GSM Signaling System

GSM Signaling System

Course Objectives:

Understand Protocol stack of GSM system

Understand MTP, LAPD, LAPDm protocols

State main calling process

Contents

1 Interfaces and Protocols............................................................................................................................1

1.1 Interfaces...........................................................................................................................................1

1.1.1 A Interface..............................................................................................................................1

1.1.2 Abis interface..........................................................................................................................1

1.1.3 Ater Interface..........................................................................................................................1

1.1.4 Gb Interface............................................................................................................................2

1.1.5 Qx Interface............................................................................................................................2

1.2 Protocols............................................................................................................................................2

1.2.1 Circuit Service Protocols........................................................................................................3

1.2.2 Packet Service Protocols......................................................................................................12

1.2.3 TCP/IP..................................................................................................................................14

1.2.4 X.25 Protocol........................................................................................................................15

1.2.5 HDLC Protocol.....................................................................................................................16

2 Basic Signaling Procedure.......................................................................................................................19

2.1 MS Location Update Procedure......................................................................................................19

2.2 IMSI Detach Procedure...................................................................................................................20

2.3 Mobile-Originated Call and Called Party On-hook Procedure........................................................21

2.4 Mobile-Terminated Call and Calling Party On-hook Procedure.....................................................23

2.5 Intra-cell Handover Procedure........................................................................................................25

2.6 Inter-cell Handover Procedure.........................................................................................................25

i

1 Interfaces and Protocols

1.1 Interfaces

1.1.1 A Interface

The interface between BSC and MSC is the A interface. TC on the BSC is connected to

MSC via A interface.

TC performs conversion between voice codes and 64 kbps A-law PCM cods. In

addition, it performs data rate adaptation in circuit data services. TC is located between

BSC and MSC and can be on either the BSC side or MSC side depending on the

requirements.

A interface is realized by E1 link with a 75 ohm coaxial cable or a 120 ohm twisted

pair cable for connection.

A interface uses Message Transfer Part level-2 (MTP2) at the data link layer, MTP3

and SCCP protocols at the network layer and Base Station Subsystem Management

Application Part (BSSMAP) protocol at the application layer.

1.1.2 Abis interface

The interface between BSC and BTS is the Abis interface. BSC and BTS are

interconnected through Abis interface with Base station Interface Equipment (BIE)

configured on both sides.

Abis is a self-defined internal interface realized by E1 with a 75 ohm coaxial or 120

ohm twisted pair cable for connection. Supports star, chain, and tree networking

modes.

LAPD protocol is used at the data link layer and other application protocols such as RR

are used at the Physical layer.

1.1.3 Ater Interface

SMU is used between BSC and TC to reduce transmission line costs when TC is

located on the MSC side.

1


The interface between BSC and TC is the Ater interface. Transmission content is the

same as A interface except transmission rate of voice signals. The voice signal at A

interface is 64 kbps A-law PCM coded signal while the voice signal at the Ater

interface is the same as that of Abis interface. Ater interface uses SS7 for transmission.

1.1.4 Gb Interface

The interface between BSC and SGSN is the Gb interface.

Gb interface is realized by E1 link between BSC and SGSN. Access rates are N x 64

kbps (1≤ N ≤ 32) or 2048 kbps. Operator specifies the timeslot and bandwidth used on

E1 link.

BSC implements RLC/MAC protocol, NS protocol, and BSSGP on the Gb interface.

1.1.5 Qx Interface

The interface between BSC and the background OMC is the Qx interface. Operation

and maintenance instructions are received at the BSC while system maintenance

information is sent to OMC via the Qx interface.

Qx interface supports the following connection modes:

Connection through X.25 leased line

Connection through Packet Switched Public Data Network (PSPDN)

Connection through Ethernet interface

Semi-permanent connection between BSC and OMC through the A interface

circuit.

1.2 Protocols

Two systems can communicate only when they agree to a certain protocol. Interfaces

are the connections between two entities and protocols are the rules for information

exchange using some interface. In application systems, several pieces of equipment and

various devices work together to accomplish a single function. Therefore, they are

interconnected via a variety of interfaces based on specified protocols.

The GSM signaling protocol is based on Open System Interconnection (OSI) reference

model. Fig 1.2-1 shows the basic structure of OSI, which is a layered topology. First

2

2 Basic Signaling Procedure

layer is the Physical or Transmission layer, second is the Link or Network layer, and

third is the Application layer.

Fig 1.2-1 OSI Reference Model Layered Structure

ZXG10-BSC (V2.95) implements different protocols to process circuit services and

GPRS data services. Following is a brief description of circuit service and data service

protocols used on related interfaces.

1.2.1 Circuit Service Protocols

Fig 1.2-2 shows the circuit service protocol stack structure.

Fig 1.2-2 Circuit Service Protocol Stack Structure

1.2.1.1 A Interface Protocols

Fig 1.2-3 shows the circuit service protocol stack on A interface.

3


Fig 1.2-3 Circuit Service Protocol Stack on A Interface

Physical layer

The physical layer defines physical and electrical parameters as well as the

channel structure. This layer connects BSC and MSC physically.

It is implemented through MTP1 of SS7 and uses 2 Mbps PCM digital link for

transmission.

Data link layer

Network operation program defines the data link layer.

Data link layer uses MTP2, a derivative of High-level Data Link Control (HDLC).

Frame is composed of flag, control, information, check, and flag sequence fields.

MTP3 and SCCP implements signal routing.

Application layer

The protocol used on application layer is the BSS Application Programs (BSSAP).

It implements maintenance and management of BSS resources and connection,

and removal of services.

1.2.1.2 Abis Interface Protocols

Fig 1.2-4 shows the circuit service protocol stack on Abis interface.

4


Fig 1.2-4 Circuit Service Protocol Stack on Abis Interface

Physical layer

2 Mbps PCM link is often used

Data link layer

LapD (Link Access Procedure of D Channel) is a data link procedure for signaling

transmission between BTS and BSC, used to implement message transmission between

the L3 entities in the D channel.

LapD is a point-to-multipoint communication protocol which employs frame structure.

LapD implements the following functions:

1. Providing one or multiple data connections in the D channel.

The data link connections are identified by the data link connection identifiers

(DLCI) contained in the respective frames. DLCI consists of terminal equipment

identifier (TEI) and service access point identifier (SAPI), indicating the

terminal entity and target service access point.

2. Delimitation, location and transparency of the frame

3. Sequence control, ensuring sequential transmission of the frames

4. Error detection

5. Error recovering

6. Notifying the management entity of the unrecoverable error

7. Flow control

5


Functions 1, 2 and 4 hereof are completed automatically by the hardware, while

functions 3, 5, 6 and 7 are implemented via the software.

LapD is implemented in the LapD module of RSL. Fig 1.2-5 shows the position of the

LapD module in RSL.

Fig 1.2-5 The Position of the LapD Module

The LapD module communicates with the physical layer and L3. The L3 protocol is

processed in FURRM.

OAMM configures the parameters such as TEI and values of the timer necessary for

LapD module running.

The LapD module provides two types of information transmission modes for the

FURRM: I-frame multi-frame operation and UI frame operation.

1. I-frame multi-frame operation

The L3 message is sent in the information frame mode which requires the

confirmation from the receiver. This mode provides a whole set of control

mechanism for error recovering and flow control, the establishment mechanism

and release mechanism for multi-frame operations.

As shown in Fig 1.2-6, the I frame consists of flag sequence, address field,

control field, information field and check field.

6


Fig 1.2-6 The Structure of the I Frame in the LapD

The address field contains SAPI and TEI. It performs addressing for various

units via TEI in the Abis interface link. Generally, a unit has multiple functional

entities, and the logical physical links between different functional entities are

identified by the functional address of SAPI. The LapD supports three types of

information: Signaling (including short message information), O&M

information and LapD layer management information. Links of the three types

of information are distinguished by SAPI. SAPI = 0 represents the signaling

link, SAPI = 62 represents the O&M link, and SAPI = 63 represents the

management link of the LapD layer.

In the control field, N (S) represents the transmitting serial number and the serial

number of the I frame currently transmitted at the sending end; N (R) represents

the receiving serial number and the transmitting serial number of the next

expected I frame. N (R) is used to predict the instruction from the receiving end.

Frame check sequence (FCS) is used for error code detection.

Flag is the beginning and the end token of a frame, namely, eight bits containing

six consecutive 1s.

2. UI frame operation

The L3 message is transmitted in the non-SN frame mode, and the receiver is

not required to send a confirmation upon reception of a UI frame. This operation

mode does not provide flow control or error recovering mechanism.

Fig 1.2-7 shows the frame structure of a UI frame. It consists of address field,

control field and information field.

7


Fig 1.2-7 The Structure of UI Frame in the LapD

The address field contains SAPI and TEI. P in the control field is a query bit. When it is

set to 1, it means that a response frame from the peer entity is required.

Application layer

This layer implements the BTS Management (BTSM) and RR protocol

transmission that includes the radio link management function and operation and

management function.

1.2.1.3 Um Interface Protocols

Fig 1.2-8 shows the circuit service protocol stack on Um interface.

Fig 1.2-8 Circuit Service Protocol Stack on Um Interface

Physical layer

This layer provides transmission channel for wireless links to transmit data

through the radio carrier. It also provides different functional channels for higher

layers including service and logic channels.

8


Data link layer

This layer provides reliable data links between MS and BTS. It uses the LAPDm

protocol, a derivative of the LAPD and dedicated for GSM.

In GSM, LapDm is a data link protocol for signaling transmission between MS and

BTS, used to implement message transmission in the Dm channel to the L3 entities via

the radio interface. LapDm is based on LapD with some simplification and

modification.

LapDm implements the following functions:

1. Providing a point-to-point data link connection in a Dm channel and multiple

services for the upper layer. The data link connections are identified by the

DLCIs in the respective frames. The DLCI in the LapDm protocol only contains

SAPI, indicating the target service access point.

2. Supporting to identify diversified frame types.

3. Supporting the transparent transmission of L3 messages between L3 entities.

4. Sequence control, to maintain the sequence of respective frames connected via

data link.

5. Checking the format and operation errors in the data link layer.

6. Notifying the L3 entities to process the unrecoverable errors.

7. Flow control

8. Supporting access of the burst solution mode after the RACH channel access is

instantly assigned.

LapDm is implemented in the LapDm module of RSL.

Fig 1.2-9 shows the position of the LapDm module in RSL.

9


Fig 1.2-9 LapDm Module

The LapDm module communicates with the physical layer and L3. The L3 protocol is

processed in FURRM. OAMM configures the value of the timer necessary for LapDm

module running.

LapDm module provides two types of message transmission modes for FURRM: I-

frame multi-frame operation and UI frame operation In terms of frame structure,

LapDm eliminates the frame delimiter flag (FLAG) and the frame check sequence

(FCS). In LapDm, frame delimitation information is transmitted by means of

synchronization scheme of the radio interface without the beginning frame and end

frame flags. FCS is not available in the LapDm because the transmission scheme in the

physical layer of the Um interface has the error check function.

1. I-frame multi-frame operation

The L3 message is sent in the information frame mode which requires the

confirmation from the receiver. This mode provides a whole set of control

mechanism for error recovering and flow control, the establishment mechanism

and release mechanism for multi-frame operations.

The structure of I frame in LapDm is shown inFig 1.2-10.

Fig 1.2-10 The Structure of I Frame in LapDm

10


The I frame in LapDm is made up of the address field, control field and

information field.

The address field contains the service access point identifier (SAPI). On the

radio interface, LapDm supports two types of messages: Signaling and short

message service, distinguished by the SAPI. SAPI = 0 represents the signaling

link, and SAPI = 3 represents the short message link.

The maximum length of LapDm frames on the TCH is 23 bytes, and 21 bytes on

the SACCH. The reason for this difference is that there are two special-purpose

bytes in each SACCH block: timing advance and transmit power control. Since

the maximum length of a frame on the radio interface is 21 or 23 bytes which

cannot meet the need of majority signaling, segmentation and regrouping are

defined in LapDm. An “additional” bit is introduced to distinguish the last frame

of a frame from other frames. Thanks to this mechanism, packet length on the

radio channel is not restricted. The only restriction is that these packets must

also be transmitted on other interfaces, namely, 260 bytes mentioned in the radio

interface specification.

In the control field, N (S) represents the sending serial number and the I frame’s

serial number currently sent by the sending end; N (R) represents the receiving

serial number, the expected sending serial number of the next I frame. N (R) is

used to predict the instruction from the receiving end.

2. UI frame operation

The L3 message is sent in the non-SN frame mode, and the receiver is not

required to send a confirmation upon reception of a UI frame. This operation

mode does not provide flow control or error recovering mechanism.

The structure of UI frame in LapDm is shown in Fig 1.2-11.

Fig 1.2-11 The Structure of UI Frame in LapDm

11


The UI frame in LapDm is made up of address field, control field and information

field. The address field contains the service access point identifier (SAPI). P in the

control field is a query bit. When it is set to 1, it means that a response frame from the

peer entity is required.

Application layer

This layer is responsible for control and management protocols and implements

CM, Mobility Management (MM), and RR protocols. It arranges subscriber

information and system control process into designated logical channels

according to protocol packets.

CM layer implements communication management, establishes connections, and

maintain/release calls between users. This layer includes Call Control (CC),

Supplementary Service Management (SSM), and SMS.

MM layer performs mobility and security management, for example, the

necessary processing when MS initiates location update.

RR layer performs radio resource management to establish and release a

connection between MS and MSC during the call process.

1.2.2 Packet Service Protocols

Fig 1.2-12 shows the packet service protocol stack structure.

Fig 1.2-12 Packet Service Protocol Stack Structure

12


1.2.2.1 Um Interface Protocols

Fig 1.2-13 shows the packet service protocol stack on Um interface

Fig 1.2-13 Packet Service Protocol Stack on Um Interface

GSM RF

GSM RF specifies carrier features, channel structure, modulation mode, and

radio frequency indices. RF part uses the same transfer mode as the GSM circuit

services.

RLC/MAC layer

RLC is the air interface protocol between BTS and MS. Its main functions

include error detection in the Um interface data block, confirmation of the error,

and re-sending selection of the data block.

MAC controls access signaling process in the radio channel. In addition, it also

maps LLC frames to the GSM physical channels.

LLC layer

This layer is a reliable encrypted logical link. It is independent of lower layer

wireless interface protocols, which ensure minimum modification to the network

when another GPRS wireless solution is introduced.

SNDCP

13


Sub Network Dependent Convergence Protocol (SNDCP) is a transition between

the network and data link layers and segments. It compresses IP/X.25 user data

before sending it to the LLC layer for transmission.

Relay

LLC PDU relay between Um and Gb interfaces.

1.2.2.2 Gb Interface Protocols

L1bis

Physical Transport layer

NS

This protocol includes two sub layers: Network Service Control (NSC) layer and

Frame Relay (FR) layer. Based on the FR, the NSC layer transmits the upper-

layer BSSGP PDU.

BSSGP

This protocol provides a connectionless link between BSS and SGSN for

unconfirmed data transmission on the transmission platform.

1.2.3 TCP/IP

Transmission Control Protocol/Internet Protocol (TCP/IP) is used for foreground and

background communication between BSC and OMCR and implements TCP/IP on the

MP. Following are the TCP/IP standard functions:

Link establishment

The background server initiates link establishment procedure to establish a TCP

link and the foreground MP receives it. MP receives port number of the latest

link establishment request as the port number of current link. Original port

number is not used for data switching by MP. Background is responsible for re-

establishing the link in case it is broken.

Data transmission

Data transmission is the radical objective of TCP/IP. FAM and BAM data

transmission is performed in TCP mode.

Connection termination

14


If MP finds any error in the message, it terminates the connection to enable the

opposite party to resume normal status. MP never terminates an active

connection.

1.2.4 X.25 Protocol

PCOM board implements the X.25 protocol and is used for BSC and CBC

communication. X.25 protocol provides an interface between the subscriber’s device

and the packet switching network. Fig 1.2-14 shows the X.25 protocol model.

The three layers of X.25 have a one-to-one correspondence with the lowest three layers

of OSI model. Network layer in OSI is called Packet layer in X.25 but its functions are

the same.

X.25 provides a reliable basis for upper-layer communication protocols between BSC

and remote Data Communications Equipment (DCE). In the PCOM board, CBC

protocol is used as the upper-layer protocol and CBC messages are transferred in the

user data of an X.25 data packet.

Fig 1.2-14 X.25 Protocol Model

15


BSC sends messages to CBC through X.25. After the message is assembled in BSC, it

enters the message-sending queue in X.25. The X.25 transmission processor obtains

messages from the sending queue and assembles them into one or more X.25 data

packet formats for transmission.

CBC sends messages to BSC through X.25. The X.25 receiving processor receives the

CBC message, transfers it to the X.25 message-receiving queue, and then sends the

message to MP.

Communication control implements the control functions of X.25 communication link

including link connection/disconnection, restoring after fault, resetting communication

protocol stack, abnormal communication protection, and communication link

active/standby switching.

1.2.5 HDLC Protocol

Internal communication in the BSC uses HDLC protocol to ensure reliable and

efficient information transmission.

Following are the four main functions of HDLC protocol:

Link establishment

Link establishment employs three-channel handshake mode when both

directions of the link are normal. This mode enables one party to originate

synchronous handshake so the other party can respond or both parties can

originate a synchronous handshake simultaneously.

Link selection

Any PP or T network can interact with MP via a pair of COMM boards for data.

MP decides the communication link of COMM board to be used.

Communication control process performs link selection, monitors the link status,

and selects a link for the link-established PP on time basis.

Link holdover

COMM board regularly sends a link holdover message to PP for timely fault

identification of links over which no messages are transmitted for a long time. If

the PP cannot receive the message, service identifier of the link is eliminated and

the link is re-established.

16


Data transmission

Data transmission is the fundamental aim of HDLC. Reliable transmission is

expected when the data moves from MP to PP or PP to MP.

17


2.1 MS Location Update Procedure

MS sends a CH REQ (Channel Request) message through RACH to BTS. Upon

receiving CH REQ message, the BTS processes it and then sends it to BSC.

After receiving CH REQ message, BSC sends a CH ACT message to the BTS to

activate SDCCH. After activating the channel, BTS returns a CH ACT ACK message.

BSC sends IMM ASS CMD to BTS. Upon receiving the message, BTS sends IMM

ASS through AGCH to MS. When receiving message, MS sends SABM to BTS. BTS

sends UA to MS.

At the same time, BTS sends a channel establishment indication (EST IND) to BSC,

containing location update request of MS. BSC forwards the location update request

(LOC UPD REQ) to MSC in CR. As receiving message, MSC returns a CC message to

BSC.

SDCCH is established between MS and BTS, and location update message is sent to

MSC through SDCCH. MSC selects the encryption mode and sends a location update

acceptance message (LOC UPD ACCEPT) to MS.

Fig 2.1-15 shows MS location update procedure.

19

Fig 2.1-15 MS Location Update Procedure

MSC sends a Clear CMD message to BSC, which returns a Clear COM message to

MSC. Meanwhile, BSC sends to BTS a CH REL message to release SDCCH and a

DEACT SACCH message to deactivate SACCH.

BTS sends a CH REL message to MS. MS requests BTS to release radio link (DISC).

BTS returns UA and reports the channel release indication to the BSC.

BSC sends a RF CHL REL message to BTS. BTS returns a RF CHL REL ACK

message. Radio channel is released.

2.2 IMSI Detach Procedure

After the SDCCH is established, an IMSI DETACH message is sent through SDCCH

to MSC. After receiving the message, MSC releases SDCCH.

Fig 2.2-16 shows the IMSI detach procedure.

20


Fig 2.2-16 IMSI Detach Procedure

2.3 Mobile-Originated Call and Called Party On-hook ProcedureWhen a mobile subscriber originates a call, the SDCCH is established first, and then a

request for TCH is sent through SDCCH to the MSC.

MSC sends an Assignment Request message to BSC. After receiving the message, BSC

sends an IMM ASS CMD message to MS which establishes a TCH with the BTS.

The BTS then sends a channel establishment indication, completes immediate

assignment, and releases SDCCH.

MSC sends a ring-back tone to MS over the established TCH. After the Connect and

Connect ACK messages are exchanged, the call is set up.

When the called party hangs up, MSC sends a Disconnect message to MS which

releases TCH and MSC replies with a Release Complete message and releases TCH.

21


Fig 2.3-17 shows the mobile-originated call and the called party on-hook procedure.

Fig 2.3-17 Mobile-Originated Call and Called Party On-hook Procedure

22


2.4 Mobile-Terminated Call and Calling Party On-hook Procedure

When MS is called, MSC sends the paging message to MS. After receiving paging

message, MS establish a SDCCH. Then, MSC establishes a TCH and releases SDCCH.

TCH is used to complete the call connection.

After the conversation is over, TCH is released. shows mobile-terminated call and

calling party on-hook procedure.

23


Fig 2.4-18 Mobile-Terminated Call and Calling Party On-Hook Procedure

24


2.5 Intra-cell Handover Procedure

Based on the measurement reports submitted by MS continuously, BSC judges whether

to perform handover.

If intra-cell handover is expected, BSC activates another TCH in the same cell and

assigns that TCH to MS immediately.

After MS completes the immediate assignment, BSC notifies MSC of intra-cell

handover occurred to MS and releases the original TCH.

Fig 2.5-19 shows the intra-cell handover procedure.

Fig 2.5-19 Intra-Cell Handover Procedure

2.6 Inter-cell Handover Procedure

Based on the measurement reports sent by MS continuously, BSC judges whether to

perform handover.

If an inter-cell handover is necessary, BSC activates a TCH in the target BTS and sends

a HO CMD message to MS. MS sets up a connection with TCH of the target BTS and

performs the handover.

BSC informs MSC of inter-cell handover occurred to MS and releases TCH in original

cell.

Fig 2.6-20 shows inter-cell handover procedure.

25


Fig 2.6-20 Inter-cell Handover Procedure

Power Control Signaling Procedure

When an MS is in dedicated mode, it is assigned with an SACCH besides a TCH.

SACCH transmits measurement report, power control, timing advance control, and link

monitoring information under mobile environment.

Fig 2.6-21 and Fig 2.6-22 show the measurement report and transmit power control

procedures respectively.

Fig 2.6-21 Measurement Report Procedure

26


Fig 2.6-22 Transmit Power Control Procedure

MS reports the measurement data through SACCH. BSC makes the power control

decision and sends the related control commands to BTS. BTS executes power control

commands or forwards the commands to MS.

27

GSM Signaling System

Documents

Transcript of GSM Signaling System