Professional Documents
Culture Documents
Messages Analysis
Layer3 Messages
1. Introduction
(45 minutes)
What is Layer3?
• In the protocol stack of GSM signaling, composed of 3 layer, L1, L2 and L3.
• In L3 there are 3 sub-layers, Radio Resource (RR), Mobility Management (MM) and Connection
Management (CM).
CM CM
MM MM
RR BSSAP
BSSAP
RR
BTSM
RR BTSM SCCP SCCP
LAPDm LAPDm LAPD MTP MTP
Layer1 Layer1 Layer1 Layer1 Layer1
What is Layer3?
• From the diagram, we can imply that all the information which MS
would like to talk with the network are done in the Layer 3.
• The flow of the message is so-called Message Flow Chart or
Signaling Flow Chart.
MS Network
Note: Actual TA for the connection and MS Power level are send
in Layer1 on SACCH.
What is Layer3?
Hierarchy of 3 sub-layers
Practice
1. What is the layer 1, explain roughly?
Answer: Layer 1 specify the physical layer of the
connection.
Layer 3 Protocol
(2 hours)
• Network Sides
• Broadcast the system information on BCCH.
• Paging on CCCH (PCH).
Yes
No B = MSPWR _ MAX _ CCH − P
Tuned to SCH
for decode BSIC
and decode System Info
CBQ CB Cell Selection Cell Reselection
High(1) NO (0) Normal Normal
Calculate Cell Selection
Criteria (C1) Try at least 30 Strongest High(1) YES(1) Barred Barred
RF channel for GSM900,
or 40 for GSM1800 Low(0) NO (0) Low Normal
or 40 for GSM 1900
Suitable Cell
Low(0) YES(1) Low Normal
Exist?
Yes
Radio tower
PLMN Selection
C 2 = C 1 + CRO − TO * H ( PT − t ), PT <> 11111
C 2 = C 1 − CRO , PT = 11111
Cell Selection
H ( x ) = 0, x < 0
Ms Update SS of Serving Cell every
5 to Max(5, 5 consecutive paging block)
MS Measuring Signal and
H ( x ) = 1, x ≥ 0
Decode System Info from
Serving Cell Criteria :
Ms Update SS of Neighboring Cells every
5 to Max(5, [(5*N+6)div7]*MFRM/4) 1.Serving cell becomes barred.
N=BCCH in the BA List
MFRM=Multiframe for paging group
MS Measuring Signal, BSIC and 2.MS tried to access network for the
Decode System Info from
Neighboring Cell
NO allowed number of time.(MAXRET
time.(MAXRET))
3.MS detects a downlink signaling
failure.
fullfil Cell 4.C1 of Serving Cell <0 for 5 seconds.
Reselection
Criteria? 5.C2 of Neighbor > C2 of Serving for 5
Seconds.
YES 6.If Cell Reselection take place at last
15 seconds C2 of Neighbor > C2 of
MS Select the new Cell
Serving 5 dB for 5 Seconds .
MS Network
Channel Request
Send on RACH
Immediate Assignment
Send on AGCH
Classmark Change
Send on SDCCH
MS Network
Assignment Command
Send on SDCCH
Assignment Complete
Send on FACCH
Alerting
Send on FACCH
MS Network
Measurement Report
Send on SACCH
Handover Command
Send on FACCH
Handover Access
Send on FACCH
Physical Information
Send on FACCH
Handover Complete
Send on FACCH
MS Network
MS Network
Setup
Send on SDCCH
Call Proceeding
Send on SDCCH
Alerting
Send on FACCH
Connect
Send on FACCH
Connect Acknowledge
Send on FACCH
MS Network
Setup
Send on SDCCH
Call Confirmed
Send on SDCCH
Alerting
Send on FACCH
Connect
Send on FACCH
Connect Acknowledge
Send on FACCH
non-combined combined
TX-integer CCCH CCCH/SDCCH
3,8,14,50 55 41
4,9,16 76 52
5,10,20 109 58
6,11,25 163 86
7,12,32 217 115
NCC permitted
MS will use this value when it first enter to
dedicated mode before it get new in
formation on SACCH.
Cell Option
• DTX indicator whether mobile shall
use DTX or not.
• RADIO-LINK-TIMEOUT the radio link
timeout for DL connection that mobile
will use for this cell.
• where
• N = number of paging blocks "available" on one CCCH = (number of paging blocks "available"
in a 51-multiframe on one CCCH) x BS_PA_MFRMS.
• IMSI = International Mobile Subscriber Identity, as defined in 3GPP TS 03.03.
• BS_CC_CHANS = number of CCCH timeslots on BCCH frequency.
– mod = Modulo.
– div = Integer division.
Mobile Identity
• Can contain maximum 2 mobile identity
with TMSI or IMSI.
Channel Request
Channel Request
Bit Pattern between Random Reference and Establishment cause can be found in
specification 44.018. We can see there are some bit pattern that are not defined in the
table.
Immediate Assignment
Channel Description
• The details of target physical
channel of SDCCH which MS have
to camp on in dedicated mode.
Request Reference
• Include the Establishment cause
and random reference value from
the channel request.
Timing Advance
• The initial timing advance values,
which BSC calculate from the delay
of random access.
Immediate Assignment
TA calculation in Call setup
Access burst
GSM900
MS Power Output Sensitivity
Class power [dBm] [dBm]
2 39 -106
3 37 -106
4 33 -104
5 29 -104
GSM1800
MS Power Output Sensitivity
Class power [dBm] [dBm]
1 30 -104
2 24 -104
RAND
A8 Kc
Ki
Kc Kc
data data
data
A5 A5 data
Power Command
• Power level the initial power use in this connection.
Cell channel description
• Channels the frequency available in this cells.
Mobile allocation
• Mobile allocation array the frequency which will use when
hopping.
RLT (max)
0 SACCH
Drop Call
NCC permitted
• MS will not report the signal level of the
cell which NCC are not belong or exist in
this list.
Handover Reference
• reference value use to
identify the Handover Access
from the mobile.
Synchronization
• indicate the handover is
synchronous or
asynchronous. Synchronous
handover case after MS send
Handover Access, it will tune
the transceiver to the target
channel without waiting for
Physical Information
message.
Handover Reference
• Refer that this Handover Access belong to which
Handover Command.
Access Burst
Mobile Identity
• New TMSI which MS will use in the new LAI, in
this case MS have to send TMSI
REALLOCATION COMPLETE in order to confirm
the use of new TMSI to the network and there are
no TMSI REALLOCATION COMAND sent in this
case.
Authentication Response
• MS use RAND as input of A3 algorithm together with
Ki stored in the SIM card.
• The output of the operation is SRES.
• MS return SRES to MSC via AUTHENTICATION
RESPONSE message.
• MSC will check compare the SRES with the one that
calculated in MSC.
RAND
A3 SRES
Ki