Core Networks Division

MSS IS41-Module Introduction

Motorola Confidential Property

1
 Architecture
 Introduction
 Transport
 Initialization
 Mapping
 Processing
 Handoff
FSM
 MGMT
 Questions

2
 SS7 Protocol Stack
IS41

Application

Telephone User Part

Transaction
Presentation Capabilities ISDN
Applications User
OSI Reference Model

Part Part

SS7 Protocol Stack

Session

Transport SCCP

Network Message Transfer Part Level 3

Data Link Message Transfer Part Level 2

Physical Message Transfer Part Level 1

3
 Wireless Network
Mobile
Mobile Data Set Switching
Center (MSC)
Base Station
Controller
(BSC) PSTN

Mobile
Voice Unit
Packet
Network

Packet Inter-
Base Transceiver Working Function
System (BTS)

4
 PSTN-to-Mobile Call
PLMN PLMN PSTN
(Visitor) (Home)

(SCP) HLR
Signaling SCP
over SS7 Where is the subscriber?

MAP/ IS41 (over TCAP)

ISUP (STP)

4 2

Provide Roaming 3
5
Routing Info

VMSC 6 MSSC 1

IAM IAM (SSP)

MS BSS (SSP) (SSP) (STP)
VLR
514 581 ...

5
 Call-flow
IS41 – IMPLEMENTATION

IS41 in Implementation is a combination of MAP/IS41 . In general IS41 means Map/IS41

1. MAP :--
• Map acts as a Upper Layer and as a sort of Interface between CP and IS41 in Implementation .
• Map Maintains 2 Callback arrays Mainly Provider_cb and Application_cb . These further work parallel with
muser_table callback array. Here Application_cb means it is CP and Provider_cb is IS41.
• When IS41 is initialized by calling map_provider_register , Provider_cb gets initialized with same Cb’s.
Also the callbacks are copied to is41_mapifc_cbs, which is then used to call the Map Funcitons.
• “is41_direct_api.c” is used to provide a callback to Other Modules.

2. IS41:--
• Other than PSTN and RAN almost all Entities Connected to MSC will use IS41.
• Forms the Entry and Exit Point to All IS41 Messages .
• Converts the Incoming Message (raw data )to CSM Structures and vise versa .
• IS41 is used By many Modules in the MSSC, CCSW, AD and HLR are one of the Process which use this
protocol. Because of which There are many Initialization on basis of Process.
• ASN Format is used to define a message structure at the Protocol Level .
(ASN is dealt in Detail in coming Slides).
• OSSDecoder and OSSEncoder is used to decode and encode the ASN Structure.

• IS41 handles a FSM for Handoff .

6
 CCSW (main)

Mscm_init() Map_init() fim_provInit()

Rpc_init_moule_
iif_mapping_init() Map_clone_util_init() Map_ifc_provInit() iif_prov_init() Map_procedures_matrix() map_providers_init() Is41_direct_api()
wms_map_ifc()

Some IS41 and Other Tables

wms_reftimer_is41_profile ::-- Contains The timers for Different profiles Like Japan, Default.
wms_is41_proto_cap ::-- Contains Many Flags related to IS41. Like IntersystemSMSpage.
wms_ref_is41_timers ::-- Contains the IS41 Timer Id’s and the Descriptions.
wms_ref_is41_proto_rev ::-- Contains the Protocol Revision What we support . Each Revision will support some parameters.
wms_mss_feature ::-- Contains Several Flags of Features .
wms_mss_feature_params::-- Contains the Flags of Individual Features .

Important Data structures

muser_table[ssn].opCodeTbl[OpCode + protocolOffset].cb.*
gOpCodeTbl[opCode + IS41_USER_TABLE_OFFSET].cb *

7
 Timers :
1. IS41 Timers are defined in map_util.c, Further these timers get initialized in
Init_OpCode_Table().
2. While starting the timer the timer call back is also sent as an Argument . Which will be further
called when the timer expiers.

Example:
cvx_timer_addNode(gpIS41ApmTimer, NULL, timeout,
IS41Apm_smdfwdRRToFACREL_TimerExpiryEvent, pApmLeg);

Callbacks :
• Files to be Looked fim_map_register.c, fim_map_ifc.c.
Fim_map_register.c fim_map_ifc.c
case CALL_STATUS: mapCBFuncs.request_function = fim_map_receive_call_status;
{ mapCBFuncs.forward_to_csm_function =
map_cb->map_is_trace_reqd_cb = is41_apm_map_trace_func; csm_map_forward_to_another_csm;
map_cb->convert_req_oss_to_csm = IS41_callStatus_req_in;
map_cb->convert_req_csm_to_oss = IS41_callStatus_req_out; #ifdef _NEW_MAP_API_
if (CVX_STATUS_FAILURE ==
CVX_LOG_INFO(" Registering callback for CALL_STATUS\n"); map_is41api_map_register_cb(USE_MSC_SSN,
MapRegisterOpcode(lssn,CALL_STATUS,map_cb); CALL_STATUS,
break; &mapCBFuncs))
} #else
• if (CVX_STATUS_FAILURE == map_register_cb(USE_MSC_SSN,
CALL_STATUS,
&mapCBFuncs))
#endif _NEW_MAP_API_

• Similarly The Callbacks will be registered For Other Modules. 8

Adding a New Table and its required functionality (with Eg).

• An Entry in wms-ref-create.sql ( for reftables).

CREATE TABLE wms_ref_lir_modes(
value integer PRIMARY KEY,
display varchar(64) NOT NULL,
descr varchar(64));

• An Entry in wms-svc-create.sql .
CREATE TABLE wms_svc_lbs_config (
id integer UNIQUE NOT NULL DEFAULT 0 PRIMARY KEY,
svc_opt integer,
vas_mpc varchar(128),
lir_mode integer,

FOREIGN KEY (svc_opt) REFERENCES wms_ref_cdma_svc_options(value),

FOREIGN KEY (lir_mode) REFERENCES wms_ref_lir_modes(value),
FOREIGN KEY (vas_mpc) REFERENCES wms_scpinfo(remote_id));
• An Entry in dbenums.input
#for lbs
wms_ref_lir_modes 0 NOT_USED
wms_ref_lir_modes 1 UNCONDITIONALLY_RESTRICTED
wms_ref_lir_modes 2 PRE_AUTHORIZED_LCS_CLIENTS_ONLY
wms_ref_lir_modes 3 PRE_AUTHORIZED_LCS_CLIENTS_AND_USER_AUTHORIZED_LCS_CLIENTS
wms_ref_lir_modes 4 UNRESTRICTED

• messageHierarchy.in
IPCC_PROV_DATA {
/*at the end */
IPCC_PROV_DATA_wms_svc_lbs_config 5147
}

9
• Entry in subscribesInfo.in
CCSW{
IPCC_PROV_DATA_wms_svc_lbs_config
}

• Compile whole OAMP folder

• Entry in dbUpgrade.xml
<CHANGE version="2_5_X" date="01/06/2005" contact="seshadri" changelist="" id="">
<DESCRIPTION>
the following additions is done for LBS service
</DESCRIPTION>
<SQL>
FOLLOW DB – RULES

</SQL>
</CHANGE>

• Entry in x*prov*.c
/*inclusion of string.h is done by seshadri*/
#include<string.h>

/*4 variables added by seshadri*/

int gLbs_id = 0;
int gLbs_svc_opt = 0;
char gLbs_vas_mpc[130]="";
int gLbs_lir_mode=0;

/*in PCProvisionCbk csm_mscm_pld_cbks[] */

10
NULL},
{ IPCC_PROV_DATA_wms_svc_lbs_config,
CVX_BOOL_FALSE,
NULL,
csm_mscm_lbs_prov_add_data_cb,
csm_mscm_lbs_prov_add_data_cb,
NULL}

CVX_BOOL
csm_mscm_lbs_prov_add_data_cb
(
uint32 txnId,
PCDataType dataType,
void* data
)
{

DbType_wms_svc_lbs_config_p p_dbData;
p_dbData = (DbType_wms_svc_lbs_config_p)data;

gLbs_id = p_dbData->id;
gLbs_svc_opt=p_dbData->svc_opt;
gLbs_lir_mode=p_dbData->lir_mode;
strcpy(gLbs_vas_mpc,p_dbData->vas_mpc);
CVX_LOG_INFO("\n Lbs id= %d \n,Lbs service option = %d\n",gLbs_id,gLbs_svc_opt);
CVX_LOG_INFO("Lbs lir mode = %d \n Lbs vas mpc = %s \n",gLbs_lir_mode,gLbs_vas_mpc);
cvx_return();
cvx_return( CVX_BOOL_TRUE );
}

• Compile the Whole Module.

11
• Functions Commonly Known as Conversion Functions.
• Convert The Parameters to ASN – CSM ( Incoming Messages ) & CSM – ASN
(outgoing Messages )

Incoming Messages – Example

SMDPP_invoke_to_csm_in() .

if (pSMDelivery_asn->bit_mask & SMSDeliveryPointToPointArg_esn_present)

esn_asn_to_csm(&pSMDelivery_asn->esn, &pSMDelivery_csm-> event_u.event_u.smsMsg.esn);

• This Function will be called when We Receive SMDPP .

• Main Aim is to Copy the Contents of ASN Structure to CSM Structure. Here
pSMDelivery_asn is a variable of ASN Structure SMSDeliveryPointtoPointArg Where as
the pSMDelivery_csm points to a corresponding CSM Structure .
• If the Parameter is Optional There will be an Present Field . First we check weather
the Corresponding field is present and then Fill the CSM Structure . Here
“pSMDelivery_asn->bit_mask & SMSDeliveryPointToPointArg_esn_present” Is a
Check.

12
Outgoing Messages – Example

SMDPP_invoke_to_asn_out()

if (pSMDelivery_csm->event_u.event_u.smsMsg.esn.present)
{
esn_csm_to_asn(&pSMDelivery_asn->esn, &pSMDelivery_csm->event_u.event_u.smsMsg.esn);
pSMDelivery_asn->bit_mask |= SMSDeliveryPointToPointArg_esn_present;
}

• This Function is called when SMDPP is sent Out.

• Here we are converting CSM – ASN. Here pSMDelivery_csm is CSM Structure and
pSMDelivery_asn is known is ASN Structure .
• ESN Parameter is Optional so We first check whether it is present and then we will copy
the same in ASN Structure .

Adding New Parameter in CSM

• This is needed when we are adding a New parameter for a message

• To full fill some requirement we may need to add .
• Mainly all messages are found in src/Transport , src/CSM/MSCM/include , ad/ ,
src/Protocols/Map/Include . The file modifications might be idl file . Or an *.h file .

13
Adding New Parameter/Message in ASN

Every Parameter has a unique id . This ID known as TAG or Parameter Id identifies the
Parameter.

There are some specific rules to define an ID to the parameter .

• This is the first step in introducing a new Parameter . Knowing the rules
• After changing the ASN (IS41/asn/) There is a need to Ftp the same and compile it
in bugsbunny.corp.mot.com ( type ./c) and then ftp the linux/IS41_protocol.c
linux/IS41_protocol.h linux/IS41_protocol.gen . The same holds good for Solaris/*
also . Then compile whole of IS41.

Example Parameters :

SubscriberClass ::= [PRIVATE 74] IMPLICIT OCTET STRING

11011111
01001010

RestrictionDigits ::= [149] IMPLICIT OCTET STRING

10011111
10000001
00010101

BillingID ::= [1] IMPLICIT OCTET STRING (SIZE(7))

10000001

14
 There are some rules defined in ASN.1 to identify the Unique identifier for every
Parameter.

One octet
Following octets
0 <= tag <= 30 class P/C ttttt 1 1 1 1
leading octet
tag >= 31
class P/C ttttt U U U U

Bit 7 Bit 6 Class Bit 5 form

0 0 Universal 0 Primitive
0 1 Application
1 Constructed
1 0 Context-specific
1 1 Private

Short definitive length 0 <= length <= 127 octets 1 LLLLLLL

(primitive form ) ( length = nb pf octets for V )

long definitive length 0 <= length <= 256126 - 1octets 1 LLLLLLL

(primitive form ) ( length = nb pf octets for V ) (lllllll = nb of octets for L

where lllllll != 1111111)
End of content octets
Indefinite length
(primitive form ) 1 0000000 Content octets (V) 00000000 00000000

15
Example Message :

AnalyzedInformationArg ::= [PRIVATE 18] IMPLICIT SET {

billingID BillingID,
digitsDialed Digits,
mscid MSCID,
transCap TransactionCapability,
triggerType TriggerType,
winCapability WINCapability,
callingPartyName CallingPartyName OPTIONAL,
callingPartyNumberDig1 CallingPartyNumberDig1 OPTIONAL,
…
}

Variable
datatype

analyzedInformation OPERATION
ARGUMENT
analyzedInformationArg AnalyzedInformationArg
RESULT
analyzedInformationRes AnalyzedInformationRes

::= localValue: 64

16
New Message in ASN :-
 The rules for the Parameters holds good But instead of Parameter ID
we will have Message ID

Eg: callStatus OPERATION

ARGUMENT
callStatusArg CallStatusArg
::= localValue: 239 Message ID/OPCODE

CallStatusArg ::= [PRIVATE 18] IMPLICIT SET {

billingID BillingID,
esn ESN,
min Min,
cellType CellType OPTIONAL,
mscIdNbr MSCIdNbr OPTIONAL
}

 Define in Map.h

#define CALL_STATUS 0XEF

 Register the Functions of ASN-CSM && CSM-ASN and related functions.

17
• These Form a sort of Interface between IS41 and CP.
• There are many API’s mainly in IS41_events.c,
IS41_answer.c ,IS41_setup_util.c.
• These api’s are registered as Callbacks . And they are called when ever it
is necessary .
• Some of the api’s also Form as Entry and Exit points for Messages . These
are registered as request Funtion.

For Example:
1. IS41Apm_sendEvent() -> Example Funciton Available in IS41_events.c
2. cb_Obj->apm_send_event = IS41Apm_sendEvent; -> registration in IS41Apm_common.c
3. if (! (*pApmLeg->apmCbs->apm_send_event)(pApmLeg, pEvent)) -> calling These Funciton .

18
•Message Sending and Receiving forms the Major part of this
module.
• map_recieve.c, map_errorhandler.c, Map.c, map_util.c,
IS41_nimhandler.c and other related Files constitutes This module .
• Transport Module connects the Application to Tcap, NIM, OSS .
• While receiving the IS41 Message OSS-Decode is called to get the
ASN struc of that Message . Similarly While sending OSS-Encode .
• Another Important Function of this module is to send the message
to Trace . This functionality is shared by other Modules in IS41.

MSC MPC

Example: SMDPP

smdpp

19
 Example code flow SMDPP -> smdpp

General Flow of any Recv Distributes the incoming sccp

message to the particular protocol
Message
Cvx_nim_sccp_dist()
Sets the
provider type
to Ansi-IS4.1
Mapifc_recv_sccp_payload()

IS41_recv_SCCPPayloadEx()

cvx_tcap_process_mesg_ Mapsend_from_tcap1()
Tcap_map_init_ii_api()
from_lower_layer

tcap_dco_deliver_com
tcap_dco_send_tc_ansi_q_ind
ponents_to_cco Mapsend_from_tcap2Ex() Mapsend_from_tcap2Ex()

Mapsend_from_tcapEx Mapsend_from_tcapEx
De
MapParseQWPIndic MapParseINVLIndic
co
d
pa es t This decodes the Creates the Dlg and Fills it 4m the incom data
An rt in he component portion
d T
ap Ma the rans
pe p f M
nd un ess actio
t c a n
ap he s tion ge
li_ a
lis me ill
w decodeBufferEx() Forward-to-anothercsm
C
OSS to CSM Trace
t in on
fu ver
decodeBufferCommon() nc si Req
tio on
n
OssDecode()
Free func

Decodes the incoming

raw data to Asn Struc
Res is pointer to
Asn Struc
20
 MAP

Application Req
Specific Flow
is41_recv_smdpp_request
MAP/IS41
msc_sms_deliver_req

mapifc_provider_received_request

sms_mt_deliver_req

csm_mscm_sms_recv_SMDPP

Here MSS finds the received SMDPP

is invalid & therefore initiates
MSCM/CP/ Not Valid smdpp RR with a cause code .
Services SMDPP
(NO ESN)

Sending smdpprr
with cause code

“map_msc_sms_deliver_fail”

mapifc_app_send_failure

MAP/
MapSendRRLreq
is41_msc_sms_deliver_fail
IS41

21
 MAP

General Flow of any Sending Message

MapSendRRLreq
Sending
the
Message
MapSendRRLonDialogueMessage
to trace

tcap_mp_init_su_api csm_to_oss EncodeOSS Trace Free-Func

Co
n
fu ver Encodes the
nc si
tio on Incoming ASN
n
Struct to Raw cvx_tcap_process_mesg
data

MapSendTCRESP

tcap_mp_init_su_api cvx_tcap_process_mesg

IS41_sendSCCPPayload

cvx_NIM_sendData

Sending the Message Out

Thru SS7MH

22
 TRACE [ Ethereal ]

• It is a tool from which we will be able to find the Message flow.

• oamp/trace/tracePluginv2/is41 is a place to look in .

• If some parameters are not traced in the Message Then the particular
parameter should be added in IS41_Protocol.xml available in the same place,
• All Instructions are available in the Same File .
• This tool is available in thirdparty/ethereal-0.10.13/bin/ethereal
For Example :

<complexType name="CDMAServiceOption" value="0x9F812F">

<element name="CDMAServiceOption" type="bitsEnum" mask="0xFFFF" shift="0" add_offset="1"/>
</complexType>

• When The whole Message is only Not coming in trace then The code needs to be traced . Whether The
trace packet is being sent to trace . If it is not send then The code has to be written for that call flow .

The Example Trace code is as Follows .

23
if (pProtData)
{

void* pTriggers = MSG_TRACE_GET_TRIGGERS(TRACE_PROTO_ID_IS41);

pLeg = M_Csm_Leg(pProtData->pApmLeg);
MSG_TRACE_TRIGGERS_SET_opc(pTriggers, addr.dpc);
MSG_TRACE_TRIGGERS_SET_dpc(pTriggers, addr.opc);

if(pLeg)
{

if(0 == (CVX_CallInfo_getTraceID(M_Csm_Leg_Call_Info(pLeg))))
{
int traceId;
if(p_min->numOfOctets > 0)
{
MSG_TRACE_TRIGGERS_SET_min(pTriggers, p_min-
>val.value_mobile_id_u_u.min);
}
if(p_esn->present)
{
MSG_TRACE_TRIGGERS_SET_esn(pTriggers, p_esn->value);
}
MSG_TRACE_TRIGGERS_SET_cic(pTriggers, legId.cic);
traceId = MSG_TRACE_TRY_TRACE(pTriggers);
CVX_CallInfo_setTraceID(M_Csm_Leg_Call_Info(pLeg), traceId);
}
MSG_TRACE_SET_context(TRACE_PROTO_ID_IS41, ((void*)&pLeg->callId),
TRACE_CONTEXT_TYPE_UINT32,
CVX_CallInfo_getTraceID(M_Csm_Leg_Call_Info(pLeg)));
MSG_TRACE_SEND(TRACE_PROTO_ID_IS41);

}
else {
csm_mscm_set_trace_id_in_dialog(pDlg,0,0);
MSG_TRACE_SET_context(TRACE_PROTO_ID_IS41, ((void*)&pDialog->callid),
TRACE_CONTEXT_TYPE_UINT32,
pDialog->traceid);

MSG_TRACE_SEND(TRACE_PROTO_ID_IS41)
24
}
}
 Intersystem handoff or Inter-MSC handoff
The new and the old BSs are connected to different MSCs.

MSC MSC

Old BS New BS

25
Implentation

•Handoff is an Combined effort from 3 Modules . IOS ( Tia-634 Which maintains

all Connections with BSC’s ), IS41 ( Maintains Communications with MSC’s),
MSCM (as a part of Call Processing )
• In IS41 it is IS41_HOSM.fsm
• Action Functions of HOSM is available in IS41_HOSM_actions.c .
• Some more IS41 Handoff related Functions are available in
IS41_handoff_util.c
• Many functions are callbacks .
• These Functions specify the process when a particular Function is hit .
For Example :
IS41Apm_recvFacdir2()
• Is called When FACDIR2 is received By the Switch.
• This Further initiates Other Handoff Related FSM’s (MSCM,TIA) in the Switch .
• Further the Process is continued By sending Handoff Messages .

26
 First Choice
a a

q1 a q2
a
q0
b
q3

27
 First Choice
a a

q1 a q2
a
q0
b
q3

28
 First Choice
a a

q1 a q2
a
q0
b
q3

29
 First Choice
a a

q1 a q2 “accept”
a
q0
b
q3

30
 Second Choice
b b

q1 a q2
a
q0
b
q3

31
 Second Choice
b b

q1 a q2
a
q0
b
q3

32
 Second Choice
b b

q1 a q2
a
q0
b
q3 “reject”

33
 FSM Entry
// The other lines should be interpreted as follows
// CURRENT_STATE EVENT Function NEXT_STATE

NULL                            FACDIR2_FROM_SW         sendFacdir2             WAIT_FACDIR2_RR_FROM_NW

WAIT_FACDIR2_RR_FROM_NW FACDIR2_RR_FROM_NW      recvHandoffRR   WAIT_MSONCH_FROM_NW

FSM Transition Table

•IS41_HOSM_TransitionTable[IS41_HOSM_STATE_NULL][IS41_HOSM_EVENT_FACDIR2_FROM_NW].nextState = IS41_HOSM_STATE_WAIT_FACDIR2_RR_FROM_SW;
•IS41_HOSM_TransitionTable[IS41_HOSM_STATE_NULL][IS41_HOSM_EVENT_FACDIR2_FROM_NW].action = IS41_HOSM_recvFacdir2;
•IS41_HOSM_TransitionTable[IS41_HOSM_STATE_WAIT_FACDIR2_RR_FROM_SW][IS41_HOSM_EVENT_FACDIR2_RR_FROM_SW].nextState =
IS41_HOSM_STATE_WAIT_MSONCH_FROM_SW;
•IS41_HOSM_TransitionTable[IS41_HOSM_STATE_WAIT_FACDIR2_RR_FROM_SW][IS41_HOSM_EVENT_FACDIR2_RR_FROM_SW].action =
IS41_HOSM_sendFacdir2RR;

FSM Posting an Event

retVal = IS41Apm_process_hosm_fsm(pProtData, IS41_HOSM_EVENT_FACDIR2_FROM_NW,
pReqd);
MSSC-Anchor MSSC-Serving

FACDIR
<IS41_HOSM>,(s:NULL,e:FACDIR2_FROM_SW)
<IS41_HOSM>,(s:WAIT_FACDIR2_RR_FROM_NW,e:FACDIR2_RR_FROM_NW)
facdir
<IS41_HOSM>,(s:WAIT_MSONCH_FROM_NW, e:MSONCH_FROM_NW)

MSONCH

34
• MGMT Shorter Form of Management Functionality Is managed By Every protocol
and Overall by Switch .
• This is Responsible for maintaining the Cic status.
• The Management Messages are RESET, BLOCK, UNBLOCK.
• For IS41 these Messages and Related Timer Functionality is available in
is41_mgmt_api.c, is41_mgmt_module.c, is41_mgmt_module.h, is41_mgmtutil.c,
is41_mgmtutil.h.
For Example :
Initiating BLOCKING to Another MSC means We are Locally Blocked and Target
MSC is Remotely Blocked .

MSC MSC

Blocking Invoke

LB
RB
Blocking RR

35
10.232.112.119/seshadri/winphoria
/home/seshadri/Features/is41/IS41-Presentation-Cork-final.ppt

36