6
6
6
6
6
6
3
6
6
6
6
6
6
6
6
GSM Supervisory Tones

Tone
Frequency
Type
Dial Tone (optional)
425 Hz
Continuous
2
*
Subscriber Busy
(Called Number)
425 Hz
Tone on 500ms
Silence 500ms
3
*
Congestion
425 Hz
Tone on 200ms
Silence 500ms
Radio Path Acknowledgement

(Mobile originated only)
(optional)
425 Hz
Single Tone
200ms
{Radio Path Not Available

{Call dropped - Mobile originated only
425 Hz
200ms} On/off for

200ms} 3 bursts
6
*
Error/Special Information}
Number Unobtainable
}
Authentication Failure }
950 Hz
1400 Hz
1800 Hz
{Triple Tone
{Tones on 330ms
{Silence 1.0s
Call Waiting Tone
425 Hz, on for 400 ms, 8 s silence

followed by (425 Hz, on for 150 ms
off for 150 ms, on for 150 ms, 8 s
silence and repeated as necessary)
GSM Signaling Recommendations

Air Interface
A - bis
A - Interface
Layer 1 protocol
Physical layer
GSM Recs
Radio GMSK
Rec 4:04
64 kbit/s E1, T1,

microwave
Rec 8:54
Layer 2 protocol
Data link layer
GSM Recs
LAPDm
LAPD
CCS7 / MTP
Rec 4:06
Rec 8:56
Rec 8:06
Layer 3 protocol
Network layer
GSM Recs
CM/ MM/ RR
DTAP
Rec 4:08
CM/ MM/ RR
BSSMAP
Rec 8:58
MTP / SCCP
BSSAP
Rec 8:08
CCS7
64 kbit/s MTP
Rec 8:04
GSM Timers
] Timers are used to supervise
messages sent across the network.
] The network entity sending the
message starts and stops the
supervisory timer.
] The mobile uses timers to control its
behavior when not under the direct
control of the network, for example,
when idle, during a handover or during
channel disconnect.
] Various messages are used to trigger
the start and stop of each timer.
] The timers allow the MS and BTS time
to respond to requests for
resources or to send information.
] Usually, when a timer times out,

the message is re-transmitted.
] If the timer times out again, the
channels will be released and a
failure will be recorded by the
MSC or BSC.
] Timers are classified as:
c
c
c
c
c
Radio Resource Timers

Mobility Management Timers
BSSAP Timers
A-bis Timers
Call control Timers
] There are timers for both Layer 3

functions and Layer 2 functions.
GSM Timers
Sue Smith TWS
GSM Timers - Radio Resource Timers
4th February '97
Comments
Name
Range
Default
Network
T3101
1-5s
1s
Supervision of network access. Started when IMMEDIATE_ASSIGNMENT is sent to MS. Stops when MS successfully seizes
SDCCH. On expiry, newly allocated channels are released and the access request is forgotten.
T3107
3.5 - 10 s
6s
Supervision of assignment procedure. Started when ASSIGNMENT_CMD is sent to the mobile. Stopped when
ASSIGNMENT_COMplete message is received on the new channel or ASSIGNMENT_FAILURE is received on the old channel.
On expiry, all resources are released and the connection with the mobile is released.
T3109
5 - 15 s
8s
Releases channels in case of a loss of communication. Started when a lower layer failure is detected by the network when not
engaged in a RF procedure. Also used during the channel release procedure. On expiry channels are released. Default is 9 s.
0.5 s
Supervision of channel disconnection. Started when CHANNEL_RELEASE message is sent. On expiry, disconnects the main
signalling link. Allows for possible repetition of the disconnection command.
T3111
T3113
Supervision of paging procedure. Started when PAGING_REQUEST is sent to the mobile and stopped when
PAGING_RESPONSE message is received from the MS. This timer must be longer than T3102 plus T3101. If timer times out,
network may allow PAGING_REQUEST to be sent again and the T3113 is re-started.
Mobile
T3110
T3120
T3122
0.5 s
Used to delay channel deactivation after receipt of the CHANNEL_RELEASE message. Allows some time for disconnection of
main signalling link. Must be short enough to prevent T3109 timing out.
nRACCH+T1 Supervision of network access attempts. Started when CHANNEL_REQUEST message is sent on the RACCH. Stops on receipt
of an IMMEDIATE_ASSIGNMENT on the AGCH. On expiry, if the mobile has not exceeded the maximum number of
retransmissions allowed (RET = 4) then the MS sends another CHANNEL_REQUEST and T3120 is loaded with a new value.
The value is obtained from T3120 = n RACCH slots + T1 where n = 1..N and N=8 initially and the valaue of "Tx-integer"
subsequently, and T1 = 350 ms.
2 - 255 s
6s
Delays network access. Started on receipt of an IMMEDIATE_ASSIGNMENT_REJECT message from the network. On expiry, the
mobile may attempt to access the network again.
TWS Proprietary - www.tws-inc.com - (770) 752-7033
GSM Timers
Handover
T3103
4 - 10 s
6s
Supervises the handover in the BSC. Started when the HANDOVER command is sent to the MS. Stopped when the
HANDOVER_COMPLETE message is received via the new BTS on the new channel or HANDOVER_FAILURE message
received via the old BTS on the old channel. On expiry ALL RF channels are released and the mobile is assumed to be lost
during the handover procedure.
T3105
100 ms Supervision of repetition frequency of the PHYSICAL INFO message. Started when the network sends the PHYSICAL INFO
message to the MS and stopped when any correct frames are received from the MS. On expiry, the PHYSICAL INFO message is
sent again up to the number of repetitions (NY1 = 8) and the timer is re-started. If NY1 is reached, the handover is aborted.
T3105_F = 100 ms and T3105_D = 280 ms.
T3124
320 ms Supervision of handover in the MS. Started when the MS receives a HANDOVER_CMD and stops when the
HANDOVER_COMPLETE message is sent. If the handover fails due to the BTS failing to receive the HANDOVER_ ACCESS
message, or the mobile fails to receive the PHYSICAL INFO message, then the Timer expires and a HANDOVER_FAILURE is
recorded. The mobile the deactivates the new channels, reactivates the old channels and continues as if no handover attempt
had occurred.
GSM Timers
Sue Smith TWS
GSM Timers - Mobility Management Timers
4th February 1997
Default
Comments
Mobile
T3210
20 s
Started when LOC_UPD_REQ sent. Stopped if LOC_UPD_ACK or LOC_UPD_REJ received from network, or on AUTH_REJ. On
expiry start Timer 3211.
T3211
15 s
Started on receipt of LOC_UPD_REJ with cause = network failure. Causes a delay before the mobile attempts access to the
network again. On expiry restart location update procedure.
Name
Range
T3212
Time between periodic updates. Started on termination of MM service signalling. Stopped on initiation of MM service signalling.
On expiry, initiate location update procedure.
T3213
4s
Started on location update failure. Delays network access attempt. On expiry, generate a new random access attempt.
T3220
5s
Allows time to receive network messages on IMSI Detatach. Started on IMSI_DETACH sent to network. Stopped on release from
Radio Management sub-layer. Enter NULL or IDLE into HLR/VLR, not updated.
T3230
15 s
Cipher mode supervision. Started on CIPHER_REQUEST sent to BTS. Stopped on CIPHERMODE_SETTING. On expiry, provide
RELEASE indication to network.
T3240
10 s
Allows time to disconnect from network. Start on normal end of location update procedure. Stop on receipt of any message from
the network. On expiry, release RR connection.
Network
T3250
5s
Start on TMSI_REAL_CMD or LOC_UPD_ACK with new TMSI sent to MS. Stop on TMSI_REAL_COM received. On first expiry,
retransmit AUTH_REQ; on second expiry, release RR connections.
T3260
5s
Supervision of authentication procedure. Start on AUTHentication_REQuest sent to MS. Stop on AUTH_RESP received. On first
expiry, retransmit AUTH_REQ; on second expiry, release RR connections.
T3270
5s
Supervision of identity procedure. Start on IDENTITY_REQUEST sent to MS. Stop on IDENTITY_RESPONSE received. On first
expiry, re-transmit IDENTITY_REQUEST; on second expiry, release RR connections.
GSM Timers
Sue Smith
TWS
GSM Timers - BSSAP Timers

4th February 1997
Name
Range
Default
Comments
T4
10 - 120 s
60 s
Supervision of sending RESET to MSC. Started whenever BSC RESET occurs. Stopped when RESET Acknowledge is received
from MSC. On expiry procedure is repeated until RESET ACK is received.
T5
1 - 10 s
4s
Supervision of OVERLOAD procedure. Started when OVERLOAD message is received from MSC. On expiry new OVERLOAD
messages are taken into account.
T6
3 - 20 s
10 s
Supervision of OVERLOAD procedure. Started with T5 when OVERLOAD message is received from MSC. On expiry traffic is
increased to next level.
T7
5 - 30 s
20 s
Supervision of periodicity of HANDOVER_REQUIRED message. Started when HANDOVER_REQUIRED message is sent to

MSC. Stopped when HANDOVER_COMMAND message is received from MSC. On expiry, handover procedure is repeated.
T8
8 - 15 s
12 s
Supervision of handover procedure in source BSC. Started when HANDOVER_COMMAND message is received from MSC.
Stopped when CLEAR_COMMAND (external handover) is received from MSC. On expiry, ASSIGNMENT_FAILURE message is
sent to MSC.
T10
4 - 14 s
8s
T12
5 - 30 s
15 s
Supervision of assignment procedure. Started when ASSIGNMENT_COMMAND message is sent to the MS via the BTS.
Stopped when ASSIGNMENT_COMPLETE or ASSIGNMENT_FAILURE is received from the MS. On expiry,
ASSIGNMENT_FAILURE message is sent to MSC.
Serves as a guard period for local call clearing procedure. Started when a RESET message is received from the MSC. Stopped
when a SSP (sub-system prohibited) message is received from SCCP. On expiry RESET_ACKNOWLEDGEMENT sent to MSC.
GSM Timers
Sue Smith TWS
GSM Timers - ABIS Timers
4th February '97
Name
Range
Comments
Default
T9101
10 s
Non-modifiable
T9103
2s
Non-modifiable
T9104
5 - 20 s
15 s
Supervision of clear procedure from MSC. Started when CLEAR_REQ is sent to MSC. Stopped when CLEAR_CMD is received
from MSC. On expiry, CHANNEL_REL is sent to mobile, via the BTS.
T9105
2 - 240 s
10 s
Supervision of SCCP connection procedure. Started when SCCP_CONNECTION_REQUEST is sent to the MSC. Stopped when
SCCP_CONNECTION_CONFIRM or _REFUSED is received from MSC. On expiry, CHANNEL_RELEASE is sent to MS via BTS.
Set to 31 s.
T9108
T9113
T200
2s
8 - 15 s
12 s
Non-modifiable
Supervision of external handover in target BSC. Started when HANDOVER_REQUEST_ACK is sent to MSC. Stopped when
HANDOVER_COMplete is received from MS or when CLEAR_CMD is received from MSC. On expiry CLEAR_REQUEST is sent
to MSC.
240 ms Layer 2 repeat timer. Values depend on timers used to supervise message flow between the MS and the network. For proper
operation T200 should be greater than the maximum time between re-transmission of command frames and the reception of
their corresponding response or acknowledgement frames but should be shorter than the corresponding Layer 3 timer
supervising this message flow.
GSM Timers
Sue Smith TWS
GSM Timers - MSC Timers
4th February '97
Comments
Name
Range
Default
TNT1
60 - 300 s
300 s
TNT2
1 - 30 s
5s
ASSIGNMENT_REQUEST message sent, awaiting for ASSIGNMENT_COMPLETE reply from BSS. On expiry channels are
released. Value of TNT2 should be greater than BSS timer T10.
TNT3
1 - 30 s
5s
CLEAR_COMMAND message sent, awaiting CLEAR_COMPLETE reply from BSS. On expiry resources are released and mobile
is assumed lost during call clear. Value of TNT3 + T102 should be greater than T8 at the BSS.
TNT4
1 - 30 s
5s
CIPHER_MODE_COMMAND message sent, awaiting CIPHER_MODE_COMPLETE reply from BSS. On expiry the connection is
released and a cipher failure is logged (GMSC601 log).
T101
1 - 10 s
5s
At MSC-A, HANDOVER_REQUEST message sent, awaiting HANDOVER_REQUEST_ACKNOWLEDGEMENT from BSS. If T101

expires, the MSC tries to use another cell from the list of preferred cells. (see NPC parameter)
T201
1 - 30 s
5s
At MSC-B, HANDOVER_REQUEST message sent, awaiting HANDOVER_REQUEST_ACKNOWLEDGEMENT message at MSCB after inter-MSC handover. If T201 expires the MSC attempts to use another cell from the preferred cell list if available.
T102
1 - 30 s
5s
With T103, T104, T202, T204, T210 these supervise the sending of messages between two MSCs for an inter-MSC handover.
On expiry resources are released (similar to inter-BSC handover supervisory timers)
T3250
1 - 20 s
5s
TMSI_REALLOCATE_COMMAND or LOCATION_UPDATE_ACCEPT message sent, awaiting TMSI_REALLOCATE command

from mobile station. On initial expiry message re-sent, on second expiry release connection.
T3260
1 - 20 s
5s
AUTHENTIATION_REQUEST message sent, awaiting AUTHENTICATION_RESPONSE message from mobile. On initial expiry
message re-sent, on second expiry release connection.
T3270
1 - 20 s
5s
IDENTITY_REQUEST message sent, awaiting IDENTITY_RESPONSE message from mobile. On initial expiry message resent, on second expiry release connection.
T2_DTAP 30 - 120 s
T301
45 - 300 s
Timer deployed to ensure release of SCCP resources. Internal SCCP Integrity Timer
30 s
Call initiated to mobile station and no response message is received. Incoming call timer for network side integrity. On expiry,
release connection.
180 s
ALERT message is received for the mobile, awaiting sending of CALL_CONFIRMED message. On expiry, release connection.
GSM Timers
T303
1 - 60 s
30 s
SETUP message is received for the mobile station, awaiting sending of CALL_CONFIRMED message. On expiry, release
connection.
T305
1 - 60 s
30 s
DISCONNECT message sent to mobile, awaiting RELEASE_COMPLETE from the mobile. On expiry RELEASE message sent.
T308
1 - 60 s
30 s
RELEASE message sent to the mobile. Awaiting ALERT, CONNECT or DISCONNECT message from the network. On expiry,
DISCONNECT sent.
T310
1 - 60 s
30 s
CALL_CONFIRMED message is sent to the mobile, awaiting ALERT, CONNECT or DISCONNECT message from the network.
On expiry, DISCONNECT sent.
T313
1 - 60 s
30 s
CONNECT message has been sent to the mobile, awaiting reply of CONNECT_ACKNOWLEDGEMENT. On expiry,
DISCONNECT sent.
TC1N
1 - 60 s
20 s
CP_DATA_INDICATION sent to the mobile, awaiting reply of CP_ACKNOWLEDGEMENT. Error indication on second expiry.
CALL SET-UP - Mobile Terminate

BTS
MS
RR MM
CM
PAGING REQUEST
(PCH)
CHANNEL REQUEST
(RACH)
PAGING COMMAND
BSS MAP
CM
PAGING COMMAND
CM
PAGE RESPONSE
CM
T3113
CHANNEL REQUIRED
T3120
CHANNEL ACTIVATION
(RR)
(IMMEDIATE ASSIGNMENT)
RR nRACCH
>T3101 + T3120
+ T1 (350ms)
CHANNEL ACTIVATION
IMMEDIATE ASSIGNMENT
IMM ASSIGN RES
MSC
BSC
(AGCH)
ACK
IMMEDIATE ASSIGN COMMAND
RR
T3122 (6s)
SABM
(PAGING RESPONSE)
(SDCCH)
(PAGING RESPONSE)
(SDCCH)
T3101
UA
(RR) 1s
ESTABLISH INDICATION
RR
AUTHENTICATE
AUTHENTICATE REQUEST (RAND)
AUTHENTICATE REQPONSE
AUTHENTICATE RESPONSE (SRES)
CIPHER MODE CMD
CIPHER MODE COMMAND
CIPHER MODE COMPLETE
TNT4
SETUP
PHYSICAL CONTEXT REQUEST
SETUP
T303
CALL PROCEEDING
CALL PROCEEDING
PHYSICAL CONTEXT CONFIRM

LAYER 2 TIMERS
CHANNEL ACTIVATION
(TCH ASSIGN)
T200 240ms x 4 rep.
ASSIGNMENT COMMAND
(FACCH on TCH)
SABM (FACCH)
(SDCCH)
DATA REQUEST
(CM)
ASSIGNMENT REQUEST COMMAND
call confirmed
T3107
UA
T310
THEN T3109 (8s)

RELEASES LOWER
LAYER.
CHANNEL ACT. ACK
TNT
2
T10
8s
6s
call proc.
CM
TNT2 should be
greater than T10
(5s)
ASSIGNMENT COMPLETE
(CM)
DATA INDICATION
RF CHANNEL RELEASE
RF CHANNEL RELEASE ACK
ALERTING
(FACCH)
CONNECT
CONNECT ACK
ASSIGNMENT COMPLETE
CM
(SDCCH) RR
RR
ALERTING
DATA REQUEST
CONNECT
DATA REQUEST
T301
CONNECT ACKNOWLEDGE
DATA INDICATION
T313
MOBILE DISCONNECT
DISCONNECT
RELEASE
DATA INDICATION
CLEAR REQUEST
DATA REQUEST
CLEAR COMMAND
TNT3
RELEASE COMPLETE
DATA INDICATION
CHANNEL RELEASE
DATA REQUEST
CLEAR COMPLETE
(5s)
CHANNEL RELEASE
T3110
DEACTIVATE SACCH
0.5s
DISC
RELEASE INDICATION
T3111
0.5s
T308
RELEASE COMPLETE
UA
Air Interface
RF CHANNEL RELEASE
on RF channel
release
RF CHANNEL RELEASE ACK
or T3111 expiry
A-bis
A-Interface
INTER - BSC HANDOVER

Mobile
BSC 1
BTS 1
RR MM CM
SYS INFO 5 & 6
(SACCH)
MEASUREMENT REPORT
MSC
BSC 2
BSS MAP
BTS 2
Mobile
RR MM CM BSS MAP
BTS MEAS. RESULT
MS MEAS. RESULT
T7 20s
HANDOVER REQUIRED
HANDOVER REQUEST
CHANNEL ACTIVATION
T101
ACT. ACK.
Def:
5s
H/O REQ.
HANDOVER COMMAND
(FACCH)
ACK.
(FACCH)
HANDOVER DETECT
HANDOVER COMMAND
DATA REQUEST
T9113
RELEASE REQUEST
T3113
6s
T8
Note: Handover
Access
on FACCH
using
RACCH burst
structure
HANDOVER ACCESS
PHYSICAL INFO
12s
T3105
100ms
12s
PHYSICAL INFO
No Phys Info
on Synchronised
Handovers
T102
Def: 5s
T8 +T102 +
TNT3
SABM
T3124
UA
320ms
H/O COMPLETE
DATA INDICATION
HANDOVER
COMPLETE
CLEAR COMMAND
CLEAR COMPLETE
RF CHAN. RELEASE
TNT3
RELEASE
Air Interface
RF CHAN. REL. ACK

RELEASE COMPLETE
H/O
FAILS
T3124 TIMES OUT
HANDOVER ACCESS
(FACCH)
SABM
UA
H/O FAILURE
DATA INDICATION
OLD BSC
HANDOVER FAILURE
Return to Old
channel
CLEAR COMMAND
TNT3
(5s)
NEW BSC
CLEAR COMPLETE
RELEASE
RELEASE COMPLETE
Air Interface
A-bis
A-Interface
A-Interface
RELEASE RF CHANNEL
RF CH. REL. ACK.
A-bis
LOCATION UPDATE
BTS
Mobile
CHANNEL REQUEST
(RACH)
MSC
BSC
RR
CM
MM
BSSMAP
CHANNEL REQUIRED
CHANNEL ACTIVATION
CHANNEL ACTIVATION
(AGCH)
ACK
CM SERVICE REQUEST (LOC UPDATE)
LOCATION UPDATE REQUEST
CM
VLR
(SDCCH)
( SDCCH)
UPDATE LOCATION AREA
IDENTITY REQUEST
T
3
T3230
2
15s
3
0
IDENTITY REQUEST
T3270
T3270
5s
IDENTITY RESPONSE
IDENTITY RESPONSE
VLR
TMSI
ACKNOWLEDGE
1
5
s
AUTHENTICATION REQUEST
T
3
2
1
0
2
0
s
AUTH. REQUEST (RAND)

T3260
T3260
AUTHENTICATION RESPONSE
5s
SRES
AUTH. RESPONSE (SRES)
VLR
TMSI, LOC AREA
ACCEPTED
CIPHER MODE COMMAND
CIPHER MODE CMD (Key)

TNT
4
(5S)
T3210
20s
LOC UPDATE ACCEPTED
T3250
TMSI REALLOCATION COMPLETE
T3240
T3240
10s
10s
RELEASE
5S
T
3
2
5
0
5
S
CHANNEL RELEASE
LOC UPDATE ACCEPTED
(TMSI)
T3250
TMSI REALLOCATION COMPLETE
TMSI
CLEAR COMMAND
ACKNOWLEDGE
TNT 3
RELEASE COMPLETE
RELEASE COMPLETE
CLEAR COMPLETE
CHANNEL RELEASE
(5S)
RELEASED
DEACTIVATE SDCCH
T3111
DISC
UA
RELEASE INDICATION
RELEASE COMPLETE
RELEASE RF CHANNEL
RF CHANNEL RELEASE ACK.
S.Smith Dec 94
Air Interface
A-bis
A-Interface

Gsmsignaling

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Gsmsignaling

Uploaded by

Copyright:

Available Formats

GSM Signaling Overview

] GSM signaling defines the communications between the mobile and

TWS Proprietary - www.tws -inc.com - (770) 752-7033

Search for GSM frequencies

TWS Proprietary - www.tws -inc.com - (770) 752-7033

SS7 User Parts:

LAPD: ISDN, Link Access Protocol Version D

TWS Proprietary - www.tws -inc.com - (770) 752-7033

Carries signaling messages, for getting the message to

Data Link Layer :

Transfers frames error free between nodes. Concerned

Transmits all information across the physical medium.

TWS Proprietary - www.tws -inc.com - (770) 752-7033

Signaling Layers for the Air Interface

Provides a reliable signaling link between MS and the

Takes care of the main control of the MS -network

TWS Proprietary - www.tws -inc.com - (770) 752-7033

OSI layer 2 Data link functions

Builds frames, requests

OSI layer 1 Physical layer

TWS Proprietary - www.tws -inc.com - (770) 752-7033

TWS Proprietary - www.tws -inc.com - (770) 752-7033

Signaling Protocol Reference Model

Note: X.25 can be used

GSM Network Protocol Model

TWS Proprietary - www.tws -inc.com - (770) 752-7033

Example Page Jim

TWS Proprietary - www.tws -inc.com - (770) 752-7033

Radio Resource Messages

TWS Proprietary - www.tws -inc.com - (770) 752-7033

Radio Resource Messages

] Cipher Mode Command

TWS Proprietary - www.tws -inc.com - (770) 752-7033

System Information Messages

] System Information Messages 1 to

TWS Proprietary - www.tws -inc.com - (770) 752-7033

System Information Messages

] System Information Type 2:

TWS Proprietary - www.tws -inc.com - (770) 752-7033

System Information Messages

3) Control channel description

4) Cell Options including

5) Cell selection parameters

6) the RACH control parameters as

TWS Proprietary - www.tws -inc.com - (770) 752-7033

System Information Messages

TWS Proprietary - www.tws -inc.com - (770) 752-7033

System Information Messages

3) Cell Options including

4) PLMN permitted which lists the

TWS Proprietary - www.tws -inc.com - (770) 752-7033

Call Control Messages

] Call Information Phase Messages

] Connection Management Messages

TWS Proprietary - www.tws -inc.com - (770) 752-7033

Mobility Management Messages

TWS Proprietary - www.tws -inc.com - (770) 752-7033

GSM Cause Codes Rec 2:10

Resources unavailable, unspecified

TWS Proprietary - www.tws -inc.com - (770) 752-7033

GSM Supervisory Tones

Dial Tone (optional)

Radio Path Acknowledgement